feat: robots.txt, Sitemap und Staging-noindex für SEO

Google Search Console: echte robots.txt und sitemap.xml für Produktion;
Staging blockiert Crawler per X-Robots-Tag und Disallow in robots.txt.

Co-authored-by: Cursor <cursoragent@cursor.com>

client/nginx.conf.template

@@ -9,6 +9,7 @@ server {
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(self), geolocation=(self), microphone=(self)" always;
     add_header Content-Security-Policy "default-src 'self'; script-src 'self'${PLAUSIBLE_CSP}; connect-src 'self'${PLAUSIBLE_CSP}; img-src 'self' data: blob: https://*.tile.openstreetmap.org; media-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;
+${ROBOTS_NOINDEX_HEADER}
 
     # Service worker and app shell must revalidate so PWA updates are detected
     location ~* ^/(sw\.js|workbox-.*\.js|manifest\.webmanifest|version\.json)$ {