Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/FormAdminController.php

@@ -21,6 +21,9 @@ final class FormAdminController extends AbstractController
     #[Route('/%kant.admin_path%/forms', name: 'admin_forms', methods: ['GET'])]
     public function index(Request $request): Response
     {
+        // Empfaenger, Felder und die Einsendungen selbst: nichts davon gehoert in die Hand einer
+        // Rolle, die nicht einmal eine Seite veroeffentlichen darf.
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         $theme = $this->theme->load();
 
         return $this->render('admin/forms.html.twig', [
@@ -37,7 +40,7 @@ final class FormAdminController extends AbstractController
     #[Route('/%kant.admin_path%/forms/{slug}', name: 'admin_form_save', requirements: ['slug' => '[a-z0-9-]{1,80}|neu'], methods: ['POST'])]
     public function save(Request $request, string $slug): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         if (!$this->isCsrfTokenValid('forms', $request->request->getString('_csrf_token'))) {
             return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
         }