Migrate WiFi and Power/Display/Quiet Hours menus; bump to v2.3.0

By far the riskiest menus migrated so far. Both can affect real system
state outside config.json in ways that are hard to reverse: WiFi
rewrites live netplan config and, over SSH, can disconnect the very
session configuring it; power scheduling can shut the physical machine
down and wake it via RTC.

- lib/config.sh: new $SYSTEMD_DIR/$CRON_D_DIR/$BIN_DIR/$NETPLAN_DIR,
  same `: "${VAR:=default}"` pattern as $KIOSK_DIR. Nothing under
  menus/ hardcodes /etc/systemd/system, /etc/cron.d, /usr/local/bin, or
  /etc/netplan directly, so every test in this change points them at
  scratch space instead of ever touching this sandbox's real systemd
  units, cron, or network config.
- lib/menu.sh: ported get_ip_address (also fixing its "No IP" fallback,
  which never actually fired before - `hostname -I | awk` always exits
  0 even on empty output).
- menus/wifi.sh: apply_wifi_config split out from wifi_menu specifically
  so tests can drive the netplan-writing logic without needing real
  scan hardware. Preserves the legacy netplan backup, 60s SSH watchdog,
  and restore-on-failure behavior exactly.
- menus/power_schedule.sh: power schedule (+ RTC wake), display
  schedule, quiet hours, and an Electron reload timer (with its own
  nested run_menu, mirroring the legacy configured/not-configured
  dispatch), plus remove-all. Deliberately excludes the legacy
  dispatcher's "Test schedules & system" - a shared diagnostics submenu
  (audio/network/keyboard tests) that isn't specific to scheduling and
  belongs with a future Advanced/Diagnostics migration instead.

Bugs found and fixed along the way, none papered over:
- The legacy dispatcher refused to open "Configure power schedule" at
  all without RTC hardware, even though shutdown-only mode never needed
  RTC. Now always available.
- None of the six HH:MM prompts across these menus (shutdown, wake,
  display off/on, quiet start/end, custom Electron reload time) were
  validated before - plain `read`, no format check. All now go through
  ask_time.
- set -e safety (same class as the v2.1.0 run_menu fix), three more
  instances: `ls *.yaml` when no netplan file exists still fails under
  pipefail even with stderr silenced (masked in practice by cloud-init
  usually leaving a file behind); the restore-and-reapply `netplan
  apply` after an initial failure was a bare unguarded statement; and
  `systemctl enable`/`start` after writing each of the four timer pairs
  was unguarded too - caught only by testing in an environment without
  a live systemd, but a real enable/start failure on actual hardware
  (bad unit, daemon-reload skipped, ...) would hit the exact same crash.
  Added a shared enable_and_start_timers() helper used at all four call
  sites; all now report a clear warning and return to the menu instead
  of taking the session down.

Testing discipline for this round, given the risk:
- No automated test calls the real netplan/nmcli/iw/wpa_cli/systemctl -
  confirmed no WiFi tools or `wl*` interface exist in this sandbox, so
  wifi_menu's own tools-check safely short-circuits before touching
  anything; apply_wifi_config's actual YAML/backup/failure-recovery
  logic is tested with sudo/netplan/get_ip_address stubbed instead.
- One stubbing pitfall caught and fixed in the test itself: `nohup sudo
  bash "$watchdog" ... &` execs nohup as a real external binary, which
  then execs the real sudo - a bash function stub named `sudo` does NOT
  intercept that, only stubbing `nohup` itself does. Verified via pgrep
  that no real watchdog process or `sleep 60` was ever spawned.
- power_schedule.sh tested with SYSTEMD_DIR/CRON_D_DIR/BIN_DIR pointed
  at scratch dirs and only `sudo systemctl` stubbed (tee/rm/chmod/cp
  left real, since they only ever touch scratch paths): full lifecycle
  for all four schedule types plus remove-all, the RTC-available branch
  (including the wake-time-before-shutdown-time hour/day wraparound
  arithmetic) via a stubbed rtc_wake_available, and the new
  enable_and_start_timers failure path via a stub that fails `enable`
  specifically.
- End-to-end: ran the real install.sh as a genuine non-root, non-
  "kiosk" user for both menus. WiFi correctly short-circuits on missing
  tools without crashing. Power/Display/Quiet Hours (SYSTEMD_DIR/
  CRON_D_DIR/BIN_DIR redirected to scratch space) configured all four
  schedule types in sequence including the nested Electron Reload menu,
  survived four consecutive real "systemctl enable/start failed"
  warnings (this container has no live systemd) without the session
  dying, then removed everything - confirmed the scratch dirs ended up
  empty and config.json was never touched (correctly out of scope for
  this menu).

