Document the PHP api layer and fix what documenting it exposed

Writing down what each endpoint actually guarantees made the places it
didn't obvious — shell arguments reaching a crontab or a bash -c
unescaped, master.conf written without tmp+rename, and conf edits that
could be saved without ever being parsed.

Plugin/unraid/api/media.php

@@ -1,4 +1,38 @@
 <?php
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// PURPOSE
+//   Active media sessions endpoint. Normalised now-playing across every Emby, Jellyfin and
+//   Plex instance configured for this host, for the monitor page's session panel.
+//
+// DESIGN PRINCIPLES
+//   Thin transport. Discovery, per-server API dialects and normalisation all live in
+//   include/media.php; this file only sets the content type and encodes the result.
+//
+//   No parameters. Which servers to ask is derived from conf, not from the request, so the
+//   browser cannot point this endpoint at an arbitrary URL.
+//
+// OPERATIONAL SAFEGUARDS
+//   Bounded by the library's 3s per-request timeout.
+//       A wedged media server cannot hold this endpoint open, because every fetch inside
+//       vv_media_sessions() carries a stream-context timeout. This is the only thing between
+//       a hung Emby and a poll that never returns.
+//
+//   Failure is an empty list, not an error.
+//       Unreachable servers, non-JSON bodies and unexpected shapes all resolve to [] inside
+//       the library. The panel renders empty and the rest of the monitor page is unaffected.
+//
+//   Read-only. Sessions are observed. Nothing here stops a stream, forces a transcode, or
+//   messages a client.
+//
+// REQUEST
+//   GET, no parameters
+//
+// RESPONSE
+//   vv_media_sessions() verbatim — a flat list of normalised sessions across all servers
+//
+// DEPENDS ON
+//   include/media.php   vv_media_sessions()
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/media.php';