Auth stack certs tab, arrs db fallbacks, cert monitor cache, conf parser fix

- Auth stack: fold cert monitor into Auth Stack page as fourth tab (Certs);
  remove standalone cert page and top-level tab
- cert_monitor.sh: write JSON status cache to State_Files/cert_status.json
  after each run; expose per-domain days/expiry via _CERT_DAYS/_CERT_EXPIRY globals
- api/cert.php: new — serves cached cert status; falls back to configured
  domains as UNKN when no cache exists; POST action=run triggers live check
- arrs db fallbacks: vv_arr_cleanup_stats/discovery_stats/recovery_stats now
  read from data/*.db files when log JSON files don't yet exist
- config.php vv_conf_vars(): unescape bash \$ → $ so passwords with dollar
  signs read correctly from conf files
- host1.conf: fill in HOST1_NPM_USER/PASS and HOST1_LLDAP_USER/PASS
- Partnership adapter pattern: Unraid-specific container logic extracted to
  Plugin/unraid/Partnership/; platform-agnostic structure stays in Partnership/
- First-run wizard: uniform multi-step flow for all hosts; HOST2 pull moved
  to checklist; auto SSH keygen and API key creation on save
- api/checklist.php: live setup checklist with pull_master action
- Fullscreen toggle: hide Unraid header/menu; state persists via localStorage

Plugin/unraid/include/config.php

@@ -13,6 +13,7 @@ define('LOG_DIR',     '/var/log/varaverk');
 unset($_vv_cfg);
 
 define('VV_SETUP_STATE_FILE', STATE_DIR . '/varaverk_setup.db');
+define('VV_CACHE_DIR',        '/tmp/vv_cache');
 
 // Read the setup state file into a key=>value array.
 function vv_setup_state_read(): array {
@@ -202,7 +203,7 @@ function vv_conf_vars(): array {
         // Match: VAR_NAME="value" or VAR_NAME=value (no quotes)
         preg_match_all('/^\s*([A-Z0-9_]+)\s*=\s*["\']?([^"\'#\n]*?)["\']?\s*(?:#.*)?$/m', $raw, $m);
         foreach ($m[1] as $i => $key) {
-            $vars[$key] = trim($m[2][$i]);
+            $vars[$key] = str_replace('\\$', '$', trim($m[2][$i]));
         }
     }
     return $vars;
@@ -263,7 +264,7 @@ function vv_unraid_api_query(string $hostId, string $gql, int $timeoutSec = 5, s
     }
 
     if ($resp === false || $resp === '' || ($httpCode !== 0 && $httpCode !== 200)) {
-        @file_put_contents('/tmp/vv_api_debug.json', json_encode([
+        @file_put_contents(VV_CACHE_DIR . '/vv_api_debug.json', json_encode([
             'ts'        => time(),
             'host'      => $hostId,
             'url'       => $url,
@@ -278,7 +279,7 @@ function vv_unraid_api_query(string $hostId, string $gql, int $timeoutSec = 5, s
 
     // If the API returned GraphQL errors, log them for diagnosis.
     if (!empty($decoded['errors'])) {
-        @file_put_contents('/tmp/vv_api_debug.json', json_encode([
+        @file_put_contents(VV_CACHE_DIR . '/vv_api_debug.json', json_encode([
             'ts'        => time(),
             'host'      => $hostId,
             'url'       => $url,
@@ -294,8 +295,6 @@ function vv_unraid_api_query(string $hostId, string $gql, int $timeoutSec = 5, s
 
 // ── File-based API cache (/tmp/vv_cache — tmpfs, cleared on reboot) ───────────
 
-define('VV_CACHE_DIR', '/tmp/vv_cache');
-
 // Read a cached payload. Returns null if missing or older than $maxAge seconds.
 function vv_cache_read(string $key, int $maxAge = 90): ?array {
     $f = VV_CACHE_DIR . '/' . $key . '.json';
@@ -358,6 +357,38 @@ function vv_known_hosts(): array {
     return $hosts ?: ['host1' => 'HOST1'];
 }
 
+// Create (or overwrite) the Varaverk Unraid API key and write it into host conf.
+// Returns ['ok'=>true,'key_preview'=>'...'] or ['ok'=>false,'error'=>'...'].
+function vv_auto_create_api_key(string $hostId, string $confFile): array {
+    $varName = strtoupper($hostId) . '_UNRAID_API_KEY';
+    $output  = shell_exec('timeout 10 /usr/local/sbin/unraid-api apikey --name "Varaverk" --create --overwrite --description "Varaverk plugin" --roles ADMIN --json </dev/null 2>&1');
+    if (!$output) {
+        return ['ok' => false, 'error' => 'unraid-api returned no output'];
+    }
+    $data = json_decode(trim($output), true);
+    $key  = $data['key'] ?? null;
+    if (!$key) {
+        return ['ok' => false, 'error' => 'No key in response'];
+    }
+    $raw = vv_read_conf_raw($confFile);
+    if ($raw === '') {
+        return ['ok' => false, 'error' => 'Cannot read ' . $confFile];
+    }
+    if (!str_contains($raw, $varName)) {
+        foreach ([strtoupper($hostId) . '_OWNER_EMAIL', strtoupper($hostId) . '_SSH_KEY'] as $anchor) {
+            if (str_contains($raw, $anchor)) {
+                $raw = preg_replace('/^(\s*' . preg_quote($anchor, '/') . '\s*=.*$)/m',
+                    '$1' . "\n    " . $varName . '=""', $raw, 1);
+                break;
+            }
+        }
+    }
+    $raw = preg_replace('/^(\s*' . preg_quote($varName, '/') . '\s*=\s*)"[^"]*"/m',
+        '${1}"' . $key . '"', $raw);
+    vv_write_conf_raw($confFile, $raw);
+    return ['ok' => true, 'key_preview' => substr($key, 0, 8) . '...' . substr($key, -4)];
+}
+
 // Local LAN IP via routing table — static-cached per request.
 // Previously duplicated in include/docker_folders.php and inline in include/docker.php.
 function vv_local_ip(): string {