Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

zentrale/app/vorlagen/rahmen.php

@@ -0,0 +1,33 @@
+<?php /** @var Zentrale\Ansicht $v */ ?>
+<!doctype html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title><?= $v->e($titel) ?> · KantSites Zentrale</title>
+<link rel="stylesheet" href="/app.css?v=1">
+<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%23173f6b'/%3E%3Cpath d='M9 8v16M9 16l9-8M12.5 13l7 11' stroke='%23fff' stroke-width='3.2' fill='none' stroke-linecap='round'/%3E%3C/svg%3E">
+</head>
+<body>
+<a class="skip" href="#inhalt">Zum Inhalt</a>
+<header class="kopf">
+  <div class="kopf-innen">
+    <a class="marke" href="/"><span class="marke-zeichen" aria-hidden="true">K</span> KantSites <span>Zentrale</span></a>
+    <?php if (null !== $konto) { ?>
+      <form method="post" action="/abmelden" class="abmelden">
+        <?= $v->csrf() ?>
+        <span class="wer"><?= $v->e($konto['name']) ?></span>
+        <button type="submit" class="knopf knopf-leise">Abmelden</button>
+      </form>
+    <?php } ?>
+  </div>
+</header>
+<main id="inhalt" class="seite" tabindex="-1">
+  <?php if (null !== $hinweis) { ?>
+    <p class="hinweis hinweis-<?= $v->e($hinweis['art']) ?>" role="<?= 'fehler' === $hinweis['art'] ? 'alert' : 'status' ?>"><?= $v->e($hinweis['text']) ?></p>
+  <?php } ?>
+  <?= $inhalt ?>
+</main>
+</body>
+</html>