✨[Feat] SEO Foundation for securetools.app

[maruson08]

Summary

• add crawler discovery files for https://securetools.app
• add exact canonical and Open Graph URL metadata to all 18 indexable public pages
• add deterministic SEO, route, metadata, privacy, and custom-domain regression coverage
• document maintenance plus Google Search Console and Bing Webmaster Tools submission

Exact scope

• robots.txt allows crawling and points to the production sitemap
• sitemap.xml contains only real canonical routes
• every indexable page has one canonical, og:type, og:site_name, page-specific og:title/og:description, and matching og:url
• 404 and the legacy Images-to-PDF redirect retain intentional noindex and remain outside the sitemap
• no visible product copy, processing logic, dependency, CSP, or hosting behavior changed

Sitemap URLs

• https://securetools.app/
• https://securetools.app/about/
• https://securetools.app/privacy/
• https://securetools.app/tools/pdf/
• https://securetools.app/tools/pdf/images-to-pdf/
• https://securetools.app/tools/pdf/merge/
• https://securetools.app/tools/pdf/split/
• https://securetools.app/tools/pdf/organize/
• https://securetools.app/tools/pdf/to-images/
• https://securetools.app/tools/pdf/metadata/
• https://securetools.app/tools/image/
• https://securetools.app/tools/image/converter/
• https://securetools.app/tools/image/resize/
• https://securetools.app/tools/image/compress/
• https://securetools.app/tools/image/metadata/
• https://securetools.app/tools/privacy/
• https://securetools.app/tools/scan/
• https://securetools.app/tools/media/

Validation

• git diff --check main...HEAD — PASS
• node tests/run-all.mjs — PASS
• node tests/seo-foundation.test.mjs — PASS
• PowerShell XML parse — PASS, 18 URLs
• repository-relative documentation links — PASS, 65 links across 13 Markdown files
• local HTTP smoke — PASS for homepage, representative PDF/Image/Metadata/Privacy routes, robots.txt, and sitemap.xml
• pull-request CI — PASS

Manual browser QA

PASS. Representative pages rendered correctly; canonical URLs, locale switching, Light/Dark themes, representative tool initialization, robots.txt, and sitemap.xml were verified. No new production application console errors or external/tracking network requests were observed.

Expected local-development-only CSP noise was limited to the live-server injected inline script, live-server/source-map connection, and Chrome DevTools app-specific request being blocked. These are not production application regressions.

Intentional omissions

• no hreflang: languages share one client-side route; no locale URLs exist
• no JSON-LD: no sufficiently useful schema was needed for this foundation
• no og:image or Twitter card: no reviewed production share image exists
• no explicit index,follow: normal public pages rely on crawler defaults
• no analytics, telemetry, tracking, verification script, external font, remote SEO runtime, runtime dependency, version bump, tag, or release

Closes #62
Closes #63
Closes #64