Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

zentrale/app/vorlagen/fehlt.php

@@ -0,0 +1,5 @@
+<?php /** @var Zentrale\Ansicht $v */ ?>
+<div class="schmal karte">
+  <h1>Nicht gefunden</h1>
+  <p>Diese Seite gibt es nicht. <a href="/">Zur Übersicht</a></p>
+</div>