ubuntu-based-kiosk.sh

@@ -1,8 +1,43 @@
 #!/bin/bash
 ################################################################################
-###   Ubuntu Based Kiosk v2.2.0                ###
+###   Ubuntu Based Kiosk v2.3.0                ###
 ################################################################################
 #
+# RELEASE v2.3.0 - WiFi and Power/Display/Quiet Hours Migrated
+# - New in ./install.sh: WiFi (menus/wifi.sh) and Power/Display/Quiet
+#   Hours (menus/power_schedule.sh) - by far the biggest and riskiest
+#   menus migrated so far. WiFi can rewrite live netplan config and, if
+#   run over SSH, disconnect the very session configuring it; Power
+#   schedule can shut the physical machine down and wake it via RTC.
+#   Every safety mechanism from the legacy menus is preserved exactly:
+#   netplan backup + 60s SSH watchdog + restore-on-apply-failure for
+#   WiFi; RTC availability detection for power scheduling. New
+#   $SYSTEMD_DIR/$CRON_D_DIR/$BIN_DIR/$NETPLAN_DIR variables (lib/config.sh)
+#   mean nothing under menus/ hardcodes /etc/systemd/system, /etc/cron.d,
+#   /usr/local/bin, or /etc/netplan - tests point them at scratch space.
+# - Fixed: the legacy dispatcher refused to open "Configure power
+#   schedule" at all when no RTC wake was detected, even though
+#   shutdown-only scheduling never needed RTC in the first place.
+# - Fixed: none of shutdown/wake/display-off/display-on/quiet-start/
+#   quiet-end/custom-Electron-reload times were validated as HH:MM in
+#   the legacy menus (plain `read`, no format check) - now all go
+#   through ask_time.
+# - Fixed (set -e safety, same class as v2.1.0's run_menu fix): several
+#   bare, unguarded statements whose failure would have taken down the
+#   entire session instead of just that action - `ls *.yaml` when no
+#   netplan file exists (masked in practice by cloud-init usually
+#   leaving one behind), the restore-and-reapply `netplan apply` after
+#   an initial apply failure, and `systemctl enable`/`start` after
+#   writing each of the four timer pairs. The last of these was caught
+#   only by testing in an environment without a live systemd - a real
+#   `enable`/`start` failure on actual hardware (bad unit, daemon-reload
+#   skipped, ...) would have hit the same bug. All now report a clear
+#   warning and return to the menu instead.
+# - Deliberately NOT migrated: the legacy dispatcher's "Test schedules &
+#   system" led into a shared diagnostics submenu (audio/network/
+#   keyboard tests) that isn't specific to scheduling and belongs with a
+#   future Advanced/Diagnostics migration instead.
+#
 # RELEASE v2.2.0 - Password Protection & Lockout Migrated
 # - New in ./install.sh: Password Protection & Lockout (menus/lockout.sh) -
 #   enable/disable, change password (SHA-256 hashed before it's ever
@@ -122,7 +157,7 @@ set -euo pipefail
 ### SECTION 1: CONSTANTS & GLOBALS
 ################################################################################
 
-SCRIPT_VERSION="2.2.0"
+SCRIPT_VERSION="2.3.0"
 
 # Resolve the real path to this script file.
 # When piped (curl|bash or wget|bash), BASH_SOURCE[0] is a pipe descriptor,