Migrate Diagnostics menu; bump to v2.4.0

Deliberately skipped Upgrade/Full Reinstall/Complete Uninstall for now:
all three are large (130-250 lines), genuinely destructive (wipe/
reinstall the kiosk), and Upgrade specifically is coupled to the legacy
script's own self-extraction mechanism (it greps its own running source
for embedded heredocs to pull out main.js/preload.js) - there's no
modular equivalent to migrate it to yet, since those files don't exist
as separate assets outside the monolith. Migrated Diagnostics instead:
4 of the legacy Advanced menu's 12 items (System Status, View Logs,
Audio Diagnostics, Network Test), all read-only except one optional
"play a test sound?" prompt - a deliberate change of pace with no
destructive-action risk to design around, after Sites/WiFi/Power.

- lib/menu.sh: ported get_vpn_ips alongside get_ip_address.
- menus/diagnostics.sh: straight port, using $KIOSK_USER/$KIOSK_HOME
  throughout instead of the legacy code's mix of the variable and a
  hardcoded "kiosk" literal.

Bug fixed, same set -e-safety class as v2.1.0's run_menu fix and
v2.3.0's netplan/systemctl fixes, but a bigger batch this time: nearly
every diagnostic command here was a bare unguarded statement whose
*expected, common* failure - no lightdm running, no audio hardware, no
network, missing log files, ping/nslookup not even installed - would
have crashed the entire session instead of reporting "not found" and
continuing. A diagnostics tool has to be the most crash-proof code in
the project, since it exists to run when something is already broken.
Fixed at every call site: systemctl status | head, tail on lightdm's
log, journalctl, ping, nslookup, and three pactl-backed variable
assignments.

Also noted for future menus in this migration: writing `local var;` and
`var=$(cmd)` as separate statements (good practice, and how several
earlier real bugs were caught) removes an accidental safety net -
`local x=$(cmd)` on one line masks the substitution's exit code with
`local`'s own always-success status. Splitting them is correct, but
each split assignment needs an explicit `|| true` (or real fallback)
where failure is expected and non-fatal, rather than relying on that
masking by accident. Caught three instances of exactly this while
writing this file fresh, not just porting old bugs.

Verified:
- Full regression: re-ran every existing scratch-config/stub test suite
  (sites, display, timezone/pin, lockout, power schedule + RTC, wifi) -
  all still clean after the lib/menu.sh change.
- New test for diagnostics.sh, exercised mostly for real (no
  destructive-mutation risk here, so minimal stubbing needed): system
  status, all three log views (including the "no such file" paths for
  lightdm log and electron log), full 8-step audio diagnostic with test
  sound declined, and network test - all report gracefully instead of
  crashing, confirmed by re-running after each fix until every bare
  unguarded statement was accounted for.
- End-to-end: ran the real install.sh as a genuine non-root, non-
  "kiosk" user, navigating Diagnostics -> System status -> View Logs ->
  System journal -> Audio diagnostics (declined test sound) -> Network
  test -> exit. Confirmed every diagnostic path completes and returns
  to its menu cleanly (exit code 0) even with ping/nslookup missing and
  no audio hardware/network present in this environment.

ubuntu-based-kiosk.sh

@@ -1,8 +1,39 @@
 #!/bin/bash
 ################################################################################
-###   Ubuntu Based Kiosk v2.3.0                ###
+###   Ubuntu Based Kiosk v2.4.0                ###
 ################################################################################
 #
+# RELEASE v2.4.0 - Diagnostics Migrated
+# - New in ./install.sh: Diagnostics (menus/diagnostics.sh) - system
+#   status, log viewing (Electron/LightDM/journal), an 8-step audio
+#   diagnostic, and a ping+DNS network test, pulled from the legacy
+#   Advanced menu. Everything here is read-only except one optional
+#   "play a test sound?" prompt - a deliberate change of pace after
+#   Sites/WiFi/Power, with no destructive-action risk to design around.
+#   Manual Electron Update, Factory Reset, Export/Import Settings,
+#   Emergency Hotspot, and Fix Blank Screen are staying in the legacy
+#   script for now - they're mutating/destructive, and some share
+#   Upgrade's coupling to the legacy script's own self-extraction
+#   mechanism (see v2.3.0 below for why Upgrade/Reinstall/Uninstall
+#   aren't migrated either).
+# - Fixed (set -e safety, same class as v2.1.0/v2.3.0): every diagnostic
+#   command whose failure is actually the expected, common case - no
+#   lightdm running, no audio hardware, no network, missing log files,
+#   `ping`/`nslookup` not even installed - was a bare unguarded
+#   statement that would have crashed the whole session instead of
+#   reporting "not found" and moving on. A diagnostics tool has to be
+#   the most crash-proof code in the project, since it exists to run
+#   *when something is already broken*; every one of these now reports
+#   and continues instead. Also worth noting for future menus: writing
+#   `local var;` and `var=$(cmd)` as separate statements (good practice,
+#   and how earlier real bugs in this migration were caught) removes an
+#   accidental safety net bash's `local x=$(cmd)` has on one line - that
+#   form masks the substitution's exit code with `local`'s own
+#   always-success status. Splitting them is correct, but each split
+#   assignment needs its own explicit `|| true` (or real fallback) where
+#   a failure is expected and non-fatal, rather than relying on that
+#   quirk by accident.
+#
 # RELEASE v2.3.0 - WiFi and Power/Display/Quiet Hours Migrated
 # - New in ./install.sh: WiFi (menus/wifi.sh) and Power/Display/Quiet
 #   Hours (menus/power_schedule.sh) - by far the biggest and riskiest
@@ -157,7 +188,7 @@ set -euo pipefail
 ### SECTION 1: CONSTANTS & GLOBALS
 ################################################################################
 
-SCRIPT_VERSION="2.3.0"
+SCRIPT_VERSION="2.4.0"
 
 # Resolve the real path to this script file.
 # When piped (curl|bash or wget|bash), BASH_SOURCE[0] is a pipe descriptor,