refactor: comprehensive ProxRescue.sh hardening and decomposition

[click0]

Security:

• Route all Error/Warning messages to stderr
• Replace sshpass -p with sshpass -f (hide password from ps)
• Add read -s for VNC password input (hide from terminal)
• Send VNC password change to QEMU monitor in changeVncPassword()
• Add proper IPv4 validation (check octets <= 255)
• Add interactive prompt when SHA256SUMS download fails

Architecture:

• Decompose run_qemu() into build_qemu_args(), setup_vnc_and_novnc(), wait_for_qemu(), run_qemu_install(), run_qemu_settings(), run_qemu_runsystem()
• Decompose select_proxmox_product_and_version() into select_product(), fetch_available_versions(), select_version(), download_and_verify_iso()
• Replace recursive show_menu()/select_proxmox calls with while loops
• Extract duplicated VNC/noVNC setup into setup_vnc_and_novnc()
• Extract duplicated polling loops into wait_for_qemu()

Configuration:

• Add named constants: QEMU_MONITOR_PORT, QEMU_VNC_PORT, QEMU_SSH_PORT
• Add OVMF_PATH variable (was hardcoded)
• Add DISK_WARNING_ENABLED (default: true) for disk access warning
• Add REBOOT_TIMEOUT variable for delayed reboot
• Add NOVNC_VERSION variable (empty = HEAD, or specific tag)
• Add SCRIPT_DIR for reliable path resolution
• Replace all hardcoded port literals with variables

UX:

• Add OS check (Debian/Ubuntu only)
• Add root privilege check
• Add global trap for cleanup on EXIT/INT/TERM
• Add disk warning before passing raw access to QEMU
• Add reboot delay with configurable timeout
• Add choice menu when QEMU stops unexpectedly (menu vs reboot)
• Reorder menu: disks first, then install, run, utilities
• Check for existing ISO before re-downloading
• Use --depth 1 for git clone (noVNC/websockify)
• Use absolute paths ($SCRIPT_DIR) instead of relative ./noVNC/
• Improve clear_list() error reporting

https://claude.ai/code/session_01KXwhncFDxYTpBeKNzmqWqA