Route every conf writer through the guarded path

Eleven call sites wrote master.conf with tmp+rename and nothing else — no backup, no
parse check, no audit — including the two toggles the UI uses most and the raw editor
that installs a whole hand-edited file.

Plugin/unraid/api/conf_toggle.php

@@ -43,10 +43,17 @@
 //       outside one, so a matching string in a comment or an unrelated variable cannot be
 //       rewritten.
 //
-//   The write is atomic.
-//       vv_conf_toggle_script() writes through vv_write_conf_raw() (tmp + rename). Every
-//       script sources master.conf; a truncated write here would be a system-wide outage
-//       rather than a lost toggle.
+//   The write is atomic, backed up, verified and logged.
+//       vv_conf_toggle_script() goes through vv_conf_edit(), the one guarded conf write path:
+//       an exclusive lock, a timestamped copy into CONF_BACKUP_DIR, bash -n on the candidate,
+//       tmp + rename to install it, then the installed file is sourced to prove it still loads.
+//       There is no single key to read back for a commented array member, so a clean source is
+//       the whole assertion. Every script sources master.conf; a truncated or unparseable write
+//       here would be a system-wide outage rather than a lost toggle.
+//
+//   A script in no array writes nothing at all.
+//       The rewrite returns the contents unchanged, which reports success without taking a
+//       backup or touching the file. "Already in the requested state" is not a write.
 //
 // REQUEST
 //   POST id=<Category/script.sh>  enabled=0|1
@@ -56,7 +63,7 @@
 //   {"ok":false,"error":"POST only"|"Invalid id"|"Failed to write master.conf"}
 //
 // DEPENDS ON
-//   include/scheduler.php   vv_conf_toggle_script() → vv_write_conf_raw()
+//   include/scheduler.php   vv_conf_toggle_script() → vv_conf_edit() → vv_write_conf_raw()
 //   Configurations/master.conf   the *_SCRIPTS arrays
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 header('Content-Type: application/json');