fix: address reviewer feedback — dynamic sitemap/robots + wildcard CI branches

- CI workflow: replace hardcoded branch list with ['**'] wildcard so
  pipeline runs on every branch push, not just 4 named branches.

- Sitemap/robots.txt: moved from static files to dynamic generation.
  New sitemap_export.py module (follows theme_export.py pattern) uses
  KMTN_WEBSITE_URL to generate tenant-aware sitemap.xml and robots.txt
  on app startup. Atomic writes to STATIC_FILES_DIR so Nginx serves them.

- Added /api/sitemap endpoint with /status (public) and /regenerate
  (admin-only) for runtime control.

Addresses reviewer comments on PR #4:
  1. 'more general way to ensure this runs on any branch on push'
  2. 'whitelabel app - this file may need to be dynamically generated'

backend/app/api/sitemap.py

@@ -0,0 +1,38 @@
+"""Sitemap & robots.txt API: status check, regenerate endpoint.
+
+Follows the same pattern as the theme API — public GET for status,
+admin-only POST to force regeneration.
+"""
+
+from typing import Any, Dict
+
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from app.auth import get_current_admin_user
+from app.sitemap_export import get_sitemap_status, write_sitemap_files
+from app.user_models import User
+
+router = APIRouter()
+
+
+@router.get("/status")
+async def sitemap_status() -> Dict[str, Any]:
+    """Return sitemap/robots file status. Public endpoint."""
+    return get_sitemap_status()
+
+
+@router.post("/regenerate", status_code=200)
+async def regenerate_sitemap(
+    _: User = Depends(get_current_admin_user),
+) -> Dict[str, Any]:
+    """Force regenerate sitemap.xml and robots.txt. Admin only.
+
+    Returns the paths of the newly written files.
+    """
+    try:
+        return write_sitemap_files()
+    except Exception as e:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to generate sitemap: {e}",
+        )