Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

collections/Customers.ts

@@ -1,4 +1,8 @@
-import type { CollectionConfig } from "payload";
+import type { CollectionAfterChangeHook, CollectionBeforeChangeHook, CollectionConfig } from "payload";
+import { isAdminFieldLevel } from "@/access";
+import { EMAIL_VERIFICATION_TTL_MS, generateVerificationToken, hashVerificationToken, verificationExpiryISO } from "@/lib/auth/verification";
+import { verificationEmail } from "@/lib/email/authTemplates";
+import { sendEmail } from "@/lib/email/sendBookingEmails";
 
 const isSelfOrAdmin = ({ req }: { req: { user?: { collection?: string; id?: unknown } | null } }) => {
   const user = req.user;
@@ -8,6 +12,41 @@ const isSelfOrAdmin = ({ req }: { req: { user?: { collection?: string; id?: unkn
   return false;
 };
 
+// Runs on every new customer account: issues a random, single-use,
+// time-limited email-verification token. Only its hash is ever persisted
+// (see the emailVerificationTokenHash field below) — the plaintext exists
+// only in req.context for the afterChange hook below to email out, and is
+// never written to the database or logged.
+const issueVerificationToken: CollectionBeforeChangeHook = ({ data, operation, req }) => {
+  if (operation !== "create") return data;
+  const token = generateVerificationToken();
+  data.emailVerified = false;
+  data.emailVerificationTokenHash = hashVerificationToken(token);
+  data.emailVerificationExpires = verificationExpiryISO();
+  req.context.pendingVerificationToken = token;
+  return data;
+};
+
+const sendVerificationEmail: CollectionAfterChangeHook = async ({ doc, operation, req }) => {
+  if (operation !== "create") return doc;
+  const token = req.context.pendingVerificationToken;
+  if (typeof token !== "string") return doc;
+  try {
+    const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
+    await sendEmail(
+      doc.email,
+      verificationEmail({
+        name: doc.name,
+        verifyUrl: `${serverUrl}/auth/verify-email/${token}`,
+        expiresHours: Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000)),
+      }),
+    );
+  } catch (err) {
+    req.payload.logger.error({ err, msg: "customers sendVerificationEmail failed" });
+  }
+  return doc;
+};
+
 export const Customers: CollectionConfig = {
   slug: "customers",
   labels: {
@@ -32,6 +71,10 @@ export const Customers: CollectionConfig = {
     update: isSelfOrAdmin,
     delete: ({ req }) => req.user?.collection === "users",
   },
+  hooks: {
+    beforeChange: [issueVerificationToken],
+    afterChange: [sendVerificationEmail],
+  },
   fields: [
     {
       name: "name",
@@ -48,6 +91,35 @@ export const Customers: CollectionConfig = {
         description: "Optional — für eine spätere Nutzung vorbereitet, aktuell nicht verpflichtend.",
       },
     },
+    {
+      name: "emailVerified",
+      type: "checkbox",
+      label: "E-Mail bestätigt",
+      defaultValue: false,
+      // "create" AND "update" must both be locked down — otherwise a
+      // customer could simply include emailVerified: true in their own
+      // registration or profile request and skip verification entirely.
+      access: { create: isAdminFieldLevel, update: isAdminFieldLevel },
+      admin: {
+        position: "sidebar",
+        description: "Wird automatisch gesetzt, sobald der Bestätigungslink aus der E-Mail angeklickt wird. Kann hier bei Bedarf manuell gesetzt werden.",
+      },
+    },
+    {
+      name: "emailVerificationTokenHash",
+      type: "text",
+      // Never exposed or settable via any API — only the two hooks above
+      // (running through the trusted Local API) ever touch this field.
+      access: { create: () => false, read: () => false, update: () => false },
+      admin: { hidden: true },
+      index: true,
+    },
+    {
+      name: "emailVerificationExpires",
+      type: "date",
+      access: { create: () => false, read: () => false, update: () => false },
+      admin: { hidden: true },
+    },
     // "email" and "password" are added automatically by the auth config.
   ],
 };

collections/Events.ts

@@ -1,6 +1,7 @@
 import type { CollectionBeforeChangeHook, CollectionConfig } from "payload";
 import { isAdmin, publishedOrAdmin } from "@/access";
 import { slugField } from "@/fields/slug";
+import { seoFields } from "@/fields/seo";
 import { generateMeetingPassword } from "@/lib/meeting/password";
 
 export const EVENT_CATEGORIES = [
@@ -243,5 +244,6 @@ export const Events: CollectionConfig = {
       label: "Zugehörige Buchungsanfrage",
       admin: { position: "sidebar", readOnly: true },
     },
+    seoFields(),
   ],
 };

collections/Offers.ts

@@ -1,6 +1,7 @@
 import type { CollectionConfig } from "payload";
 import { isAdmin, publishedOrAdmin } from "@/access";
 import { slugField } from "@/fields/slug";
+import { seoFields } from "@/fields/seo";
 
