Add email verification, personal calendar feed, and full SEO implementation

- Customer accounts now require email verification (hashed, single-use,
  time-limited tokens) before they can request/confirm bookings, with
  resend flows on login/account/booking widget and rate limiting.
- Admins get a private, rotatable iCalendar (ICS) subscription feed of
  their confirmed bookings and public events, timezone-correct for
  Europe/Berlin including DST, never exposing meeting passwords.
- Adds a full SEO layer: per-page canonical/OG/Twitter metadata with
  CMS-editable overrides and content-derived fallbacks, a dynamic
  sitemap.xml and robots.txt driven by real published content, JSON-LD
  (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service,
  Event, BlogPosting) that never fabricates data, and a CMS-managed
  redirect table for changed slugs.
- Global ANOUMA-naming audit: the brand name is never used to label
  personal account/calendar areas anywhere in the app, CMS, or emails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/seo/redirects.ts

@@ -0,0 +1,23 @@
+import { cache } from "react";
+import { getCMS } from "@/lib/payload/getPayload";
+
+/**
+ * Looks up a CMS-configured redirect for a changed slug (see
+ * collections/Redirects.ts). Only called from the three dynamic [slug]
+ * detail pages right before they'd otherwise 404 — not a catch-all
+ * middleware, so this never adds a database lookup to the other ~30 routes
+ * that never need it.
+ */
+export const resolveRedirect = cache(async (fromPath: string): Promise<{ to: string; permanent: boolean } | null> => {
+  const payload = await getCMS();
+  const { docs } = await payload.find({
+    collection: "redirects",
+    where: { and: [{ fromPath: { equals: fromPath } }, { enabled: { equals: true } }] },
+    limit: 1,
+    depth: 0,
+    overrideAccess: false,
+  });
+  const redirect = docs[0];
+  if (!redirect) return null;
+  return { to: redirect.toPath, permanent: redirect.type !== "temporary" };
+});