SSR switch: site setting vitec.ssr.enabled gates .htaccess proxy to SSR node

- Site set Vitecset: new bool setting vitec.ssr.enabled (default off,
  backend switch under Site Management > Settings > VITEC Settings)
- SsrFlagService derives var/vitec-ssr-on.flag from the setting;
  SyncSsrFlag middleware (frontend + backend) re-syncs per request
  because TYPO3 v14 fires no event on site settings save;
  vitec:ssr-flag CLI command for status/--sync
- public/.htaccess: flag-gated block proxies page requests [P] to
  https://vitec-ssr.evomedien.de (mod_proxy incl. https target verified
  on this host 2026-11-09), same exclusions as the SPA fallback block;
  completely inert while the flag file is absent
- Emergency off without TYPO3: delete var/vitec-ssr-on.flag
- Tested end to end: flag on -> pages proxied to VPS Caddy (502 while
  the SSR node is not deployed yet), /_json untouched; flag off ->
  SPA shell exactly as before

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/vitec/Classes/Command/SsrFlagCommand.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Evomedien\Vitec\Command;
+
+use Evomedien\Vitec\Service\SsrFlagService;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+/**
+ * Shows (and on --sync repairs) the SSR routing state: the Site Set
+ * switch "vitec.ssr.enabled" versus the flag file that .htaccess
+ * evaluates. The SyncSsrFlag middleware does the same sync on every
+ * request, so this command is mainly for diagnostics and scripting.
+ *
+ *   vendor/bin/typo3 vitec:ssr-flag          # status only
+ *   vendor/bin/typo3 vitec:ssr-flag --sync   # align flag with setting
+ */
+#[AsCommand(name: 'vitec:ssr-flag', description: 'Show/sync the SSR routing flag against the vitec.ssr.enabled site setting')]
+final class SsrFlagCommand extends Command
+{
+    public function __construct(private readonly SsrFlagService $ssrFlagService)
+    {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this->addOption('sync', null, InputOption::VALUE_NONE, 'Create/remove the flag file so it matches the setting');
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $setting = $this->ssrFlagService->isEnabledInSettings();
+        $flag = $this->ssrFlagService->isFlagSet();
+
+        $output->writeln('Setting vitec.ssr.enabled: ' . ($setting ? 'ON' : 'off'));
+        $output->writeln('Flag ' . $this->ssrFlagService->getFlagPath() . ': ' . ($flag ? 'EXISTS (SSR routing active)' : 'absent (SPA as before)'));
+
+        if ($setting === $flag) {
+            $output->writeln('<info>In sync.</info>');
+            return Command::SUCCESS;
+        }
+
+        if (!$input->getOption('sync')) {
+            $output->writeln('<comment>OUT OF SYNC - run with --sync (or just hit any page: the middleware repairs it).</comment>');
+            return Command::FAILURE;
+        }
+
+        $new = $this->ssrFlagService->sync();
+        $output->writeln('<info>Synced: flag is now ' . ($new ? 'SET - SSR routing active.' : 'removed - SPA as before.') . '</info>');
+        return Command::SUCCESS;
+    }
+}