Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -18,3 +18,8 @@
 # damit auf einem frischen Server nichts fehlt und nichts von Google geladen wird. Andere
 # Installationen holen ihre eigenen mit `cms:fonts:fetch` - deren Dateien gehoeren nicht hierher.
 /public/assets/build/
+
+# Zentrale (sites.kant-it.de): Konfiguration und Daten gehoeren dem Server.
+/zentrale/config.php
+/zentrale/var/*
+!/zentrale/var/.htaccess