v2.5.1: Admin theme refactor, Navigation plugin, user roles, guide restructure

- Reorganize admin into admin/theme/default/ (views + assets)
- Rename GuideNav to Navigation plugin (essential, protected)
- Plugin assets support (SCSS/CSS) loaded after theme CSS
- User roles: Admin, Content Manager, BI Manager, Site Admin
- Role-based access control (RBAC) for admin routes and sidebar
- Guide restructure: sub-topics in separate folders with sidebar nav
- Dynamic breadcrumb for homepage and subdirectories
- Fix theme path traversal (../../ -> ../) in admin.php
- Fix CodeMirror mode load order (xml -> css -> js -> htmlmixed -> php)
- Fix editor-toolbar.js null checks for plugin edit pages
- Layout select from theme.json with live frontmatter update
- Footer sticky at bottom of viewport (min-height: 100vh)
- Breadcrumb color fix (var(--nav-font) -> var(--header-bg))
- Remove language switcher from guide pages
- Update README.md and README.en.md
- Bump version to 2.5.1

cms/router.php

@@ -50,6 +50,46 @@ if (preg_match('#^/themes/([^/]+)/(.+)$#', $path, $m)) {
     return true;
 }
 
+// Serve admin theme assets (e.g. /admin/assets/css/bootstrap.min.js)
+// Served from admin/theme/default/assets/
+if (preg_match('#^/admin/assets/(.+)$#', $path, $m)) {
+    $assetPath = $m[1];
+    $adminThemeDir = __DIR__ . '/../admin/theme/default/assets';
+    $assetFile = $adminThemeDir . '/' . $assetPath;
+    $realAdminTheme = realpath($adminThemeDir);
+    $realFile = realpath($assetFile);
+    if ($realFile && $realAdminTheme && strpos($realFile, $realAdminTheme) === 0 && is_file($realFile)) {
+        $ext = strtolower(pathinfo($realFile, PATHINFO_EXTENSION));
+        if (isset($mimeTypes[$ext])) {
+            header('Content-Type: ' . $mimeTypes[$ext]);
+        }
+        readfile($realFile);
+        return true;
+    }
+    http_response_code(404);
+    return true;
+}
+
+// Serve plugin assets (e.g. /plugins/Navigation/assets/css/navigation.css)
+if (preg_match('#^/plugins/([^/]+)/assets/(.+)$#', $path, $m)) {
+    $pluginName = $m[1];
+    $assetPath = $m[2];
+    $pluginAssetDir = __DIR__ . '/../plugins/' . $pluginName . '/assets';
+    $assetFile = $pluginAssetDir . '/' . $assetPath;
+    $realPluginDir = realpath($pluginAssetDir);
+    $realFile = realpath($assetFile);
+    if ($realFile && $realPluginDir && strpos($realFile, $realPluginDir) === 0 && is_file($realFile)) {
+        $ext = strtolower(pathinfo($realFile, PATHINFO_EXTENSION));
+        if (isset($mimeTypes[$ext])) {
+            header('Content-Type: ' . $mimeTypes[$ext]);
+        }
+        readfile($realFile);
+        return true;
+    }
+    http_response_code(404);
+    return true;
+}
+
 // Admin routes: /admin/login → admin.php?route=login
 if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
     $_GET['route'] = $m[1] ?? 'dashboard';
@@ -61,9 +101,14 @@ if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
 if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
     $_GET['lang'] = $m[1];
     if (isset($m[2]) && $m[2] !== '') {
-        $_GET['page'] = $m[2];
-        if ($_GET['page'] === 'guide') {
+        if ($m[2] === 'guide') {
+            // /nl/guide → set guide flag, keep existing ?page= from query string
             $_GET['guide'] = '1';
+            if (!isset($_GET['page'])) {
+                $_GET['page'] = '';
+            }
+        } else {
+            $_GET['page'] = $m[2];
         }
     }
     require $publicDir . '/index.php';