Clean URLs and security improvements

- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off

public/.htaccess

@@ -1,50 +1,44 @@
 # Disable directory listing
 Options -Indexes
 
-# Security - Block access to sensitive files and directories
+# Security - Block sensitive files
 <Files ~ "^\.">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </Files>
 
 <FilesMatch "\.(ini|log|conf|config|map)$">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </FilesMatch>
 
-# Block access to backup files
 <FilesMatch "\.(backup|bak|old|orig|swp|save)$">
-    Order allow,deny
-    Deny from all
+    Require all denied
 </FilesMatch>
 
-# URL Routing - Route all requests to index.php
 <IfModule mod_rewrite.c>
     RewriteEngine On
-    
-    # Set base directory
     RewriteBase /
-    
-    # Block direct access to PHP files in content directory
-    RewriteRule ^content/.*\.php$ - [F,L]
-    
-    # Route all non-file/non-directory requests to index.php
-    RewriteCond %{REQUEST_FILENAME} !-f
-    RewriteCond %{REQUEST_FILENAME} !-d
-    RewriteRule ^(.*)$ index.php [QSA,L]
-    
-    # Allow access to assets
+
+    # Admin routes: /admin/login → admin.php?route=login
+    RewriteRule ^admin$ admin.php?route=dashboard [L,QSA]
+    RewriteRule ^admin/(.+)$ admin.php?route=$1 [L,QSA]
+
+    # Language-prefixed page routes: /nl, /en, /nl/page/path
+    RewriteRule ^(nl|en)/?$ index.php?lang=$1 [L,QSA]
+    RewriteRule ^(nl|en)/(.+)$ index.php?lang=$1&page=$2 [L,QSA]
+
+    # Root
+    RewriteRule ^$ index.php [L]
+
+    # Serve existing static files directly
     RewriteCond %{REQUEST_FILENAME} -f
-    RewriteRule ^assets/.*$ - [L]
-    
-    # Allow access to content assets
-    RewriteRule ^content/assets/.*$ - [L]
-    
-    # Serve files from content/-assets/ via index.php
-    RewriteRule ^-assets/.*$ index.php [L]
-    
-    # Block direct access to all other content files
-    RewriteRule ^content/.*$ - [F,L]
+    RewriteRule ^ - [L]
+
+    # Block directory listing for remaining physical dirs
+    RewriteCond %{REQUEST_FILENAME} -d
+    RewriteRule ^ - [F]
+
+    # Fallback to index.php
+    RewriteRule ^(.*)$ index.php [L,QSA]
 </IfModule>
 
 # Security headers
@@ -53,21 +47,17 @@ Options -Indexes
     Header always set X-Frame-Options DENY
     Header always set X-XSS-Protection "1; mode=block"
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';"
 </IfModule>
 
-# PHP settings
 <IfModule mod_php.c>
     php_flag display_errors Off
     php_flag log_errors On
-    php_value error_log /var/log/php_errors.log
     php_value max_execution_time 30
     php_value memory_limit 128M
     php_value upload_max_filesize 10M
     php_value post_max_size 10M
 </IfModule>
 
-# Default index file
 DirectoryIndex index.php
-
-# Error handling
-ErrorDocument 404 /index.php
+ErrorDocument 404 /index.php