Add full banner headers to all scripts across the codebase

Every script now has the established header format: PURPOSE with ─────── separator,
OPERATIONAL MODEL, DESIGN PRINCIPLES, OPERATIONAL SAFEGUARDS, CONFIGURATION, and
RUNTIME MODES — structured with full ====== banner sections throughout.

Orchestrators converted from compact ── inline format to full banners. Stale
emby-fallback and dirty sync references removed from Plugin/user_script_plug-in.sh.

Tools/webhook_setup.sh

@@ -12,15 +12,47 @@
 # The listener (start_webhook_listener.sh) must be running before arrs will
 # actually deliver events, but this script can register the connection first.
 #
-# ── WHAT IT DOES ─────────────────────────────────────────────────────────────
-#   1. Generates WEBHOOK_SECRET in master.conf if empty
-#   2. Registers webhook in each local arr (Sonarr / Radarr / Lidarr)
-#   3. SSHes to remote host and runs itself there (unless --local-only)
+# ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
 #
-# ── USAGE ────────────────────────────────────────────────────────────────────
-#   webhook_setup.sh              — configure local + remote
-#   webhook_setup.sh --local-only — local arrs only (used internally for SSH)
-#   webhook_setup.sh --dry-run    — show what would be registered
+#   1. Generate WEBHOOK_SECRET in master.conf if empty
+#   2. Register webhook in each local arr (Sonarr / Radarr / Lidarr)
+#   3. SSH to remote host and run itself there (unless --local-only)
+#
+# ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Idempotent Registration
+#   Skips any arr that already has the webhook registered. Safe to re-run after
+#   adding a new arr or after a conf change without creating duplicate entries.
+#
+# Self-Propagating
+#   SSHes to the remote and runs itself with --local-only — one execution
+#   configures both servers without a separate remote step.
+#
+# ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+#   Idempotent      — skips arrs that already have the webhook registered
+#   Secret auto-gen — WEBHOOK_SECRET generated if empty; never left blank
+#   --local-only    — used internally for SSH; prevents infinite recursion
+#   --dry-run mode  — shows what would be registered without making API calls
+#
+# ==============================================================================================
+# RUNTIME MODES
+# ==============================================================================================
+#
+# webhook_setup.sh
+#     Configure local arrs, then SSH to remote and configure remote arrs.
+#
+# webhook_setup.sh --local-only
+#     Local arrs only (used internally when called via SSH on the remote).
+#
+# webhook_setup.sh --dry-run
+#     Show what would be registered without making any changes.
 #
 # ==============================================================================================