feat: harden admin security, add AI trip planner, map view, and SEO/notification improvements

Security:
- requireAdmin() session check added to every admin-only server action
  (previously relied only on middleware path matching, which Next.js
  Server Actions don't reliably respect)
- Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split
  into an Edge-safe auth.config.ts (used by proxy.ts) and the full
  Prisma-backed auth.ts (route handler, server actions, server components)
- Removed hardcoded fallback secret on the Instagram sync cron endpoint
- Honeypot field + per-IP rate limiting on contact/business-submission
  forms and the analytics events endpoint

Features:
- AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded
  to only recommend isLocalApproved listings, with a deterministic
  link-injection fallback for anything the model doesn't format as markdown
- Interactive Leaflet/OpenStreetMap view on category listing pages
- Telegram notifications for new contact messages and business submissions

SEO:
- Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/
  Twitter share images, generated via next/og (replacing default Next.js
  placeholders)
- BreadcrumbList structured data on category and listing detail pages
- Fixed two remaining raw <img> tags to use next/image

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proxy.ts

@@ -1,8 +1,12 @@
 import { NextRequest, NextResponse } from 'next/server'
 import createMiddleware from 'next-intl/middleware'
-import { auth } from '@/lib/auth'
+import NextAuth from 'next-auth'
+import { authConfig } from '@/lib/auth.config'
 import { routing } from '@/i18n/routing'
 
+// Edge-safe session read only — the Prisma-backed provider in lib/auth.ts
+// cannot run in the middleware's Edge runtime, so this uses the bare config.
+const { auth } = NextAuth(authConfig)
 const intlMiddleware = createMiddleware(routing)
 
 export async function proxy(request: NextRequest) {
@@ -17,5 +21,9 @@ export async function proxy(request: NextRequest) {
 }
 
 export const config = {
-  matcher: ['/((?!api|_next|_vercel|.*\\..*).*)']
+  // icon / apple-icon are root-level, locale-independent metadata routes
+  // (app/icon.tsx, app/apple-icon.tsx) — without this exclusion the intl
+  // middleware treats them as un-prefixed pages and redirects them to
+  // /tr/icon, which 404s and breaks the favicon/apple-touch-icon.
+  matcher: ['/((?!api|_next|_vercel|icon|apple-icon|.*\\..*).*)']
 }