Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/(payload)/api/admin/calendar-feed/regenerate/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { calendarFeedUrl, generateCalendarFeedToken, hashCalendarFeedToken } from "@/lib/calendar/feedToken";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * POST /api/admin/calendar-feed/regenerate — (re)generates Anna's personal
+ * ICS feed link. Only the new token's hash is stored; the plaintext URL is
+ * returned exactly once in this response and can never be retrieved again
+ * — generating a new one immediately invalidates whichever link was issued
+ * before (see collections/Users.ts).
+ */
+export async function POST(request: Request) {
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+    if (!user || user.collection !== "users") {
+      return NextResponse.json({ error: "Nicht autorisiert." }, { status: 401 });
+    }
+
+    const token = generateCalendarFeedToken();
+    await payload.update({
+      collection: "users",
+      id: user.id,
+      data: { calendarFeedTokenHash: hashCalendarFeedToken(token) },
+    });
+
+    return NextResponse.json({ url: calendarFeedUrl(token) });
+  } catch (error) {
+    console.error("calendar feed regenerate failed", error);
+    return NextResponse.json({ error: "Der Kalender-Link konnte nicht erzeugt werden." }, { status: 500 });
+  }
+}

app/(payload)/api/auth/resend-verification/route.ts

@@ -0,0 +1,91 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
+import { EMAIL_VERIFICATION_TTL_MS, generateVerificationToken, hashVerificationToken, verificationExpiryISO } from "@/lib/auth/verification";
+import { verificationEmail } from "@/lib/email/authTemplates";
+import { sendEmail } from "@/lib/email/sendBookingEmails";
+import type { Customer } from "@/payload-types";
+
+export const dynamic = "force-dynamic";
+
+// Deliberately identical whether or not an account exists / is already
+// verified — this endpoint must never let a caller find out either of
+// those things about an email address that isn't their own session.
+const GENERIC_RESPONSE = {
+  ok: true,
+  message: "Falls ein Konto mit dieser E-Mail-Adresse existiert und noch nicht bestätigt ist, wurde eine neue Bestätigungs-E-Mail gesendet.",
+};
+
+async function issueAndSend(payload: Awaited<ReturnType<typeof getPayload>>, customer: Customer) {
+  const token = generateVerificationToken();
+  await payload.update({
+    collection: "customers",
+    id: customer.id,
+    data: {
+      emailVerificationTokenHash: hashVerificationToken(token),
+      emailVerificationExpires: verificationExpiryISO(),
+    },
+  });
+
+  const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
+  await sendEmail(
+    customer.email,
+    verificationEmail({
+      name: customer.name,
+      verifyUrl: `${serverUrl}/auth/verify-email/${token}`,
+      expiresHours: Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000)),
+    }),
+  );
+}
+
+export async function POST(request: Request) {
+  const ip = getClientIp(request);
+  if (!checkRateLimit(`resend-verification:ip:${ip}`, { max: 10, windowMs: 60 * 60 * 1000 })) {
+    return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
+  }
+
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+
+    let customer: Customer | null = null;
+
+    if (user && user.collection === "customers") {
+      customer = user as Customer;
+    } else {
+      let body: { email?: unknown } = {};
+      try {
+        body = await request.json();
+      } catch {
+        // no body — handled below as a missing email
+      }
+      const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+      if (!email) {
+        return NextResponse.json({ error: "E-Mail-Adresse erforderlich." }, { status: 400 });
+      }
+      if (!checkRateLimit(`resend-verification:email:${email}`, { max: 3, windowMs: 60 * 60 * 1000 })) {
+        return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
+      }
+
+      const { docs } = await payload.find({
+        collection: "customers",
+        where: { email: { equals: email } },
+        limit: 1,
+      });
+      customer = (docs[0] as Customer) ?? null;
+    }
+
+    if (customer && !customer.emailVerified) {
+      if (!checkRateLimit(`resend-verification:customer:${customer.id}`, { max: 3, windowMs: 60 * 60 * 1000 })) {
+        return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
+      }
+      await issueAndSend(payload, customer);
+    }
+
+    return NextResponse.json(GENERIC_RESPONSE);
+  } catch (error) {
+    console.error("resend verification failed", error);
+    return NextResponse.json({ error: "Die Bestätigungs-E-Mail konnte nicht gesendet werden." }, { status: 500 });
+  }
+}

app/(payload)/api/booking/[id]/accept-alternative/route.ts

@@ -15,6 +15,9 @@ export async function POST(request: Request, { params }: Args) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
     }
+    if (!user.emailVerified) {
+      return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
+    }
 
     const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
     if (!booking || Number(booking.user) !== Number(user.id)) {

app/(payload)/api/booking/[id]/cancel/route.ts

@@ -15,6 +15,8 @@ export async function POST(request: Request, { params }: Args) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
     }
+    // Cancelling is deliberately allowed regardless of verification status —
+    // only creating/confirming a booking is a gated "protected" action.
 
     const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
     if (!booking || Number(booking.user) !== Number(user.id)) {

app/(payload)/api/booking/request/route.ts

@@ -35,6 +35,9 @@ export async function POST(request: Request) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an, um einen Termin anzufragen." }, { status: 401 });
     }
+    if (!user.emailVerified) {
+      return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
+    }
 
     const { docs } = await payload.find({
       collection: "offers",