Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Content/CustomCode.php

@@ -120,7 +120,8 @@ final class CustomCode
             // so "& .block-text" must stay "#id .block-text" instead of becoming
             // "#id.block-text", which would target the element itself.
             $suffix = preg_replace('/\s+/', ' ', rtrim($match[1][0])) ?? '';
-            if (1 !== preg_match('/^[a-zA-Z0-9 ,.:>+~_\[\]="\'-]*$/D', $suffix)) {
+            // Kein Komma: `&,body{...}` wuerde zu `#id,body{...}` und verliesse das Element.
+            if (1 !== preg_match('/^[a-zA-Z0-9 .:>+~_\[\]="\'-]*$/D', $suffix)) {
                 throw new InvalidDocument(sprintf('„&%s“ ist als verschachtelter Selektor nicht erlaubt.', $suffix));
             }
             $rules[$suffix] = $this->declarations($match[2][0]);