Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

web/src/app/robots.ts

@@ -0,0 +1,12 @@
+import type { MetadataRoute } from 'next'
+const base = process.env.NEXT_PUBLIC_SITE_URL ?? 'https://anwarpi.ai'
+export default function robots(): MetadataRoute.Robots {
+  return {
+    rules: [{
+      userAgent: '*',
+      allow: '/',
+      disallow: ['/admin', '/api', '/account-settings', '/onboarding', '/vip-onboarding', '/verify-email', '/payment-success', '/payment-cancelled', '/forgot-password'],
+    }],
+    sitemap: `${base}/sitemap.xml`,
+  }
+}