Title Issue #3607366 by hydra, Harlor: Per-site admin sections (menu, taxonomy, path alias) on shared base classes, plus a site-context security and service-decomposition hardening pass

Summary

Builds the per-site administration surface for the Sites ecosystem: menu, taxonomy and path-alias management move onto cloned /admin/sites/{site}/* routes backed by a shared set of section base classes, with the cross-site hubs reduced to global content. Alongside the feature work the branch carries a security + lifecycle hardening pass across sites core and its submodules, the section/taxonomy service decomposition, the environment-settings save-path fixes, and the integration of current 1.x.

What lands

Per-site admin sections — /admin/sites/{site}/{menu,taxonomy,path-alias}

• Reusable base classes for the section pattern (routing, controllers, access, list rendering, validation); sites_menu, sites_taxonomy and sites_path_alias all migrated onto them.
• The /admin/structure/* hubs become the "whose X?" entry point and show only global content; per-site editing happens in the scoped section. A shared base for the site-UI 404 subscribers backs it.

Security / isolation hardening

• Closes a per-site-admin → platform-control privilege escalation (access-policy neutralise-list): a per-site admin role can no longer reach bypass-node-access or administer users / permissions / sites / modules / software updates.
• Closes the ?site_id hub-injection surface on the remaining per-site capability consumers; injected permissions stop at the hub gates.
• Real-global-permission gates on the sites_ui cross-site hub routes and on sites_preview; sites_content isolation-gate admin bypass and membership writes hardened; refused section routes read as 404 on tenant hosts.

Service architecture

• Splits the god-object into responsibility-scoped, autowired services with interfaces and constructor docblocks; section access resolves {site} through the service; form behaviour moves into form decorators; administered-site resolution extracted into sites core.

Environment settings

• Fixes the add / remove-environment save path on the site form (validation-error and #wrapper_id regressions), persists only registered environments, with add and removal test coverage.

Path-alias / pathauto

• Site-aware PathAliasConstraintValidator — issue #3615085 (by Harlor and hydra); that issue is now closed and this is the retained version.

1.x integration

• Merges current 1.x (through 16a109b); adapts the per-site url-prefix override tests to upstream's new poison-disabled + per-site-value-as-prefix contract (#3605935); guards setDefaultLanguage() for the broadened ConfigurableLanguageManagerInterface check.

Review cleanup

• Dead-code, docs, accessibility, cache-tag and coverage cleanups from the services + lifecycle review across sites_ui, sites_preview, sites_path_prefix, sites_language, sites_pathauto, sites_example.

Issues included

• #3607366 (this issue) — the per-site admin sections + hardening epic.
• #3615085 — Site-aware PathAliasConstraintValidator (closed; branch carries the retained version — credit Harlor, hydra).

Testing & CI

• Full sites suite green. Pipeline green on every job: phpunit / composer (blocking) plus phpstan / phpcs / eslint / stylelint / cspell (allow-failure) all passing.

Landing note

• Squash on merge recommended. The branch includes incremental sites: fixup commits and a 1.x cross-merge commit that need not survive in 1.x history. Squash to a single Issue #3607366 by hydra, Harlor: … commit and keep Harlor's credit for the bundled #3615085 work.

Closes #3607366