Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/webhook_setup.sh

@@ -43,6 +43,34 @@
 #   acquire_lock    — prevents concurrent registration runs
 #
 # ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# master.conf
+#
+#   WEBHOOK_PORT
+#       Port the listener binds and the registered webhook URL points at. 0 disables the
+#       listener entirely (start_webhook_listener.sh exits early), so registering against
+#       a port of 0 would produce URLs nothing is serving.
+#
+#   WEBHOOK_SECRET
+#       Shared secret embedded in the registered URL as ?key=. Generated here on first run
+#       and written back into master.conf — the write-back is verified, because the arrs
+#       are registered with this value and a failed persist would leave them holding a
+#       secret this host does not have.
+#
+# host*.conf (aliased by detect_hosts())
+#
+#   SONARR_URL / SONARR_API_KEY
+#   RADARR_URL / RADARR_API_KEY
+#   LIDARR_URL / LIDARR_API_KEY
+#       Each arr the webhook is registered in. An arr with no URL or key configured on
+#       this host is skipped rather than failing the run.
+#
+#   SSH_KEY
+#       Used when propagating the same secret to the partner via OVERRIDE_SECRET.
+#
+# ==============================================================================================
 # RUNTIME MODES
 # ==============================================================================================
 #
@@ -76,6 +104,13 @@ MASTER_CONF="$ECOSYSTEM_ROOT/Configurations/master.conf"
 
 source "$ECOSYSTEM_ROOT/load_config.sh"
 parse_args "$@"
+
+# Writes the generated secret into master.conf via sed -i and SSHes to the partner.
+if [[ "$EUID" -ne 0 ]]; then
+    error "Must be run as root"
+    exit 1
+fi
+
 acquire_lock
 detect_hosts
 
@@ -84,9 +119,25 @@ WEBHOOK_NAME="Varaverk Upgrade"
 # ── Resolve or generate the secret ──────────────────────────────────────────
 # OVERRIDE_SECRET env var is set when called recursively via SSH from the
 # primary host, so both ends use the same secret.
+#
+# Every write-back below is verified by re-reading master.conf. The secret gets baked into
+# the webhook URL registered in each arr — if the sed silently fails to match, the arrs end
+# up holding a secret this host does not have, and the listener rejects every delivery.
+_persist_secret() {
+    local secret="$1"
+    sed -i "s/WEBHOOK_SECRET=\"\"/WEBHOOK_SECRET=\"$secret\"/" "$MASTER_CONF"
+    if ! grep -q "WEBHOOK_SECRET=\"$secret\"" "$MASTER_CONF" 2>/dev/null; then
+        error "Could not persist WEBHOOK_SECRET to $MASTER_CONF"
+        error "Registering the arrs now would leave them with a secret this host does not have"
+        notify "Webhook setup aborted on $(hostname) — could not persist WEBHOOK_SECRET" \
+            "Webhook Setup" "warning"
+        exit 1
+    fi
+}
+
 if [[ -n "${OVERRIDE_SECRET:-}" ]]; then
     if [[ -z "${WEBHOOK_SECRET:-}" ]]; then
-        sed -i "s/WEBHOOK_SECRET=\"\"/WEBHOOK_SECRET=\"$OVERRIDE_SECRET\"/" "$MASTER_CONF"
+        _persist_secret "$OVERRIDE_SECRET"
     fi
     WEBHOOK_SECRET="$OVERRIDE_SECRET"
 fi
@@ -95,8 +146,12 @@ if [[ -z "${WEBHOOK_SECRET:-}" ]]; then
     if [[ "$DRY_RUN" == true ]]; then
         WEBHOOK_SECRET="<would-generate>"
     else
+        if ! command -v openssl >/dev/null 2>&1; then
+            error "openssl not found — cannot generate WEBHOOK_SECRET"
+            exit 1
+        fi
         GENERATED=$(openssl rand -hex 32)
-        sed -i "s/WEBHOOK_SECRET=\"\"/WEBHOOK_SECRET=\"$GENERATED\"/" "$MASTER_CONF"
+        _persist_secret "$GENERATED"
         WEBHOOK_SECRET="$GENERATED"
         echo "Generated WEBHOOK_SECRET — saved to master.conf"
     fi