PHP app layer: consolidate common functions, fix critical bugs, standardize patterns

Consolidations (config.php gains 5 shared utilities):
- vv_format_uptime() replaces 4 inline uptime-formatting blocks
- vv_parse_conf_scalar() replaces vv_arr_scalar/vv_wd_scalar/vv_fb_scalar/vv_media_conf_scalar
- vv_known_hosts() replaces vv_arr_known_hosts/vv_fb_known_hosts + inline parser in watchdog
- vv_parse_kv_db() replaces inline key=value parsing in snapshot and monitor
- vv_local_ip() replaces duplicate in docker_folders.php and inline in docker.php
All module-level function names kept as thin aliases so call sites unchanged.

Critical bug fixes:
- api/system.php: added require_once config.php and POST-only guard (no auth on shutdown)
- api/movescript.php + reorderarray.php: use vv_write_conf_raw (atomic) + vv_push_master_conf
- api/snapshot.php: share /tmp/vv_cpu_stat.json with vv_cpu_per_core() instead of own state file

Correctness:
- vv_cpu_per_core() and vv_network_stats(): atomic tmp+rename for state files (concurrent poll safety)
- ext_ip curl cache moved from /tmp/vv_ext_ip.cache to vv_cache_read/write (canonical cache dir)
- monitor_remote.php + board.php + snapshot.php: all use vv_cache_read/write instead of ad-hoc /tmp files

HTTP method guards added to write-only APIs that were missing them:
- api/scheduler.php, conf_toggle.php, flag_toggle.php

Plugin/unraid/include/config.php

@@ -312,3 +312,57 @@ function vv_cache_write(string $key, array $data): void {
     file_put_contents($tmp, json_encode($data));
     rename($tmp, $f);
 }
+
+// ── Shared utility functions (used across include/ and api/ files) ────────────
+
+// Format seconds into "2d 3h 15m".
+function vv_format_uptime(int $seconds): string {
+    $d = intdiv($seconds, 86400);
+    $h = intdiv($seconds % 86400, 3600);
+    $m = intdiv($seconds % 3600, 60);
+    return ($d ? "{$d}d " : '') . ($h ? "{$h}h " : '') . "{$m}m";
+}
+
+// Parse a scalar value from raw conf text. Matches KEY="value" or KEY=value.
+// Identical logic was previously duplicated as vv_arr_scalar / vv_wd_scalar /
+// vv_fb_scalar / vv_media_conf_scalar — all reduce to this one regex.
+function vv_parse_conf_scalar(string $raw, string $key): string {
+    return preg_match('/^\s*' . preg_quote($key, '/') . '\s*=\s*"?([^"\n]*)"?/m', $raw, $m)
+        ? trim($m[1]) : '';
+}
+
+// Parse a key=value state file (e.g. fallback_state.db, partnership_state.db).
+// Returns ['key' => 'value', ...]. Lines without '=' are ignored.
+function vv_parse_kv_db(string $text): array {
+    $out = [];
+    foreach (explode("\n", $text) as $line) {
+        $line = trim($line);
+        if ($line === '' || $line[0] === '#') continue;
+        [$k, $v] = array_pad(explode('=', $line, 2), 2, '');
+        if ($k !== '') $out[trim($k)] = trim($v);
+    }
+    return $out;
+}
+
+// All configured hosts from master.conf as ['host1' => 'hostname', ...].
+// Canonical version — previously duplicated as vv_arr_known_hosts / vv_fb_known_hosts.
+function vv_known_hosts(): array {
+    $vars  = vv_conf_vars();
+    $hosts = [];
+    foreach ($vars as $k => $v) {
+        if (preg_match('/^HOST(\d+)$/', $k, $m) && $v !== '') {
+            $hosts['host' . $m[1]] = $v;
+        }
+    }
+    ksort($hosts);
+    return $hosts ?: ['host1' => 'HOST1'];
+}
+
+// Local LAN IP via routing table — static-cached per request.
+// Previously duplicated in include/docker_folders.php and inline in include/docker.php.
+function vv_local_ip(): string {
+    static $ip = null;
+    if ($ip !== null) return $ip;
+    $ip = trim(shell_exec("ip route get 8.8.8.8 2>/dev/null | awk '/src/{for(i=1;i<=NF;i++)if(\$i==\"src\")print \$(i+1)}'") ?? '');
+    return $ip;
+}