Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

admin/templates/pages/content-edit.php

@@ -2,7 +2,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="admin.php?route=content-edit&file=<?= urlencode($file) ?>" id="editor-form">
+        <form method="POST" action="/admin/content-edit&file=<?= urlencode($file) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="row mb-3">
                 <div class="col-md-4">
@@ -48,7 +48,7 @@
                 <button type="submit" class="btn btn-primary">
                     <i class="bi bi-check-lg"></i> Opslaan
                 </button>
-                <a href="admin.php?route=content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
+                <a href="/admin/content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
             </div>
         </form>
     </div>
@@ -172,7 +172,7 @@ document.addEventListener('DOMContentLoaded', function () {
         document.getElementById('media-size-form').classList.add('d-none');
         document.getElementById('media-grid').classList.remove('d-none');
         pendingFile = null;
-        fetch('admin.php?route=media-list')
+        fetch('/admin/media-list')
             .then(function (r) { return r.json(); })
             .then(function (files) {
                 var grid = document.getElementById('media-grid');
@@ -288,7 +288,7 @@ document.addEventListener('DOMContentLoaded', function () {
         var formData = new FormData(form);
         formData.append('csrf_token', '<?= $csrf ?>');
 
-        fetch('admin.php?route=media', { method: 'POST', body: formData })
+        fetch('/admin/media', { method: 'POST', body: formData })
             .then(function () {
                 form.reset();
                 document.getElementById('media-upload-btn').disabled = true;