Add SEO sitemap/robots + real SMS OTP (Kavenegar, admin-configured)

- /sitemap.xml (static pages + open shifts + fresh jobs, respecting expiry) + /robots.txt (blocks /Admin,/Employer); base URL from forwarded request → https://hamkadr.ir in prod
- ISmsSender + KavenegarSmsSender (verify/lookup template, sms/send fallback); SMS settings (enabled/apikey/template/sender) in /Admin/Settings; OtpService.IssueAsync sends SMS and stops revealing the code when enabled (dev still shows it); migration

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/JobsMedical.Web/Models/AppSetting.cs

@@ -54,6 +54,14 @@ public class AppSetting
     /// <summary>Max ads to fetch per ingestion run (be polite; dedupe skips already-seen).</summary>
     public int MedjobsMaxAds { get; set; } = 40;
 
+    // --- SMS OTP (Kavenegar). When off, the code is shown on screen (dev only). ---
+    public bool SmsEnabled { get; set; } = false;
+    [MaxLength(200)] public string? SmsApiKey { get; set; }
+    /// <summary>Kavenegar verify/lookup template name (preferred OTP method in Iran).</summary>
+    [MaxLength(100)] public string? SmsTemplate { get; set; }
+    /// <summary>Sender line for plain SMS fallback when no template is set.</summary>
+    [MaxLength(30)] public string? SmsSender { get; set; }
+
     public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 
     /// <summary>Split a textarea (newline/comma separated) into trimmed non-empty items.</summary>