Document the api layer's operational models, and fix two headers that had gone stale against the code

Plugin/unraid/api/readscript.php

@@ -4,6 +4,19 @@
 //   Script and document reader. Returns the full text of one .sh or .md file inside
 //   SCRIPTS_DIR — the source view behind the scheduler page's script viewer and the docs tab.
 //
+// OPERATIONAL MODEL
+//   Validate, resolve, read. The id is checked against a character class and an extension list
+//   before it is joined to SCRIPTS_DIR, so nothing reaches the filesystem that did not already
+//   look like a repo-relative path.
+//
+//   The whole file is returned in one response — no ranges, no pagination. These are scripts and
+//   documents, not logs; the largest is a few hundred kilobytes, and a viewer that had to stitch
+//   pages together would be more machinery than the thing it displays.
+//
+//   Every failure is a JSON body with ok:false, never an HTTP error code. The scheduler's viewer
+//   and the docs tab both parse the response before looking at anything else, so a 404 would
+//   surface as a parse failure rather than as "that file is not there".
+//
 // DESIGN PRINCIPLES
 //   Two extensions, one endpoint.
 //       Scripts and their READMEs are read the same way because they are read for the same