Document the PHP api layer and fix what documenting it exposed

Writing down what each endpoint actually guarantees made the places it
didn't obvious — shell arguments reaching a crontab or a bash -c
unescaped, master.conf written without tmp+rename, and conf edits that
could be saved without ever being parsed.

Plugin/unraid/include/scheduler.php

@@ -579,7 +579,9 @@ function vv_conf_flag_set(string $name, bool $value): bool {
         $content, -1, $count
     );
     if (!$count) return false;
-    return file_put_contents($confPath, $new) !== false;
+    // tmp+rename — every script sources master.conf, so a truncated write here is a
+    // system-wide outage, not a lost toggle.
+    return vv_write_conf_raw('master.conf', $new);
 }
 
 // Comment or uncomment a script's line in the first master.conf array that contains it.
@@ -607,7 +609,9 @@ function vv_conf_toggle_script(string $rel, bool $enable): bool {
     }
     unset($line);
     if (!$changed) return true;
-    return file_put_contents($confPath, implode('', $lines)) !== false;
+    // tmp+rename — every script sources master.conf, so a truncated write here is a
+    // system-wide outage, not a lost toggle.
+    return vv_write_conf_raw('master.conf', implode('', $lines));
 }
 
 // Parse an orchestrator script to find which child scripts it calls.