fix: switch sitemap/robots to dynamic generation + Nginx proxy

The reviewer noted the static sitemap.xml had a hardcoded domain in a
white-label app.  Instead of writing files to disk, we now serve
sitemap.xml and robots.txt as dynamic API endpoints that read
KMTN_WEBSITE_URL at runtime.

- Nginx proxies /sitemap.xml and /robots.txt to the backend API so
  search crawlers reach them at root paths.
- Removed the startup filesystem-write that would fail in Docker
  (backend can't write to Nginx container's static dir).
- Simplified sitemap_export.py to pure generation functions (no I/O).
- Added /api/sitemap/regenerate admin endpoint for consistency.

backend/app/api/sitemap.py

@@ -1,38 +1,60 @@
-"""Sitemap & robots.txt API: status check, regenerate endpoint.
+"""Sitemap & robots.txt API: tenant-aware SEO files served by the backend.
 
-Follows the same pattern as the theme API — public GET for status,
-admin-only POST to force regeneration.
+Because this is a white-label app where each tenant has its own domain
+(set via KMTN_WEBSITE_URL), sitemap.xml and robots.txt are generated
+on-the-fly from the station config — no static files needed.
+
+This matches the reviewer feedback:
+  'This is a whitelabel app - this file may need to be dynaimcally generated...'
+
+Follows the same pattern as theme_export.py: content is derived from
+KMTN_WEBSITE_URL at runtime, so every tenant gets their own correct URL.
 """
 
 from typing import Any, Dict
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, Response, status as http_status
 
 from app.auth import get_current_admin_user
-from app.sitemap_export import get_sitemap_status, write_sitemap_files
+from app.config import settings
+from app.sitemap_export import build_robots_txt, build_sitemap_xml
 from app.user_models import User
 
 router = APIRouter()
 
 
-@router.get("/status")
-async def sitemap_status() -> Dict[str, Any]:
-    """Return sitemap/robots file status. Public endpoint."""
-    return get_sitemap_status()
+@router.get("/sitemap.xml")
+async def get_sitemap() -> Response:
+    """Return a dynamically-generated sitemap.xml. Public endpoint.
+
+    Uses KMTN_WEBSITE_URL so each tenant gets the correct domain.
+    """
+    xml = build_sitemap_xml(settings.WEBSITE_URL)
+    return Response(content=xml, media_type="application/xml")
 
 
-@router.post("/regenerate", status_code=200)
+@router.get("/robots.txt")
+async def get_robots() -> Response:
+    """Return a dynamically-generated robots.txt. Public endpoint.
+
+    Uses KMTN_WEBSITE_URL so the Sitemap directive points to the
+    correct tenant domain.
+    """
+    txt = build_robots_txt(settings.WEBSITE_URL)
+    return Response(content=txt, media_type="text/plain")
+
+
+@router.post("/regenerate", status_code=http_status.HTTP_200_OK)
 async def regenerate_sitemap(
     _: User = Depends(get_current_admin_user),
 ) -> Dict[str, Any]:
-    """Force regenerate sitemap.xml and robots.txt. Admin only.
+    """Force regenerate the sitemap cache. Admin only.
 
-    Returns the paths of the newly written files.
+    In the dynamic model this is a no-op (files are generated per-request),
+    but kept for API consistency with the theme endpoint.
     """
-    try:
-        return write_sitemap_files()
-    except Exception as e:
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to generate sitemap: {e}",
-        )
+    return {
+        "status": "ok",
+        "note": "sitemap and robots.txt are dynamically generated per-request using KMTN_WEBSITE_URL",
+        "base_url": settings.WEBSITE_URL,
+    }