chore(seo): serve a real robots.txt and noindex the app shell

[Xavier-Charles]

app.alphaday.com has no robots.txt at any path — /robots.txt returns the SPA shell as text/html with HTTP 200, and so does /sitemap.xml and every other URL. All of them are the same 3,252-byte contentless document, which makes each route a duplicate of the others and of the landing page for the same board at alphaday.com/{slug}.

Two changes:

• public/robots.txt, so the host actually has one. It allows crawling deliberately. Disallow blocks crawling rather than indexing, so a blocked crawler never reads the noindex below, and Google still lists blocked URLs it finds linked elsewhere as bare entries with no snippet. Crawling has to stay open for the directive to be readable. Once Search Console shows these URLs dropped out, a Disallow can be added to save crawl budget.

• A static noindex, follow in index.html. Static rather than injected after hydration because the model crawlers this most matters for do not execute JavaScript, so a post-render directive would be invisible to them. follow keeps links back to alphaday.com as a signal. No canonical accompanies it: noindex plus canonical is a conflicting instruction, and the obvious target does not exist for every board that has a dashboard here.

Verified in the build output: dist/robots.txt is emitted and the meta survives into dist/index.html. The PWA workbox config already excludes index.html from precaching, so no stale service worker holds the old shell.

Closes the last outstanding Phase 0 item in the SEO plan (home repo, docs/seo-strategy.md §5.9).