fix: validate sudo access upfront in install.sh and update mode

- Added sudo -v at start of both fresh install and update mode
- Caches sudo credentials so subsequent sudo_if calls don't prompt
- If sudo is unavailable, shows clear error message
- Prevents 'Access denied' on systemctl restart

install.sh

@@ -48,6 +48,11 @@ if [ "${1:-}" = "-update" ]; then
     echo "  ╚═══════════════════════════════════════╝"
     echo ""
 
+    # Cache sudo credentials upfront so subsequent sudo_if calls don't prompt.
+    if [ "$EUID" -ne 0 ]; then
+        sudo -v 2>/dev/null || { err "This update requires sudo access. Please run: sudo ./install.sh -update"; exit 1; }
+    fi
+
     if [ ! -d "$INSTALL_DIR" ]; then
         err "$INSTALL_DIR does not exist. Run install.sh without -update first."
         exit 1
@@ -123,6 +128,11 @@ echo "  ║       ReceiptNext Installer           ║"
 echo "  ╚═══════════════════════════════════════╝"
 echo ""
 
+# Cache sudo credentials upfront.
+if [ "$EUID" -ne 0 ]; then
+    sudo -v 2>/dev/null || { err "This installer requires sudo access. Please run: sudo ./install.sh"; exit 1; }
+fi
+
 # ── Install dependencies ───────────────────────────────────────────
 if ! command -v git &>/dev/null; then
     info "Installing git..."