Rebuild DEEG as a fifth installation, add stepped forms and a plugin system, and clear the review backlog

Forms gained steps, conditions, image choices, number fields with units and a
summary step; the DEEG price finder uses all of it. Plugins are manifest plus
Twig: blocks, settings, containers, routes, presets and theme packs, switched
per installation. The review backlog is done: archive pages render through the
normal page pipeline, forms and post lists work inside areas and sections,
repeated sections get their own ids, breakpoints and colours come from the
palette, backup and update work on MySQL and lock each other out.

The task worker no longer shortens a process that has no time limit:
set_time_limit() sets the limit instead of extending it, which turned an
unlimited CLI run into eighty seconds and killed the full test suite far away
from the scheduler.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Ops/Download.php

@@ -46,6 +46,66 @@ class Download
         return $this->grund;
     }
 
+    /**
+     * Holt die Adresse direkt in eine Datei - fuer Archive, die nicht als Zeichenkette in den
+     * Speicher passen sollen. Ohne curl geht es ueber get(); dann ist der Speicher die Grenze.
+     */
+    public function toFile(string $url, string $path): bool
+    {
+        $this->grund = '';
+        if (!str_starts_with($url, 'https://')) {
+            $this->grund = 'Nur HTTPS-Adressen werden geholt.';
+
+            return false;
+        }
+        if (function_exists('curl_init')) {
+            $datei = @fopen($path, 'w');
+            if (!is_resource($datei)) {
+                $this->grund = 'Die Zieldatei ließ sich nicht anlegen: '.$path;
+
+                return false;
+            }
+            $curl = curl_init($url);
+            curl_setopt_array($curl, [
+                CURLOPT_FILE => $datei,
+                CURLOPT_FOLLOWLOCATION => true,
+                CURLOPT_MAXREDIRS => 3,
+                CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
+                CURLOPT_REDIR_PROTOCOLS => CURLPROTO_HTTPS,
+                CURLOPT_SSL_VERIFYPEER => true,
+                CURLOPT_SSL_VERIFYHOST => 2,
+                CURLOPT_CONNECTTIMEOUT => $this->connectTimeout,
+                CURLOPT_TIMEOUT => $this->timeout,
+                CURLOPT_USERAGENT => 'KantSites-Updater',
+            ]);
+            $ok = curl_exec($curl);
+            $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
+            $fehler = curl_errno($curl);
+            $text = curl_error($curl);
+            curl_close($curl);
+            fclose($datei);
+            if (true === $ok && 200 === $status && (int) filesize($path) > 0) {
+                return true;
+            }
+            @unlink($path);
+            if (!in_array($fehler, self::ZERTIFIKATSFEHLER, true)) {
+                $this->grund = match (true) {
+                    0 !== $fehler => 'Die Verbindung kam nicht zustande: '.$text,
+                    0 === $status => 'Der Server hat nicht geantwortet.',
+                    default => sprintf('Die Adresse antwortet mit %d statt 200.', $status),
+                };
+
+                return false;
+            }
+        }
+        $inhalt = $this->get($url);
+        if (null === $inhalt || '' === $inhalt) {
+            return false;
+        }
+
+        return false !== file_put_contents($path, $inhalt);
+    }
+
     /** Den Inhalt der Adresse, oder null wenn sie nicht mit 200 antwortet. */
     public function get(string $url): ?string
     {