feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/seo.ts

@@ -34,12 +34,20 @@ export function ogLocale(locale: string): string {
  * Metadata for pages that only need a localized title/description, but still
  * want their own Open Graph/Twitter tags instead of inheriting the layout's
  * generic sitewide fallback (which would otherwise show on every such page).
+ *
+ * Next.js doesn't deep-merge `openGraph`/`twitter` objects across the segment
+ * tree — a page that returns its own `openGraph` here replaces (not extends)
+ * the root layout's, which would silently drop the shared opengraph-image.tsx
+ * fallback. So the share image is added back explicitly.
  */
-export function basicMetadata(title: string, description: string): Metadata {
+export function basicMetadata(title: string, description: string, locale: string, pathSuffix: string = ''): Metadata {
+  const image = `${SITE_URL}/${locale}/opengraph-image`
+  const pathname = `/${locale}${pathSuffix.startsWith('/') ? pathSuffix : pathSuffix ? `/${pathSuffix}` : ''}`
   return {
     title,
     description,
-    openGraph: { title, description, type: 'website' },
-    twitter: { card: 'summary_large_image', title, description },
+    alternates: buildAlternates(pathname),
+    openGraph: { title, description, url: `${SITE_URL}${pathname}`, locale: ogLocale(locale), type: 'website', images: [image] },
+    twitter: { card: 'summary_large_image', title, description, images: [image] },
   }
 }