Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

admin/templates/pages/plugins-new.php

@@ -34,7 +34,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="admin.php?route=plugins" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/plugins" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Aanmaken</button>
     </div>
 </form>