feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/rateLimit.ts

@@ -0,0 +1,27 @@
+// In-memory sliding-window rate limiter. Good enough for a single-instance
+// Docker deployment (Coolify) — resets on redeploy and doesn't share state
+// across replicas, but that's an acceptable MVP tradeoff for abuse-throttling
+// a public, unauthenticated endpoint (no external dependency like Redis needed).
+const hits = new Map<string, number[]>()
+
+export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
+  const now = Date.now()
+  const timestamps = (hits.get(key) || []).filter((t) => now - t < windowMs)
+
+  if (timestamps.length >= limit) {
+    hits.set(key, timestamps)
+    return false
+  }
+
+  timestamps.push(now)
+  hits.set(key, timestamps)
+
+  // Opportunistic cleanup so the map doesn't grow unbounded.
+  if (hits.size > 5000) {
+    for (const [k, v] of hits) {
+      if (v.every((t) => now - t > windowMs)) hits.delete(k)
+    }
+  }
+
+  return true
+}