feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

PRODUCT.md

@@ -0,0 +1,48 @@
+# Product
+
+<!-- impeccable:product-schema 1 -->
+
+## Platform
+
+web
+
+## Users
+International tourists (primarily British, Russian, and Turkish tourists visiting Marmaris) seeking curated, authentic local places and experiences; local business owners (restaurants, apart hotels, boat rentals, tours, dive centers) applying for listing curation.
+
+## Product Purpose
+Marmaris Local is a curated directory and guide ("Turistin göremediği yerel bilgi") that brings together Marmaris's best restaurants, apart hotels, boat rentals, dive centers, and local tour operators under a single trusted platform.
+
+## Positioning
+Not a generic user-review aggregator (like Yelp or TripAdvisor). Every listing features a human editorial curation layer ("Yerel Onaylı" / "Locally Approved" stamp), guaranteeing local verification and authentic editorial recommendations.
+
+## Operating Context
+Multilingual (TR/EN/RU) mobile-first browser exploration for tourists on-the-go in Marmaris or planning before travel; admin dashboard workflow for local business submission review, approval, and listing management.
+
+## Capabilities and Constraints
+- Multilingual content support (TR, EN, RU) via `next-intl`.
+- Listing categories (Restoranlar, Apartlar, Dalış, Tekne Kiralama, Tur Operatörü, Transfer, vb.) and Neighborhoods (Yat Limanı, İçmeler, Armutalan, Siteler, Turunç).
+- Business submission form (`/isletme-ekle`) with admin approval pipeline.
+- Contact form (`/iletisim`).
+- Interactive map integration with Leaflet / OpenStreetMap.
+- Cloudinary image gallery integration.
+- MVP ratings are admin-assigned curation scores (no public user reviews in MVP).
+- Multi-city ready architecture (`city` field defaulted to `"marmaris"`).
+
+## Brand Commitments
+- Palette: Pine Night (`#123238`), Bay Turquoise (`#2E9C9A`), Shutter Blue (`#4F7C93`), Golden Hour (`#E8A23D`), Bougainvillea (`#E85D6E`), Limestone (`#EDEEE3`).
+- Typography: Unbounded (Headings, 800/600), Golos Text (Body), IBM Plex Mono (Data: prices, hours, phones).
+- Signature Mark: Circular "Yerel Onaylı" stamp accompanying curated listings.
+
+## Evidence on Hand
+- `docs/prd.md` (Detailed product requirement document)
+- `docs/marmaris-local-brand.html` (Brand mockup and style specifications)
+- `docs/prd-2.md` & `docs/prd-3.md` (Supplementary specs)
+
+## Product Principles
+1. **Editorial Trust First:** Every listing carries local verification ("Yerel Onaylı"); curation over noise.
+2. **First-Class Multilingual Experience:** RU and EN content must feel natively written, not an auto-translated afterthought.
+3. **Mobile-First Utility:** Instant access to phone/WhatsApp, hours, directions, and prices for tourists exploring on mobile devices.
+4. **Authentic Local Aesthetics:** Deep coastal hues and distinct typography that reflect Marmaris's natural pine and turquoise environment.
+
+## Accessibility & Inclusion
+Full WCAG AA compliance, semantic HTML5, responsive layout across mobile and desktop viewports, clear focus indicators, and accessible color contrast ratios.