critical-fixes, swap module & gaming overhaul

- Fixed script crashes from `whiptail` Cancel/Esc under `set -e`. Added `_menu()`, `_checklist()` and `_inputbox()` wrappers with `|| true` to prevent premature exits.
- Resolved startup failures by using defaults instead of relying on unset variables with `set -u`.
- Hardened sudoers management — `_validate_sudoers()` writes to temp file, validates with `visudo -cf`, only copies if successful.
- Replaced `eval` in `_run_cmd` with safer `bash -c` execution.

Swap Management Module (`modules/swap.sh`)
- New standalone module with 9 internal functions and `manage_swap()` entry point.
- Btrfs CoW detection — applies `chattr +C` before swapfile creation to prevent mkswap rejection on Btrfs.
- Dynamic swappiness configuration — reads current system value instead of hardcoding 60, pre-fills inputbox with existing setting.
- Uses `/run/lock/debianito-swap.lock` for early init compatibility (added as option 9 in main menu).

Repository & Branch Migration (`modules/repos/migrate.sh`)
- Handles branch migration from stable (11/12) to Testing or SID with 5-screen UX flow.
- Persistent backup system — creates timestamped tar.gz backups of `/etc/apt/sources.list*`, auto-restores on apt update failure.
- SID guardrails — installs `apt-listbugs` and `apt-listchanges` before upgrade to warn about critical bugs in unstable packages.
- Dynamic menu options based on Debian version (SID shows only 1-2-3 Exit, non-SID includes backports + branch migration).
- New `_components_enabled()` helper detects current contrib/non-free state.

Gaming Module Overhaul
- Unified gaming checklist — merged i386 toggle into single prompt with lazy evaluation instead of separate pre-check.
- Lazy 32-bit architecture enablement — only enables i386 when needed (steam/lutris/i386 selected) and installs graphics drivers if `need_32bit=true`.
- New `_install_nvidia_32bit()` helper with proper driver detection, version pinning, and legacy/tesla variant handling.

Heroic & OpenRGB Downloads
- Heroic — fetches latest release from GitHub API using `jq` to extract amd64.deb URL, validates with `dpkg-deb --info`.
- OpenRGB — downloads from Codeberg Gitea API with SHA256 verification when available, fallback to `dpkg-deb` validation.
- Dynamic codename detection — now detects Bookworm vs Trixie at runtime instead of hardcoded static values for .deb download URLs.

|Other Improvements
- Renumbered main menu: 8=ZRAM, 9=Swap Management, 10=Extras, 11=Boot Rescue, 12=Exit.
- Improved `detect_storage()` — excludes loop/CD-ROM devices via `lsblk -e 7,11`, explicitly skips zram, detects USB/SD via `/sys/block/$name/removable`.
- Standardized SCROLL_HINT across all files with centralized readonly variable.

modules/sudo_config.sh

@@ -7,14 +7,13 @@ config_sudo() {
 
     while true; do
         local choice
-        choice=$(whiptail --title "User Privileges & Feedback" --menu \
+        choice=$(_menu "User Privileges & Feedback" \
             "Select an option:" $TUI_ALTO $TUI_ANCHO 6 \
             "1" "Sudo Group Membership" \
             "2" "Passwordless Sudo (maintenance commands)" \
             "3" "Repair Home Directory Ownership" \
             "4" "Sudo Password Feedback (asterisks)" \
-            "5" "Back to main menu" \
-            3>&1 1>&2 2>&3)
+            "5" "Back to main menu")
 
         [ -z "$choice" ] && return
         clear
@@ -67,12 +66,11 @@ _configure_nopasswd() {
   - shutdown / reboot / halt (power commands)\n\n\
 Useful for automation but reduces security." 14 70; then
         local choices
-        choices=$(whiptail --title "NOPASSWD Commands" --checklist \
+        choices=$(_checklist "NOPASSWD Commands" \
             "Select commands to allow without password:" 12 60 3 \
             "apt"       "APT package management" ON \
             "systemctl" "Systemd service management" ON \
-            "power"     "Shutdown, reboot, halt" ON \
-            3>&1 1>&2 2>&3)
+            "power"     "Shutdown, reboot, halt" ON)
         clear
 
         [ -z "$choices" ] && { echo "No commands selected."; return; }
@@ -93,12 +91,10 @@ Useful for automation but reduces security." 14 70; then
             esac
         done
 
-        echo -e "$content" | sudo tee "$nopasswd_file" > /dev/null
-        sudo chmod 0440 "$nopasswd_file"
-        if [ -f "$nopasswd_file" ]; then
+        local content_str; content_str=$(echo -e "$content")
+        if _validate_sudoers "$content_str" "$nopasswd_file"; then
             echo -e "${GREEN}Passwordless sudo configured for selected commands.${NC}"
         else
-            echo -e "${RED}Failed to configure passwordless sudo.${NC}"
             return 1
         fi
     fi
@@ -148,10 +144,9 @@ _toggle_pwfeedback() {
     else
         if _confirm "Password Feedback" \
             "Show asterisks when typing the sudo password?"; then
-            if echo 'Defaults pwfeedback' | sudo tee "$fb_file" > /dev/null 2>&1; then
+            if _validate_sudoers 'Defaults pwfeedback' "$fb_file"; then
                 echo -e "${GREEN}Password feedback enabled.${NC}"
             else
-                echo -e "${RED}Failed to create $fb_file${NC}"
                 return 1
             fi
         fi