PHP app layer: consolidate common functions, fix critical bugs, standardize patterns

Consolidations (config.php gains 5 shared utilities):
- vv_format_uptime() replaces 4 inline uptime-formatting blocks
- vv_parse_conf_scalar() replaces vv_arr_scalar/vv_wd_scalar/vv_fb_scalar/vv_media_conf_scalar
- vv_known_hosts() replaces vv_arr_known_hosts/vv_fb_known_hosts + inline parser in watchdog
- vv_parse_kv_db() replaces inline key=value parsing in snapshot and monitor
- vv_local_ip() replaces duplicate in docker_folders.php and inline in docker.php
All module-level function names kept as thin aliases so call sites unchanged.

Critical bug fixes:
- api/system.php: added require_once config.php and POST-only guard (no auth on shutdown)
- api/movescript.php + reorderarray.php: use vv_write_conf_raw (atomic) + vv_push_master_conf
- api/snapshot.php: share /tmp/vv_cpu_stat.json with vv_cpu_per_core() instead of own state file

Correctness:
- vv_cpu_per_core() and vv_network_stats(): atomic tmp+rename for state files (concurrent poll safety)
- ext_ip curl cache moved from /tmp/vv_ext_ip.cache to vv_cache_read/write (canonical cache dir)
- monitor_remote.php + board.php + snapshot.php: all use vv_cache_read/write instead of ad-hoc /tmp files

HTTP method guards added to write-only APIs that were missing them:
- api/scheduler.php, conf_toggle.php, flag_toggle.php

Plugin/unraid/include/fallback.php

@@ -7,15 +7,11 @@ require_once __DIR__ . '/partnership.php';   // vv_pt_ssh(), vv_pt_ts_peers()
 // ── Conf parsers ──────────────────────────────────────────────────────────────
 
 function vv_fb_bash_array(string $raw, string $varname): array {
-    if (!preg_match('/^\s*' . preg_quote($varname, '/') . '\s*=\s*\(\s*(.*?)\s*\)/ms', $raw, $m))
-        return [];
-    preg_match_all('/"([^"]*)"/', $m[1], $items);
-    return array_values(array_filter($items[1]));
+    return vv_parse_bash_array($raw, $varname);
 }
 
 function vv_fb_scalar(string $raw, string $varname): string {
-    return preg_match('/^\s*' . preg_quote($varname, '/') . '\s*=\s*"?([^"\n]*)"?/m', $raw, $m)
-        ? trim($m[1]) : '';
+    return vv_parse_conf_scalar($raw, $varname);
 }
 
 // ── State file ────────────────────────────────────────────────────────────────
@@ -90,16 +86,7 @@ function vv_fb_covers(string $covering, string $remote, string $coveringRaw, str
 // ── Known hosts ───────────────────────────────────────────────────────────────
 
 function vv_fb_known_hosts(): array {
-    $master = vv_read_conf_raw('master.conf');
-    preg_match_all('/^\s*(HOST(\d+))(?:_NAME)?\s*=\s*["\']?(\S+?)["\']?\s*$/m', $master, $m);
-    $hosts = [];
-    foreach ($m[1] as $i => $key) {
-        $num  = $m[2][$i];
-        $name = trim($m[3][$i]);
-        $hosts['host' . $num] = $name;
-    }
-    ksort($hosts);
-    return $hosts ?: ['host1' => 'HOST1'];
+    return vv_known_hosts();
 }
 
 // ── Main data builder ─────────────────────────────────────────────────────────