K-114: input validation in build.func + mini CI (nexus-hub card)

- validation helpers: sanitize_input trims CR/edge whitespace only;
  embedded control/non-ASCII bytes FAIL validation and re-prompt with a
  hint (2026-06-11 incident: invisible byte in a pasted VLAN tag broke
  pct create mid-run) - never silently stripped
- prompt_lxc_config: every prompt validated (uint for CTID/disk/cores/
  RAM, VLAN 1-4094, hostname/token formats, IP/CIDR/gateway, DNS list);
  env-provided values are sanitized + validated too (abort, no re-prompt
  loop in non-interactive use); helpers reusable for app prompts
- tests/test_validation.sh: 34 cases incl. the 2<0x80>0 repro, re-prompt
  simulation, BASH_REMATCH clobbering regression (is_cidr), env dry-run
  of prompt_lxc_config without PVE/TTY
- tests/check_ct_source.sh: every ct/*.sh must source build.func (bug
  shipped twice); negative proof via prepared fixture in the test suite
- .gitea/workflows/ci.yml: bash -n over all scripts, source-check,
  validation tests, shellcheck if present (documented skip otherwise)
- README: contributions via PR with cross-review (binding)

tests/check_ct_source.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# K-114: Jedes ct/*.sh MUSS lib/build.func sourcen — der Bug "Helfer nicht
+# gesourct, Skript stirbt erst mitten im Lauf" ist zweimal real passiert
+# (nexus-db: im Review gefangen; authentik: erst in Produktion).
+# Aufruf: tests/check_ct_source.sh [verzeichnis]  (Default: ct/)
+set -euo pipefail
+
+DIR="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/ct}"
+status=0
+
+shopt -s nullglob
+scripts=("$DIR"/*.sh)
+if [[ ${#scripts[@]} -eq 0 ]]; then
+  echo "no scripts found in $DIR" >&2
+  exit 1
+fi
+
+for script in "${scripts[@]}"; do
+  if grep -Eq 'source[[:space:]]+<\(curl[^)]*build\.func' "$script"; then
+    echo "ok     $script"
+  else
+    echo "FEHLT  $script — sourct lib/build.func nicht" >&2
+    status=1
+  fi
+done
+exit "$status"