Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/SystemController.php

@@ -21,7 +21,7 @@ use Symfony\Component\Routing\Attribute\Route;
  */
 final class SystemController extends AbstractController
 {
-    public function __construct(private Updater $updater, private Backup $backup, private ArchiveUpdate $archive, private Installation $installation, private string $adminPath, private string $databaseUrl, private string $mediaDirectory, private string $projectDir)
+    public function __construct(private Updater $updater, private Backup $backup, private ArchiveUpdate $archive, private Installation $installation, private string $adminPath, private string $databaseUrl, private string $mediaDirectory, private string $projectDir, private string $siteOrigin)
     {
     }
 
@@ -50,6 +50,11 @@ final class SystemController extends AbstractController
             'pendingMigrations' => $this->pendingMigrations(),
             // Actual runtime connection, with credentials excluded from the screen.
             'database' => $this->databaseFacts(),
+            // Die Adresse, die Sitemap, Feed und Canonical nennen - und ob die Verwaltung gerade
+            // unter ihr laeuft. Die Schreibweise mit oder ohne www leitet die Anwendung selbst um;
+            // ein ganz anderer Host (Vorschauadresse des Hosters, IP) bleibt erreichbar und
+            // bekommt hier den Hinweis, dass die Website woanders eingetragen ist.
+            'origin' => $this->originFacts($request),
         ]);
     }
 
@@ -114,6 +119,22 @@ final class SystemController extends AbstractController
         ];
     }
 
+    /**
+     * @return array{adresse: string, quelle: string, host: string, passt: bool}
+     */
+    private function originFacts(Request $request): array
+    {
+        $wanted = strtolower((string) parse_url(trim($this->siteOrigin), PHP_URL_HOST));
+        $port = parse_url(trim($this->siteOrigin), PHP_URL_PORT);
+
+        return [
+            'adresse' => $this->siteOrigin,
+            'quelle' => $this->environmentSource('SITE_ORIGIN'),
+            'host' => $request->getHttpHost(),
+            'passt' => '' !== $wanted && strtolower($request->getHost()) === $wanted && (null === $port || $request->getPort() === $port),
+        ];
+    }
+
     /** Explicit server values take precedence over the single installation file. */
     private function environmentSource(string $name): string
     {