Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

admin/templates/pages/config.php

@@ -5,7 +5,7 @@
         <i class="bi bi-filetype-json"></i> config.json
     </div>
     <div class="card-body">
-        <form method="POST" action="admin.php?route=config">
+        <form method="POST" action="/admin/config">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="mb-3">
                 <textarea name="config_content" class="form-control font-monospace" rows="25" style="font-size: 0.9rem; tab-size: 4;"><?= htmlspecialchars($siteConfig) ?></textarea>