Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/ThemeController.php

@@ -20,6 +20,9 @@ final class ThemeController extends AbstractController
     #[Route('/%kant.admin_path%/theme', name: 'admin_theme', methods: ['GET'])]
     public function index(): Response
     {
+        // Das Design gilt sofort auf jeder Seite - das ist Administratorensache, wie die
+        // Rollenhilfe es verspricht.
+        $this->denyAccessUnlessGranted('ROLE_ADMIN');
         $theme = $this->theme->load();
 
         return $this->render('admin/theme.html.twig', [
@@ -46,7 +49,7 @@ final class ThemeController extends AbstractController
     #[Route('/%kant.admin_path%/theme/fonts', name: 'admin_theme_fonts', methods: ['POST'])]
     public function fonts(Request $request): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_ADMIN');
         if (!$this->isCsrfTokenValid('theme', $request->request->getString('_csrf_token'))) {
             $this->addFlash('error', 'Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
 
@@ -75,7 +78,7 @@ final class ThemeController extends AbstractController
     #[Route('/%kant.admin_path%/theme/save', name: 'admin_theme_save', methods: ['POST'])]
     public function save(Request $request): Response
     {
-        $this->denyAccessUnlessGranted('ROLE_EDITOR');
+        $this->denyAccessUnlessGranted('ROLE_ADMIN');
         if (!$this->isCsrfTokenValid('theme', $request->request->getString('_csrf_token'))) {
             $this->addFlash('error', 'Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');