Migrate Authelia addon; fix real config-clobbering bug in save_config; bump to v2.6.0

Second Addon migrated: menus/addon_authelia.sh (encrypted SSO
credentials, AES-256-CBC with a key derived from /etc/machine-id via
scrypt - same algorithm main.js decrypts with - plus the full
Dockerized server-side setup instructions, now viewable again later
without reconfiguring).

Investigating how to wire its three config.json fields (autheliaURL/
autheliaUsername/autheliaEncryptedPassword) into lib/config.sh surfaced
a real, currently-shipping bug that has nothing to do with Authelia
specifically: save_config() did a full `jq -n` rebuild of config.json
from a fixed list of known fields - identical to what the legacy
script's own save_config still does. The legacy configure_authelia()
writes its three fields via a careful `. + {...}` merge that preserves
everything else already in the file, but neither save_config knew those
fields existed - so the next time a user visited Sites, Touch Controls,
Navigation, or Password Protection (all of which call save_config),
their Authelia credentials were silently deleted. This bug already
existed in the shipped single-file installer; it was ported faithfully
into lib/config.sh's first version because no test happened to set an
untracked field before calling save_config.

Fixed in lib/config.sh: save_config now merges its known fields onto
whatever's already in config.json (jq `. + {...}`) instead of rebuilding
the file from nothing, with a `jq empty` validity check falling back to
`{}` if the existing file is missing or corrupt. Any field this tool
doesn't track - Authelia's three today, anything else a future addon
adds tomorrow - now survives automatically. autheliaURL/
autheliaUsername/autheliaEncryptedPassword are also tracked fields in
their own right now (load_existing_config/save_config), consistent with
every other config.json field this tool manages, giving Authelia both a
direct fix and the general safety net.

The equivalent bug still exists, unfixed, in ubuntu-based-kiosk.sh's own
save_config - noted in both that script's changelog and the Readme's
"Modular Management" section as an open question: whether to backport
just that one fix into the legacy script now, independent of the wider
migration, given it's a real credential-loss bug affecting the
currently-shipping installer today.

Verified:
- New dedicated test (test_save_merge.sh) proving the save_config fix
  itself: seeded config.json with a simulated untracked field via the
  same `. + {...}` merge Authelia's own code uses, called save_config
  from an unrelated context (Sites deleting a tab), and confirmed the
  untracked field survived while the tab deletion still correctly took
  effect (not undone by the merge) - plus corrupt-JSON and
  missing-file edge cases both handled without crashing.
- New scratch-config test for addon_authelia.sh using REAL encryption
  (this sandbox has both Node and /etc/machine-id): configured with a
  real password, then decrypted the stored ciphertext using main.js's
  exact algorithm (independently reproduced in the test) and confirmed
  it recovers the original password exactly - true interoperability,
  not just "some ciphertext was produced." Also covered cancel paths,
  clearing the configuration, the encryption-unavailable failure path,
  and confirmed Authelia's config survives an unrelated Sites save.
- Full regression: re-ran all 9 prior scratch/stub test suites after
  both the lib/config.sh changes - all still clean.
- End-to-end: ran the real install.sh as a genuine non-root, non-
  "kiosk" user with a seeded minimal config.json, through Addons ->
  Authelia -> Configure with a real URL/username/password -> confirmed
  the resulting config.json on disk, and independently decrypted the
  stored password for real using main.js's algorithm to confirm it
  matches exactly. Clean exit code 0 throughout.

ubuntu-based-kiosk.sh

@@ -1,8 +1,43 @@
 #!/bin/bash
 ################################################################################
-###   Ubuntu Based Kiosk v2.5.0                ###
+###   Ubuntu Based Kiosk v2.6.0                ###
 ################################################################################
 #
+# RELEASE v2.6.0 - Authelia Migrated; Real Config-Clobbering Bug Fixed
+# - New in ./install.sh: Authelia Auto-Login (menus/addon_authelia.sh) -
+#   encrypted SSO credentials (AES-256-CBC, key derived from this
+#   machine's /etc/machine-id via scrypt - same algorithm main.js
+#   decrypts with, verified by test with a real round-trip encrypt/
+#   decrypt, not just "some string came out"), plus the full Dockerized
+#   server-side setup instructions, viewable again later without
+#   reconfiguring.
+# - IMPORTANT bug found and fixed in lib/config.sh, NOT specific to
+#   Authelia or to this migration: save_config() did a full `jq -n`
+#   rebuild of config.json from known fields, exactly like the legacy
+#   script's save_config still does. Authelia's own write is a careful
+#   `. + {...}` merge that preserves everything - but the legacy
+#   configure_authelia() writes autheliaURL/autheliaUsername/
+#   autheliaEncryptedPassword into config.json via that merge, and
+#   *neither* the legacy save_config nor this project's own (before this
+#   fix) had any idea those three fields existed. The next time a user
+#   visited Sites, Touch Controls, Navigation, or Password Protection -
+#   all of which call save_config - their Authelia credentials were
+#   silently deleted. This is a real bug in the currently-shipping
+#   single-file installer, not introduced by this migration; ported
+#   faithfully into lib/config.sh's first version because no test
+#   happened to set an untracked field before calling save_config.
+#   Fixed here by changing save_config to merge its known fields onto
+#   whatever's already in config.json (jq `. + {...}`) instead of
+#   rebuilding the file from nothing, so any field this tool doesn't
+#   track - Authelia's three today, anything else tomorrow - survives
+#   automatically. autheliaURL/autheliaUsername/autheliaEncryptedPassword
+#   are also now tracked fields in their own right, same as every other
+#   config.json field this tool manages. NOTE: the equivalent bug still
+#   exists in this script's own save_config below, unfixed - see
+#   Readme.md ("Modular Management") for the open question of whether to
+#   backport this specific fix here independent of the wider migration,
+#   given it's a real, currently-shipping credential-loss bug.
+#
 # RELEASE v2.5.0 - First Addon Migrated (CUPS), Menu Restructured
 # - New in ./install.sh: CUPS Printing (menus/addon_cups.sh) - the first
 #   Addon migrated. Install/reconfigure/complete uninstall (purge),
@@ -226,7 +261,7 @@ set -euo pipefail
 ### SECTION 1: CONSTANTS & GLOBALS
 ################################################################################
 
-SCRIPT_VERSION="2.5.0"
+SCRIPT_VERSION="2.6.0"
 
 # Resolve the real path to this script file.
 # When piped (curl|bash or wget|bash), BASH_SOURCE[0] is a pipe descriptor,