Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

cms/router.php

@@ -1,59 +1,53 @@
 <?php
-// Router file for PHP development server to handle security and static files
+// Router file for PHP development server - clean URL support + static file serving
 
 $requestUri = $_SERVER['REQUEST_URI'];
 $parsedUrl = parse_url($requestUri);
-$path = $parsedUrl['path'];
+$path = $parsedUrl['path'] ?? '/';
+$path = rtrim($path, '/') ?: '/';
+$publicDir = __DIR__ . '/../public';
 
-// Block direct access to content directory
-if (strpos($path, '/content/') === 0) {
-    http_response_code(403);
-    echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
+$mimeTypes = [
+    'css' => 'text/css',
+    'js'  => 'application/javascript',
+    'svg' => 'image/svg+xml',
+    'png' => 'image/png',
+    'jpg' => 'image/jpeg',
+    'ico' => 'image/x-icon',
+    'woff' => 'font/woff',
+    'woff2' => 'font/woff2',
+    'json' => 'application/json',
+];
+
+// Serve static files from public/
+$filePath = $publicDir . $path;
+if (is_file($filePath)) {
+    $ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
+    if (isset($mimeTypes[$ext])) {
+        header('Content-Type: ' . $mimeTypes[$ext]);
+    }
+    readfile($filePath);
     return true;
 }
 
-// Block PHP execution in content directory
-if (preg_match('/\.php$/i', $path) && strpos($path, '/content/') !== false) {
-    http_response_code(403);
-    echo '<h1>403 - Forbidden</h1><p>PHP execution not allowed in content directory.</p>';
+// Admin routes: /admin/login → admin.php?route=login
+if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
+    $_GET['route'] = $m[1] ?? 'dashboard';
+    require $publicDir . '/admin.php';
     return true;
 }
 
-// Block access to sensitive files
-$sensitiveFiles = ['.htaccess', 'config.php'];
-foreach ($sensitiveFiles as $file) {
-    if (basename($path) === $file && dirname($path) === '/') {
-        http_response_code(403);
-        echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
-        return true;
+// Language-prefixed routes: /nl/page/path → index.php?lang=nl&page=page/path
+if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
+    $_GET['lang'] = $m[1];
+    $_GET['page'] = $m[2] ?? 'index';
+    if ($_GET['page'] === 'guide') {
+        $_GET['guide'] = '1';
     }
+    require $publicDir . '/index.php';
+    return true;
 }
 
-// Serve static files from engine/assets
-if (strpos($path, '/engine/') === 0) {
-    $filePath = __DIR__ . $path;
-    if (file_exists($filePath)) {
-        // Set appropriate content type
-        $extension = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
-        $mimeTypes = [
-            'css' => 'text/css',
-            'js' => 'application/javascript',
-            'svg' => 'image/svg+xml',
-            'woff' => 'font/woff',
-            'woff2' => 'font/woff2',
-            'ttf' => 'font/ttf'
-        ];
-        
-        if (isset($mimeTypes[$extension])) {
-            header('Content-Type: ' . $mimeTypes[$extension]);
-        }
-        
-        // Serve the file
-        readfile($filePath);
-        return true;
-    }
-}
-
-// Route all other requests to index.php
-include __DIR__ . '/index.php';
+// Root or unknown → index.php
+require $publicDir . '/index.php';
 return true;