Add SEO sitemap/robots + real SMS OTP (Kavenegar, admin-configured)

- /sitemap.xml (static pages + open shifts + fresh jobs, respecting expiry) + /robots.txt (blocks /Admin,/Employer); base URL from forwarded request → https://hamkadr.ir in prod
- ISmsSender + KavenegarSmsSender (verify/lookup template, sms/send fallback); SMS settings (enabled/apikey/template/sender) in /Admin/Settings; OtpService.IssueAsync sends SMS and stops revealing the code when enabled (dev still shows it); migration

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/JobsMedical.Web/Program.cs

@@ -1,6 +1,7 @@
 using System.Text.Encodings.Web;
 using System.Text.Unicode;
 using JobsMedical.Web.Data;
+using JobsMedical.Web.Models;
 using JobsMedical.Web.Services;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.HttpOverrides;
@@ -17,6 +18,8 @@ builder.Services.AddMemoryCache();
 builder.Services.AddScoped<VisitorContext>();
 builder.Services.AddScoped<InterestService>();
 builder.Services.AddScoped<RecommendationService>();
+builder.Services.AddHttpClient("sms");
+builder.Services.AddSingleton<ISmsSender, KavenegarSmsSender>();
 builder.Services.AddScoped<OtpService>();
 builder.Services.AddSingleton<CaptchaService>();
 builder.Services.AddScoped<SubmissionGuard>();
@@ -116,4 +119,42 @@ app.MapRazorPages()
 // Lightweight liveness probe for the deploy health-wait loop (and uptime checks).
 app.MapGet("/healthz", () => Results.Text("ok"));
 
+// ---- SEO: robots.txt + dynamic sitemap.xml (so Google indexes every live shift/job page) ----
+app.MapGet("/robots.txt", (HttpContext ctx) =>
+{
+    var b = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
+    return Results.Text($"User-agent: *\nAllow: /\nDisallow: /Admin\nDisallow: /Employer\nSitemap: {b}/sitemap.xml\n", "text/plain");
+});
+
+app.MapGet("/sitemap.xml", async (HttpContext ctx, AppDbContext db) =>
+{
+    var b = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
+    var today = DateOnly.FromDateTime(DateTime.UtcNow);
+    var jobCutoff = JobsMedical.Web.Services.Scraping.ListingPolicy.JobCutoffUtc;
+
+    var sb = new System.Text.StringBuilder();
+    sb.Append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+    sb.Append("<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n");
+    void Url(string loc, DateTime? mod = null, string freq = "daily")
+    {
+        sb.Append("  <url><loc>").Append(System.Security.SecurityElement.Escape(loc)).Append("</loc>");
+        if (mod is not null) sb.Append("<lastmod>").Append(mod.Value.ToString("yyyy-MM-dd")).Append("</lastmod>");
+        sb.Append("<changefreq>").Append(freq).Append("</changefreq></url>\n");
+    }
+
+    foreach (var p in new[] { "", "/Shifts", "/Jobs", "/Calendar", "/Facilities" })
+        Url($"{b}{p}", DateTime.UtcNow, p == "" ? "daily" : "hourly");
+
+    foreach (var s in await db.Shifts.Where(s => s.Status == ShiftStatus.Open && s.Date >= today)
+                 .Select(s => new { s.Id, s.CreatedAt }).ToListAsync())
+        Url($"{b}/Shifts/Details/{s.Id}", s.CreatedAt, "daily");
+
+    foreach (var j in await db.JobOpenings.Where(j => j.Status == ShiftStatus.Open && j.CreatedAt >= jobCutoff)
+                 .Select(j => new { j.Id, j.CreatedAt }).ToListAsync())
+        Url($"{b}/Jobs/Details/{j.Id}", j.CreatedAt, "weekly");
+
+    sb.Append("</urlset>");
+    return Results.Content(sb.ToString(), "application/xml");
+});
+
 app.Run();