Document the PHP api layer and fix what documenting it exposed

Writing down what each endpoint actually guarantees made the places it
didn't obvious — shell arguments reaching a crontab or a bash -c
unescaped, master.conf written without tmp+rename, and conf edits that
could be saved without ever being parsed.

Plugin/unraid/README-unraid.md

@@ -112,6 +112,39 @@ be the reason a page fails to load.
 
 ---
 
+## ━━━ WHAT GUARDS THE API LAYER ━━━
+
+Every endpoint under `api/` is protected by exactly one thing: **the Unraid WebGUI session.**
+Anything that can reach `/plugins/varaverk/api/*.php` with a valid session can do everything
+this plugin can do — stop the array, power off the host, write `master.conf` and push it to
+every partner, create an lldap user, write and schedule a root-run script.
+
+That is the same trust level as the rest of the WebGUI, and it is the intended model. It is
+written down here because two things about it are easy to assume and wrong.
+
+**No endpoint validates a CSRF token.** `pages/partnership.php` and `pages/scheduler.php` send
+Unraid's `csrf_token` with their POSTs, which reads like the token is checked somewhere. It is
+not — no file in `api/` looks at it. A request that arrives with a logged-in session cookie is
+honoured whatever caused the browser to send it. Adding validation is a worthwhile hardening
+pass, but it is a real change: every caller has to send the token before any endpoint requires
+it, or the UI breaks silently on whichever page was missed. Do it deliberately, in one pass,
+with the pages open — not opportunistically while touching one endpoint.
+
+**`api/webhook.php` is the exception that authenticates nothing at all.** It exists to receive
+Sonarr/Radarr/Lidarr download events, which arrive from a container rather than a browser.
+`master.conf` carries a `WEBHOOK_SECRET` and the standalone Node listener on `WEBHOOK_PORT`
+validates it — this WebGUI-hosted path does not. Injection is not the risk (the path is
+validated and escaped); triggering work is. Closing it means adding a secret check here **and**
+updating the webhook URL in each arr's settings, in that order.
+
+Two further endpoints are worth knowing about because they read wider than the rest:
+`api/api_test.php` returns an API key prefix and the live GraphQL schema, and
+`api/import_script.php`'s browse action and `api/manual_sync.php`'s browse actions list
+directory names anywhere on either host. All three are read-only and none return file contents,
+but they are the ones to look at first if the session boundary ever moves.
+
+---
+
 ## ━━━ ARRAY LIFECYCLE HOOKS ━━━
 
 `event/` plugs Varaverk into Unraid's own array lifecycle. These are how the ecosystem starts