Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/MenuController.php

@@ -20,6 +20,8 @@ final class MenuController extends AbstractController
     #[Route('/%kant.admin_path%/menus', name: 'admin_menus', methods: ['GET'])]
     public function index(Request $request): Response
     {
+        // Ein gespeichertes Menue steht sofort auf der Website - Sache des Veroeffentlichers.
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         $slot = $request->query->getString('slot', 'header');
         $slot = isset(MenuRepository::SLOTS[$slot]) ? $slot : 'header';
         $menu = $this->menus->all()[$slot] ?? null;
@@ -43,7 +45,7 @@ final class MenuController extends AbstractController
     #[Route('/%kant.admin_path%/menus/{slot}', name: 'admin_menu_save', methods: ['POST'])]
     public function save(Request $request, string $slot): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         if (!$this->isCsrfTokenValid('menus', $request->request->getString('_csrf_token'))) {
             return 'json' === $request->getPreferredFormat() ? $this->json(['error' => 'Deine Sitzung ist abgelaufen. Bitte erneut anmelden.'], 403) : $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.', slot: $slot);
         }