Give conf writes a backup, a lock and a read-back before they count

These files are gitignored, so a bad write had nothing to go back to; the escaping order
also stored any value containing a quote truncated but still parseable, which only a
read-back can catch.

data/README.md

@@ -19,6 +19,8 @@ data/
 ├── cache/    persistent backups of the tmpfs caches — and only those
 │   ├── arr/    *_tracked_cache.json, restored into tmpfs on demand
 │   └── conf/   partner host*.conf snapshot (0700 — holds credentials)
+├── Backups/  point-in-time copies kept so a bad write can be undone
+│   └── Confs/  pre-write copies of this host's own confs (0700 — holds credentials)
 └── logs/     retained log output
 ```
 
@@ -31,6 +33,8 @@ variable is what a storage-mode migration rewrites.
 | `state/` | `STATE_DIR` | ALL state files must use this. No `/tmp`, no repo root. |
 | `ai/` | `AI_DATA_DIR` | |
 | `cache/` | `CACHE_BACKUP_DIR` | `ARR_CACHE_BACKUP_DIR`, `PERSISTENT_CONF_CACHE` sit under it |
+| `Backups/` | `BACKUP_DIR` | parent only; each kind of backup gets a subdirectory |
+| `Backups/Confs/` | `CONF_BACKUP_DIR` | retained per `CONF_BACKUP_RETAIN`; **not** a cache — see below |
 | `logs/` | `LOG_ARCHIVE_DIR` | live logging still goes to `LOG_DIR` (`/var/log/varaverk`) |
 
 ---
@@ -74,6 +78,11 @@ Ask what happens if it is deleted.
 called — `lidarr_art_miss_cache.tsv` has "cache" in its name and lives in `db/` for exactly that
 reason.
 
+`Backups/` is the same trap from the other side: it has "backup" in its name but backs up nothing
+that exists elsewhere. The confs are gitignored, so a pre-write copy under `Backups/Confs/` is the
+only prior version of that file anywhere. Deleting it loses something permanently, which is why it
+is a root of its own and not a subdirectory of `cache/`.
+
 ---
 
 ## History