feat: AI SEO generator, full admin panel, i18n sweep, new logo + auth/RTL fixes

AI SEO content generator
- content-svc: per-tenant OpenAI config (ai_settings) + /v1/ai endpoints
  (settings GET/PUT, seo-post) with SEO-expert prompt → structured article
- admin UI to configure token/base-url/model and generate + save as blog
- configurable base URL for restricted networks

Full data-driven admin panel
- generic /api/admin/resource proxy + reusable AdminResource component
- categories/tags/fonts/blogs (CRUD), users (list + ban), plans/slides
- AI content section; nav + i18n

i18n localization sweep
- localized 116 user-facing + studio/editor components to next-intl (fa+en)
  under the auto.* namespace; merge tooling in scripts/merge-i18n.js

Branding + assets
- Monoline F logo (LogoMark + favicon)
- offline SVG placeholder generator (/api/placeholder), dropped picsum.photos

Fixes
- JWT issuer mismatch on content/studio (flatrender → flatrender-identity)
- missing role claim → [Authorize(Roles="Admin")] now works (RBAC)
- Secure cookies broke HTTP sessions → gated behind AUTH_COOKIE_SECURE
- Radix RTL via DirectionProvider (right-aligned menus in fa)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/db/migrations/17_content_ai_settings.sql

@@ -0,0 +1,20 @@
+-- =====================================================================
+-- CONTENT SCHEMA — Part 17: AI settings (per-tenant OpenAI config)
+-- Stores the OpenAI (or OpenAI-compatible) API credentials used by the
+-- AI SEO content generator. One row per tenant; api_key is stored as-is
+-- (self-hosted) and never returned in full to clients (masked in the API).
+-- base_url is configurable so deployments behind a proxy / in restricted
+-- networks can point at a reachable OpenAI-compatible endpoint.
+-- =====================================================================
+
+SET search_path TO content, public;
+
+CREATE TABLE IF NOT EXISTS ai_settings (
+    tenant_id    UUID PRIMARY KEY,
+    provider     TEXT        NOT NULL DEFAULT 'openai',
+    api_key      TEXT,
+    base_url     TEXT        NOT NULL DEFAULT 'https://api.openai.com/v1',
+    model        TEXT        NOT NULL DEFAULT 'gpt-4o-mini',
+    enabled      BOOLEAN     NOT NULL DEFAULT FALSE,
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);