Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/assets/editor-model.js

@@ -121,16 +121,21 @@ export function createBlock(type) {
 /** Raises the document schema to the version that knows this block type. */
 export function upgradeForType(document, type) {
   if (type === 'gallery') upgradeDocument(document, 3);
-  if (type === 'postlist') upgradeDocument(document, 5);
+  // Die Fassung, die der Server fuer die Eigenschaften verlangt, mit denen createBlock den
+  // Baustein anlegt - nicht die, in der der Typ zuerst auftauchte. Sonst steht ein neuer
+  // Baustein sofort mit 422 in der Vorschau und laesst sich nicht speichern.
+  if (type === 'postlist') upgradeDocument(document, 18);
   if (type === 'postnav') upgradeDocument(document, 18);
   if (type === 'legal') upgradeDocument(document, 19);
   if (['iconcard', 'stat', 'quote', 'logos', 'cta', 'contact', 'divider', 'spacer', 'accordion', 'accordionitem'].includes(type)) upgradeDocument(document, 6);
   if (type === 'tabs' || type === 'tabitem') upgradeDocument(document, 7);
   if (type === 'form') upgradeDocument(document, 8);
   if (type === 'breadcrumb') upgradeDocument(document, 9);
-  if (type === 'menu' || type === 'partialref') upgradeDocument(document, 11);
+  if (type === 'menu') upgradeDocument(document, 16);
+  if (type === 'partialref') upgradeDocument(document, 11);
   if (type === 'embed') upgradeDocument(document, 14);
-  if (['icon', 'progress', 'slider'].includes(type)) upgradeDocument(document, 15);
+  if (type === 'icon' || type === 'progress') upgradeDocument(document, 15);
+  if (type === 'slider') upgradeDocument(document, 17);
   if (type === 'social') upgradeDocument(document, 23);
 }
 
@@ -193,7 +198,9 @@ export function moveBlock(document, selected, targetId, inside = false) {
   if (!source || !target || selected === targetId || locate(source.block.children || [], targetId)) return false;
   if (inside && !isContainer(target.block)) return false;
   if (inside && !canContain(target.block, source.block)) return false;
-  if (!inside && target.parent && !canContain(target.parent, source.block)) return false;
+  // Neben ein Element der obersten Ebene darf nur, was dort auch stehen darf - eine Spalte oder
+  // ein Akkordeoneintrag nicht.
+  if (!inside && !dropList(document, target.parent?.id ?? null, source.block)) return false;
   source.siblings.splice(source.index, 1);
   const destination = locate(document.blocks, targetId);
   if (inside) (destination.block.children ??= []).push(source.block);
@@ -224,10 +231,18 @@ function place(document, block, parentId, index) {
   return block.id;
 }
 
-/** Inserts a new block at an exact position instead of behind the selection. */
+/**
+ * Inserts a new block at an exact position instead of behind the selection.
+ *
+ * Erst pruefen, ob das Ziel den Baustein nimmt, dann die Fassung anheben: sonst bliebe bei einer
+ * Ablehnung nur die Schemaaenderung uebrig - ein Verlaufsschritt, ein "ungespeichert", und nichts
+ * zu sehen.
+ */
 export function insertBlockAt(document, type, parentId, index) {
+  const block = createBlock(type);
+  if (!dropList(document, parentId, block)) return null;
   upgradeForType(document, type);
-  return place(document, createBlock(type), parentId, index);
+  return place(document, block, parentId, index);
 }
 
 /**
@@ -333,12 +348,19 @@ export function mediaProps(media) {
 
 export function insertMedia(document, selected, items) {
   const target = locate(document.blocks, selected)?.block;
-  upgradeDocument(document, 3);
-  if (target?.type === 'image') { target.props = { ...target.props, ...mediaProps(items[0]), caption: target.props.caption || '' }; return target.id; }
+  if (target?.type === 'image') {
+    upgradeDocument(document, 3);
+    target.props = { ...target.props, ...mediaProps(items[0]), caption: target.props.caption || '' };
+    return target.id;
+  }
   let parent = target;
   if (target?.type !== 'gallery') {
-    const id = insertBlock(document, 'gallery', selected); parent = locate(document.blocks, id).block;
+    // Ein Akkordeon nimmt nur Eintraege: dann gibt es keine Galerie und nichts zu tun.
+    const id = insertBlock(document, 'gallery', selected);
+    if (id === null) return null;
+    parent = locate(document.blocks, id).block;
   }
+  upgradeDocument(document, 3);
   for (const item of items) { const image = createBlock('image'); image.props = mediaProps(item); (parent.children ??= []).push(image); }
   return parent.id;
 }
@@ -399,17 +421,19 @@ function buildRow(columns) {
 
 /** A row at an exact position, for a marked insertion point or a drop in the preview. */
 export function insertRowAt(document, columns, parentId, index) {
+  const row = buildRow(columns);
+  if (!dropList(document, parentId, row)) return null;
   upgradeDocument(document);
-  return place(document, buildRow(columns), parentId, index);
+  return place(document, row, parentId, index);
 }
 
 export function insertRow(document, columns, selected) {
-  const row = buildRow(columns);
-  upgradeDocument(document);
   // Same placement rule as a single element, so the row does not land somewhere else than the
   // toolbox promised.
   const target = insertionTarget(document, selected, 'row');
-  return target ? place(document, row, target.parentId, target.index) : null;
+  if (!target) return null;
+  upgradeDocument(document);
+  return place(document, buildRow(columns), target.parentId, target.index);
 }
 
 export function insertPreset(document, name, selected) {