feat: Cloudflare Turnstile on auth, CSP fixes, admin/SEO/analytics additions

Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
  provider; endpoints listed explicitly rather than relying on defaults.
  /reset-password is intentionally excluded — it is reached only via a
  single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
  so each form resets the challenge after a failed submit; submit stays
  disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
  does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
  secret is set without a site key (that combination would demand a token
  no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
  the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.

CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
  iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
  compiles with eval(), so the strict policy threw EvalError and killed
  hydration — no client JS ran at all, which also meant form submit
  handlers never fired. Production policy is unchanged and still strict.

Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
  OG/Twitter images, manifest), Umami analytics, not-found page.

Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).

Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/(public)/p/[shareId]/page.tsx

@@ -8,17 +8,28 @@ import { WaveformPlayer } from "@/components/app/waveform-player";
 import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { Logo } from "@/components/ui/logo";
+import { SITE_NAME, absoluteUrl } from "@/lib/seo";
 import type { StructuredScript } from "@/lib/ai/types";
 
 export const dynamic = "force-dynamic";
 
+/** Trim to `max` characters on a word boundary, for meta descriptions. */
+function truncate(text: string, max: number): string {
+  const collapsed = text.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= max) return collapsed;
+  const cut = collapsed.slice(0, max - 1);
+  const lastSpace = cut.lastIndexOf(" ");
+  return `${(lastSpace > max * 0.6 ? cut.slice(0, lastSpace) : cut).trimEnd()}…`;
+}
+
 async function loadShared(shareId: string) {
   const episode = await prisma.episode.findUnique({
     where: { shareId },
     include: { audioAsset: true, coverArt: true, script: true, speakers: true },
   });
   // 404 when no episode, sharing disabled, or not finished.
-  if (!episode || !episode.shareId || episode.status !== "READY") return null;
+  // moderatedAt = taken down by an admin: treat exactly like a missing share.
+  if (!episode || !episode.shareId || episode.moderatedAt || episode.status !== "READY") return null;
   return episode;
 }
 
@@ -29,11 +40,33 @@ export async function generateMetadata({
 }): Promise<Metadata> {
   const { shareId } = await params;
   const episode = await loadShared(shareId);
-  if (!episode) return { title: "Episode not found" };
+  if (!episode) return { title: "Episode not found", robots: { index: false, follow: false } };
+
+  const url = absoluteUrl(`/p/${shareId}`);
+  const description = truncate(episode.topic, 160);
+  // Share links are unlisted by design, so they stay out of the index — but they
+  // are made to be pasted into chat and social, so the unfurl has to be complete.
+  const cover = episode.coverArt ? absoluteUrl(`/api/public/episodes/${shareId}/cover`) : undefined;
+
   return {
     title: episode.title,
-    description: episode.topic.slice(0, 160),
-    robots: { index: false },
+    description,
+    robots: { index: false, follow: false, nocache: true },
+    openGraph: {
+      type: "article",
+      title: episode.title,
+      description,
+      url,
+      siteName: SITE_NAME,
+      ...(cover ? { images: [{ url: cover, alt: `Cover art for ${episode.title}` }] } : {}),
+    },
+    twitter: {
+      // The cover is square, so the compact card frames it better than a wide one.
+      card: cover ? "summary" : "summary_large_image",
+      title: episode.title,
+      description,
+      ...(cover ? { images: [cover] } : {}),
+    },
   };
 }