Migrate Timezone and Hidden Site PIN menus; harden menu framework against set -e; bump to v2.1.0

Two more menus migrated onto lib/menu.sh + lib/config.sh, chosen
specifically because neither touches config.json - a third and fourth
shape for the framework (a system command via timedatectl, and a flat
PIN file), on top of Sites' list CRUD and Display's JSON toggles.

- menus/timezone.sh: also replaces the legacy script's hand-numbered
  18-entry case statement with a plain data list (TIMEZONE_COMMON_ZONES)
  plus one handler that reads the number run_menu hands it - adding or
  removing a zone never touches numbering anywhere else. Required a
  small run_menu addition: handlers now receive the chosen 1-based
  number as $1, so one handler can serve a whole data-driven list
  instead of needing a wrapper function per entry.
- menus/hidden_pin.sh: set/disable/reset the PIN gating hidden pages.

Testing menus/timezone.sh surfaced a real bug before it ever shipped:
this whole tool runs under `set -e`, and set_timezone() rejecting an
invalid zone via a bare `return 1` as its last statement took down the
*entire* install.sh session, not just that one action - a single typo
would silently drop the user back to their shell. Fixed at the
framework level in lib/menu.sh (run_menu now absorbs a failed handler's
exit code) rather than patching set_timezone alone, since any future
menu could hit the same trap. Verified against the real install.sh as a
genuine non-root user: an invalid timezone now logs an error and
redraws the Timezone menu instead of killing the session (confirmed
exit code 0 at the end of the run). Note this specific hazard was
introduced by this session's own return-1 idiom, not inherited from the
legacy script, which never uses a bare return 1 in these functions.

Also per the user: left the old configure_sites/configure_touch_controls/
configure_navigation_security/configure_optional_features functions in
ubuntu-based-kiosk.sh untouched for now (still carrying the v2.0.0
settings-clobber and reorder bugs) rather than removing them - they'll
be retired in one pass once enough of Core Settings/Addons/Advanced is
migrated. Bumped SCRIPT_VERSION to 2.1.0 with matching changelog entries
in the script header and Readme, and updated the Readme's "Modular
Management" section to state plainly what is and isn't migrated yet.

Verified:
- Full regression: re-ran the Sites and Display scratch-config test
  suites against the updated run_menu signature - both still clean.
- New scratch-config tests for hidden_pin.sh (set/mismatch/reject/
  disable/reset, correct file permissions) and timezone.sh (builder
  entry count, common-zone pick by index, manual entry with legacy
  US/* alias normalization, region search + cancel, invalid-zone
  rejection) - all correct, with timedatectl/sudo stubbed only where
  needed to avoid mutating this sandbox's real system clock/timezone.
- End-to-end: ran the real install.sh as a genuine non-root, non-"kiosk"
  user, navigating Timezone -> manual entry -> invalid zone -> confirmed
  no crash and a normal return to the menu, then Hidden Site PIN -> set
  a PIN -> confirmed the file on disk (mode 600, correct content) ->
  clean exit (code 0).

install.sh

@@ -3,16 +3,18 @@
 # install.sh - Modular management entry point for Ubuntu Based Kiosk.
 #
 # This is NOT yet the full system installer - that is still the big
-# single-file script (ubuntu-based-kiosk-v1.0.3.sh etc) documented in
-# Readme.md, and first-time provisioning of a new kiosk still goes through
-# it. This entry point is the start of pulling the *menu system* out of
-# that 12k-line file into small, independently editable modules under
-# lib/ and menus/, so a change to (say) the Sites menu can't accidentally
-# break WiFi setup or the uninstaller three thousand lines away.
+# single-file script (ubuntu-based-kiosk.sh) documented in Readme.md, and
+# first-time provisioning of a new kiosk still goes through it. That file
+# still also contains its own (unmigrated, unmodified) copies of every
+# menu below - both copies coexist deliberately until enough of Core
+# Settings/Addons/Advanced has moved over to retire the old ones in one
+# pass. This entry point is the modular replacement, one menus/*.sh file
+# at a time, so a change to (say) the Sites menu can't accidentally break
+# WiFi setup or the uninstaller three thousand lines away.
 #
-# Today this wires up Sites & Page Timing (menus/sites.sh) and Display &
-# Interaction (menus/display.sh). The rest of Core Settings/Addons/Advanced
-# will move over the same way, one menus/*.sh file at a time.
+# Migrated so far: Sites & Page Timing (menus/sites.sh), Display &
+# Interaction (menus/display.sh), Timezone (menus/timezone.sh), Hidden
+# Site PIN (menus/hidden_pin.sh).
 #
 # Usage (once the kiosk has already been installed):
 #   git clone <repo>
@@ -32,6 +34,10 @@ source "$SCRIPT_DIR/lib/config.sh"
 source "$SCRIPT_DIR/menus/sites.sh"
 # shellcheck source=menus/display.sh
 source "$SCRIPT_DIR/menus/display.sh"
+# shellcheck source=menus/timezone.sh
+source "$SCRIPT_DIR/menus/timezone.sh"
+# shellcheck source=menus/hidden_pin.sh
+source "$SCRIPT_DIR/menus/hidden_pin.sh"
 
 ################################################################################
 # Preflight
@@ -68,8 +74,8 @@ fi
 ################################################################################
 
 main_menu_builder() {
-    MENU_LABELS=("Sites & Page Timing" "Display & Interaction")
-    MENU_HANDLERS=(sites_menu display_menu)
+    MENU_LABELS=("Sites & Page Timing" "Display & Interaction" "Timezone" "Hidden Site PIN")
+    MENU_HANDLERS=(sites_menu display_menu timezone_menu hidden_pin_menu)
 }
 
 main_menu_status() {