Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

admin/templates/pages/plugins-edit.php

@@ -1,13 +1,13 @@
 <div class="d-flex justify-content-between align-items-center mb-4">
     <h2><i class="bi bi-pencil"></i> Plugin bewerken: <?= htmlspecialchars($pluginName) ?></h2>
-    <a href="admin.php?route=plugins" class="btn btn-outline-secondary btn-sm">
+    <a href="/admin/plugins" class="btn btn-outline-secondary btn-sm">
         <i class="bi bi-arrow-left"></i> Terug
     </a>
 </div>
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="admin.php?route=plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
+        <form method="POST" action="/admin/plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="d-flex justify-content-between align-items-center mb-2">
                 <span class="badge bg-secondary">PHP</span>
@@ -21,7 +21,7 @@
                 <button type="submit" class="btn btn-primary">
                     <i class="bi bi-check-lg"></i> Opslaan
                 </button>
-                <a href="admin.php?route=plugins" class="btn btn-outline-secondary">Annuleren</a>
+                <a href="/admin/plugins" class="btn btn-outline-secondary">Annuleren</a>
             </div>
         </form>
     </div>