Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

zentrale/app/vorlagen/einrichten.php

@@ -0,0 +1,19 @@
+<?php /** @var Zentrale\Ansicht $v */ ?>
+<div class="schmal karte">
+  <h1>Zentrale einrichten</h1>
+  <p>Es gibt noch kein Konto. Lege das erste an – dafür brauchst du den Einrichtungscode aus <code>config.php</code>.</p>
+  <?php if (null !== $fehler) { ?><p class="hinweis hinweis-fehler" role="alert"><?= $v->e($fehler) ?></p><?php } ?>
+  <form method="post" action="/">
+    <?= $v->csrf() ?>
+    <label for="code">Einrichtungscode</label>
+    <input id="code" name="code" type="password" autocomplete="off" required>
+    <label for="name">Name</label>
+    <input id="name" name="name" type="text" autocomplete="username" required minlength="3" maxlength="60" value="<?= $v->e($name) ?>">
+    <label for="passwort">Passwort</label>
+    <p class="feldhilfe" id="pw-hilfe">Mindestens 12 Zeichen.</p>
+    <input id="passwort" name="passwort" type="password" autocomplete="new-password" required minlength="12" aria-describedby="pw-hilfe">
+    <label for="passwort2">Passwort wiederholen</label>
+    <input id="passwort2" name="passwort2" type="password" autocomplete="new-password" required minlength="12">
+    <button type="submit" class="knopf abstand">Konto anlegen</button>
+  </form>
+</div>