refactor(core): rexstan + namespace baseline

[skerbis]

Part 1 of stacked PRs for #86.

Scope:

• Core PHP refactor/cleanup for rexstan compatibility
• Namespace baseline and related structural updates
• Boot/install/update/package adjustments that belong to core layer

Solved issues:

• Closes Inputfelder werden nicht gespeichert bei «Anzeige in eigenem Tab» #85
• Fixes Massig PHP-Meldungen im Log bei neuer Installation #84

How and why:

• Inputfelder werden nicht gespeichert bei «Anzeige in eigenem Tab» #85 (Metainfo im eigenen Tab speichert nicht):
  • How: Der Metainfo-Tab-Flow wurde auf den aktuellen REDAXO-Content-Workflow ausgerichtet (Subpage-Registrierung über PAGES_PREPARED, saubere Sidebar-Entkopplung, stabilere Context/ctype-Guards).
  • Why: In REDAXO 5.21.4+ führten inkonsistente Zustände im alten Flow dazu, dass Formzustand/Save-Route nicht mehr zuverlässig zusammenpassten.
• Massig PHP-Meldungen im Log bei neuer Installation #84 (Deprecated-Warnungen / PHP 8.4 DOM-Thema):
  • How: DOM-Verarbeitung wurde auf die moderne API ausgerichtet und defensive Guards ergänzt.
  • Why: Die alte mbstring-Entitätsverarbeitung ist deprecated; der neue Ansatz reduziert Log-Spam und ist zukunftssicher für aktuelle PHP-/REDAXO-Versionen.
• Sicherheits-/Stabilitäts-Härtung im Core-Layer:
  • How: Sichere JSON-Einbettung (JSON_HEX_*) und Namespace-/Legacy-Kompatibilität für den Übergang innerhalb des Stacks.
  • Why: Verhindert JS-Breakage/XSS-Kantenfälle und vermeidet Runtime-Fatals während der gestaffelten Migration.

Base: master
Next stacked PR: stack/02-backend

[Copilot]

Pull request overview

This PR is the first step of the 2.0.0 core refactor to establish a namespace baseline and adjust addon boot/install/update logic for rexstan/PHPStan compatibility and newer REDAXO versions.

Changes:

• Introduces FriendsOfREDAXO\StructureTweaks namespace and adds type hints / safer SQL parameter binding in core classes.
• Updates backend injection scripts (adds CSP nonce) and modernizes meta-info handling.
• Adjusts packaging + install/update execution paths for the 2.0.0 line.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
update.php	Adds lib loading in update context to ensure classes are available during update runs.
package.yml	Bumps to 2.0.0, updates requirements, and tweaks backend page/subpage configuration.
lib/move_metainfo.php	Namespacing + typing, safer SQL binding, and some runtime guards.
lib/move_metainfo_to_tab.php	Namespacing + typing, moves meta-info handling to DOM HTMLDocument approach.
lib/hide_startarticle.php	Namespacing + typing; CSP nonce added to injected script.
lib/hide_category_functions.php	Namespacing + typing; CSP nonce added to injected scripts; simplifies legacy handling.
lib/category_splitter.php	Namespacing + typing; CSP nonce added; emits splitter config to JS.
lib/base.php	Namespaces base class and adds typing/return shaping for shared helpers.
install.php	Uses __DIR__ to include update on reinstall.
boot.php	Adds use imports and simplifies meta-info config toggle logic.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[skerbis]

Addressed Copilot review comments in follow-up commit 2795542:

• package.yml: changed subpage key from itemClass to itemclass.
• Added backwards-compatible global alias for structure_tweaks_base to avoid fatal errors for still-global classes loaded from master context.
• boot.php: made hide-categories init compatible with both namespaced and legacy global class.
• Hardened inline JSON embedding in JS snippets (category_splitter, hide_startarticle, hide_category_functions) using JSON_HEX_* flags and string fallback.
• Guarded template_attributes / ctype handling in move_metainfo with array checks.

Stack branches were rebased afterwards to keep the chain consistent:

• stack/02-backend rebased onto updated stack/01-core
• stack/03-docs rebased onto updated stack/02-backend