Section and theme editors wrote straight to columns that carry CHECK
constraints, so a bad value surfaced as a 500 rather than a field error.
Adds rules() mirroring the constraints, Arabic messages(), and an error
summary in both forms.

home() also served unpublished sites to the public. Staff keep their
preview route; everyone else is sent to login.

Drops a redundant invalidateAll() from ThemeEditor::save(): the call
passed an argument the method does not take, and would have flushed
every tenant's cache. WebsiteSettingService::update() already
invalidates the one academy that changed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>