fix: HTTPS URLs in sitemap, robots, canonical + og:image on homepage

- Add UseForwardedHeaders middleware so Request.Scheme = "https" behind nginx
- Add SITE_BASE_URL env var fallback for sitemap.xml, robots.txt, and all
  Razor page canonical/og URLs — set it to https://draletaha.ir in .env
- Add og:image to homepage using hero photo
- Add SITE_BASE_URL to docker-compose.yml environment block

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

DrSousan.Api/Program.cs

@@ -56,6 +56,15 @@ builder.Services.ConfigureHttpJsonOptions(opts =>
 
 // ── Build ─────────────────────────────────────────────────────────────────────
 var app = builder.Build();
+
+// Trust the X-Forwarded-Proto header from nginx so ctx.Request.Scheme = "https"
+// This fixes canonical URLs, sitemap, robots.txt, og:image all using http:// on production
+app.UseForwardedHeaders(new Microsoft.AspNetCore.HttpOverrides.ForwardedHeadersOptions
+{
+    ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedFor
+                     | Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedProto
+});
+
 app.UseCors();
 app.UseDefaultFiles();   // serves /admin/index.html for /admin/ (wwwroot/index.html deleted → no conflict with Razor Pages)
 app.UseStaticFiles();
@@ -780,7 +789,9 @@ app.MapDelete("/api/health-requests/{id:int}", async (int id, AppDbContext db) =
 // ── Sitemap ───────────────────────────────────────────────────────────────────
 app.MapGet("/sitemap.xml", async (AppDbContext db, HttpContext ctx) =>
 {
-    var baseUrl = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
+    // SITE_BASE_URL env var wins (e.g. "https://draletaha.ir") — falls back to request scheme+host
+    var baseUrl = Environment.GetEnvironmentVariable("SITE_BASE_URL")?.TrimEnd('/')
+               ?? $"{ctx.Request.Scheme}://{ctx.Request.Host}";
     var published = await db.BlogPosts.Where(p => p.IsPublished)
         .Select(p => new { p.Slug, p.UpdatedAt }).ToListAsync();
 
@@ -814,7 +825,8 @@ app.MapGet("/healthz", () => Results.Ok(new { status = "healthy", utc = DateTime
 // ── Robots.txt ────────────────────────────────────────────────────────────────
 app.MapGet("/robots.txt", (HttpContext ctx) =>
 {
-    var host = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
+    var host = Environment.GetEnvironmentVariable("SITE_BASE_URL")?.TrimEnd('/')
+            ?? $"{ctx.Request.Scheme}://{ctx.Request.Host}";
     var body = $"User-agent: *\nAllow: /\nDisallow: /admin/\nDisallow: /api/\n\nSitemap: {host}/sitemap.xml";
     ctx.Response.ContentType = "text/plain";
     return ctx.Response.WriteAsync(body);