Migrate Remote Access addon; fix status-function crash gap in run_menu; bump to v2.8.0

Third and biggest Addon migrated: menus/addon_remote_access.sh - VNC
(x11vnc), WireGuard, Tailscale, and Netbird, each with its own install/
connect/status/uninstall flow. Same risk class as CUPS (real apt
packages, real system state) but broader in scope: Tailscale and
Netbird install via the vendors' own documented `curl -fsSL <url> | sh`
method, preserved exactly as-is rather than redesigned.

- lib/config.sh: new $WIREGUARD_DIR, same pattern as $SYSTEMD_DIR/
  $BIN_DIR/etc - nothing in this file hardcodes /etc/wireguard.
- lib/menu.sh: promoted power_schedule.sh's enable_and_start_timers()
  to a shared enable_and_start_units() (works for services now too, not
  just timers) - Remote Access needed the identical enable+start-with-
  graceful-failure-reporting pattern for x11vnc and wg-quick@, so this
  is fixed once and reused rather than duplicated a second time.
  power_schedule.sh's four call sites renamed to match.

Found and fixed a real framework-level bug while building this file:
run_menu()'s *handler* call has been `|| true`-guarded since v2.1.0,
but the *status function* call (`"$status_func"` on its own line) was
still completely bare. A status function's entire job is read-only
display, but if it contains so much as a pipeline whose grep matches
nothing - which pipefail turns into a pipeline failure even though the
actual last command in it (e.g. sed) succeeds - that bare call would
crash the *entire session*, not just fail to show status text. Found
while writing wireguard_status()'s `sudo wg show | grep ... | sed ...`
and deliberately verifying its exact failure mode rather than assuming
run_menu already covered it. Fixed once in run_menu() itself
(lib/menu.sh), protecting every status function across every menu -
present and future - the same "fix once at the framework level"
pattern as the v2.1.0 handler fix.

Given the framework fix meant this class of bug had been silently
possible since v2.1.0, audited every existing status function across
every already-migrated menu for the same specific shape (a bare
`var=$(...)` assignment from a grep-based pipeline, not embedded in an
echo and not already guarded - embedded substitutions and if-condition
contexts are both already safe on their own). Found and fixed one real
instance in power_schedule_status(). menus/addon_remote_access.sh's own
two equivalent pipelines (wireguard_status, netbird_status) were
written with `|| true` from the start once the pattern was identified.

Verified:
- New scratch/stub test for addon_remote_access.sh, with curl stubbed
  separately from sudo (Tailscale/Netbird's install scripts must never
  reach the real network regardless of what sudo intercepts) and a
  belt-and-suspenders `sh` stub in case anything got past curl: full
  status/menu-builder coverage for all four sub-areas in their real,
  unstubbed "not installed" state (none of the four tools exist in this
  sandbox); VNC install/change-password/uninstall with systemd unit
  content verified (correct $KIOSK_USER/$KIOSK_HOME substitution);
  WireGuard install, paste-config (content written correctly to scratch
  $WIREGUARD_DIR), and uninstall - including documenting a genuine
  cat-until-EOF test-harness limitation (a redirected pipe's EOF is
  permanent for the whole stream, unlike a real terminal's per-read
  Ctrl+D, so only the config's *default* name is testable through
  simple stdin redirection - inherent to the design, matches the legacy
  script's identical `cat`-based approach, not a bug); Tailscale and
  Netbird install/connect-interactive/connect-with-key/uninstall; and
  all four cancel paths confirmed to make zero sudo calls.
- Full regression: re-ran all 11 prior scratch/stub suites after the
  lib/menu.sh and power_schedule.sh changes - all still clean.
- End-to-end: ran the real install.sh as a genuine non-root, non-
  "kiosk" user through Addons -> Remote Access -> all four sub-menus in
  turn, each showing accurate real (unstubbed) "not installed" status,
  selecting Install, declining the confirmation, and returning cleanly
  - zero invalid-choice errors, clean exit code 0.

lib/config.sh

@@ -30,6 +30,7 @@
 : "${BIN_DIR:=/usr/local/bin}"
 : "${NETPLAN_DIR:=/etc/netplan}"
 : "${POLKIT_DIR:=/etc/polkit-1/localauthority/50-local.d}"
+: "${WIREGUARD_DIR:=/etc/wireguard}"
 
 # The admin account actually running this tool (as opposed to $KIOSK_USER,
 # the kiosk's own restricted account) - used where an addon needs to grant

lib/menu.sh

@@ -84,6 +84,18 @@ get_vpn_ips() {
     [[ -n "$vpn_info" ]] && echo "$vpn_info" || echo "None"
 }
 
+# enable_and_start_units UNIT [UNIT...]
+# Reloads systemd and enables+starts the given unit(s) - services or
+# timers - returning non-zero if enable or start fails (e.g. systemd/
+# D-Bus unreachable, or a real failure on real hardware). Always call
+# this from an `if`/`&&`/`||` context: this whole tool runs under
+# set -e, so a bare, unguarded call whose last command fails would take
+# down the entire session instead of just this one action.
+enable_and_start_units() {
+    sudo systemctl daemon-reload 2>/dev/null || true
+    sudo systemctl enable "$@" 2>/dev/null && sudo systemctl start "$@" 2>/dev/null
+}
+
 pause() {
     read -r -p "Press Enter to continue..."
 }
@@ -279,7 +291,14 @@ run_menu() {
         print_menu_header "$title"
 
         if [[ -n "$status_func" ]]; then
-            "$status_func"
+            # `|| true`: same reasoning as the handler call below - a
+            # status function's job is read-only display, and a
+            # legitimately failing command inside it (e.g. a pipeline
+            # whose grep matches nothing, which pipefail turns into a
+            # pipeline failure even though the actual last command
+            # succeeded) must not be allowed to kill the whole session
+            # over what should be, at worst, incomplete status text.
+            "$status_func" || true
             echo
         fi