Media browser: recursive scan entire content/ tree, /-media/ URL prefix, editor change detection fix

- handleMediaList() now scans content/ recursively for all media files
- URLs use /-media/ prefix mapping directly to content/ (no special cases)
- index.php: added /-media/ route, kept /-assets/ for backward compat
- editor-toolbar.js: fixed editor.on('change') placement (was inside switchMode)
- content-edit.php and content-new.php: back-btn unsaved-changes detection
- Removed unused __editorCleanup global

cli/test/pentest/pentest.sh

@@ -133,7 +133,7 @@ test_vulnerability \
 
 test_vulnerability \
     "Path traversal - config access" \
-    "$TARGET/?page=../engine/core/config" \
+    "$TARGET/?page=../cms/core/config" \
     "content_dir" \
     "true"