Route every conf writer through the guarded path

Eleven call sites wrote master.conf with tmp+rename and nothing else — no backup, no
parse check, no audit — including the two toggles the UI uses most and the raw editor
that installs a whole hand-edited file.

Plugin/unraid/api/setup.php

@@ -120,6 +120,7 @@
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/config.php';
+require_once dirname(__DIR__) . '/include/confform.php';
 
 $action = ($_SERVER['REQUEST_METHOD'] === 'GET')
     ? trim($_GET['action'] ?? '')
@@ -277,7 +278,10 @@ if ($action === 'pull') {
                 '${1}"' . $sshKey . '"', $conf);
             $conf = preg_replace('/^(\s*' . $hostId . '_STORAGE_MODE_INTERNAL\s*=\s*)\S+/m',
                 '${1}' . $storageInternal2, $conf);
-            vv_write_conf_raw($confFile, $conf);
+            // allowCreate: this is first-run setup, so the host conf does not exist yet. There
+            // is no prior content to back up, and a candidate that fails bash -n is removed
+            // rather than restored.
+            vv_conf_edit($confFile, fn(): string => $conf, [], ["{$hostId}_SSH_KEY"], true);
         }
     }
 
@@ -313,6 +317,9 @@ if (!preg_match('/^host\d+$/', $mySlot)) {
 
 // Write HOST1 / HOST2 into master.conf
 $master = vv_read_conf_raw('master.conf');
+// Captured before the substitutions below — the write compares against it so a master.conf that
+// changed while setup was being filled in is not silently overwritten.
+$origMaster = $master;
 if ($master === '') {
     echo json_encode(['ok' => false, 'error' => 'master.conf not found — check SCRIPTS_DIR in varaverk.cfg']);
     exit;
@@ -333,7 +340,8 @@ if ($slotNum > 2 && !empty($myHostname)) {
     }
 }
 
-if (!vv_write_conf_raw('master.conf', $master)) {
+if (!vv_conf_edit('master.conf', fn(string $cur): ?string => $cur === $origMaster ? $master : null,
+                  [], ['HOST1', 'HOST2'])) {
     echo json_encode(['ok' => false, 'error' => 'Failed to write master.conf']);
     exit;
 }
@@ -368,7 +376,8 @@ if (!file_exists(CONF_DIR . '/' . $confFile)) {
             '${1}"' . $sshKeyPath . '"', $conf);
         $conf = preg_replace('/^(\s*' . $hostId . '_STORAGE_MODE_INTERNAL\s*=\s*)\S+/m',
             '${1}' . $storageInternal, $conf);
-        if (!vv_write_conf_raw($confFile, $conf)) {
+        // allowCreate — see the sibling write above; this is the same first-run create.
+        if (!vv_conf_edit($confFile, fn(): string => $conf, [], ["{$hostId}_SSH_KEY"], true)) {
             echo json_encode(['ok' => false, 'error' => "Failed to write $confFile"]);
             exit;
         }