Prepare the application skeleton for CakePHP 6

[josbeir]

Prepare the application skeleton for CakePHP 6 and PHP 8.5+, using controller attributes for routing and public/ as the webserver document root.

Changes

• Incorporate #1055: rename webroot/ to public/, including the front controller, static assets and Apache rewrite file. Update application paths, root rewrites and setup instructions; remove the old directory.
• Update dependencies to CakePHP 6, Migrations 6.x-dev, Bake 4, DebugKit 6, CodeSniffer 6 and PHPUnit 13. Update the PHPUnit XML schema to 13.0. The skeleton and its tests require PHP 8.5+.
• Connect / and /pages/* using two #[Get] attributes on PagesController::display(), with DashedRoute inherited from AppController.
• Bootstrap attribute routing in Application::routes(). Keep a minimal config/routes.php with a commented conventional route example, loaded through a direct parent::routes() call. The framework handles a missing file. The file remains optional and can be deleted.
• Configure attribute metadata caching for production and disable persistent caching in debug mode. Document the attribute resolver options in config/app.php.
• Update the container interface, run lowest and highest dependency jobs on PHP 8.5, and update documentation and the welcome page’s PHP requirement.
• Test named routes, optional route configuration with and without a file, missing pages, traversal protection, routing constraints and CSRF handling.

Dependencies

This PR remains a draft until these upstream fixes merge:

• Migrations #1121: CakePHP 6 dependencies and runtime compatibility.
• CakePHP #19663: repeated route attributes on one action.
• CakePHP #19665: optional loading of config/routes.php in BaseApplication.

CI currently stops at Composer because the published Migrations 6.x branch requires CakePHP 5 components. Once installation is unblocked, the route tests also need the framework fixes.

Validation

Tested locally on PHP 8.5.11 with all three upstream fixes applied in a temporary installation:

• Highest dependencies / PHPUnit 13.4.1: 15 tests, 39 assertions, all pass.
• PHPCS passes for the updated skeleton.
• PHPStan 2.3 passed for the unchanged application source.
• The missing-route-file regression test fails before CakePHP #19665 and passes with that fix applied.
• HTTP smoke checks with bin/cake server confirm the public/ document root, both page routes, CSS/fonts/images/favicon, production 404 responses and DebugKit plugin assets.
• All 29 moved files retain their original contents.

CI runs lowest and highest dependency jobs on PHP 8.5 once the upstream installation blocker is resolved.

[dereuromark]

We might want to start including #1055

[josbeir]

The documentation uses src/Event/Listener/ with a separate named configuration and explicit registration. Following that approach would establish a discoverable convention for listener classes. We could include a commented registration example in Application::events() and account for the listener configuration in the debug cache override.

Or should listener discovery remain entirely application-defined, with the skeleton documenting that the default paths only cover controllers?