Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/editor-model.test.mjs

@@ -192,7 +192,7 @@ test('plugin blocks stay movable and intact while the editor refuses to fill or
   assert.deepEqual(JSON.parse(JSON.stringify(history.document)).blocks.find(b => b.id === 'p1'), plugin);
 });
 
-test('the post list block carries only its filter, lifts the schema to v5 and undoes atomically', () => {
+test('the post list block carries only its filter, lifts the schema to v18 and undoes atomically', () => {
   const history = new EditorHistory(fixture());
   const id = history.change(doc => insertBlock(doc, 'postlist', 's2'));
   const block = locate(history.document.blocks, id).block;
@@ -200,7 +200,8 @@ test('the post list block carries only its filter, lifts the schema to v5 and un
   // Content is the filter and the count; the posts themselves are added when the page is served.
   assert.deepEqual(block.props, { count: 3, category: '', tag: '', layout: 'karten' });
   assert.equal(block.children, undefined);
-  assert.equal(history.document.schemaVersion, 5);
+  // v18, weil der Server die Darstellung "karten" erst ab dieser Fassung annimmt.
+  assert.equal(history.document.schemaVersion, 18);
 
   // Nothing can be nested inside it, and it does not swallow a following block.
   assert.equal(canContain(block, { type: 'text' }), false);
@@ -431,7 +432,10 @@ test('a current document still accepts new blocks, and every block type can be i
   }
 
   // Jeder Typ, der eine Fassung anhebt, landet tatsächlich im Dokument.
-  for (const [type, needed] of [['gallery', 3], ['postlist', 5], ['quote', 6], ['tabs', 7], ['form', 8], ['breadcrumb', 9], ['menu', 11], ['embed', 14], ['icon', 15], ['progress', 15], ['slider', 15]]) {
+  // Die Zahlen sind die des Servers fuer die Eigenschaften, die createBlock setzt (Beitragsliste
+  // mit Darstellung: v18, Menue mit Art: v16, Slider mit Punkten: v17) - nicht die erste Fassung,
+  // die den Typ kannte.
+  for (const [type, needed] of [['gallery', 3], ['postlist', 18], ['quote', 6], ['tabs', 7], ['form', 8], ['breadcrumb', 9], ['menu', 16], ['partialref', 11], ['embed', 14], ['icon', 15], ['progress', 15], ['slider', 17], ['social', 23]]) {
     const history = new EditorHistory(fixture());
     const id = history.change(doc => insertBlock(doc, type, 's2'));
     assert.ok(locate(history.document.blocks, id), `${type} wird eingefügt`);