Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

templates/feed.xml.twig

@@ -11,7 +11,7 @@
         <title>{{ post.title }}</title>
         <link>{{ origin }}{{ post.href }}</link>
         <guid isPermaLink="true">{{ origin }}{{ post.href }}</guid>
-        {% if post.publishedAt %}<pubDate>{{ post.publishedAt|date('r') }}</pubDate>{% endif %}
+        {% if post.publishedAt %}<pubDate>{{ (post.publishedAt ~ ' UTC')|date('r', 'UTC') }}</pubDate>{% endif %}
         {% if post.excerpt %}<description>{{ post.excerpt }}</description>{% endif %}
         {% for term in post.terms.category %}<category>{{ term.name }}</category>{% endfor %}
     </item>