Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/(payload)/api/admin/calendar-feed/regenerate/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from "next/server";
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { calendarFeedUrl, generateCalendarFeedToken, hashCalendarFeedToken } from "@/lib/calendar/feedToken";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * POST /api/admin/calendar-feed/regenerate — (re)generates Anna's personal
+ * ICS feed link. Only the new token's hash is stored; the plaintext URL is
+ * returned exactly once in this response and can never be retrieved again
+ * — generating a new one immediately invalidates whichever link was issued
+ * before (see collections/Users.ts).
+ */
+export async function POST(request: Request) {
+  try {
+    const payload = await getPayload({ config });
+    const { user } = await payload.auth({ headers: request.headers });
+    if (!user || user.collection !== "users") {
+      return NextResponse.json({ error: "Nicht autorisiert." }, { status: 401 });
+    }
+
+    const token = generateCalendarFeedToken();
+    await payload.update({
+      collection: "users",
+      id: user.id,
+      data: { calendarFeedTokenHash: hashCalendarFeedToken(token) },
+    });
+
+    return NextResponse.json({ url: calendarFeedUrl(token) });
+  } catch (error) {
+    console.error("calendar feed regenerate failed", error);
+    return NextResponse.json({ error: "Der Kalender-Link konnte nicht erzeugt werden." }, { status: 500 });
+  }
+}