Media browser: recursive scan entire content/ tree, /-media/ URL prefix, editor change detection fix

- handleMediaList() now scans content/ recursively for all media files
- URLs use /-media/ prefix mapping directly to content/ (no special cases)
- index.php: added /-media/ route, kept /-assets/ for backward compat
- editor-toolbar.js: fixed editor.on('change') placement (was inside switchMode)
- content-edit.php and content-new.php: back-btn unsaved-changes detection
- Removed unused __editorCleanup global

AGENTS.md

@@ -13,7 +13,7 @@
 ## Project Structuur
 ```
 codepress/
-├── engine/
+├── cms/                            # Core CMS engine
 │   ├── core/
 │   │   ├── class/
 │   │   │   ├── CodePressCMS.php    # Hoofd CMS class
@@ -25,16 +25,17 @@ codepress/
 │   │   ├── config.php              # Config loader (leest config.json)
 │   │   └── index.php               # Bootstrap (autoloader, requires)
 │   ├── lang/                       # Taalbestanden (nl.php, en.php)
-│   └── templates/                  # Mustache templates
-│       ├── layout.mustache         # Hoofd layout (bevat inline CSS)
-│       ├── assets/
-│       │   ├── header.mustache
-│       │   ├── navigation.mustache
-│       │   └── footer.mustache
-│       ├── markdown_content.mustache
-│       ├── php_content.mustache
-│       └── html_content.mustache
-├── admin-console/                  # Admin paneel
+│   ├── templates/                  # Mustache templates
+│   │   ├── layout.mustache         # Hoofd layout (bevat inline CSS)
+│   │   ├── assets/
+│   │   │   ├── header.mustache
+│   │   │   ├── navigation.mustache
+│   │   │   └── footer.mustache
+│   │   ├── markdown_content.mustache
+│   │   ├── php_content.mustache
+│   │   └── html_content.mustache
+│   └── router.php                  # PHP dev server router
+├── admin/                          # Admin paneel
 │   ├── config/
 │   │   ├── app.php                # Admin app configuratie
 │   │   └── admin.json             # Gebruikers & security (file-based)
@@ -48,10 +49,18 @@ codepress/
 │   │       ├── content.php
 │   │       ├── content-edit.php
 │   │       ├── content-new.php
+│   │       ├── content-dir-form.php
 │   │       ├── config.php
 │   │       ├── plugins.php
+│   │       ├── plugin-config.php
 │   │       └── users.php
 │   └── storage/logs/              # Admin logs
+├── cli/                            # CLI scripts & tests
+│   └── test/
+│       ├── accessibility.sh        # WCAG 2.1 AA test suite
+│       ├── enhanced-suite.sh       # Enhanced test suite
+│       ├── functional/             # Functionele testen
+│       └── pentest/                # Penetratietesten
 ├── plugins/                        # CMS plugins
 │   ├── HTMLBlock/
 │   └── MQTTTracker/
@@ -61,8 +70,8 @@ codepress/
 │   └── admin.php                  # Admin entry point + router
 ├── content/                        # Content bestanden
 ├── guide/                          # Handleidingen (nl/en)
+├── docs/                           # Documentatie
 ├── config.json                     # Site configuratie
-├── TODO.md                         # Openstaande verbeteringen
 └── AGENTS.md                       # Dit bestand
 ```
 
@@ -70,12 +79,12 @@ codepress/
 - **PHP Standards**: Follow PSR-12. Use 4 spaces for indentation.
 - **Naming**: Classes `PascalCase` (e.g., `CodePressCMS`), methods `camelCase` (e.g., `renderMenu`), variables `camelCase`, config keys `snake_case`.
 - **Architecture**: 
-  - Core CMS logic in `engine/core/class/CodePressCMS.php`
-  - Bootstrap/requires in `engine/core/index.php`
-  - Configuration loaded from `config.json` via `engine/core/config.php`
+  - Core CMS logic in `cms/core/class/CodePressCMS.php`
+  - Bootstrap/requires in `cms/core/index.php`
+  - Configuration loaded from `config.json` via `cms/core/config.php`
   - Public website entry point: `public/index.php`
   - Admin entry point + routing: `public/admin.php`
-  - Admin authenticatie: `admin-console/src/AdminAuth.php`
+  - Admin authenticatie: `admin/src/AdminAuth.php`
 - **Content**: Stored in `content/`. Supports `.md` (Markdown), `.php` (Dynamic), `.html` (Static).
 - **Templating**: Mustache-style `{{placeholder}}` in `templates/layout.mustache` via `SimpleTemplate.php`.
 - **Navigation**: Auto-generated from directory structure. Folders require an index file to be clickable in breadcrumbs.
@@ -87,11 +96,11 @@ codepress/
 - **Git**: `main` is the clean CMS core. `development` is de actieve development branch. `e.noorlander` bevat persoonlijke content. Niet mixen.
 
 ## Admin Console
-- **File-based**: Geen database. Gebruikers opgeslagen in `admin-console/config/admin.json`
+- **File-based**: Geen database. Gebruikers opgeslagen in `admin/config/admin.json`
 - **Routing**: Via `?route=` parameter in `public/admin.php`
-- **Routes**: `login`, `logout`, `dashboard`, `content`, `content-edit`, `content-new`, `content-delete`, `config`, `plugins`, `users`
+- **Routes**: `login`, `logout`, `dashboard`, `content`, `content-edit`, `content-new`, `content-delete`, `config`, `plugins`, `plugins-new`, `plugins-edit`, `plugins-config`, `plugins-toggle`, `plugins-delete`, `users`
 - **Auth**: Session-based. `AdminAuth` class handelt login, logout, CSRF, brute-force lockout af
-- **Templates**: Pure PHP templates in `admin-console/templates/pages/`. Layout in `layout.php`
+- **Templates**: Pure PHP templates in `admin/templates/pages/`. Layout in `layout.php`
 
 ## Important: Title vs File/Directory Name Logic
 - **CRITICAL**: When user asks for "title" corrections, they usually mean **FILE/DIRECTORY NAME WITHOUT LANGUAGE PREFIX AND EXTENSIONS**, not the HTML title from content!
@@ -107,4 +116,4 @@ codepress/
 - LSP errors over "Undefined function" in PHP files zijn vals-positief (standaard PHP functies worden niet herkend door de LSP). Negeer deze.
 - Zie `TODO.md` voor alle openstaande verbeteringen en nieuwe features.
 - `vendor/` map bevat Composer dependencies (CommonMark, Mustache). Niet handmatig wijzigen.
-- `admin-console/config/admin.json` bevat wachtwoord-hashes. Niet committen met echte productie-wachtwoorden.
+- `admin/config/admin.json` bevat wachtwoord-hashes. Niet committen met echte productie-wachtwoorden.