Document the PHP api layer and fix what documenting it exposed

Writing down what each endpoint actually guarantees made the places it
didn't obvious — shell arguments reaching a crontab or a bash -c
unescaped, master.conf written without tmp+rename, and conf edits that
could be saved without ever being parsed.

Plugin/unraid/api/fallback.php

@@ -1,4 +1,41 @@
 <?php
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// PURPOSE
+//   Fallback data endpoint. One JSON document describing every node's fallback picture —
+//   state, tier activation, handback strikes, covered container status — for the fallback
+//   tab's 30s poll.
+//
+// DESIGN PRINCIPLES
+//   Thin transport. Every judgement about what a state file means lives in
+//   include/fallback.php. This file exists to give the browser a URL.
+//
+//   No parameters. There is exactly one answer to "what is the fallback state", so the
+//   endpoint takes no input and has no branch that can be asked for the wrong thing.
+//
+// OPERATIONAL SAFEGUARDS
+//   Read-only by construction.
+//       There is no code path here that writes a state file, starts a container, or forces a
+//       tier. Failover and handback are driven by fallback.sh reacting to real reachability;
+//       a browser request is exactly the wrong way to enter either state.
+//
+//   Unknown is passed through, never smoothed into NORMAL.
+//       vv_fb_all() reports a missing or unparseable state file as empty rather than healthy.
+//       This endpoint encodes that verbatim instead of substituting a default, because
+//       claiming NORMAL for a fallback process that is not running is the worst available lie.
+//
+//   A dark partner degrades the payload, never fails it.
+//       Remote SSH failures inside vv_fb_all() return empty, so the node this page exists to
+//       diagnose cannot take the page down with it.
+//
+// REQUEST
+//   GET, no parameters
+//
+// RESPONSE
+//   vv_fb_all() verbatim — per-node state, tiers, strikes and covered container status
+//
+// DEPENDS ON
+//   include/fallback.php   vv_fb_all()
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/fallback.php';
 echo json_encode(vv_fb_all());