Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

config/packages/framework.yaml

@@ -8,7 +8,9 @@ framework:
         cookie_httponly: true
         cookie_samesite: lax
         cookie_secure: auto
-        cookie_path: /admin
+        # Der Pfad folgt der Adresse der Verwaltung: hiesse sie anders und das Cookie weiter
+        # /admin, schickte der Browser es nie mit, und keine Anmeldung kaeme je an.
+        cookie_path: '/%kant.admin_path%'
         name: KANTSESSION
     router:
         utf8: true
@@ -19,6 +21,7 @@ framework:
         log: true
     mailer:
         # Default to the host's sendmail, which is what ordinary PHP hosting offers. Override with
-        # MAILER_DSN in .env.local for SMTP. Delivery failures never lose a submission: it is
+        # MAILER_DSN in .env for SMTP. Delivery failures never lose a submission: it is
         # stored first and stays visible as undelivered in the administration.
-        dsn: '%env(resolve:MAILER_DSN)%'
+        # Ohne `resolve:`: ein SMTP-Passwort mit Prozentzeichen ist kein Parametername.
+        dsn: '%env(MAILER_DSN)%'