Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -7,6 +7,8 @@ APP_DEBUG=0
 DATABASE_URL="sqlite:///%kernel.project_dir%/var/cms.db"
 # Für MySQL stattdessen, mit den Zugangsdaten des Hostings:
 # DATABASE_URL="mysql://benutzer:passwort@127.0.0.1:3306/datenbank?charset=utf8mb4"
+# Die oeffentliche Adresse der Website, mit oder ohne www - so, wie sie in Sitemap, Feed und
+# Canonical stehen soll. Die andere Schreibweise leitet die Anwendung dorthin um.
 SITE_ORIGIN=https://example.de
 MEDIA_DIRECTORY="%kernel.project_dir%/var/media"
 MAILER_DSN=sendmail://default