Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/services.yaml

@@ -14,6 +14,9 @@ parameters:
     kant.mailer_dsn: 'sendmail://default'
     # Die Einstellung, die die Verwaltung anzeigt und ausprobiert; Tests setzen sie fest.
     kant.mail_dsn: '%env(default:kant.mailer_dsn:MAILER_DSN)%'
+    # Die Zentrale, bei der sich jede Installation meldet (ADR 123). ZENTRALE_URL=aus schaltet ab.
+    kant.zentrale_default: 'https://sites.kant-it.de'
+    kant.zentrale_url: '%env(default:kant.zentrale_default:ZENTRALE_URL)%'
 
 services:
     _defaults:
@@ -150,6 +153,21 @@ services:
         arguments:
             $tasks: !tagged_iterator kant.task
             $projectDir: '%kernel.project_dir%'
+    App\Ops\Zentrale:
+        arguments:
+            $root: '%kernel.project_dir%'
+            $url: '%kant.zentrale_url%'
+            $siteOrigin: '%env(SITE_ORIGIN)%'
+            $databaseUrl: '%env(DATABASE_URL)%'
+            $senden: null
+    App\Ops\Tasks\ZentraleTask:
+        arguments:
+            $siteOrigin: '%env(SITE_ORIGIN)%'
+            $projectDir: '%kernel.project_dir%'
+            $anstossen: null
+    App\EventSubscriber\RemoteUpdateFinishSubscriber:
+        arguments:
+            $projectDir: '%kernel.project_dir%'
     App\Ops\Tasks\CleanupTask:
         arguments:
             $projectDir: '%kernel.project_dir%'