feat(seo): add sitemap generator

app/api/revalidate/route.ts

@@ -0,0 +1,28 @@
+import { revalidateTag } from "next/cache";
+import type { NextRequest } from "next/server";
+
+/**
+ * On-demand cache revalidation. The BFF pings this (fire-and-forget) when
+ * sitemap-relevant data changes — a new signup, or a content re-seed/reindex —
+ * so /sitemap.xml refreshes within seconds instead of waiting out the 24h ISR
+ * window. Secret-gated; lives under /api/ which robots.txt disallows.
+ *
+ *   POST /api/revalidate?tag=sitemap&secret=…
+ */
+export const runtime = "nodejs";
+
+export async function POST(req: NextRequest) {
+  const expected = process.env.REVALIDATE_SECRET;
+  const secret = req.nextUrl.searchParams.get("secret");
+  if (!expected || secret !== expected) {
+    return Response.json(
+      { revalidated: false, error: "unauthorized" },
+      { status: 401 },
+    );
+  }
+  const tag = req.nextUrl.searchParams.get("tag") || "sitemap";
+  // Next 16 requires a cache-life profile as the 2nd arg; "max" fully purges
+  // the tagged entries so the next request re-fetches from the BFF.
+  revalidateTag(tag, "max");
+  return Response.json({ revalidated: true, tag });
+}