Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

templates/admin/settings.html.twig

@@ -53,6 +53,7 @@
 </section>
 <section class="stack-section">
     <div class="section-head"><h2>Unternehmensdaten</h2><span class="muted">Grundlage für Organization und LocalBusiness</span></div>
+    {% if is_granted('ROLE_ADMIN') %}
     <form action="{{ path('admin_settings_save') }}" method="post" class="card card-body">
         <input type="hidden" name="_csrf_token" value="{{ csrf_token('settings') }}">
         <div class="fields">
@@ -273,6 +274,9 @@
 
         <button class="primary" type="submit">Einstellungen speichern</button>
     </form>
+    {% else %}
+    <p class="card card-body muted">Unternehmensdaten, Knopf „nach oben“, Spamschutz und Einwilligung ändert nur ein Administrator.</p>
+    {% endif %}
 </section>
 
 <section class="stack-section">

templates/admin/shell.html.twig

@@ -32,20 +32,20 @@
             {% set entries = [
                 {id: 'pages', route: 'admin_pages', icon: 'pages', label: 'Seiten'},
                 {id: 'posts', route: 'admin_posts', icon: 'pages', label: 'Beiträge'},
-                {id: 'partials', route: 'admin_partials', icon: 'partials', label: 'Bereiche'},
-                {id: 'menus', route: 'admin_menus', icon: 'menus', label: 'Menüs'},
+                {id: 'partials', route: 'admin_partials', icon: 'partials', label: 'Bereiche', role: 'ROLE_PUBLISHER'},
+                {id: 'menus', route: 'admin_menus', icon: 'menus', label: 'Menüs', role: 'ROLE_PUBLISHER'},
                 {id: 'media', route: 'admin_media', icon: 'media', label: 'Mediathek'},
-                {id: 'forms', route: 'admin_forms', icon: 'forms', label: 'Formulare'},
+                {id: 'forms', route: 'admin_forms', icon: 'forms', label: 'Formulare', role: 'ROLE_PUBLISHER'},
                 {id: 'statistics', route: 'admin_statistics', icon: 'statistics', label: 'Statistik'}
             ] %}
-            {% for entry in entries %}
+            {% for entry in entries %}{% if entry.role is not defined or is_granted(entry.role) %}
             <li><a class="nav-item" href="{{ path(entry.route) }}"{{ nav|default('') == entry.id ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: entry.icon} only %}{{ entry.label }}</a></li>
-            {% endfor %}
+            {% endif %}{% endfor %}
         </ul>
         <p class="nav-label" id="nav-site">WEBSITE</p>
         <ul class="nav-list" aria-labelledby="nav-site">
-            <li><a class="nav-item" href="{{ path('admin_theme') }}"{{ nav|default('') == 'theme' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'theme'} only %}Design</a></li>
-            <li><a class="nav-item" href="{{ path('admin_settings') }}"{{ nav|default('') == 'settings' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'settings'} only %}Einstellungen</a></li>
+            {% if is_granted('ROLE_ADMIN') %}<li><a class="nav-item" href="{{ path('admin_theme') }}"{{ nav|default('') == 'theme' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'theme'} only %}Design</a></li>{% endif %}
+            {% if is_granted('ROLE_PUBLISHER') %}<li><a class="nav-item" href="{{ path('admin_settings') }}"{{ nav|default('') == 'settings' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'settings'} only %}Einstellungen</a></li>{% endif %}
             {% if is_granted('ROLE_ADMIN') %}<li><a class="nav-item" href="{{ path('admin_system') }}"{{ nav|default('') == 'system' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'system'} only %}System</a></li>{% endif %}
             {% if is_granted('ROLE_ADMIN') %}<li><a class="nav-item" href="{{ path('admin_tasks') }}"{{ nav|default('') == 'tasks' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'tasks'} only %}Aufgaben</a></li>{% endif %}
             {% if is_granted('ROLE_ADMIN') %}<li><a class="nav-item" href="{{ path('admin_users') }}"{{ nav|default('') == 'users' ? ' aria-current="page"' : '' }}>{% include 'admin/icon.html.twig' with {name: 'users'} only %}Benutzer</a></li>{% endif %}

templates/admin/system.html.twig

@@ -34,6 +34,16 @@
                 {% endif %}
                 <br><span class="muted">Eingestellt in <code>{{ database.quelle }}</code>; Server-Umgebungsvariablen haben Vorrang.</span>
             </dd>
+            <dt>Adresse</dt>
+            <dd>
+                {% if origin.adresse %}<code>{{ origin.adresse }}</code>{% else %}<span class="check-bad"><strong>Nicht eingetragen.</strong></span>{% endif %}
+                {% if origin.passt %}
+                <span class="muted">– Canonical, Sitemap und Feed nennen sie; die Schreibweise {{ origin.adresse matches '{^https?://www\.}' ? 'ohne' : 'mit' }} www leitet hierher um.</span>
+                {% else %}
+                <br><span class="check-bad"><strong>Diese Verwaltung läuft gerade unter <code>{{ origin.host }}</code>.</strong> Canonical, Sitemap und Feed nennen trotzdem die eingetragene Adresse. Stimmt die nicht mehr: <code>php bin/console cms:site:origin https://…</code> oder <code>SITE_ORIGIN</code> in <code>.env</code> ändern.</span>
+                {% endif %}
+                <br><span class="muted">Eingestellt in <code>{{ origin.quelle }}</code>; Server-Umgebungsvariablen haben Vorrang.</span>
+            </dd>
             {% if state.worktree %}
             <dt>Stand</dt><dd><code>{{ state.describe }}</code>{% if state.commit != 'unbekannt' %} · Commit <code>{{ state.commit }}</code>{% endif %}</dd>
             {% else %}