Add defensive newline filtering when writing passwords to config

CRITICAL FIX: Added robust newline stripping as a defensive measure
when writing passwords to the config file.

The Problem:
Even though prompt_password() was fixed to output to stderr, the
newline was still somehow getting into the PBS_PASSWORD variable
in some cases, causing the config file to be malformed.

The Solution (Defense in Depth):
Before writing PBS_PASSWORD to config file, explicitly strip all
newline and carriage return characters:

PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')

This ensures the password is always clean, regardless of how it
was captured or what's in the original variable.

Changes:
- pbs-client-installer.sh:
  - Line 298: Added newline filter in reconfigure_connection()
  - Line 593: Added newline filter in create_systemd_service()
  - Both use: tr -d '\n\r' to remove \n and \r characters

CHANGELOG.md:
- Updated to document defensive filtering approach
- Lists both functions that apply the filter

This is a belt-and-suspenders approach: we fix the source
(prompt_password) AND filter at write time for maximum safety.

Impact:
Config file will now ALWAYS have single-line passwords, even if
something goes wrong with password capture. This prevents the
"authentication failed - invalid credentials" error in the
backup service.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -50,8 +50,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - This was the root cause of "authentication hanging" issues
 - **CRITICAL**: Password/token capture no longer includes newline character
   - `prompt_password()` function now outputs formatting to stderr
+  - Added defensive newline stripping when writing config file
+  - Filters `\n` and `\r` characters from passwords using `tr -d '\n\r'`
   - Fixes "authentication failed - invalid credentials" in backup service
   - Config file now has properly formatted single-line passwords
+  - Applied to both `reconfigure_connection()` and `create_systemd_service()`
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned

pbs-client-installer.sh

@@ -293,10 +293,14 @@ reconfigure_connection() {
 
     # Update config file with new connection details
     log "Updating configuration file..."
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"
@@ -584,12 +588,15 @@ create_systemd_service() {
     
     # Create config directory
     mkdir -p "$CONFIG_DIR"
-    
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     # Save configuration
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"