Add the central site registry and remote updates

Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.

The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

zentrale/public/index.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+$wurzel = dirname(__DIR__);
+
+// Der eingebaute Server von PHP liefert Dateien aus public/ selbst aus.
+if ('cli-server' === PHP_SAPI && is_file(__DIR__.parse_url((string) $_SERVER['REQUEST_URI'], PHP_URL_PATH))) {
+    return false;
+}
+
+if (PHP_VERSION_ID < 80100) {
+    http_response_code(500);
+    header('Content-Type: text/plain; charset=UTF-8');
+    echo "Die Zentrale braucht PHP 8.1 oder neuer.\n";
+    exit;
+}
+
+spl_autoload_register(static function (string $klasse) use ($wurzel): void {
+    if (str_starts_with($klasse, 'Zentrale\\')) {
+        $datei = $wurzel.'/app/'.substr($klasse, 9).'.php';
+        if (is_file($datei)) {
+            require $datei;
+        }
+    }
+});
+
+$config = is_file($wurzel.'/config.php') ? require $wurzel.'/config.php' : [];
+$config = is_array($config) ? $config : [];
+$config += ['releases_api' => 'https://git.kant-it.de/api/v1/repos/kantarci/KantSites', 'einrichtungscode' => ''];
+
+(new Zentrale\Anwendung($config, $wurzel))->bearbeiten();