chore: adopt shared Guiding Light configs and fix conformance gaps

Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).

PHP toolchain (§1)
  - require.php  >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
    constraint also permitted PHP 9, which is not a promise we can keep.
    composer.lock regenerated with --lock: content-hash + platform-overrides
    only, zero dependency version movement.
  - friendsofphp/php-cs-fixer  * -> ^3.95. A wildcard meant CI was not
    reproducible.

PHPStan (§2.2)
  - vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
    187 errors are captured rather than fixed; the baseline should only shrink
    from here.
  - add phpstan/phpstan:^2.1 to require-dev.

Code style (§8.2)
  - vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
    declare_strict_types) and apply it: 59 of 67 files reformatted.
  - Verified this is a formatting change, not a behaviour change: all 313 tests
    pass after the reformat, all in_array() calls already passed strict=true,
    and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
    self:: over the class name).

Repository layout (§4.4)
  - docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
    example.env becoming the conventional .env.example. This is the layout
    GUIDING-LIGHT already cites preauth as doing correctly — it just needed
    renaming.
  - update the four readme.md references and a stale compose.yaml comment.
  - docs/v1.1-plan.md references are left alone deliberately: it is a historical
    plan recording what was done at the time, not live documentation.

Licence and security policy (§7)
  - add LICENSE (uniform MIT, matching composer.json).
  - add SECURITY.md describing the actual threat model: per-request
    allow/intercept, no caching of the login flow, app-set security headers,
    TOTP, and the fact that REMOTE_USER is trusted input.

Mobile accessibility (§3.3a)
  - templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
    preauth was the one app already past the font-size precondition (controls
    render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
    restores pinch-zoom for Android users.

Conformance tooling (§8.2)
  - vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
    from a checkout rather than fetching from the LAN-only private/ci.
  - .editorconfig synced from the version that keeps the Caddyfile tab rule.

Not included (blocked by the .gitea/workflows pre-receive hook):
  - ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
    Workflow files may only change via a trusted ref, so the caller files are
    staged but not committed.

Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.

tests/Functional/PublicAccessFlowTest.php

@@ -27,6 +27,7 @@ final class PublicAccessFlowTest extends WebTestCase
     {
         $client = parent::createClient($options, $server);
         $client->disableReboot();
+
         return $client;
     }
 
@@ -37,13 +38,14 @@ final class PublicAccessFlowTest extends WebTestCase
 
     private function encodePayload(array $data): string
     {
-        $json = json_encode($data, JSON_THROW_ON_ERROR);
+        $json = json_encode($data, \JSON_THROW_ON_ERROR);
+
         return rtrim(strtr(base64_encode($json), '+/', '-_'), '=');
     }
 
     /* ── public path accessible without auth ───────────────────────────── */
 
-    public function testPublicPathAccessibleWithoutAuthentication(): void
+    public function test_public_path_accessible_without_authentication(): void
     {
         $client = static::createClient();
         $client->request('GET', '/public/some-repo');
@@ -54,7 +56,7 @@ final class PublicAccessFlowTest extends WebTestCase
         self::assertFalse($response->headers->has('Remote-User'));
     }
 
-    public function testPublicPathWithQuerystringAccessible(): void
+    public function test_public_path_with_querystring_accessible(): void
     {
         $client = static::createClient();
         $client->request('GET', '/public/repo?tab=issues&page=2');
@@ -62,7 +64,7 @@ final class PublicAccessFlowTest extends WebTestCase
         self::assertSame(200, $client->getResponse()->getStatusCode());
     }
 
-    public function testDeepPublicPathAccessible(): void
+    public function test_deep_public_path_accessible(): void
     {
         $client = static::createClient();
         $client->request('GET', '/public/org/repo/issues/42');
@@ -72,7 +74,7 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── non-public path requires auth ─────────────────────────────────── */
 
-    public function testNonPublicPathShowsLoginPage(): void
+    public function test_non_public_path_shows_login_page(): void
     {
         $client = static::createClient();
         $client->request('GET', '/private/settings');
@@ -81,7 +83,7 @@ final class PublicAccessFlowTest extends WebTestCase
         self::assertSelectorExists('form#preauth-form');
     }
 
-    public function testRootPathShowsLoginPage(): void
+    public function test_root_path_shows_login_page(): void
     {
         $client = static::createClient();
         $client->request('GET', '/');
@@ -89,7 +91,7 @@ final class PublicAccessFlowTest extends WebTestCase
         self::assertSame(401, $client->getResponse()->getStatusCode());
     }
 
-    public function testExactPublicPathWithoutSlashNotMatched(): void
+    public function test_exact_public_path_without_slash_not_matched(): void
     {
         // /public/** does NOT match /public (no trailing content)
         $client = static::createClient();
@@ -100,17 +102,17 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── rate limiting ─────────────────────────────────────────────────── */
 
-    public function testRateLimitEnforcedAfterBurstExceeded(): void
+    public function test_rate_limit_enforced_after_burst_exceeded(): void
     {
         $client = static::createClient();
 
         // PUBLIC_BURST_COUNT=3 — first 3 requests succeed
-        for ($i = 0; $i < 3; $i++) {
+        for ($i = 0; $i < 3; ++$i) {
             $client->request('GET', '/public/repo');
             self::assertSame(
                 200,
                 $client->getResponse()->getStatusCode(),
-                "Request $i should have been allowed"
+                "Request $i should have been allowed",
             );
         }
 
@@ -125,12 +127,12 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── authenticated user bypasses public rate limiter ───────────────── */
 
-    public function testAuthenticatedUserBypassesPublicRateLimit(): void
+    public function test_authenticated_user_bypasses_public_rate_limit(): void
     {
         $client = static::createClient();
 
         // First, exhaust the public rate limiter
-        for ($i = 0; $i < 4; $i++) {
+        for ($i = 0; $i < 4; ++$i) {
             $client->request('GET', '/public/repo');
         }
         // Confirm rate limit is in effect
@@ -145,10 +147,10 @@ final class PublicAccessFlowTest extends WebTestCase
 
         $client->request('GET', '/private', [], [], [
             'HTTP_X-Preauth' => $this->encodePayload([
-                'id'    => 'alice',
+                'id' => 'alice',
                 'token' => $this->validTotpCode(),
                 'nonce' => $nonce,
-                'json'  => true,
+                'json' => true,
             ]),
         ]);
         self::assertSame(303, $client->getResponse()->getStatusCode());
@@ -166,7 +168,7 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── 200 response has correct content type ─────────────────────────── */
 
-    public function testPublicAccessResponseIsPlainText(): void
+    public function test_public_access_response_is_plain_text(): void
     {
         $client = static::createClient();
         $client->request('GET', '/public/repo');
@@ -178,12 +180,12 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── 429 response renders error template ───────────────────────────── */
 
-    public function testRateLimitedResponseRendersErrorTemplate(): void
+    public function test_rate_limited_response_renders_error_template(): void
     {
         $client = static::createClient();
 
         // Exhaust rate limit
-        for ($i = 0; $i < 4; $i++) {
+        for ($i = 0; $i < 4; ++$i) {
             $client->request('GET', '/public/repo');
         }
 
@@ -198,7 +200,7 @@ final class PublicAccessFlowTest extends WebTestCase
 
     /* ── security headers still applied to public responses ────────────── */
 
-    public function testSecurityHeadersOnPublicAccess(): void
+    public function test_security_headers_on_public_access(): void
     {
         $client = static::createClient();
         $client->request('GET', '/public/repo');