ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes

SEO
- New Settings > SEO admin page (seo_settings in app_config): indexing switch,
  Google/Bing verification, X handle, JSON-LD identity (Person/Organization,
  sameAs), per-locale keywords, readiness checklist and open links for
  sitemap.xml / robots.txt / manifest.
- robots.txt is now dynamic: disallows admin, api, success and coming-soon
  paths; blocks everything while indexing is off or maintenance is on.
- sitemap.xml carries hreflang alternates per URL, lists only categories with
  published projects, and is empty while hidden.
- Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form,
  alternateLocale, twitter site/creator, project cover as OG image with
  article type, noindex on /success and /coming-soon.
- JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per
  project (view-mode independent).

Security
- Maintenance bypass now requires a correctly signed admin cookie; the
  middleware previously only checked the cookie existed. Token helpers moved
  to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts).
- Media uploads: magic-byte validation against the declared type, SVG
  sanitization (script/handlers/foreignObject/javascript: rejected), upload
  folder sanitized, kind inferred from the real file.
- Media route: fixed prefix-based path check that accepted sibling
  directories, unknown extensions return 404, nosniff header, CSP sandbox on
  SVG, gif content type added.
- External media URLs: protocol-relative (//host) URLs rejected.

Portfolio
- Project and category slugs share /portfolio/[slug]; saving now rejects a
  slug already used on the other side instead of silently shadowing it.

Tooling/docs
- Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import.
- New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin
  spec and CLAUDE.md updated.
- Tests for all of the above (unit + integration); suite green.

tests/unit/seo-settings.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  buildDefaultSeoSettings,
+  normalizeKeywords,
+  normalizeSameAs,
+  normalizeTwitterHandle,
+  normalizeVerificationToken,
+  parseSeoSettingsValue,
+  toOpenGraphLocale,
+} from "@/lib/seo-settings";
+
+describe("parseSeoSettingsValue", () => {
+  it("returns defaults for empty or invalid JSON", () => {
+    expect(parseSeoSettingsValue(undefined)).toEqual(buildDefaultSeoSettings());
+    expect(parseSeoSettingsValue("{not json")).toEqual(buildDefaultSeoSettings());
+    expect(parseSeoSettingsValue(null).allowIndexing).toBe(true);
+  });
+
+  it("only disables indexing on an explicit false", () => {
+    expect(parseSeoSettingsValue(JSON.stringify({ allowIndexing: false })).allowIndexing).toBe(false);
+    expect(parseSeoSettingsValue(JSON.stringify({ allowIndexing: "no" })).allowIndexing).toBe(true);
+  });
+
+  it("normalizes every field and drops junk", () => {
+    const parsed = parseSeoSettingsValue(
+      JSON.stringify({
+        googleSiteVerification: "abc-123_XYZ",
+        bingSiteVerification: "<script>",
+        twitterHandle: "https://x.com/moh_farawati",
+        structuredDataType: "Company",
+        sameAs: ["https://behance.net/x", "http://insecure", "javascript:alert(1)", "https://behance.net/x"],
+        locales: { de: { keywords: " a , ,b,, c " } },
+      }),
+    );
+
+    expect(parsed.googleSiteVerification).toBe("abc-123_XYZ");
+    expect(parsed.bingSiteVerification).toBe("");
+    expect(parsed.twitterHandle).toBe("@moh_farawati");
+    expect(parsed.structuredDataType).toBe("Person");
+    expect(parsed.sameAs).toEqual(["https://behance.net/x"]);
+    expect(parsed.locales.de.keywords).toBe("a, b, c");
+    expect(parsed.locales.en.keywords).toBe("");
+  });
+});
+
+describe("normalizers", () => {
+  it("rejects verification tokens with unsafe characters", () => {
+    expect(normalizeVerificationToken("ok_token-1")).toBe("ok_token-1");
+    expect(normalizeVerificationToken('x" onload="1')).toBe("");
+    expect(normalizeVerificationToken(42)).toBe("");
+  });
+
+  it("normalizes twitter handles with or without @ / URL", () => {
+    expect(normalizeTwitterHandle("@moh")).toBe("@moh");
+    expect(normalizeTwitterHandle("moh")).toBe("@moh");
+    expect(normalizeTwitterHandle("https://twitter.com/moh")).toBe("@moh");
+    expect(normalizeTwitterHandle("this-has-dashes")).toBe("");
+    expect(normalizeTwitterHandle("a".repeat(16))).toBe("");
+  });
+
+  it("accepts newline or comma separated https URLs only", () => {
+    expect(normalizeSameAs("https://a.com\nhttps://b.com, ftp://c")).toEqual(["https://a.com", "https://b.com"]);
+    expect(normalizeSameAs(null)).toEqual([]);
+  });
+
+  it("caps keywords at 30 entries", () => {
+    const keywords = normalizeKeywords(Array.from({ length: 40 }, (_, index) => `k${index}`).join(","));
+    expect(keywords.split(", ")).toHaveLength(30);
+  });
+
+  it("maps locales to og:locale codes", () => {
+    expect(toOpenGraphLocale("de")).toBe("de_DE");
+    expect(toOpenGraphLocale("en")).toBe("en_US");
+    expect(toOpenGraphLocale("ar")).toBe("ar_AR");
+  });
+});