Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/auth/rateLimit.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal in-memory fixed-window rate limiter for a single Node process
+ * (this app always runs as one process — see server.ts). Good enough to
+ * blunt abuse of the email-verification resend endpoint without adding an
+ * external store; resets on deploy/restart, which is an acceptable
+ * trade-off for this use case.
+ */
+const buckets = new Map<string, { count: number; resetAt: number }>();
+
+// Opportunistic cleanup so long-running processes don't accumulate an
+// unbounded number of stale keys (one per distinct IP/email ever seen).
+const MAX_TRACKED_KEYS = 5000;
+
+function sweepExpired(now: number) {
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt < now) buckets.delete(key);
+  }
+}
+
+export function checkRateLimit(key: string, opts: { max: number; windowMs: number }): boolean {
+  const now = Date.now();
+  if (buckets.size > MAX_TRACKED_KEYS) sweepExpired(now);
+
+  const bucket = buckets.get(key);
+  if (!bucket || bucket.resetAt < now) {
+    buckets.set(key, { count: 1, resetAt: now + opts.windowMs });
+    return true;
+  }
+  if (bucket.count >= opts.max) return false;
+  bucket.count += 1;
+  return true;
+}
+
+export function getClientIp(request: Request): string {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0]!.trim();
+  return "unknown";
+}

lib/auth/verification.ts

@@ -0,0 +1,22 @@
+import { createHash, randomBytes } from "node:crypto";
+
+/** How long a freshly issued email-verification link stays valid. */
+export const EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1000;
+
+/** 256 bits of randomness, hex-encoded — not guessable, never derived from user data. */
+export function generateVerificationToken(): string {
+  return randomBytes(32).toString("hex");
+}
+
+/**
+ * Only this hash is ever persisted (see collections/Customers.ts) — the
+ * plaintext token exists only in the URL sent by email and briefly in
+ * memory while that email is being sent.
+ */
+export function hashVerificationToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function verificationExpiryISO(): string {
+  return new Date(Date.now() + EMAIL_VERIFICATION_TTL_MS).toISOString();
+}

lib/auth/verifyEmailToken.ts

@@ -0,0 +1,38 @@
+import { getCMS } from "@/lib/payload/getPayload";
+import { hashVerificationToken } from "@/lib/auth/verification";
+
+const TOKEN_SHAPE = /^[0-9a-f]{64}$/i;
+
+/**
+ * Verifies a token from a /auth/verify-email/[token] link: looks it up by
+ * hash (the plaintext is never stored), checks it hasn't expired, then
+ * marks the account verified and immediately clears the hash + expiry so
+ * the same link can never be used a second time.
+ */
+export async function verifyEmailToken(token: string): Promise<boolean> {
+  if (!TOKEN_SHAPE.test(token)) return false;
+
+  const payload = await getCMS();
+  const hash = hashVerificationToken(token);
+
+  const { docs } = await payload.find({
+    collection: "customers",
+    where: { emailVerificationTokenHash: { equals: hash } },
+    limit: 1,
+  });
+  const customer = docs[0];
+  if (!customer || !customer.emailVerificationExpires) return false;
+  if (new Date(customer.emailVerificationExpires).getTime() < Date.now()) return false;
+
+  await payload.update({
+    collection: "customers",
+    id: customer.id,
+    data: {
+      emailVerified: true,
+      emailVerificationTokenHash: null,
+      emailVerificationExpires: null,
+    },
+  });
+
+  return true;
+}