CurseForge token fetch + decrypt block copy-pasted 7x across two modules, timeouts drifting

[aradanmn]

The token.enc download + openssl decrypt + cleanup sequence is duplicated at 7 sites despite a consolidated helper already existing:

• modules/mod_management.sh: check_curseforge_mod (~283), resolve_curseforge_dependencies (~687), resolve_curseforge_dependencies_api (~852), fetch_and_add_external_mod (~1041), get_curseforge_download_url (~1141), get_curseforge_api_token (~1262 — the intended single home)
• modules/version_management.sh: check_mod_version_compatibility (~211)

The copies have already drifted (timeout 10 curl vs plain curl vs wget variants), and every site fails soft with || true, so a missed edit surfaces as "mods mysteriously reported incompatible" rather than an error. Any change to the fetch/decrypt mechanics requires 7 synchronized edits.

Fix: route all 6 other sites through get_curseforge_api_token() and move it to a shared utility so version_management.sh can use it too. (Verified 2026-07-05: 7 occurrences via grep. Plan ref: Part 5 item D2.)

[aradanmn]

Scope decision (owner, 2026-07-10): the CurseForge token-fetch dedup planned as PR 3 commit 6 of #45 is DEFERRED to the BYOK branch (wip/curseforge-byok), which rewrites the token scheme entirely — deduplicating the token.enc fetch here would polish code that branch deletes and manufacture rebase conflicts for it. PR #81 lands the rest of the installer globals block; the API-base/URL constants it defines are ready for mod_management.sh to consume when BYOK lands.

[aradanmn]

Fixed via PR #92 (merge 2d5d321), Deck-validated 2026-07-17 — full validation record on the PR (runtime 4-up + hot-add reflow, burst launch, installer 26.1.2 pass, 4-player Paper server join).