История коммитов

Published assets and language flags are served over HTTP, so they resolve from
PUBLIC_THEMES_PATH. The list of available themes keeps using THEMES_PATH: it is
built from the theme templates, which stay outside the document root.

Assets and avatars are served from the document root, so their URLs are
relative to PUBLIC_PATH rather than to the repository root.

Three independent implementations mapped a filesystem path to a URL. They now
delegate to PublicUrlResolver and keep their signatures.

This also fixes pathToUrl(): it diffed the path segments against the root ones,
so /upload/app/photo.jpg under the /var/www/app root silently lost the app
directory. Paths outside of the base path now resolve to an empty string
instead of a mangled URL.

PUBLIC_PATH marks the web document root. It equals ROOT_PATH for now, so the
values of every constant stay exactly as they were, and ASSETS_PATH,
UPLOAD_PATH and the new PUBLIC_THEMES_PATH are derived from it.

THEMES_PATH keeps pointing at the repository root: most of its usages resolve
templates, which stay outside the document root.

Remove 14 one-off scripts, none of which were referenced from the code:
they were meant to be run manually by URL.

- updaters and converters for 8.0 to 9.9
- module installation scripts for 9.9

The upgrade path is 9.8 -> 9.9 -> 10.0, so these scripts stay available in
the 9.x branch together with their documentation. The install directory is
now a plain web installer.

BREAKING CHANGE: installing a module on an existing database has no tool in
10.x anymore.

- assets/modules/album/image.php: no incoming references anywhere in the repository
- assets/modules/downloads/rating.php: no incoming references and already broken,
it reads vote.gif relative to the current working directory

Reset the changelog for the new major branch: 10.x history starts fresh
with an Unreleased section, and the 9.x and earlier history stays in the
9.x branch, linked from the header. Record the vendor directory move as
the first breaking change.

- drop the custom vendor-dir (system/vendor) from composer.json
- ignore /vendor instead of /system/vendor
- update autoload paths in system/bootstrap.php, tests/bootstrap.php, install/index.php and assets/modules/downloads/preview.php
- update psalm ignore and stub paths

The custom-control classes were removed in Bootstrap 5, so all 65 checkboxes and radios in the admin templates rendered as unstyled browser controls.

Bootstrap 5 requires the bs- prefix on data attributes, so data-dismiss and data-parent were doing nothing: modal close buttons did not close the dialog and sidebar accordion sections did not collapse each other. Also replaces the removed .close class with .btn-close.