Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/TaskScreenTest.php

@@ -70,7 +70,7 @@ final class TaskScreenTest extends WebTestCase
         self::assertSame(200, $client->getResponse()->getStatusCode());
         $html = (string) $client->getResponse()->getContent();
 
-        foreach (['publish-due', 'stats-prune', 'backup', 'update-check', 'cleanup'] as $task) {
+        foreach (['publish-due', 'stats-prune', 'backup', 'update-check', 'cleanup', 'zentrale'] as $task) {
             self::assertStringContainsString($task, $html);
         }
         // Die Einschränkung gehört auf den Bildschirm und nicht in die Dokumentation: wer sie
@@ -78,7 +78,7 @@ final class TaskScreenTest extends WebTestCase
         self::assertStringContainsString('Ohne Besuch und ohne geöffnete Verwaltung passiert nichts.', $html);
         self::assertStringContainsString('/cms-cron/'.Scheduler::cronToken(self::SECRET), $html);
         // Und der Plan steht danach in der Datenbank - eine Zeile je Aufgabe, nicht mehr.
-        self::assertSame(5, (int) $this->db->fetchOne('SELECT COUNT(*) FROM scheduled_task'));
+        self::assertSame(6, (int) $this->db->fetchOne('SELECT COUNT(*) FROM scheduled_task'));
     }
 
     public function testStartingWorkNeedsAnAdministratorAndAValidForm(): void