Document the PHP api layer and fix what documenting it exposed

Writing down what each endpoint actually guarantees made the places it
didn't obvious — shell arguments reaching a crontab or a bash -c
unescaped, master.conf written without tmp+rename, and conf edits that
could be saved without ever being parsed.

Plugin/unraid/include/config.php

@@ -476,7 +476,12 @@ function vv_auto_create_api_key(string $hostId, string $confFile): array {
     if (!file_exists($script)) {
         return ['ok' => false, 'error' => 'unraid_api_key_renew.sh not found'];
     }
-    exec('bash ' . escapeshellarg($script) . ' 2>&1', $out, $rc);
+    // set_time_limit() does not cover exec() time on Linux, so the bound has to be external —
+    // otherwise a stalled unraid-api call holds a php-fpm worker open indefinitely.
+    exec('timeout 120 bash ' . escapeshellarg($script) . ' 2>&1', $out, $rc);
+    if ($rc === 124) {
+        return ['ok' => false, 'error' => 'Key renewal timed out after 120s'];
+    }
     if ($rc !== 0) {
         $msg = implode(' ', array_filter(array_map('trim', $out)));
         return ['ok' => false, 'error' => $msg ?: 'Script failed'];