feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/sitemap.ts

@@ -64,13 +64,32 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
     console.error('Sitemap listings fetch error:', e)
   }
 
-  // 5. Neighborhood pages
+  // 5. Neighborhood pages & Programmatic Neighborhood x Category landing pages
   try {
     const neighborhoods = await mockDb.getNeighborhoods()
+    const categories = await mockDb.getCategories()
+
     for (const neighborhood of neighborhoods) {
       entries.push(
-        ...localizedEntries(`/neighborhood/${neighborhood.slug}`, { changeFrequency: 'monthly', priority: 0.4 })
+        ...localizedEntries(`/neighborhood/${neighborhood.slug}`, { changeFrequency: 'monthly', priority: 0.5 })
       )
+
+      // Programmatic Neighborhood x Category combinations
+      for (const category of categories) {
+        const matchingListings = await mockDb.getListings({
+          neighborhoodId: neighborhood.id,
+          categoryId: category.id,
+        })
+        // Only include indexable programmatic pages in sitemap (at least 2 listings)
+        if (matchingListings.length >= 2) {
+          entries.push(
+            ...localizedEntries(`/neighborhood/${neighborhood.slug}/${category.slug}`, {
+              changeFrequency: 'weekly',
+              priority: 0.7,
+            })
+          )
+        }
+      }
     }
   } catch (e) {
     console.error('Sitemap neighborhoods fetch error:', e)
@@ -108,5 +127,25 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
     console.error('Sitemap blog posts fetch error:', e)
   }
 
+  // 8. AI-generated itineraries (long-tail SEO pages, PRD §3.3)
+  // Each plan is generated in a single language (see params.locale) — unlike
+  // other content types it has no translated counterpart, so it gets one
+  // sitemap entry for its own locale rather than the tr/en/ru trio.
+  try {
+    entries.push(...localizedEntries('/plan-olustur', { changeFrequency: 'monthly', priority: 0.6 }))
+    const itineraries = await mockDb.getItineraries()
+    for (const itinerary of itineraries) {
+      const itinLocale = LOCALES.includes((itinerary.params as any)?.locale) ? (itinerary.params as any).locale : 'tr'
+      entries.push({
+        url: `${SITE_URL}/${itinLocale}/plan/${itinerary.id}`,
+        lastModified: itinerary.createdAt,
+        changeFrequency: 'yearly',
+        priority: 0.3,
+      })
+    }
+  } catch (e) {
+    console.error('Sitemap itineraries fetch error:', e)
+  }
+
   return entries
 }