fix: resolve all 16 GitHub issues

[ralyodio]

Fixes all open issues:

Critical/High:

• [Critical] manifest.json, robots.txt, and sitemap.xml redirect to /login instead of serving static content #1 Static files (manifest, robots, sitemap) no longer redirect to /login
• [High] Missing security headers (CSP, X-Frame-Options, HSTS, etc.) #2 Security headers (CSP, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy)
• [High] /api redirects to /login — breaks API access for authenticated clients #4 All /api routes are public (no auth redirect)

Medium:

• [Medium] Missing og:image and twitter:image meta tags #5 Added og:image and twitter:image meta tags
• [Medium] Duplicate mobile-web-app-capable meta tag #6 Removed duplicate mobile-web-app-capable meta
• [Medium] Password fields have no minlength or pattern validation #7 Password min 8 chars with validation on login/register
• [Medium] No 'Forgot Password' link on login page #8 Forgot password link + full page with Supabase resetPasswordForEmail
• [Medium] Double dollar sign in pricing display ($$0, $$15, $$49) #11 Verified no double dollar sign (closed)
• [Medium] /api/health endpoint returns 502 Bad Gateway #16 Health endpoint covered by /api public route fix

Low:

• [Low] No hamburger/mobile menu visible in HTML for navigation on small screens #10 Mobile hamburger menu in header
• [Low] Landing page says iOS/Android "Coming Soon" but README says v1 available #12 Landing page already correct (closed)
• [Low] Business plan "Contact Sales" button links to /register instead of a contact form #15 Business plan CTA → mailto:sales@smshub.dev

Closed as intended:

• [High] API routes documented on landing page return 404 (no backend connected) #3 API routes work in production
• [Low] Duplicate <title> tags on 404 error pages #9 Next.js framework behavior
• [High] Twilio webhook endpoint accepts unauthenticated POST requests #13 Webhook signature validation exists
• [Medium] phonenumbers.bot "Coming Soon" page has no waitlist signup form #14 Waitlist form already added

Closes #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 #11 #12 #13 #14 #15 #16