fix(install-scripts): correct critical bugs in contrib scripts

- download_and_install_bitcoincore.sh:
  - Fix apt install with single-quoted string (was treating all deps as one package)
  - Add sudo to apt install commands
  - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin
  - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic)
  - Fix install check (0 was testing cd, not tar) with explicit extraction check
  - Handle existing user in adduser
  - Fix source lib.sh path

- download_and_install_bal.sh:
  - Use curl -sfL (fail on 404, follow redirects) for Gitea download
  - Add null/empty check after jq download URL extraction
  - Change certbot --standalone to --nginx (avoids port 80 conflict)
  - Enable nginx site symlink (was commented out)
  - Handle existing 'bal' user in adduser

- install_tor.sh:
  - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl)
  - Backup torrc with timestamp before modifying
  - Add DisableDebuggerAttachment hardening

contrib/download_and_install_bal.sh

@@ -79,13 +79,17 @@ fi
 ################## DOWNLOAD AND INSTALL BAL  #####################
 url_releases="https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest"
 
-url_asset="$(curl -s $url_releases | jq -r .assets[0].browser_download_url)"
+url_asset="$(curl -sfL $url_releases | jq -r .assets[0].browser_download_url)"
+if [ -z "$url_asset" ] || [ "$url_asset" = "null" ]; then
+    echo "Error: could not fetch download URL from Gitea releases"
+    exit 1
+fi
 tempdir=$(mktemp -d)
 cd $tempdir
 
-curl -s -O $url_asset
-echo $url_asset
-filename=$(basename $url_asset)
+curl -sfL -O "$url_asset"
+echo "$url_asset"
+filename=$(basename "$url_asset")
 tar -xzf $filename
 
 dirname=$(basename "$filename" .tar.gz)
@@ -94,7 +98,7 @@ cd $dirname
 sudo install -m 0755 -o root -g root -t /usr/local/bin bal-server
 sudo install -m 0755 -o root -g root -t /usr/local/bin bal-pusher
 
-sudo adduser --gecos "" --disabled-password bal
+id bal >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password bal
 printf "$bal_server_conf" | sudo -u bal tee "/home/bal/bal-server.env" > /dev/null
 sudo chmod 600 /home/bal/bal-server.env
 printf "$bal_pusher_conf" | sudo -u bal tee "/home/bal/bal-pusher.env" > /dev/null
@@ -202,7 +206,7 @@ sudo systemctl restart bal-pusher.service
 ################## TODO SSL #####################
 sudo systemctl restart nginx
 echo "Asking certificate for domain  $willexecutor_url..."
-sudo certbot certonly --standalone --non-interactive --agree-tos --email $email -d $willexecutor_url
+sudo certbot --nginx --non-interactive --agree-tos --email $email -d $willexecutor_url
 
 if [ -n "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" ]; then
     sudo openssl x509 -in "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" -noout -text | grep -E "Issuer:|Subject:|Not Before:|Not After :"
@@ -247,7 +251,7 @@ EOF
 )
 
 printf "$nginx_reverse_proxy" | sudo tee "/etc/nginx/sites-available/$willexecutor_url" > /dev/null
-#sudo ln -s /etc/nginx/sites-available/$willexecutor_url /etc/nginx/sites-enabled/
+sudo ln -s "/etc/nginx/sites-available/$willexecutor_url"  "/etc/nginx/sites-enabled/" || true
 sudo systemctl restart nginx
 
 rm -r $tempdir