the correct store behind a proxy.
TunnelStoreProvisioner now receives ResourceConnection and copies default web
CMS pages/blocks and theme-related setup for new tunnel stores.
Tighten system.xml (remove invalid default), crontab/config defaults, and
update tests with a ResourceConnection stub for PHPUnit.
