Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/ProjectDirEnvProcessorTest.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Tests;
+
+use App\Infrastructure\ProjectDirEnvProcessor;
+use PHPUnit\Framework\TestCase;
+
+final class ProjectDirEnvProcessorTest extends TestCase
+{
+    public function testOnlyTheProjectDirectoryPlaceholderIsReplaced(): void
+    {
+        $processor = new ProjectDirEnvProcessor('/srv/site');
+        $read = static fn (string $name): string => match ($name) {
+            'DATABASE_URL' => 'sqlite:///%kernel.project_dir%/var/cms.db',
+            'MYSQL' => 'mysql://kunde:p%40ss%21wort@127.0.0.1:3306/kunde_db?charset=utf8mb4',
+            'MEDIA' => '%kernel.project_dir%/var/media',
+        };
+        self::assertSame('sqlite:////srv/site/var/cms.db', $processor->getEnv('projectdir', 'DATABASE_URL', $read));
+        // Prozentkodierte Zugangsdaten bleiben, wie sie sind - `resolve:` laese `%40ss%` als
+        // Parameter und liesse den Container bei jeder Anfrage abbrechen.
+        self::assertSame('mysql://kunde:p%40ss%21wort@127.0.0.1:3306/kunde_db?charset=utf8mb4', $processor->getEnv('projectdir', 'MYSQL', $read));
+        self::assertSame('/srv/site/var/media', $processor->getEnv('projectdir', 'MEDIA', $read));
+        self::assertSame(['projectdir' => 'string'], ProjectDirEnvProcessor::getProvidedTypes());
+    }
+}