Serve the editor from feuerwerk.nockal.com as well

The subdomain proxies to the same folder, but the build had the path
/feuerwerk/ baked in. On feuerwerk.nockal.com the page loaded its
assets, the API and the data URLs from /feuerwerk/... and got 404. The
session cookie had Path=/feuerwerk/, so the browser would never have
sent it to /api/ there either.

- site.ts takes the base path from the folder of the open page:
  /feuerwerk/ on nockal.com, / on the subdomain. Release links point at
  the address you are working on.
- vite.config.ts builds with a relative base. The copy plugin rewrites
  the pages to ./dist/assets/ and stops the build if it finds nothing
  to rewrite. The dev server now runs at http://localhost:5175/.
- Auth.php sets the cookie without a Path, so it belongs to the API
  folder the browser sees. Sign-in and sign-out also clear the old
  /feuerwerk/ cookie, otherwise it would keep signing in after a
  logout. Existing sessions stay valid.
- README: the new dev server address.

Tests:
- curl on both addresses: pages, JS, CSS and API 200
- sign-in, session, sign-out on both addresses
- e2e 70 against both addresses: 13/13 each, no CSP violation
- tsc, lint, prettier clean, site and releases tests 14/14
- PHP tests 7 of 8 files green, videos.test.php fails only because
  the web-php-fpm container has no ffmpeg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/Auth.php

@@ -109,19 +109,29 @@ final class Auth
         return (string) ($_COOKIE[SessionStore::COOKIE] ?? '');
     }
 
+    /**
+     * The cookie has no `Path`: the browser takes the folder of the API as it sees it, which is
+     * `/feuerwerk/api` on nockal.com and `/api` on feuerwerk.nockal.com. nginx sees the second as
+     * the first, so no path this side writes down would be right for both. The editor's pages and
+     * the data never needed the cookie.
+     *
+     * Before that, the cookie was set for the whole site (`/feuerwerk/`). Such an old one is ended
+     * with every new one, or it would still sign a browser in after signing out.
+     */
     private function setCookie(string $value, int $expires): void
     {
-        setcookie(SessionStore::COOKIE, $value, [
+        $options = [
             'expires' => $expires,
-            'path' => self::basePath(),
             'httponly' => true,
             'samesite' => 'Lax',
             'secure' => ($_SERVER['HTTPS'] ?? '') !== '',
-        ]);
+        ];
+        setcookie(SessionStore::COOKIE, $value, $options);
+        setcookie(SessionStore::COOKIE, '', ['expires' => time() - 3600, 'path' => self::basePath()] + $options);
     }
 
     /**
-     * The path the editor is served under (`/feuerwerk/`), read off the script rather than
+     * The path the old cookie was set for (`/feuerwerk/`), read off the script rather than
      * written down: the same checkout answers under a different prefix in CI.
      */
     private static function basePath(): string