Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

AGENTS.md

@@ -5,7 +5,7 @@
 - Sessie gestart: 16 feb 2026
 
 ## Build & Run
-- **Run Server**: `php -S localhost:8080 -t public`
+- **Run Server**: `php -S localhost:8080 cms/router.php` (router nodig voor clean URLs)
 - **Lint PHP**: `find . -name "*.php" -not -path "./vendor/*" -exec php -l {} \;`
 - **Dependencies**: Composer vereist voor CommonMark. Geen NPM.
 - **Admin Console**: Toegankelijk op `/admin.php` (standaard login: `admin` / `admin`)