Add structured headers to the PHP include layer, fix monitor state paths

All 16 include/ files now carry PURPOSE / DESIGN PRINCIPLES / OPERATIONAL
SAFEGUARDS / EXPORTS / CONFIGURATION, keeping the first three section names
identical to the bash headers so retrieval can route across both languages.

monitor.php read six watchdog state files from /tmp while the watchdogs write
to STATE_DIR, so every strike set came back empty and the summary reported
healthy unconditionally. docs.php gained path containment before it is wired
to a page.

Plugin/unraid/include/docker.php

@@ -1,4 +1,50 @@
 <?php
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// PURPOSE
+//   Docker page backend. Owns Varaverk's container-folder grouping, builds the container
+//   inventory the page renders, and keeps the folder map in sync with host*.conf so the
+//   onboarding scripts see the same grouping.
+//
+// DESIGN PRINCIPLES
+//   Varaverk owns its own folder store.
+//       docker_folders.json is the primary record and has no external dependency. The
+//       folder.view3 plugin is synced to only when it is actually installed, so Varaverk's
+//       grouping survives that plugin being absent, removed, or reset.
+//
+//   The conf map is the interface to the scripts.
+//       HOST*_DOCKER_FOLDER_MAP is written so onboarding and partnership scripts can act on
+//       the same grouping the UI shows, without parsing a UI-owned JSON file.
+//
+//   Inventory is built from docker inspect in one pass.
+//       vv_dk_inspect_all() collects everything once rather than per-container, because this
+//       runs on every page load.
+//
+// OPERATIONAL SAFEGUARDS
+//   JSON writes are atomic.
+//       Written to .vv.tmp then rename()d into place, so a reader or a concurrent write never
+//       observes a truncated folder store — losing it would scatter every container back to
+//       ungrouped.
+//
+//   The optional folder.view3 sync is best-effort and never fatal.
+//       Its write is suppressed and its failure ignored. A second plugin's file must not be
+//       able to fail a Varaverk operation.
+//
+//   A missing store reads as empty, not as an error.
+//       First run and a deleted file behave identically — no folders yet, page renders.
+//
+// EXPORTS
+//   Store      vv_dk_read_json(), vv_dk_write_json(), vv_dk_gen_id()
+//   Conf map   vv_dk_read_conf_map(), vv_dk_write_conf_map(),
+//              vv_dk_sync_conf_to_json(), vv_dk_sync_json_to_conf()
+//   Folders    vv_dk_create_folder(), vv_dk_rename_folder(), vv_dk_delete_folder(),
+//              vv_dk_move_container()
+//   Inventory  vv_dk_all(), vv_dk_inspect_all(), vv_dk_webui(), vv_dk_icon()
+//
+// CONFIGURATION
+//   VV_DOCKER_JSON            /boot/config/plugins/varaverk/docker_folders.json — primary
+//   VV_FV3_JSON               folder.view3's docker.json — synced only if present
+//   HOST*_DOCKER_FOLDER_MAP   conf mirror consumed by the onboarding scripts
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
 // Docker tab — folder management and container inventory
 // Primary store: /boot/config/plugins/varaverk/docker_folders.json (Varaverk-owned, no external deps)
 // Optional sync: /boot/config/plugins/folder.view3/docker.json (only if folder.view3 is installed)