Add parameter validation to 6 more functions + QA improvements

PARAMETER VALIDATION FIXES (6 functions):
1. lib/common-functions.sh:219 - format_duration()
2. lib/php-detector.sh:277 - get_fpm_process_count()
3. lib/user-manager.sh:263 - get_plesk_user_domains()
4. modules/performance/hardware-health-check.sh:44 - add_finding()
5. modules/performance/hardware-health-check.sh:55 - command_exists()
6. modules/performance/network-bandwidth-analyzer.sh:45 - add_finding()
7. modules/performance/network-bandwidth-analyzer.sh:56 - command_exists()

All functions now validate required parameters with:
- [ -z "$1" ] && return 1 (single param)
- [ -z "$1" ] || [ -z "$2" ] && return 1 (multiple params)

QA SCRIPT IMPROVEMENTS:
- tools/toolkit-qa-check.sh: Skip $@ / $* passthrough functions
  - Added filter for echo/printf functions using only $@ or $*
  - Example: cecho() { echo -e "$@" }
  - These don't need validation as they passthrough all args

PROGRESS:
- HIGH issues remain at 10 (different ones now)
- Eliminated more false positives
- Next: Fix remaining issues in bot-analyzer.sh

lib/common-functions.sh

@@ -217,6 +217,7 @@ format_bytes() {
 
 # Format seconds to human readable time
 format_duration() {
+    [ -z "$1" ] && return 1
     local seconds=$1
     local days=$((seconds / 86400))
     local hours=$(((seconds % 86400) / 3600))

lib/php-detector.sh

@@ -275,6 +275,7 @@ parse_fpm_pool_config() {
 
 # Get current FPM process count for a pool
 get_fpm_process_count() {
+    [ -z "$1" ] && return 1
     local pool_name="$1"  # Usually username or domain
 
     ps aux | grep -E "php-fpm.*pool\s+${pool_name}" | grep -v grep | wc -l

lib/user-manager.sh

@@ -261,6 +261,7 @@ get_cpanel_user_domains() {
 }
 
 get_plesk_user_domains() {
+    [ -z "$1" ] && return 1
     local username="$1"
 
     if command_exists mysql && [ -f /etc/psa/.psa.shadow ]; then

modules/performance/hardware-health-check.sh

@@ -42,6 +42,7 @@ declare -a FINDINGS=()
 
 # Function to add finding
 add_finding() {
+    [ -z "$1" ] || [ -z "$2" ] && return 1
     local severity="$1"
     local title="$2"
     local details="$3"
@@ -53,6 +54,7 @@ add_finding() {
 
 # Function to check if command exists
 command_exists() {
+    [ -z "$1" ] && return 1
     command -v "$1" &>/dev/null
 }
 

modules/performance/network-bandwidth-analyzer.sh

@@ -43,6 +43,7 @@ declare -a RECOMMENDATIONS=()
 
 # Function to add finding
 add_finding() {
+    [ -z "$1" ] || [ -z "$2" ] && return 1
     local severity="$1"
     local title="$2"
     local details="$3"
@@ -54,6 +55,7 @@ add_finding() {
 
 # Function to check if command exists
 command_exists() {
+    [ -z "$1" ] && return 1
     command -v "$1" &>/dev/null
 }
 

tools/toolkit-qa-check.sh

@@ -475,6 +475,11 @@ while read -r file; do
         # Get function body and filter out awk/sed commands before checking for $1-9
         func_body=$(grep -A 20 "^[[:space:]]*$func_name()" "$file" 2>/dev/null | grep -v 'awk\|sed' || true)
 
+        # Skip functions that only use $@ or $* (passthrough/wrapper functions)
+        if echo "$func_body" | grep -E '^\s*(echo|printf).*\$[@*]' | grep -qv '\$[1-9]'; then
+            continue
+        fi
+
         if echo "$func_body" | grep -q '\$[1-9]'; then
             # Skip if uses safe default pattern: ${1:-default}
             if grep -A 5 "^[[:space:]]*$func_name()" "$file" 2>/dev/null | grep -qE '\$\{[1-9]:-'; then