Harden KantSites after the security review

- The installer only opens with a per-installation key that install.php
  creates and shows; the key is deleted with the first account.
- Lock files keep .env, the database, backups and logs out of reach when a
  domain points at the project folder instead of public/.
- Linked sections render by their own schema version, so an old section
  cannot carry unfiltered HTML into a newer page.
- Editors no longer move, trash or change areas and post data of published
  pages; a scheduled publication goes live with the revision that was
  scheduled (migration 20261012000100).
- Form stamps are bound to their form, IPv6 senders count per /64, and a
  flood per form or overall stops storing with a visible message.
- The consent redirect rejects control characters, update targets must look
  like 1.2.3, and own CSS cannot reach outside its block.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/ArchiveUpdateTest.php

@@ -272,7 +272,9 @@ final class ArchiveUpdateTest extends TestCase
         // Beiwerk, das eine laufende Installation nicht liest.
         // plugins/ ebenso Datei für Datei: mitgelieferte Plugins werden aktualisiert, ein vom
         // Betreiber installiertes bleibt stehen (ADR 102).
-        $anders = ['public', 'plugins', 'README.md', 'LICENSE', '.env.example'];
+        // Die .htaccess im Projektstamm ersetzt das Update nicht: sie kann dem Betreiber gehören.
+        // Fehlt sie, legt die Website sie selbst an (App\Ops\Protection, ADR 116).
+        $anders = ['public', 'plugins', 'README.md', 'LICENSE', '.env.example', '.htaccess'];
         foreach ($liste($mit[1]) as $eintrag) {
             self::assertContains(
                 $eintrag,