2.2.0 - centralize session/CSP headers, extract CSS, add PHPUnit suite

What's new in 2.2.0

Refactoring: all pages now use start_session() and send_security_headers() from a single includes/session.php, eliminating ~18 duplicated session and header blocks across the codebase. Inline style blocks removed from all PHP pages and moved to external CSS files.

Testing: PHPUnit unit test suite added — 87 tests, 129 assertions covering the src/ OOP layer (Form, Domain, Csrf, Support). Dev-only, not required in production. New CI workflow runs the suite on PHP 8.1, 8.2, and 8.3 on every push and pull request.