Add structured headers to the PHP pages layer

Documents each tab's purpose, what it renders, and which endpoints it polls.
Pages that start with markup get the header in a <?php ?> block so it never
reaches the browser.

Also corrects the layer diagram in README-unraid.md: eight of eleven pages hold
no PHP logic and poll api/ for everything — only auth, monitor and scheduler
require an include/ file directly.

Plugin/unraid/pages/auth.php

@@ -1,3 +1,47 @@
+<?php
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// PURPOSE
+//   Auth tab. Manages the stack sitting in front of every protected hostname — NPM proxy
+//   hosts and certificates, LLDAP users and groups, and Authelia access-control rules.
+//
+// OPERATIONAL MODEL
+//   The most consequential page in the UI. A wrong edit here does not render badly, it locks
+//   people out of every service or exposes one that should be protected.
+//
+// DESIGN PRINCIPLES
+//   Requires include/auth.php directly rather than going through an endpoint for everything.
+//       Server-rendered for the initial state, with api/auth.php handling mutations. The
+//       credentials involved never reach the browser either way.
+//
+//   Only the owner host edits auth config.
+//       Changes are made here and reach the partner through Critical-Data sync, not by the
+//       browser writing to two hosts. One source of truth, one direction of travel.
+//
+//   Authelia rules are edited as a block, preserving the rest of the YAML untouched.
+//
+// OPERATIONAL SAFEGUARDS
+//   Every destructive action is confirmed — deleting a user, removing a proxy host, or
+//   rewriting the rule set are all one click away from locking out a household.
+//
+//   Rule writes are atomic and refuse a missing config. include/auth.php writes to a temp
+//   file and renames; a missing configuration.yml is an error, never a freshly created file
+//   with a permissive default policy.
+//
+//   Certificate state is read-only here. Renewal is owned by the cert monitor.
+//
+//   All values render escaped — usernames, domains and rule fields are attacker-adjacent
+//   strings by definition on this page.
+//
+// RENDERS
+//   NPM proxy host list and editor, certificate status
+//   LLDAP user and group management
+//   Authelia access-control rules and default policy
+//
+// DEPENDS ON
+//   include/auth.php  required directly for initial render
+//   api/auth.php      mutations
+//   api/cert.php      certificate status
+?>
 <style>
 /* ── Toolbar ─────────────────────────────────────────────────────────────── */
 .vv-au-toolbar  { display:flex;align-items:center;gap:8px;margin-bottom:12px;flex-wrap:wrap; }