feat: backend users see the TYPO3 13 frontend on staging.ep-reisen.de

Logged in to the staging backend (be_typo_user cookie of that host), the
frontend is no longer redirected to www, so pages can be checked before
they go live. Everyone else still gets the 301; the host sends
X-Robots-Tag: noindex.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

public/.htaccess

@@ -280,6 +280,15 @@ AddDefaultCharset utf-8
 ### End: Cross Origin ###
 
 
+# staging.ep-reisen.de shows the TYPO3 13 frontend to backend users only; keep it out of search engines
+<IfModule mod_setenvif.c>
+	<IfModule mod_headers.c>
+		SetEnvIfNoCase Host ^staging\.ep-reisen\.de$ EP_STAGING_HOST
+		Header always set X-Robots-Tag "noindex, nofollow" env=EP_STAGING_HOST
+	</IfModule>
+</IfModule>
+
+
 
 ### Begin: Rewriting and Access ###
 
@@ -303,9 +312,12 @@ AddDefaultCharset utf-8
 	# The frontend lives on www.ep-reisen.de (static export + TYPO3 13); here it would be duplicate
 	# content, so only the backend and the files it loads stay on this host
 	# (original requests only: the index.php hand-over below runs through these rules again)
+	# Logged-in backend users (be_typo_user cookie of this host) see the TYPO3 13 frontend here, to check
+	# pages before they go live on www; the host sends noindex (see the headers section)
 	RewriteCond %{ENV:REDIRECT_STATUS} ^$
 	RewriteCond %{HTTP_HOST} ^staging\.ep-reisen\.de$ [NC]
 	RewriteCond %{REQUEST_URI} !^/(?:typo3|_assets|typo3temp|fileadmin|\.well-known)(?:/|$)
+	RewriteCond %{HTTP_COOKIE} !(?:^|;\s*)be_typo_user=
 	RewriteRule ^ https://www.ep-reisen.de%{REQUEST_URI} [R=301,L]
 	#RewriteCond %{HTTP_HOST} ^www\.example\.com$
 	#RewriteRule .? - [E=TYPO3_CONTEXT:Production]