SEO prerender pipeline + register AI routes and tighten CSP

- Static prerender + sitemap/robots for marketing, blog, and tool pages
  (entry-server, Seo component, prerender/sitemap scripts, NotFoundPage)
- Register aiRoutes and extend CSP for Turnstile + Spaces image hosts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/web/scripts/generate-sitemap.mts

@@ -0,0 +1,37 @@
+// Generates dist/sitemap.xml from the public, indexable routes in src/seo/routes-meta.ts.
+// Run after `vite build` (see the "build" script in package.json): npx tsx scripts/generate-sitemap.mts
+// Paths are resolved from import.meta.url so the script works regardless of cwd.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { SITEMAP_ROUTES, SITE_URL } from '../src/seo/routes-meta';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const distDir = path.resolve(__dirname, '../dist');
+const outFile = path.join(distDir, 'sitemap.xml');
+
+const lastmod = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+
+const urlEntries = SITEMAP_ROUTES.map((route) => {
+  // Root must be the origin with a trailing slash: https://elegalsoftware.com/
+  const loc = route.path === '/' ? `${SITE_URL}/` : `${SITE_URL}${route.path}`;
+  return [
+    '  <url>',
+    `    <loc>${loc}</loc>`,
+    `    <lastmod>${lastmod}</lastmod>`,
+    '  </url>',
+  ].join('\n');
+});
+
+const xml = [
+  '<?xml version="1.0" encoding="UTF-8"?>',
+  '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+  ...urlEntries,
+  '</urlset>',
+  '',
+].join('\n');
+
+fs.mkdirSync(distDir, { recursive: true });
+fs.writeFileSync(outFile, xml, 'utf8');
+
+console.log(`sitemap: wrote ${SITEMAP_ROUTES.length} URLs to ${outFile}`);