Migrate Timezone and Hidden Site PIN menus; harden menu framework against set -e; bump to v2.1.0

Two more menus migrated onto lib/menu.sh + lib/config.sh, chosen
specifically because neither touches config.json - a third and fourth
shape for the framework (a system command via timedatectl, and a flat
PIN file), on top of Sites' list CRUD and Display's JSON toggles.

- menus/timezone.sh: also replaces the legacy script's hand-numbered
  18-entry case statement with a plain data list (TIMEZONE_COMMON_ZONES)
  plus one handler that reads the number run_menu hands it - adding or
  removing a zone never touches numbering anywhere else. Required a
  small run_menu addition: handlers now receive the chosen 1-based
  number as $1, so one handler can serve a whole data-driven list
  instead of needing a wrapper function per entry.
- menus/hidden_pin.sh: set/disable/reset the PIN gating hidden pages.

Testing menus/timezone.sh surfaced a real bug before it ever shipped:
this whole tool runs under `set -e`, and set_timezone() rejecting an
invalid zone via a bare `return 1` as its last statement took down the
*entire* install.sh session, not just that one action - a single typo
would silently drop the user back to their shell. Fixed at the
framework level in lib/menu.sh (run_menu now absorbs a failed handler's
exit code) rather than patching set_timezone alone, since any future
menu could hit the same trap. Verified against the real install.sh as a
genuine non-root user: an invalid timezone now logs an error and
redraws the Timezone menu instead of killing the session (confirmed
exit code 0 at the end of the run). Note this specific hazard was
introduced by this session's own return-1 idiom, not inherited from the
legacy script, which never uses a bare return 1 in these functions.

Also per the user: left the old configure_sites/configure_touch_controls/
configure_navigation_security/configure_optional_features functions in
ubuntu-based-kiosk.sh untouched for now (still carrying the v2.0.0
settings-clobber and reorder bugs) rather than removing them - they'll
be retired in one pass once enough of Core Settings/Addons/Advanced is
migrated. Bumped SCRIPT_VERSION to 2.1.0 with matching changelog entries
in the script header and Readme, and updated the Readme's "Modular
Management" section to state plainly what is and isn't migrated yet.

Verified:
- Full regression: re-ran the Sites and Display scratch-config test
  suites against the updated run_menu signature - both still clean.
- New scratch-config tests for hidden_pin.sh (set/mismatch/reject/
  disable/reset, correct file permissions) and timezone.sh (builder
  entry count, common-zone pick by index, manual entry with legacy
  US/* alias normalization, region search + cancel, invalid-zone
  rejection) - all correct, with timedatectl/sudo stubbed only where
  needed to avoid mutating this sandbox's real system clock/timezone.
- End-to-end: ran the real install.sh as a genuine non-root, non-"kiosk"
  user, navigating Timezone -> manual entry -> invalid zone -> confirmed
  no crash and a normal return to the menu, then Hidden Site PIN -> set
  a PIN -> confirmed the file on disk (mode 600, correct content) ->
  clean exit (code 0).

Readme.md

@@ -1,6 +1,6 @@
 # Ubuntu Based Kiosk
 
-**Current Version:** 2.0.0 (check script header for latest version)
+**Current Version:** 2.1.0 (check script header for latest version)
 **Built with Claude Sonnet 4.6 AI assistance**
 **License:** GPL v3 - Keep derivatives open source
 **Repository:** https://github.com/outis1one/ubuntu-based-kiosk/
@@ -1182,8 +1182,14 @@ terminal menu and the web UI, so they can't drift apart).
   concept for this approach.
 - `menus/display.sh` — **Display & Interaction**: touch gesture mode,
   link navigation security, and the on-screen pause/keyboard/navigation
-  button toggles. A second proof of concept covering a different menu
-  shape (settings toggles vs. the list CRUD in Sites).
+  button toggles. A different menu shape from Sites (settings toggles
+  vs. list CRUD).
+- `menus/timezone.sh` — **Timezone**: also replaces the legacy script's
+  hand-numbered 18-entry `case` statement with a plain data list plus one
+  handler — the numbering is just `run_menu`'s job now.
+- `menus/hidden_pin.sh` — **Hidden Site PIN**: the PIN gating hidden
+  pages (`duration: -1` in Sites). A fourth shape again — a flat file,
+  not `config.json`.
 - `install.sh` — entry point for the modular tool. Run it against an
   *already-installed* kiosk:
   ```bash
@@ -1192,19 +1198,30 @@ terminal menu and the web UI, so they can't drift apart).
   ./install.sh
   ```
 
-This does **not** yet replace first-time installation — that's still the
-single-file script above (`Quick Install`). The rest of Core
-Settings/Addons/Advanced will move into `menus/*.sh` the same way, one
-menu at a time, and `install.sh` will eventually take over the whole
-`show_main_menu` from the legacy script.
+**Honest status:** this does not yet replace first-time installation, or
+most of the old installer. `ubuntu-based-kiosk.sh` is still ~12,000
+lines and still contains its own unremoved, unmodified copies of every
+menu above (plus WiFi, Power/Display/Quiet Hours, Password Protection &
+Lockout, Upgrade, Reinstall, Uninstall, all Addons, and all of Advanced —
+none of that has moved yet). Both copies coexist deliberately: the old
+ones stay until enough of Core Settings/Addons/Advanced is migrated to
+retire them in one pass, rather than leaving the legacy menu half-wired.
+Migration continues one `menus/*.sh` file at a time; first-time
+installation itself is the last and largest piece to move, if it moves
+at all.
 
 ---
 
 ## Project Status & Future Plans
 
-**Current Version:** 2.0.0
+**Current Version:** 2.1.0
 
-**Recent Updates (v2.0.0):**
+**Recent Updates (v2.1.0):**
+- **Two more menus migrated:** Timezone (`menus/timezone.sh`) and Hidden Site PIN (`menus/hidden_pin.sh`), joining Sites & Page Timing and Display & Interaction in `./install.sh`. Timezone also replaces the old hand-numbered 18-entry list with a data-driven one built on the generic menu framework.
+- **Bug fix (framework-level):** `install.sh` runs under `set -e`; a menu action that legitimately fails (e.g. rejecting an invalid timezone) and returns non-zero as its last statement could take down the *entire* session instead of just that action. Caught by testing before this ever shipped broadly; `run_menu()` now absorbs a failed handler's exit code, protecting every menu — present and future.
+- The old, unmigrated `configure_sites`/`configure_touch_controls`/`configure_navigation_security`/`configure_optional_features` in `ubuntu-based-kiosk.sh` are staying in place for now (still carrying the v2.0.0 bugs below) until enough of Core Settings/Addons/Advanced is migrated to retire them in one pass — see "Modular Management" below for exactly what's covered so far.
+
+**Previous (v2.0.0):**
 - **Modular management path:** new `lib/menu.sh` (reusable numbered-menu framework: auto-numbered entries, `0` always exits/returns) and `lib/config.sh` (single load/save for `config.json`), with menus migrating into `menus/*.sh` one at a time — **Sites & Page Timing** and **Display & Interaction** are migrated so far. Run via `./install.sh` after cloning the repo, against an already-installed kiosk (see "Modular Management" below). Groundwork for the planned web-based GUI, which will share this same `lib/config.sh` layer.
 - **Bug fix:** the old Sites menu could save `config.json` without first loading swipe/navigation/lockout settings, silently resetting them to script defaults.
 - **Bug fix:** reordering sites had an off-by-one that left the moved site one slot short of the requested position.