refactor(routing): rewire the setsites ajax route to an extension-free url

[DeepDiver1975]

Description

Hardening, in the same class as owncloud/core#41740 and rewired the same way as
owncloud/core#41742. No user-visible behaviour change — see Impact below.

appinfo/routes.php declared

$this->create('external_ajax_setsites', 'ajax/setsites.php')
    ->actionInclude('external/ajax/setsites.php');

The router prefixes app route urls with /apps/<appid>, so the declared url
becomes /apps/external/ajax/setsites.php — which is a real file. The front
controller rewrite generated by \OC\Setup::updateHtaccess() only forwards a
request to index.php when the requested path does not exist on disk:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [PT,E=PATH_INFO:$1]

The web server therefore executes the script directly, without the bootstrap
index.php would have performed, and the request dies with Class "OC" not found → HTTP 500. The route was unreachable at its own declared url.

Impact: latent, not a live bug

OC.filePath() unconditionally injects /index.php/ for non-core app .php
files (core/js/js.js, the file.substring(file.length - 3) === 'php' && !isCore
branch), so the admin panel always requested the routed
/index.php/apps/external/ajax/setsites.php form — which works. Verified against
a pristine owncloud/server:11.0.0-rc2. The setting is not broken today.

The value here is that a route is reachable at the url it declares, and the bug
class cannot resurface if a caller is ever written the obvious way.

What this changes

• The route url loses its .php suffix so that it no longer resolves to a file
  on disk. The actionInclude() target and the route name are unchanged, so
  linkToRoute() callers keep working.
• js/admin.js moves from OC.filePath() to OC.generateUrl(). Simply dropping
  the .php from the OC.filePath() call would not work: with a non-.php file
  name and a non-core app, OC.filePath() falls through to its
  OC.appswebroots[app] branch and yields a static url rather than a routed
  one.

No backwards-compatible .php alias is added — an alias would re-introduce
exactly the shadowed url this change removes, so it would be dead on arrival.

Release note

This app needs its own release before an ownCloud bundle picks the change up.

🤖 Generated with Claude Code

[phil-davis]

seems reasonable