Don't glob or test inside the kiosk user's private home as the admin

Reported on a 26.04 offline install, first-boot step 4:
  chown: cannot dereference '/home/kiosk/kiosk-app/*.js': No such file or directory
(same for *.mjs, *.html). `sudo chown ... "$KIOSK_DIR"/*.js` has the glob
expanded by the calling (admin) shell before sudo runs; the kiosk user's
home is created mode 750, so the admin can't list it, the pattern stays
literal, and chown fails - stopping the install under set -e.

- provision_install_app: chown the copied top-level files with
  `sudo find "$KIOSK_DIR" -maxdepth 1 -type f -exec chown ...` (root does
  the listing). Top level only, so chrome-sandbox inside node_modules
  keeps its root ownership.
- Swept lib/ and menus/ for the same class of bug: Asterisk Intercom's
  baresip_is_installed and status read $KIOSK_HOME/.baresip/accounts
  without sudo, so they always reported "not configured". Now sudo test
  / sudo head. Everything else that touches the kiosk home (config.json,
  kiosk-app checks) already goes through sudo -u kiosk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

menus/addon_asterisk_intercom.sh

@@ -62,7 +62,9 @@ baresip_installed_version() {
 # `apt install baresip` with no configured extension isn't something
 # this menu should call done.
 baresip_is_installed() {
-    command -v baresip &>/dev/null && [[ -f "$BARESIP_CONFIG_DIR/accounts" ]]
+    # sudo: it's under the kiosk user's home, which the admin running this
+    # can't look inside (mode 750) - a plain [[ -f ]] is always false there.
+    command -v baresip &>/dev/null && sudo test -f "$BARESIP_CONFIG_DIR/accounts"
 }
 
 baresip_is_running() {
@@ -78,9 +80,9 @@ addon_asterisk_intercom_status() {
         else
             echo "Asterisk Intercom: Installed (v${ver:-unknown}) - Not running"
         fi
-        if [[ -f "$BARESIP_CONFIG_DIR/accounts" ]]; then
+        if sudo test -f "$BARESIP_CONFIG_DIR/accounts"; then
             local account
-            account=$(head -1 "$BARESIP_CONFIG_DIR/accounts" 2>/dev/null)
+            account=$(sudo head -1 "$BARESIP_CONFIG_DIR/accounts" 2>/dev/null)
             local extension="${account#<sip:}"
             extension="${extension%%@*}"
             [[ -n "$extension" ]] && echo "  Extension: $extension"