feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/cron/instagram-sync/route.ts

@@ -2,9 +2,13 @@ import { NextRequest, NextResponse } from 'next/server'
 import { mockDb } from '@/lib/mockDb'
 
 export async function POST(req: NextRequest) {
+  const secret = process.env.CRON_SECRET
+  if (!secret) {
+    console.error('CRON_SECRET env değişkeni tanımlı değil — instagram-sync endpoint devre dışı.')
+    return new NextResponse('Server misconfigured', { status: 500 })
+  }
+
   const authHeader = req.headers.get('Authorization')
-  const secret = process.env.CRON_SECRET || 'secret-token-key-123'
-  
   if (authHeader !== `Bearer ${secret}`) {
     return new NextResponse('Unauthorized', { status: 401 })
   }

app/api/events/route.ts

@@ -1,8 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { mockDb } from '@/lib/mockDb'
+import { checkRateLimit } from '@/lib/rateLimit'
 
 export async function POST(req: NextRequest) {
   try {
+    const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
+    if (!checkRateLimit(`events:${ip}`, 30, 60_000)) {
+      return NextResponse.json({ error: 'Too many requests' }, { status: 429 })
+    }
+
     const body = await req.json()
     const { listingId, actionType } = body