Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

collections/Customers.ts

@@ -1,4 +1,8 @@
-import type { CollectionConfig } from "payload";
+import type { CollectionAfterChangeHook, CollectionBeforeChangeHook, CollectionConfig } from "payload";
+import { isAdminFieldLevel } from "@/access";
+import { EMAIL_VERIFICATION_TTL_MS, generateVerificationToken, hashVerificationToken, verificationExpiryISO } from "@/lib/auth/verification";
+import { verificationEmail } from "@/lib/email/authTemplates";
+import { sendEmail } from "@/lib/email/sendBookingEmails";
 
 const isSelfOrAdmin = ({ req }: { req: { user?: { collection?: string; id?: unknown } | null } }) => {
   const user = req.user;
@@ -8,6 +12,41 @@ const isSelfOrAdmin = ({ req }: { req: { user?: { collection?: string; id?: unkn
   return false;
 };
 
+// Runs on every new customer account: issues a random, single-use,
+// time-limited email-verification token. Only its hash is ever persisted
+// (see the emailVerificationTokenHash field below) — the plaintext exists
+// only in req.context for the afterChange hook below to email out, and is
+// never written to the database or logged.
+const issueVerificationToken: CollectionBeforeChangeHook = ({ data, operation, req }) => {
+  if (operation !== "create") return data;
+  const token = generateVerificationToken();
+  data.emailVerified = false;
+  data.emailVerificationTokenHash = hashVerificationToken(token);
+  data.emailVerificationExpires = verificationExpiryISO();
+  req.context.pendingVerificationToken = token;
+  return data;
+};
+
+const sendVerificationEmail: CollectionAfterChangeHook = async ({ doc, operation, req }) => {
+  if (operation !== "create") return doc;
+  const token = req.context.pendingVerificationToken;
+  if (typeof token !== "string") return doc;
+  try {
+    const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
+    await sendEmail(
+      doc.email,
+      verificationEmail({
+        name: doc.name,
+        verifyUrl: `${serverUrl}/auth/verify-email/${token}`,
+        expiresHours: Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000)),
+      }),
+    );
+  } catch (err) {
+    req.payload.logger.error({ err, msg: "customers sendVerificationEmail failed" });
+  }
+  return doc;
+};
+
 export const Customers: CollectionConfig = {
   slug: "customers",
   labels: {
@@ -32,6 +71,10 @@ export const Customers: CollectionConfig = {
     update: isSelfOrAdmin,
     delete: ({ req }) => req.user?.collection === "users",
   },
+  hooks: {
+    beforeChange: [issueVerificationToken],
+    afterChange: [sendVerificationEmail],
+  },
   fields: [
     {
       name: "name",
@@ -48,6 +91,35 @@ export const Customers: CollectionConfig = {
         description: "Optional — für eine spätere Nutzung vorbereitet, aktuell nicht verpflichtend.",
       },
     },
+    {
+      name: "emailVerified",
+      type: "checkbox",
+      label: "E-Mail bestätigt",
+      defaultValue: false,
+      // "create" AND "update" must both be locked down — otherwise a
+      // customer could simply include emailVerified: true in their own
+      // registration or profile request and skip verification entirely.
+      access: { create: isAdminFieldLevel, update: isAdminFieldLevel },
+      admin: {
+        position: "sidebar",
+        description: "Wird automatisch gesetzt, sobald der Bestätigungslink aus der E-Mail angeklickt wird. Kann hier bei Bedarf manuell gesetzt werden.",
+      },
+    },
+    {
+      name: "emailVerificationTokenHash",
+      type: "text",
+      // Never exposed or settable via any API — only the two hooks above
+      // (running through the trusted Local API) ever touch this field.
+      access: { create: () => false, read: () => false, update: () => false },
+      admin: { hidden: true },
+      index: true,
+    },
+    {
+      name: "emailVerificationExpires",
+      type: "date",
+      access: { create: () => false, read: () => false, update: () => false },
+      admin: { hidden: true },
+    },
     // "email" and "password" are added automatically by the auth config.
   ],
 };