Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/robots.ts

@@ -1,15 +1,43 @@
 import type { MetadataRoute } from "next";
-import { siteConfig } from "@/lib/site";
+import { getSiteUrl, isSiteIndexable } from "@/lib/seo/config";
+
+// Reads the CMS's SEO settings (site URL override, robots kill switch) on
+// every request — must not be statically prerendered at build time.
+export const dynamic = "force-dynamic";
+
+export default async function robots(): Promise<MetadataRoute.Robots> {
+  const [siteUrl, indexable] = await Promise.all([getSiteUrl(), isSiteIndexable()]);
+
+  if (!indexable) {
+    // Global kill switch (SEO-Einstellungen → "Website für Suchmaschinen
+    // sichtbar") — block everything rather than list exceptions.
+    return { rules: [{ userAgent: "*", disallow: "/" }] };
+  }
 
-export default function robots(): MetadataRoute.Robots {
   return {
     rules: [
       {
         userAgent: "*",
         allow: "/",
-        disallow: ["/impressum", "/datenschutz"],
+        disallow: [
+          // Admin panel and its API.
+          "/admin",
+          "/admin/*",
+          "/api/*",
+          // Customer accounts — never public.
+          "/konto",
+          "/konto/*",
+          "/login",
+          "/registrieren",
+          "/auth/*",
+          // Private calendar-subscription feed (secret-token URLs).
+          "/calendar/*",
+          // Meeting join/call flow — session-gated, never a page worth indexing.
+          "/termine/*/beitreten",
+          "/termine/*/call",
+        ],
       },
     ],
-    sitemap: `${siteConfig.domain}/sitemap.xml`,
+    sitemap: `${siteUrl}/sitemap.xml`,
   };
 }