setup_nodejs: restore the npm allowScripts bypass lost in the migration

[MickLesk]

✍️ Description

Restores the npm allowScripts bypass that was lost when setup_nodejs moved from ProxmoxVE misc/tools.func into lib/runtime.func.

npm 11 added allowScripts: dependency install hooks are skipped unless the package is covered, and npm still exits 0. Apps with native addons therefore "install" with nothing built. ProxmoxVE#16280 added the guard on 2026-08-08; this file had no occurrence of it at all. The line is copied back verbatim, in the same place.

Surfaced on n8n: update printed "Updated successfully!" and left the service dead with DriverPackageNotInstalledError, because sqlite3 fetches its binding from the skipped hook. 272 ct/ and install/ scripts call setup_nodejs, so every app with native addons was affected.

🔗 Related Issue

Fixes community-scripts/ProxmoxVE#16973

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – not run on a live container; verified bash -n and that the inserted line is byte-identical to ProxmoxVE misc/tools.func:7774.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
• API.txt regenerated – n/a, no signature changed and this repo has no API.txt.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any code in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Code was written without AI assistance.
• AI was used – The output has been reviewed and corrected, and I take responsibility for it matching this repo's conventions.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing behavior in a way that may require updates in every downstream script.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, docs/, CONTRIBUTING.md, or other docs.

[github-actions]

Try this branch

The engine and the scripts resolve independently, so a production script can
be run against the engine from this PR by setting one variable:

COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/community-scripts/core/fix/npm-allow-scripts-policy \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/debian.sh)"

Swap ct/debian.sh for whatever exercises the change.

Run a script from a fork as well

curl -fsSL https://raw.githubusercontent.com/community-scripts/core/fix/npm-allow-scripts-policy/tools/run.sh |
  bash -s -- https://raw.githubusercontent.com/YOU/ProxmoxVED/your-branch ct/debian.sh \
             https://raw.githubusercontent.com/community-scripts/core/fix/npm-allow-scripts-policy

Note that run.sh is reached through a pipe, so the script it starts inherits
an exhausted stdin. Whiptail is fine — it opens /dev/tty — but a plain read
would see EOF. The single-variable form above does not have that problem.

Useful flags while testing

dev_mode=net logs every engine fetch with status and duration, which is the
quickest way to confirm the branch is really being used. dev_mode=keep stops a
failed build from deleting the container along with the evidence.