Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

cms/templates/assets/navigation.mustache

@@ -5,7 +5,7 @@
             <div class="col">
                 <ul class="nav nav-tabs flex-wrap" role="menubar">
                     <li class="nav-item" role="none">
-                        <a class="nav-link {{home_active_class}}" href="?page={{homepage}}&lang={{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
+                        <a class="nav-link {{home_active_class}}" href="/{{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
                             <i class="bi bi-house" aria-hidden="true"></i> {{homepage_title}}
                         </a>
                     </li>