Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/(payload)/api/booking/[id]/accept-alternative/route.ts

@@ -15,6 +15,9 @@ export async function POST(request: Request, { params }: Args) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
     }
+    if (!user.emailVerified) {
+      return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
+    }
 
     const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
     if (!booking || Number(booking.user) !== Number(user.id)) {

app/(payload)/api/booking/[id]/cancel/route.ts

@@ -15,6 +15,8 @@ export async function POST(request: Request, { params }: Args) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
     }
+    // Cancelling is deliberately allowed regardless of verification status —
+    // only creating/confirming a booking is a gated "protected" action.
 
     const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
     if (!booking || Number(booking.user) !== Number(user.id)) {

app/(payload)/api/booking/request/route.ts

@@ -35,6 +35,9 @@ export async function POST(request: Request) {
     if (!user || user.collection !== "customers") {
       return NextResponse.json({ error: "Bitte melde dich an, um einen Termin anzufragen." }, { status: 401 });
     }
+    if (!user.emailVerified) {
+      return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
+    }
 
     const { docs } = await payload.find({
       collection: "offers",