refactor: modular .bashrc.d/ structure

- Rewrite .bashrc as minimal loader (34 lines → loads .bashrc.d/*.sh)
- Clean .bash_profile: single source, Apple Silicon/Intel brew path
- Add .bashrc.d/ with 7 topic modules:
    00_env.sh      PS1, OSTYPE, colors, pyenv
    10_aliases.sh  universal aliases
    20_functions.sh proxy, dbash, git helpers
    30_work.sh     work-host detection, LDAP, AWX, Juniper tools
                   (+ unified-hub-login with env-var creds)
    40_k8s.sh      kubectl completion + aliases
    50_ai_env.sh   WORKSPACE/DATA_ROOT/MODEL_ROOT paths
    60_dotfiles.sh dotfiles manager aliases, zet shortcuts
- Secrets (SN_PASSWORD, LDAP bind PWs, Unified Hub token) moved
  to ~/.bashrc.local (gitignored, written by setup script)
- Update .dotfiles_manifest to track .bashrc.d directory

.bashrc.d/20_functions.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# 20_functions.sh — Universal shell functions, safe on all machines
+# ============================================================================
+
+# -----------------------------------------------------------------------
+# Proxy management
+# -----------------------------------------------------------------------
+function proxy_on() {
+    export no_proxy="localhost,127.0.0.1,localaddress,.localdomain.com"
+
+    if (($# > 0)); then
+        export http_proxy="http://$1/"
+        export https_proxy=$http_proxy
+        export ftp_proxy=$http_proxy
+        export rsync_proxy=$http_proxy
+        export HTTP_PROXY=$http_proxy
+        export HTTPS_PROXY=$http_proxy
+        echo "Proxy set to: $http_proxy"
+        return 0
+    fi
+
+    echo -n "username (leave blank if none): "
+    read -r username
+    local pre=""
+    if [[ $username != "" ]]; then
+        echo -n "password: "
+        read -rs password; echo
+        pre="$username:$password@"
+    fi
+
+    echo -n "server: "
+    read -r server
+    echo -n "port: "
+    read -r port
+
+    export http_proxy="http://${pre}${server}:${port}/"
+    export https_proxy=$http_proxy
+    export ftp_proxy=$http_proxy
+    export rsync_proxy=$http_proxy
+    export HTTP_PROXY=$http_proxy
+    export HTTPS_PROXY=$http_proxy
+    export FTP_PROXY=$http_proxy
+    export RSYNC_PROXY=$http_proxy
+    echo "Proxy environment set."
+}
+
+function proxy_off() {
+    unset http_proxy https_proxy ftp_proxy rsync_proxy
+    unset HTTP_PROXY HTTPS_PROXY FTP_PROXY RSYNC_PROXY
+    echo "Proxy environment cleared."
+}
+
+# -----------------------------------------------------------------------
+# Docker helpers
+# -----------------------------------------------------------------------
+function dbash() {
+    docker exec -it "$1" bash
+}
+
+function curl_time() {
+    curl -w "@curl-format.txt" -o /dev/null -s "$1"
+}
+
+# -----------------------------------------------------------------------
+# Git: prune merged/orphaned local branches
+# -----------------------------------------------------------------------
+function git-prune-branches() {
+    echo "🌿 Git Branch Cleanup"
+    echo "===================="
+    echo
+
+    if ! git rev-parse --git-dir >/dev/null 2>&1; then
+        echo "❌ Not in a git repository"; return 1
+    fi
+
+    local main_branch
+    main_branch=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')
+    [[ -z "$main_branch" ]] && main_branch="main"
+
+    echo "📡 Fetching and pruning..."
+    git fetch --all --prune
+    echo
+
+    local merged_branches
+    merged_branches=$(git branch --merged "$main_branch" | grep -v "^\*" | grep -v "$main_branch" | grep -v "master" || true)
+    echo "🗑️  Merged branches:"
+    if [[ -z "$merged_branches" ]]; then
+        echo "   (none)"
+    else
+        echo "$merged_branches"
+        echo
+        read -r -p "Delete merged branches? (y/N): " -n 1
+        echo
+        if [[ $REPLY =~ ^[Yy]$ ]]; then
+            echo "$merged_branches" | xargs -n 1 git branch -d
+            echo "✅ Deleted."
+        fi
+    fi
+
+    echo
+    local orphaned
+    orphaned=$(git branch -vv | grep ': gone]' | awk '{print $1}' || true)
+    echo "🗑️  Orphaned branches (remote deleted):"
+    if [[ -z "$orphaned" ]]; then
+        echo "   (none)"
+    else
+        echo "$orphaned"
+        echo
+        read -r -p "Delete orphaned branches? (y/N): " -n 1
+        echo
+        if [[ $REPLY =~ ^[Yy]$ ]]; then
+            echo "$orphaned" | xargs -n 1 git branch -D
+            echo "✅ Deleted."
+        fi
+    fi
+
+    echo
+    echo "📊 Remaining branches:"
+    git branch -vv
+    echo
+    echo "✨ Done."
+}
+
+# -----------------------------------------------------------------------
+# SSH key distribution helper
+# -----------------------------------------------------------------------
+function copy_pub_key() {
+    # Usage: copy_pub_key user@host
+    cat ~/.ssh/authorized_keys.kenjim-protected | \
+        ssh "$1" 'umask 0077; mkdir -p .ssh; cat >> .ssh/authorized_keys && echo "Key copied"'
+}