fix: remove client-side API keys, repair capture forms, harden host c… - #41

…anonicalisation

Middleware: non-primary hosts (pages.dev preview deployments, stale custom
domains) are now 301'd to the apex instead of served, removing indexable
duplicates of the whole site. Adds an X-Robots-Tag noindex fallback. The
verified single-hop www/protocol/trailing-slash behaviour and the /api/*,
/go/* and file-extension exemptions are unchanged.

New functions/api/capture-email.js proxies Systeme.io server-side, reading
only env.SYSTEME_API_KEY. Validates the address, allow-lists tags, treats an
upstream 409 as success, CORS restricted to the apex.

Removes the hardcoded live Systeme.io API key from
src/pages/shopify-automation-guides.astro and routes all capture forms
through the new endpoint. Two of those forms were posting to an unreplaced
pub_YOUR_PUBLICATION_ID placeholder and had never captured anything:
replace-klaviyo-free.astro and the stack.astro newsletter form. Deletes the
BEEHIIV_PUB_ID constant and the leftover setup-instruction comment that was
being shipped in stack.astro's page source.

Homepage scanner and guide captures no longer depend on window.open to
beehiiv, which mobile browsers block; gfGet keeps a single popup for the PDF
the visitor actually requested.

Deployment prerequisite: SYSTEME_API_KEY must be bound in Cloudflare Pages
for both Production and Preview, using the rotated key.

public/_redirects, public/robots.txt, astro.config.mjs and
src/layouts/Base.astro are untouched; all 18 /go/ rules intact.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESF5YNWpVMFdYJRNoNRrMm