Adds a static robots.txt blocking admin/API/auth routes, a sitemap
generation script (scripts/generate-sitemap.mjs) that writes both
sitemap.xml and sitemap.xml.gz to public/, and hooks it into the
build so the sitemap is always fresh on deploy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
