Document the api layer's operational models, and fix two headers that had gone stale against the code

Plugin/unraid/api/media.php

@@ -4,12 +4,19 @@
 //   Active media sessions endpoint. Normalised now-playing across every Emby, Jellyfin and
 //   Plex instance configured for this host, for the monitor page's session panel.
 //
+// OPERATIONAL MODEL
+//   Local is the default and stays the cheap path: one call per media server configured on this
+//   host. Mesh adds one bounded SSH hop per partner and is only requested while the operator is
+//   looking at the mesh view, so a dashboard left open on the default costs exactly what it did
+//   before the scope existed.
+//
 // DESIGN PRINCIPLES
 //   Thin transport. Discovery, per-server API dialects and normalisation all live in
 //   include/media.php; this file only sets the content type and encodes the result.
 //
-//   No parameters. Which servers to ask is derived from conf, not from the request, so the
-//   browser cannot point this endpoint at an arbitrary URL.
+//   The request chooses a scope, never a target. scope= selects local or mesh; which servers
+//   are asked, and which partners the mesh hop reaches, are both derived from conf. The browser
+//   can widen what it asks for, but it cannot point this endpoint at an arbitrary URL.
 //
 // OPERATIONAL SAFEGUARDS
 //   Bounded by the library's 3s per-request timeout.
@@ -25,18 +32,16 @@
 //   messages a client.
 //
 // REQUEST
-//   GET, no parameters
-//
-// RESPONSE
-//   vv_media_sessions() verbatim — a flat list of normalised sessions across all servers
-//
-// REQUEST
 //   GET                 this host's sessions
 //   GET ?scope=mesh     every node's sessions, each row tagged with the host it is playing on
 //
-//   Local is the default and stays the cheap path: one call per configured media server here.
-//   Mesh adds one bounded SSH hop per partner and is only requested while the operator is looking
-//   at the mesh view, so a dashboard left open on the default costs exactly what it did before.
+// RESPONSE
+//   local  {"scope":"local","sessions":[…],"server_names":[…],"server_count":N}
+//   mesh   {"scope":"mesh","nodes":[…],"sessions":[…],"server_names":[…],"server_count":N}
+//
+//   sessions is the normalised list; in the mesh scope each row also carries the host it is
+//   playing on. server_count counts media servers, not sessions. There is no error shape — an
+//   unreachable server contributes nothing; see OPERATIONAL SAFEGUARDS.
 //
 // DEPENDS ON
 //   include/media.php   vv_media_sessions(), vv_media_sessions_mesh()