Give the rest of the conf a place to be changed

A third of the settings had no control anywhere, so the answer to "where do I
change this" was to open a file over SSH.

Plugin/unraid/include/confform.php

@@ -107,6 +107,14 @@ const VV_UI_SECTION_SURFACES = [
         'tab'   => 'AI',
         'route' => 'AI tab → Settings → Configuration',
     ],
+    // Everything that is not structurally excluded. The catch-all exists so no ordinary setting
+    // is reachable only by editing a file — a settings page whose answer to a third of the conf
+    // is "open it over SSH" is not a settings page.
+    [
+        'match' => '*',
+        'tab'   => 'Settings',
+        'route' => 'Settings tab → All settings',
+    ],
     [
         'match' => 'partnership',
         'tab'   => 'Partnership',
@@ -116,6 +124,30 @@ const VV_UI_SECTION_SURFACES = [
     ],
 ];
 
+// Sections deliberately kept out of every settings surface, and why. Not a security boundary —
+// vv_conf_edit() still guards the write and the raw editor can still reach them. This is about
+// what belongs in a form: these hold the machine's identity and the roots everything else is
+// derived from, and a text box next to a Save button is the wrong shape for a value that decides
+// whether the server recognises itself on next boot.
+//
+// The reason travels with the exclusion because the UI map prints it. "No route" invites someone
+// to add one; "no route, because changing this moves the entire data tree" does not.
+const VV_UI_SECTION_EXCLUDE = [
+    'HOST IDENTITIES' =>
+        'HOST1 and HOST2 are what detect_hosts() matches the local hostname against. Editing one '
+        . 'here would change which machine this believes it is.',
+    'SHARED HOST CONFIGURATION' =>
+        'DATA_DIR is the single on-disk root — move it and the whole tree follows, including the '
+        . 'state the running scripts are holding open.',
+    'Cache Roots' =>
+        'The tmpfs half. These must never point at flash, and nothing in a form conveys that.',
+    'State Files' =>
+        'Paths to live state databases, derived from STATE_DIR. Repointing one orphans the state '
+        . 'a watchdog is mid-way through writing.',
+    'GIT / REPO' =>
+        'Where the plugin updates itself from. Wrong here means the next pull is the last one.',
+];
+
 // Pages that edit named keys rather than whole sections — a purpose-built control for one
 // setting, not a form over a conf section. Only the route is declared: the keys themselves are
 // read out of the page source by Tools/ui_map_build.php, so a control added or removed changes