feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

lib/telegram.ts

@@ -0,0 +1,91 @@
+// Best-effort Telegram notification — a failed send never blocks the form
+// submission it's attached to (the message is already saved in the DB by
+// the time this runs; Telegram is a convenience notification, not the
+// source of truth).
+export async function sendTelegramMessage(text: string): Promise<void> {
+  const token = process.env.TELEGRAM_BOT_TOKEN
+  const chatId = process.env.TELEGRAM_CHAT_ID
+  if (!token || !chatId) return
+
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ chat_id: chatId, text, disable_web_page_preview: true }),
+    })
+    if (!res.ok) {
+      console.error('Telegram notification failed:', res.status, await res.text())
+    }
+  } catch (e) {
+    console.error('Telegram notification error:', e)
+  }
+}
+
+function formatIstanbulDate(date: Date): string {
+  return new Intl.DateTimeFormat('tr-TR', {
+    timeZone: 'Europe/Istanbul',
+    day: '2-digit',
+    month: '2-digit',
+    year: 'numeric',
+    hour: '2-digit',
+    minute: '2-digit',
+    second: '2-digit',
+    hour12: false,
+  }).format(date)
+}
+
+export function formatContactMessageNotification(params: {
+  name: string
+  email: string
+  subject: string
+  message: string
+  ip: string
+}): string {
+  return [
+    '⚡ [Marmaris Local] Yeni İletişim Talebi',
+    '',
+    '📍 Kaynak: marmarislocal.com / İletişim Formu',
+    `👤 Ad Soyad: ${params.name}`,
+    `📧 E-posta: ${params.email}`,
+    `📋 Konu: ${params.subject}`,
+    `🌐 IP Adresi: ${params.ip}`,
+    `⏰ Tarih: ${formatIstanbulDate(new Date())}`,
+    '',
+    '📝 Mesaj:',
+    params.message,
+  ].join('\n')
+}
+
+export function formatBusinessSubmissionNotification(params: {
+  businessName: string
+  categoryName: string
+  neighborhoodName: string
+  address: string
+  phone?: string | null
+  whatsapp?: string | null
+  description: string
+  contactName: string
+  contactEmail: string
+  ip: string
+}): string {
+  return [
+    '🏢 [Marmaris Local] Yeni İşletme Başvurusu',
+    '',
+    '📍 Kaynak: marmarislocal.com / İşletme Ekle Formu',
+    `🏷️ İşletme Adı: ${params.businessName}`,
+    `📂 Kategori: ${params.categoryName}`,
+    `📌 Mahalle: ${params.neighborhoodName}`,
+    `🏠 Adres: ${params.address}`,
+    ...(params.phone ? [`☎️ Telefon: ${params.phone}`] : []),
+    ...(params.whatsapp ? [`💬 WhatsApp: ${params.whatsapp}`] : []),
+    `👤 Başvuran: ${params.contactName}`,
+    `📧 E-posta: ${params.contactEmail}`,
+    `🌐 IP Adresi: ${params.ip}`,
+    `⏰ Tarih: ${formatIstanbulDate(new Date())}`,
+    '',
+    '📝 Açıklama:',
+    params.description,
+    '',
+    'Onaylamak için admin panel → Başvurular.',
+  ].join('\n')
+}