feat(web): full SEO stack — metadata, JSON-LD, sitemap, robots, OG image

Ported and adapted from the BuildMyDiscord SEO setup:

- lib/seo.ts — single source for site constants, the FAQ data (shared by
  the rendered FAQ and the FAQPage schema so they never drift) and JSON-LD
  builders.
- Rich root metadata: title template, keywords, Open Graph, Twitter card,
  robots directives, canonical.
- JSON-LD: Organization + WebSite + SoftwareApplication sitewide, FAQPage
  on the landing page. No AggregateRating — there are no real reviews yet.
- app/robots.ts — allow all, explicit allow-list for AI answer-engine
  crawlers (GPTBot, ClaudeBot, PerplexityBot, …), disallow private routes.
- app/sitemap.ts — every public marketing + docs route.
- app/opengraph-image.tsx — monochrome on-brand 1200x630 share card.
- app/manifest.ts + public/llms.txt.
- Per-page metadata for pricing, changelog, security, privacy, terms,
  docs, templates and status.
- opengraph-image + apple-icon pinned to the edge runtime — next/og
  crashes during a Node-runtime prerender.

Verified: next build passes; /robots.txt, /sitemap.xml,
/manifest.webmanifest and /opengraph-image all generate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(marketing)/security/page.tsx

@@ -1,7 +1,13 @@
-import Link from 'next/link';
 import { CodeBlock } from '@/components/code-block';
+import { pageMetadata } from '@/lib/seo';
+import Link from 'next/link';
 
-export const metadata = { title: 'Security — BuildMyMCPServer' };
+export const metadata = pageMetadata({
+  title: 'Security',
+  description:
+    'How BuildMyMCPServer secures your MCP servers — per-server Docker isolation, AES-256-GCM encrypted secrets, OAuth 2.1 and a hardened control plane.',
+  path: '/security',
+});
 
 const PILLARS = [
   {
@@ -18,7 +24,7 @@ const PILLARS = [
   },
   {
     title: 'No token passthrough',
-    body: 'When a tool calls a downstream API, it uses its own server-side credentials — not the user\'s OAuth token. Tokens never leak across trust boundaries. This is mandated by the MCP authorization spec.',
+    body: "When a tool calls a downstream API, it uses its own server-side credentials — not the user's OAuth token. Tokens never leak across trust boundaries. This is mandated by the MCP authorization spec.",
   },
   {
     title: 'Static security checks',
@@ -49,8 +55,8 @@ export default function Security() {
           Built like infrastructure.
         </h1>
         <p className="mt-3 text-[14px] leading-relaxed text-[--color-fg-muted]">
-          We host code generated by an LLM, on behalf of customers, that exposes their internal
-          APIs to AI clients. The threat model is real. Here is what we do about it.
+          We host code generated by an LLM, on behalf of customers, that exposes their internal APIs
+          to AI clients. The threat model is real. Here is what we do about it.
         </p>
       </header>
 
@@ -67,7 +73,10 @@ export default function Security() {
         <h2 className="text-[18px] font-semibold tracking-tight">Disclosure</h2>
         <p className="mt-2 text-[13.5px] leading-relaxed text-[--color-fg-muted]">
           Found a vulnerability? Email{' '}
-          <a className="text-[--color-accent] underline" href="mailto:security@buildmymcpserver.com">
+          <a
+            className="text-[--color-accent] underline"
+            href="mailto:security@buildmymcpserver.com"
+          >
             security@buildmymcpserver.com
           </a>{' '}
           with a clear reproduction. We respond within 48h. We do not run a paid bounty yet, but we