ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes

SEO
- New Settings > SEO admin page (seo_settings in app_config): indexing switch,
  Google/Bing verification, X handle, JSON-LD identity (Person/Organization,
  sameAs), per-locale keywords, readiness checklist and open links for
  sitemap.xml / robots.txt / manifest.
- robots.txt is now dynamic: disallows admin, api, success and coming-soon
  paths; blocks everything while indexing is off or maintenance is on.
- sitemap.xml carries hreflang alternates per URL, lists only categories with
  published projects, and is empty while hidden.
- Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form,
  alternateLocale, twitter site/creator, project cover as OG image with
  article type, noindex on /success and /coming-soon.
- JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per
  project (view-mode independent).

Security
- Maintenance bypass now requires a correctly signed admin cookie; the
  middleware previously only checked the cookie existed. Token helpers moved
  to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts).
- Media uploads: magic-byte validation against the declared type, SVG
  sanitization (script/handlers/foreignObject/javascript: rejected), upload
  folder sanitized, kind inferred from the real file.
- Media route: fixed prefix-based path check that accepted sibling
  directories, unknown extensions return 404, nosniff header, CSP sandbox on
  SVG, gif content type added.
- External media URLs: protocol-relative (//host) URLs rejected.

Portfolio
- Project and category slugs share /portfolio/[slug]; saving now rejects a
  slug already used on the other side instead of silently shadowing it.

Tooling/docs
- Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import.
- New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin
  spec and CLAUDE.md updated.
- Tests for all of the above (unit + integration); suite green.

tests/middleware.test.ts

@@ -20,7 +20,7 @@ vi.mock("../lib/admin-routing", () => ({
   toInternalAdminPath: (pathname: string) => pathname,
 }));
 
-function createMockRequest(url: string) {
+function createMockRequest(url: string, cookieValue?: string) {
   const nextUrl = new URL(url) as URL & { clone: () => URL };
   nextUrl.clone = () => new URL(nextUrl.toString());
 
@@ -31,11 +31,25 @@ function createMockRequest(url: string) {
       host: nextUrl.host,
     }),
     cookies: {
-      has: vi.fn(() => false),
+      has: vi.fn(() => cookieValue !== undefined),
+      get: vi.fn(() => (cookieValue !== undefined ? { name: "moh_admin_session", value: cookieValue } : undefined)),
     },
   };
 }
 
+function stubMaintenanceRuntime() {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => ({
+      ok: true,
+      json: async () => ({
+        defaultLocale: "de",
+        maintenanceEnabled: true,
+      }),
+    })),
+  );
+}
+
 describe("middleware locale runtime config", () => {
   beforeEach(() => {
     vi.resetModules();
@@ -123,6 +137,28 @@ describe("middleware locale runtime config", () => {
     expect(intlHandlerMock).not.toHaveBeenCalled();
   });
 
+  it("does not let a forged admin cookie bypass maintenance mode", async () => {
+    vi.stubEnv("ADMIN_AUTH_SECRET", "test-secret");
+    stubMaintenanceRuntime();
+
+    const { default: middleware } = await import("../proxy");
+    const response = await middleware(createMockRequest("https://example.com/about", "superadmin.forged") as never);
+
+    expect(response.headers.get("location")).toBe("https://example.com/coming-soon");
+    expect(intlHandlerMock).not.toHaveBeenCalled();
+  });
+
+  it("lets a correctly signed admin cookie through maintenance mode", async () => {
+    vi.stubEnv("ADMIN_AUTH_SECRET", "test-secret");
+    stubMaintenanceRuntime();
+
+    const { buildAdminSessionToken } = await import("../lib/admin-session-token");
+    const { default: middleware } = await import("../proxy");
+    await middleware(createMockRequest("https://example.com/about", buildAdminSessionToken()) as never);
+
+    expect(intlHandlerMock).toHaveBeenCalledTimes(1);
+  });
+
   it("prefers the configured internal runtime origin when provided", async () => {
     process.env.SITE_RUNTIME_ORIGIN = "http://app:3000";