Prevent PayGate search indexing

[Phloraxx]

Summary

• add global X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex;
• cover PayGate API, operator SPA, and PocketBase routes with router-wide middleware;
• add HTML robots metadata to the operator app;
• expose a crawler policy route so engines can fetch the noindex directives;
• keep sitemap and unknown marketing routes absent.

Verification

• full Go test suite passed;
• go vet ./... passed;
• focused robots/header tests passed.