 // Groups the 7 individual offers for the mega menu and the /angebote
 // overview page (Kindergruppen bundles Erdenkinder + Mädchenkreis, Singkreise
@@ -123,5 +124,6 @@ export const Offers: CollectionConfig = {
         },
       ],
     },
+    seoFields(),
   ],
 };

collections/Posts.ts

@@ -1,6 +1,7 @@
 import type { CollectionConfig } from "payload";
 import { isAdmin, publishedOrAdmin } from "@/access";
 import { slugField } from "@/fields/slug";
+import { seoFields } from "@/fields/seo";
 
 export const Posts: CollectionConfig = {
   slug: "posts",
@@ -64,5 +65,13 @@ export const Posts: CollectionConfig = {
         date: { pickerAppearance: "dayOnly", displayFormat: "dd.MM.yyyy" },
       },
     },
+    {
+      name: "author",
+      type: "text",
+      label: "Autor:in",
+      defaultValue: "Anouma",
+      admin: { position: "sidebar" },
+    },
+    seoFields(),
   ],
 };

collections/Redirects.ts

@@ -0,0 +1,76 @@
+import type { CollectionConfig } from "payload";
+import { isAdmin } from "@/access";
+
+function normalizePath(value: string): string {
+  const trimmed = value.trim();
+  const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+  return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+
+/**
+ * Simple slug-change redirect table (see lib/seo/redirects.ts). Deliberately
+ * scoped to the three dynamic [slug] detail routes (Angebote/Termine/
+ * Aktuelles) — that's the only place slugs actually live and can change, so
+ * looking this up only there avoids adding a database lookup to every
+ * single request the way a catch-all middleware would.
+ */
+export const Redirects: CollectionConfig = {
+  slug: "redirects",
+  labels: {
+    singular: "Weiterleitung",
+    plural: "Weiterleitungen",
+  },
+  admin: {
+    useAsTitle: "fromPath",
+    defaultColumns: ["fromPath", "toPath", "type", "enabled"],
+    group: "SEO",
+    description: "Leitet eine alte URL (z. B. nach einer Slug-Änderung bei Angeboten, Terminen oder Aktuelles) dauerhaft auf eine neue weiter.",
+  },
+  access: {
+    read: () => true,
+    create: isAdmin,
+    update: isAdmin,
+    delete: isAdmin,
+  },
+  fields: [
+    {
+      name: "fromPath",
+      type: "text",
+      label: "Alte URL (Pfad)",
+      required: true,
+      unique: true,
+      index: true,
+      admin: { description: "Nur der Pfad, z. B. /angebote/doula (ohne Domain)." },
+      hooks: {
+        beforeValidate: [({ value }) => (typeof value === "string" && value ? normalizePath(value) : value)],
+      },
+    },
+    {
+      name: "toPath",
+      type: "text",
+      label: "Neue URL (Pfad)",
+      required: true,
+      admin: { description: "Ziel-Pfad, z. B. /angebote/doula-begleitung." },
+      hooks: {
+        beforeValidate: [({ value }) => (typeof value === "string" && value ? normalizePath(value) : value)],
+      },
+    },
+    {
+      name: "type",
+      type: "select",
+      label: "Art der Weiterleitung",
+      required: true,
+      defaultValue: "permanent",
+      options: [
+        { label: "301 – Dauerhaft", value: "permanent" },
+        { label: "302 – Vorübergehend", value: "temporary" },
+      ],
+    },
+    {
+      name: "enabled",
+      type: "checkbox",
+      label: "Aktiv",
+      defaultValue: true,
+    },
+  ],
+};

collections/Users.ts

@@ -45,6 +45,17 @@ export const Users: CollectionConfig = {
         update: isAdminFieldLevel,
       },
     },
+    {
+      name: "calendarFeedTokenHash",
+      type: "text",
+      // Only ever set by /api/admin/calendar-feed/regenerate (see
+      // lib/calendar/feedToken.ts) — never exposed or directly settable via
+      // any API, so the plaintext token is never retrievable again after
+      // it's shown once at generation time.
+      access: { create: () => false, read: () => false, update: () => false },
+      admin: { hidden: true },
+      index: true,
+    },
     // "email" and "password" are added automatically by `auth: true`-style config.
   ],
 };