Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/calendar/feedToken.ts

@@ -0,0 +1,21 @@
+import { createHash, randomBytes } from "node:crypto";
+
+/**
+ * Long-lived, random, rotatable secret for a personal calendar-subscription
+ * URL (/calendar/<token>.ics) — treated like an API key, not a
+ * short-lived link: only its hash is stored, so a database leak alone
+ * can't be used to subscribe to anyone's calendar, and rotating it
+ * (overwriting the stored hash) immediately invalidates the old URL.
+ */
+export function generateCalendarFeedToken(): string {
+  return randomBytes(32).toString("hex");
+}
+
+export function hashCalendarFeedToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function calendarFeedUrl(token: string): string {
+  const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
+  return `${serverUrl}/calendar/${token}.ics`;
+}