Harden KantSites after the security review

- The installer only opens with a per-installation key that install.php
  creates and shows; the key is deleted with the first account.
- Lock files keep .env, the database, backups and logs out of reach when a
  domain points at the project folder instead of public/.
- Linked sections render by their own schema version, so an old section
  cannot carry unfiltered HTML into a newer page.
- Editors no longer move, trash or change areas and post data of published
  pages; a scheduled publication goes live with the revision that was
  scheduled (migration 20261012000100).
- Form stamps are bound to their form, IPv6 senders count per /64, and a
  flood per form or overall stops storing with a visible message.
- The consent redirect rejects control characters, update targets must look
  like 1.2.3, and own CSS cannot reach outside its block.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Ops/Updater.php

@@ -231,6 +231,12 @@ final class Updater
         $step($steps, 'Vorprüfung', true, 'Alle Prüfungen bestanden.');
 
         $target ??= $this->availableVersion();
+        // Ein Tag der Form v1.2.3 und sonst nichts: der Wert geht an git checkout (ADR 116).
+        if (null !== $target && 1 !== preg_match('/^v\d{1,4}\.\d{1,5}\.\d{1,6}$/D', $target)) {
+            $step($steps, 'Ziel bestimmen', false, 'Das Ziel hat nicht die Form v1.2.3.');
+
+            return ['ok' => false, 'steps' => $steps, 'target' => $target];
+        }
         if (null === $target) {
             $step($steps, 'Ziel bestimmen', false, 'Die Herkunft bietet keinen Tag der Form v1.2.3 an.');
 
@@ -293,7 +299,7 @@ final class Updater
                     throw new \RuntimeException('Die alte Git-Konfiguration konnte nicht für den Updatewechsel vorbereitet werden.');
                 }
             }
-            $checkout = $this->git(['checkout', '--force', $target]);
+            $checkout = $this->git(['checkout', '--force', $target, '--']);
             $this->restoreEnvironment();
             if (!$step($steps, 'Code wechseln', $checkout['ok'], $checkout['ok'] ? 'Auf '.$target.' gewechselt.' : $checkout['output'])) {
                 throw new \RuntimeException('checkout');