Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

cms/templates/assets/header.mustache

@@ -1,6 +1,6 @@
 <header id="site-header" class="navbar navbar-expand-lg navbar-dark" style="background-color: transparent;">
     <div class="container-fluid">
-        <a class="navbar-brand" href="?page={{default_page}}&lang={{current_lang}}">
+        <a class="navbar-brand" href="/{{current_lang}}">
             <img src="/assets/icon.svg" alt="CodePress Logo" width="32" height="32" class="me-2">
             {{site_title}}
         </a>
@@ -27,7 +27,7 @@
                 <ul class="dropdown-menu dropdown-menu-end" role="menu">
                     {{#available_langs}}
                     <li role="none">
-                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
+                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
                             {{native_name}}
                         </a>
                     </li>
@@ -47,7 +47,7 @@
             <ul class="dropdown-menu dropdown-menu-end" role="menu">
                     {{#available_langs}}
                     <li role="none">
-                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
+                        <a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
                             {{native_name}}
                         </a>
                     </li>