feat(wipe): opt-in multi-pass overwrite (WIPE_OVERWRITE_ROUNDS)

[Avicennasis]

Summary

Resolves #49427 (follow-up from #48091/FR-099). Adds an optional stricter-than-NIST multi-pass overwrite for random-overwrite wipe methods (HDD, USB flash, frozen-SSD fallback).

The default stays 1 pass — NIST SP 800-88 Rev. 1 compliant — so behavior is unchanged unless an operator opts in. SSD erase/crypto methods are unaffected.

Per the chosen "Both" config design, the pass count resolves in this precedence order (highest first):

1. WIPE_OVERWRITE_ROUNDS environment variable
2. ssr.overwrite-rounds=N on the kernel cmdline (parsed like the existing ssr.include-usb)
3. WIPE_OVERWRITE_ROUNDS=N in the baked /wipe.env on the FAT32 root
4. default 1

Only positive integers are accepted; an invalid value at one source is warned about and the next source is tried, so a bad value never silently drops the pass count (0 is rejected).

Changes

• resolve_overwrite_rounds() + overwrite_rounds_for_type() in wipe-lib.sh; the three nwipe overwrite invocations now use --rounds="$rounds" (erase branches untouched).
• Effective pass count recorded per drive in the JSON audit as overwrite_rounds (null for erase/crypto), in both the wizard (append_drive_audit) and eWaste (wipe-now.sh) paths.
• New config/wipe.env, baked onto the FAT32 root by build-wipe-usb.sh (both block-device and image write paths).
• docs/usage.md documents the tunable + the NIST "single pass is sufficient" note.

Note: my original ticket said config/default.env, but that file is never baked onto the wipe image — so this uses a dedicated config/wipe.env (+ cmdline + env) instead, confirmed with the requester.

Testing

• New tests/test_overwrite_rounds.sh (16 cases): precedence, validation/fall-through (invalid env→cmdline→file→default, zero rejected), and the audit mapping. Sources are overridable via WIPE_CMDLINE_FILE/WIPE_CONFIG_FILE for hermetic testing.
• Full local suite green; audit JSON validated with both null and integer overwrite_rounds; shellcheck --severity=warning adds no new warnings (the 3 pre-existing YELLOW/CYAN/remainder remain); bash -n clean on all touched scripts.

Frozen-SSD caveat

A frozen sata-ssd falls back to overwrite at runtime, but the audit classifies by nominal method, so that exceptional path records overwrite_rounds: null. Documented in a code comment; not worth runtime plumbing here.