Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Content/PageRepository.php

@@ -2,6 +2,7 @@
 
 namespace App\Content;
 
+use App\Domain\InvalidDocument;
 use App\Domain\InvalidPage;
 use App\Domain\StaleWrite;
 use Doctrine\DBAL\Connection;
@@ -36,7 +37,7 @@ final class PageRepository
         return $this->db->transactional(function () use ($slug, $parentId, $type, $document, $locale): string {
             $path = $slug;
             if (null !== $parentId) {
-                $parent = $this->db->fetchAssociative('SELECT path, type FROM page WHERE id = ? AND website_id = ? AND locale = ?', [$parentId, 'default', $locale]);
+                $parent = $this->db->fetchAssociative('SELECT path, type FROM page WHERE id = ? AND website_id = ? AND locale = ? AND deleted_at IS NULL', [$parentId, 'default', $locale]);
                 if (false === $parent) {
                     throw new InvalidPage('Die übergeordnete Seite gibt es nicht mehr. Lade die Übersicht neu.');
                 }
@@ -244,13 +245,19 @@ final class PageRepository
      * overwritten in place: the restored state becomes a new revision, so the history stays whole.
      */
     public function restoreRevision(string $pageId, string $revisionId, int $expectedVersion): string
+    {
+        return $this->saveDraft($pageId, $this->revisionDocument($pageId, $revisionId), $expectedVersion);
+    }
+
+    /** Das Dokument einer Fassung dieser Seite - und nur dieser Seite. */
+    public function revisionDocument(string $pageId, string $revisionId): array
     {
         $raw = $this->db->fetchOne('SELECT document FROM revision WHERE id = ? AND page_id = ?', [$revisionId, $pageId]);
         if (false === $raw) {
             throw new InvalidPage('Diese Fassung gehört nicht zu dieser Seite.');
         }
 
-        return $this->saveDraft($pageId, json_decode($raw, true, 512, JSON_THROW_ON_ERROR), $expectedVersion);
+        return json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
     }
 
     /**
@@ -266,7 +273,15 @@ final class PageRepository
             'SELECT id, path, draft_revision_id, version FROM page WHERE website_id = ? AND deleted_at IS NULL AND publish_at IS NOT NULL AND publish_at <= ? AND draft_revision_id IS NOT NULL AND (published_revision_id IS NULL OR published_revision_id <> draft_revision_id)',
             ['default', gmdate('Y-m-d H:i:s')],
         ) as $row) {
-            $this->publish($row['id'], $row['draft_revision_id'], (int) $row['version']);
+            try {
+                $this->publish($row['id'], $row['draft_revision_id'], (int) $row['version']);
+            } catch (InvalidPage|InvalidDocument|StaleWrite|\InvalidArgumentException $e) {
+                // Eine Seite, deren Fassung heute nicht mehr gilt, bleibt Entwurf - und haelt die
+                // anderen nicht auf. Der Grund steht im Protokoll, die Seite behaelt ihren Termin.
+                error_log(sprintf('Geplante Veröffentlichung von /%s zurückgestellt: %s', $row['path'], $e->getMessage()));
+
+                continue;
+            }
             $this->db->executeStatement('UPDATE page SET publish_at = NULL WHERE id = ?', [$row['id']]);
             $published[] = $row['path'];
         }