Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/ConsentController.php

@@ -34,11 +34,33 @@ final class ConsentController extends AbstractController
             default => array_map(static fn (mixed $group): string => (string) $group, (array) $request->request->all('groups')),
         };
         $response = $this->redirect($this->backTo($request));
-        $this->consent->remember($request, $response, $groups);
+        // Eine Entscheidung trifft nur der eigene Browser auf dieser Website. Ein fremdes Formular,
+        // das hierher postet, darf keine Einwilligung eintragen - die Route hat keine Sitzung und
+        // damit kein CSRF-Token, also entscheidet die Herkunft der Anfrage.
+        if ($this->sameSite($request)) {
+            $this->consent->remember($request, $response, $groups);
+        }
 
         return $response;
     }
 
+    /** Ob die Anfrage von dieser Website kommt - nach dem, was der Browser darueber sagt. */
+    private function sameSite(Request $request): bool
+    {
+        $site = $request->headers->get('Sec-Fetch-Site');
+        if (null !== $site) {
+            return \in_array($site, ['same-origin', 'same-site', 'none'], true);
+        }
+        $origin = $request->headers->get('Origin') ?? $request->headers->get('Referer');
+        if (null === $origin || '' === $origin) {
+            // Aeltere Browser nennen keine Herkunft; ohne Anhaltspunkt bleibt die Frage beantwortbar.
+            return true;
+        }
+        $host = parse_url($origin, PHP_URL_HOST);
+
+        return \is_string($host) && strtolower($host) === strtolower($request->getHost());
+    }
+
     #[Route('/einwilligung', name: 'consent_page', methods: ['GET'])]
     public function page(Request $request): Response
     {
@@ -73,7 +95,9 @@ final class ConsentController extends AbstractController
     private function backTo(Request $request): string
     {
         $target = $request->request->getString('back');
-        if ('' === $target || !str_starts_with($target, '/') || str_starts_with($target, '//')) {
+        // Nur ein Pfad dieser Website: `//fremd.example` ist protokollrelativ, und `/\fremd.example`
+        // lesen Browser genauso.
+        if ('' === $target || 1 !== preg_match('#^/(?![/\\\\])#', $target)) {
             return '/';
         }