Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

admin/templates/pages/media.php

@@ -8,7 +8,7 @@
 <div class="collapse mb-4" id="uploadForm">
     <div class="card shadow-sm">
         <div class="card-body">
-            <form method="POST" action="admin.php?route=media" enctype="multipart/form-data">
+            <form method="POST" action="/admin/media" enctype="multipart/form-data">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="mb-3">
                     <label for="file" class="form-label">Bestanden selecteren</label>
@@ -53,7 +53,7 @@
                     <td class="text-muted small"><?= htmlspecialchars($file['modified']) ?></td>
                     <td><code class="small"><?= htmlspecialchars($file['url']) ?></code></td>
                     <td>
-                        <form method="POST" action="admin.php?route=media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
+                        <form method="POST" action="/admin/media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
                             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                             <input type="hidden" name="delete" value="<?= htmlspecialchars($file['name']) ?>">
                             <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">