feat: Cloudflare Turnstile on auth, CSP fixes, admin/SEO/analytics additions

Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
  provider; endpoints listed explicitly rather than relying on defaults.
  /reset-password is intentionally excluded — it is reached only via a
  single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
  so each form resets the challenge after a failed submit; submit stays
  disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
  does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
  secret is set without a site key (that combination would demand a token
  no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
  the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.

CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
  iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
  compiles with eval(), so the strict policy threw EvalError and killed
  hydration — no client JS ran at all, which also meant form submit
  handlers never fired. Production policy is unchanged and still strict.

Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
  OG/Twitter images, manifest), Umami analytics, not-found page.

Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).

Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -5,12 +5,43 @@ DATABASE_URL="postgresql://user:password@host:5432/podcast-distribution-ai?schem
 # Better Auth — generate a strong secret: `openssl rand -base64 32`
 BETTER_AUTH_SECRET="change-me"
 BETTER_AUTH_URL="http://localhost:3000"
+# The canonical public origin. Also the SEO source of truth: canonical tags, the
+# sitemap, robots.txt and Open Graph URLs are all built from it, so it must be the
+# exact production origin (https, correct www/non-www, no trailing slash).
+# It is a NEXT_PUBLIC_* var, so it is inlined at BUILD time — set it as a build arg
+# too (see Dockerfile). A production build fails fast if it is missing, rather than
+# shipping canonicals that point at localhost.
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
 
+# ─────────────────────────── SEO / search consoles ──────────
+# Optional site-ownership tokens. Leave empty to omit the verification meta tags.
+NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION=""
+NEXT_PUBLIC_BING_SITE_VERIFICATION=""
+
+# ─────────────────────────── Analytics (Umami) ──────────────
+# Self-hosted Umami. Leave either value empty to disable analytics entirely
+# (the default in development) — no script is rendered and no rewrite is added.
+# The tracker is proxied through this app at /_a, so the CSP stays untouched and
+# content blockers leave it alone; nothing needs allowlisting.
+# Both are read at BUILD time by statically rendered pages, so they must also be
+# passed as build args (see Dockerfile).
+UMAMI_HOST_URL="https://fickanalytics.phluit.net"
+UMAMI_WEBSITE_ID="98f83e69-cea1-435d-a002-6facea09764a"
+
 # ─────────────────────────── OAuth ──────────────────────────
 GOOGLE_CLIENT_ID=""
 GOOGLE_CLIENT_SECRET=""
 
+# ─────────────────────────── Bot protection ─────────────────
+# Cloudflare Turnstile guards the sign-in, sign-up and password-reset endpoints.
+# Create a widget at https://dash.cloudflare.com → Turnstile.
+# REQUIRED in production — the app refuses to boot without the secret key.
+# Leave both blank in dev to skip the challenge entirely.
+# The site key is read at RUNTIME (server-rendered into the page), so it does not
+# need to be a Docker build arg.
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=""
+TURNSTILE_SECRET_KEY=""
+
 # ─────────────────────────── AI providers ───────────────────
 OPENAI_API_KEY=""
 ELEVENLABS_API_KEY=""