feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/[locale]/blog/[slug]/page.tsx

@@ -3,6 +3,8 @@ import { Link } from '@/i18n/routing'
 import { notFound } from 'next/navigation'
 import { Calendar, Tag, ArrowLeft } from 'lucide-react'
 import ListingCard from '@/components/ListingCard'
+import { renderMarkdownToHtml } from '@/lib/markdown'
+import Image from 'next/image'
 import type { Metadata } from 'next'
 
 interface Props {
@@ -36,48 +38,6 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
   }
 }
 
-// Lightweight safe Markdown to HTML parsing function
-function renderMarkdownToHtml(md: string): string {
-  if (!md) return ''
-  let html = md
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-
-  // Bold
-  html = html.replace(/\*\*(.*?)\*\*/g, '<strong>$1</strong>')
-  html = html.replace(/__(.*?)__/g, '<strong>$1</strong>')
-
-  // Italic
-  html = html.replace(/\*(.*?)\*/g, '<em>$1</em>')
-  html = html.replace(/_(.*?)_/g, '<em>$1</em>')
-
-  // Headings
-  html = html.replace(/^### (.*?)$/gm, '<h4 class="text-base font-heading font-bold text-pine mt-6 mb-2 lowercase">$1</h4>')
-  html = html.replace(/^## (.*?)$/gm, '<h3 class="text-lg font-heading font-extrabold text-pine mt-8 mb-3 lowercase">$1</h3>')
-  html = html.replace(/^# (.*?)$/gm, '<h2 class="text-xl font-heading font-extrabold text-pine mt-10 mb-4 lowercase">$1</h2>')
-
-  // Bullet Lists
-  html = html.replace(/^\* (.*?)$/gm, '<li class="ml-4 list-disc text-sm text-ink/80 leading-relaxed">$1</li>')
-  html = html.replace(/^- (.*?)$/gm, '<li class="ml-4 list-disc text-sm text-ink/80 leading-relaxed">$1</li>')
-
-  // Links
-  html = html.replace(/\[(.*?)\]\((.*?)\)/g, '<a href="$2" class="text-turquoise hover:underline" target="_blank" rel="noopener">$1</a>')
-
-  // Paragraphs
-  const blocks = html.split(/\n\n+/)
-  html = blocks.map(block => {
-    const trimmed = block.trim()
-    if (!trimmed) return ''
-    if (trimmed.startsWith('<h') || trimmed.startsWith('<li') || trimmed.startsWith('<ul') || trimmed.startsWith('<ol')) {
-      return trimmed
-    }
-    return `<p class="leading-relaxed mb-4 text-sm sm:text-base text-ink/80 font-medium">${trimmed.replace(/\n/g, '<br/>')}</p>`
-  }).join('\n')
-
-  return html
-}
-
 export default async function BlogPostDetailPage({ params }: Props) {
   const { locale, slug } = await params
   const post = await mockDb.getBlogPostBySlug(slug)
@@ -149,10 +109,13 @@ export default async function BlogPostDetailPage({ params }: Props) {
           <article className="bg-paper border border-pine/8 rounded-3xl overflow-hidden shadow-sm">
             {post.coverImage && (
               <div className="h-[350px] relative overflow-hidden bg-stone border-b border-pine/5">
-                <img 
-                  src={post.coverImage} 
-                  alt={title} 
-                  className="w-full h-full object-cover" 
+                <Image
+                  src={post.coverImage}
+                  alt={title}
+                  fill
+                  sizes="(max-width: 768px) 100vw, 768px"
+                  className="object-cover"
+                  priority
                 />
               </div>
             )}

app/[locale]/blog/page.tsx

@@ -22,7 +22,7 @@ export async function generateMetadata({ params }: { params: Promise<{ locale: s
         ? 'Гиды, чтобы открыть Мармарис как местный житель — где поесть, скрытые места и советы путешественникам.'
         : "Marmaris'i bir yerel gibi keşfetmeniz için rehberler, nerede ne yenir tavsiyeleri ve gizli yerler."
 
-  return basicMetadata(title, description)
+  return basicMetadata(title, description, locale)
 }
 
 export default async function BlogIndexPage({ params }: { params: Promise<{ locale: string }> }) {