Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/PartialController.php

@@ -44,6 +44,9 @@ final class PartialController extends AbstractController
     #[Route('', name: 'admin_partials', methods: ['GET'])]
     public function index(): Response
     {
+        // Ein Bereich kennt keinen Entwurf: Speichern ist Veroeffentlichen. Deshalb ist der ganze
+        // Bildschirm Sache des Veroeffentlichers, nicht erst der Speicherknopf.
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         $partials = [];
         foreach ($this->partials->all() as $partial) {
             $partial['usedBy'] = 'section' === $partial['kind'] ? $this->partials->usedBy($partial['slug']) : [];
@@ -56,7 +59,7 @@ final class PartialController extends AbstractController
     #[Route('/new', name: 'admin_partial_create', methods: ['POST'])]
     public function create(Request $request): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         if (!$this->isCsrfTokenValid('partials', $request->request->getString('_csrf_token'))) {
             return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
         }
@@ -81,7 +84,7 @@ final class PartialController extends AbstractController
     #[Route('/{id}/delete', name: 'admin_partial_delete', requirements: ['id' => '[a-f0-9]{32}'], methods: ['POST'])]
     public function delete(Request $request, string $id): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         if (!$this->isCsrfTokenValid('partials', $request->request->getString('_csrf_token'))) {
             return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
         }
@@ -97,12 +100,16 @@ final class PartialController extends AbstractController
     #[Route('/{id}', name: 'admin_partial_editor', requirements: ['id' => '[a-f0-9]{32}'], methods: ['GET'])]
     public function editor(string $id): Response
     {
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
+
         return $this->render('admin/editor.html.twig', ['partial' => $this->partial($id), 'kinds' => PartialRepository::KINDS]);
     }
 
     #[Route('/{id}/document', name: 'admin_partial_document', requirements: ['id' => '[a-f0-9]{32}'], methods: ['GET'])]
     public function document(string $id): JsonResponse
     {
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
+
         return $this->json($this->payload($this->partial($id)));
     }
 
@@ -110,7 +117,7 @@ final class PartialController extends AbstractController
     #[Route('/{id}/preview', name: 'admin_partial_preview', requirements: ['id' => '[a-f0-9]{32}'], methods: ['POST'])]
     public function write(Request $request, string $id): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_PUBLISHER');
         if (!$this->isCsrfTokenValid('editor', $request->headers->get('X-CSRF-Token'))) {
             return $this->json(['error' => 'Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.'], 403);
         }