refactor: extract templates from public/

- Created /templates for main site (header.php, footer.php)
- Created /templates/admin for admin section (head.php, footer.php)
- Removed /public/includes and /public/admin/inc
- Updated all references in code and docs
- Tests passing ✅

Cleaner separation: /public only contains web-accessible files (PHP entry points + assets)

docs/SECURITY_ANALYSIS.md

@@ -254,7 +254,7 @@ ini_set('error_log', '/var/log/posterg/error.log');
 
 ### 10. External CDN Stylesheet Without Subresource Integrity (SRI)
 
-**File:** `public/admin/inc/head.php`
+**File:** `templates/admin/head.php`
 
 ```html
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/water.css@2/out/water.css">