Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

package.json

@@ -20,7 +20,9 @@
     "test:link-media": "node scripts/link-media-check.mjs",
     "test:404": "node scripts/not-found-check.mjs",
     "test:colors": "node scripts/color-picker-check.mjs",
-    "test:accordion": "node scripts/accordion-check.mjs"
+    "test:accordion": "node scripts/accordion-check.mjs",
+    "test:motion": "node scripts/motion-check.mjs",
+    "test:archive-update": "node scripts/archive-update-check.mjs"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.10.0",