Give conf writes a backup, a lock and a read-back before they count

These files are gitignored, so a bad write had nothing to go back to; the escaping order
also stored any value containing a quote truncated but still parseable, which only a
read-back can catch.

Deployment/master.conf.template

@@ -144,6 +144,8 @@
     AI_DATA_DIR="${DATA_DIR}/ai"
     CACHE_BACKUP_DIR="${DATA_DIR}/cache"
     LOG_ARCHIVE_DIR="${DATA_DIR}/logs"
+    BACKUP_DIR="${DATA_DIR}/Backups"
+    CONF_BACKUP_DIR="${BACKUP_DIR}/Confs"        # 0700 — holds credentials
     PERSISTENT_CONF_CACHE="${CACHE_BACKUP_DIR}/conf"
     ARR_CACHE_BACKUP_DIR="${CACHE_BACKUP_DIR}/arr"
 
@@ -1659,6 +1661,13 @@
 
 # ==============================================================================================
 # ── AI / RAG ──────────────────────────────────────────────────────────────────────────────────
+# ━━━ Conf Backups ━━━
+# Every write through the plugin copies the conf aside first, to CONF_BACKUP_DIR with an
+# ISO-8601 stamp. The confs are gitignored, so that directory is the whole recovery path — there
+# is no history to revert to. A backup that cannot be taken cancels the write.
+# Oldest are pruned past this count, per conf file.
+    CONF_BACKUP_RETAIN=30
+
 # ==============================================================================================
 # Varaverk works exactly as well with AI off as with it on. Nothing below is required for any
 # script to function — every feature that can lean on AI has a complete non-AI path, and the