critical-fixes, swap module & gaming overhaul

- Fixed script crashes from `whiptail` Cancel/Esc under `set -e`. Added `_menu()`, `_checklist()` and `_inputbox()` wrappers with `|| true` to prevent premature exits.
- Resolved startup failures by using defaults instead of relying on unset variables with `set -u`.
- Hardened sudoers management — `_validate_sudoers()` writes to temp file, validates with `visudo -cf`, only copies if successful.
- Replaced `eval` in `_run_cmd` with safer `bash -c` execution.

Swap Management Module (`modules/swap.sh`)
- New standalone module with 9 internal functions and `manage_swap()` entry point.
- Btrfs CoW detection — applies `chattr +C` before swapfile creation to prevent mkswap rejection on Btrfs.
- Dynamic swappiness configuration — reads current system value instead of hardcoding 60, pre-fills inputbox with existing setting.
- Uses `/run/lock/debianito-swap.lock` for early init compatibility (added as option 9 in main menu).

Repository & Branch Migration (`modules/repos/migrate.sh`)
- Handles branch migration from stable (11/12) to Testing or SID with 5-screen UX flow.
- Persistent backup system — creates timestamped tar.gz backups of `/etc/apt/sources.list*`, auto-restores on apt update failure.
- SID guardrails — installs `apt-listbugs` and `apt-listchanges` before upgrade to warn about critical bugs in unstable packages.
- Dynamic menu options based on Debian version (SID shows only 1-2-3 Exit, non-SID includes backports + branch migration).
- New `_components_enabled()` helper detects current contrib/non-free state.

Gaming Module Overhaul
- Unified gaming checklist — merged i386 toggle into single prompt with lazy evaluation instead of separate pre-check.
- Lazy 32-bit architecture enablement — only enables i386 when needed (steam/lutris/i386 selected) and installs graphics drivers if `need_32bit=true`.
- New `_install_nvidia_32bit()` helper with proper driver detection, version pinning, and legacy/tesla variant handling.

Heroic & OpenRGB Downloads
- Heroic — fetches latest release from GitHub API using `jq` to extract amd64.deb URL, validates with `dpkg-deb --info`.
- OpenRGB — downloads from Codeberg Gitea API with SHA256 verification when available, fallback to `dpkg-deb` validation.
- Dynamic codename detection — now detects Bookworm vs Trixie at runtime instead of hardcoded static values for .deb download URLs.

|Other Improvements
- Renumbered main menu: 8=ZRAM, 9=Swap Management, 10=Extras, 11=Boot Rescue, 12=Exit.
- Improved `detect_storage()` — excludes loop/CD-ROM devices via `lsblk -e 7,11`, explicitly skips zram, detects USB/SD via `/sys/block/$name/removable`.
- Standardized SCROLL_HINT across all files with centralized readonly variable.

modules/utils.sh

@@ -369,23 +369,31 @@ detect_displayserver() {
 }
 
 # ---------------------------------------
-# Storage summary via lsblk (NVMe / SSD / HDD)
+# Storage summary via lsblk (NVMe / SSD / HDD / USB-SD)
 # ---------------------------------------
 detect_storage() {
     local parts=()
-    local name size rota type
+    local name size rota type rm
 
-    while read -r name size rota; do
+    while read -r name size rota type; do
         [ "$name" = "NAME" ] && continue
+        echo "$name" | grep -q "zram" && continue
+        [ "$type" = "loop" ] || [ "$type" = "rom" ] && continue
+
         if echo "$name" | grep -q "nvme"; then
             type="NVMe"
         elif [ "$rota" = "1" ]; then
             type="HDD"
         else
-            type="SSD"
+            rm=$(cat /sys/block/"$name"/removable 2>/dev/null || echo 0)
+            if [ "$rm" = "1" ]; then
+                type="USB/SD"
+            else
+                type="SSD"
+            fi
         fi
         parts+=("${size} ${type}")
-    done < <(lsblk -d -o NAME,SIZE,ROTA 2>/dev/null || true)
+    done < <(lsblk -d -o NAME,SIZE,ROTA,TYPE -e 7,11 2>/dev/null || true)
 
     if [ ${#parts[@]} -eq 0 ]; then
         STORAGE_SUMMARY="No disks detected"
@@ -539,7 +547,38 @@ _confirm_custom() {
 }
 
 _msg() {
-    whiptail --title "$1" --msgbox "$2" "${3:-10}" "${4:-65}"
+    whiptail --title "$1" --msgbox "$2" "${3:-10}" "${4:-65}" || true
+}
+
+_menu() {
+    local title="$1" text="$2" h="$3" w="$4" lh="$5"; shift 5
+    whiptail --title "$title" --menu "$text" "$h" "$w" "$lh" "$@" 3>&1 1>&2 2>&3 || true
+}
+
+_checklist() {
+    local title="$1" text="$2" h="$3" w="$4" lh="$5"; shift 5
+    whiptail --title "$title" --checklist "$text" "$h" "$w" "$lh" "$@" 3>&1 1>&2 2>&3 || true
+}
+
+_inputbox() {
+    whiptail --title "$1" --inputbox "$2" "${3:-10}" "${4:-60}" "${5:-}" 3>&1 1>&2 2>&3 || true
+}
+
+_validate_sudoers() {
+    local content="$1" dest="$2"
+    local tmpfile
+    tmpfile=$(mktemp) || return 1
+    echo "$content" > "$tmpfile"
+    if ! visudo -cf "$tmpfile" &>/dev/null; then
+        local err
+        err=$(visudo -cf "$tmpfile" 2>&1 || true)
+        rm -f "$tmpfile"
+        _msg "Sudoers Error" "Invalid sudoers syntax in:\n\n${err}\n\nFile was NOT written.\nThis prevents broken sudo access." 12 70
+        return 1
+    fi
+    sudo cp "$tmpfile" "$dest"
+    sudo chmod 0440 "$dest"
+    rm -f "$tmpfile"
 }
 
 _pause() {
@@ -554,7 +593,7 @@ _run_cmd() {
     clear
     echo -e "${GREEN}[+]${NC} $success_msg"
     echo "──────────────────────────────────────────────"
-    eval "$command"
+    bash -c "$command"
     local rc=$?
     echo "──────────────────────────────────────────────"
     if [ $rc -eq 0 ]; then