fix: switch sitemap/robots to dynamic generation + Nginx proxy

The reviewer noted the static sitemap.xml had a hardcoded domain in a
white-label app.  Instead of writing files to disk, we now serve
sitemap.xml and robots.txt as dynamic API endpoints that read
KMTN_WEBSITE_URL at runtime.

- Nginx proxies /sitemap.xml and /robots.txt to the backend API so
  search crawlers reach them at root paths.
- Removed the startup filesystem-write that would fail in Docker
  (backend can't write to Nginx container's static dir).
- Simplified sitemap_export.py to pure generation functions (no I/O).
- Added /api/sitemap/regenerate admin endpoint for consistency.

nginx.conf.template

@@ -24,6 +24,24 @@ server {
         try_files $uri $uri/ /index.html;
     }
 
+    # Dynamic sitemap.xml + robots.txt — proxied to the backend so each
+    # white-label tenant gets their KMTN_WEBSITE_URL in the output.
+    location = /sitemap.xml {
+        proxy_pass __API_UPSTREAM__/api/sitemap/sitemap.xml;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+    }
+
+    location = /robots.txt {
+        proxy_pass __API_UPSTREAM__/api/sitemap/robots.txt;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+    }
+
     # Proxy API calls to the backend service
     location /api/ {
         proxy_pass __API_UPSTREAM__;