- lib/common.sh: add apt_lock_wait + apt_install + apt_update helpers
* waits up to 300s for dpkg lock held by unattended-upgrades
* uses DPkg::Lock::Timeout=120 native flag
* captures stderr to show real error if install fails
- lib/website.sh: install_nginx/install_certbot use apt_install
(fixes "Could not get lock /var/lib/dpkg/lock-frontend" during Pro setup)
- install.sh: bot_install uses apt_install (removes duplicated lock logic)
- lib/common.sh: ensure_deps uses apt_update + apt_install