Route every conf writer through the guarded path

Eleven call sites wrote master.conf with tmp+rename and nothing else — no backup, no
parse check, no audit — including the two toggles the UI uses most and the raw editor
that installs a whole hand-edited file.

Plugin/unraid/api/flag_toggle.php

@@ -48,9 +48,12 @@
 //       missing, malformed, or unexpected parameter disables rather than enables. Failing
 //       toward off is the safe direction for a flag that starts data movement.
 //
-//   The conf write is atomic.
-//       vv_conf_flag_set() writes through vv_write_conf_raw() (tmp + rename). Every script
-//       sources master.conf, so a truncated write would be a system-wide outage.
+//   The conf write is atomic, backed up, verified and logged.
+//       vv_conf_flag_set() goes through vv_conf_edit(), the one guarded conf write path: an
+//       exclusive lock, a timestamped copy into CONF_BACKUP_DIR, bash -n on the candidate,
+//       tmp + rename to install it, then the file is sourced and the flag read back — a value
+//       that does not come back as asked restores the backup. Every script sources master.conf,
+//       so a truncated or unparseable write would be a system-wide outage.
 //
 //   The push only happens after a confirmed local write.
 //       Guarded on $ok, so a failed edit cannot distribute a stale or partly-written conf to
@@ -69,7 +72,7 @@
 //    "push":[]}
 //
 // DEPENDS ON
-//   include/scheduler.php   vv_conf_flag_set() → vv_write_conf_raw()
+//   include/scheduler.php   vv_conf_flag_set() → vv_conf_edit() → vv_write_conf_raw()
 //   include/config.php      vv_push_master_conf(), vv_push_setup_state()
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 header('Content-Type: application/json');