[fleizean]

Summary

Fixes the code-level findings of the 2026-11-02 SEO audit: how failed renders answer, rate limiting of server rendering and the sitemap, package page size, crawlable links to package pages, generated posts, an about page, and several outdated details.

Why

Closes #28

A failed render looked like a good page to crawlers, and server rendering spent the same request budget as visitors, which makes those failures more likely. Only 20 of about 350 package pages could be reached by a link, and the largest package page was 10.7 MB. A site giving security advice also needs to say who runs it, and a generated post contained a factual error.

Changes

• Failed renders: package, package list, release digest and contributors pages answer 503 with Retry-After and noindex when their API call fails.
• Rate limits: /api/sitemap is exempt and cached in memory for an hour. API calls from the render server get their own per-visitor tier, authenticated by a shared key. Without the key they count as visitor calls, as they do today.
• Page size: GET /api/Package/{registry}/{id} accepts versionLimit and includeVersion and returns totalVersions. The first load embeds the 10 newest versions, plus the latest and the requested version. The browser then fetches the full list.
• Crawlable list: /packages uses ?page=N links with self-canonicals and ?registry= hub pages with their own heading and meta. A page past the end is a 404.
• Generated posts: every post is noindex and the section is now called Release Digests.
• About page: new /about covers the operator, data sources, categorisation and limits. It is linked from the header and footer, and Organization now has a founder.
• Sitemap: URLs match the canonicals, static pages no longer report today's date, changefreq and priority are gone, and /about, /contributors and the hubs are added.
• Copy: llms.txt is rewritten and the homepage says six registries.

Notes for reviewers

• Config after merge: set RENDER_SERVER_KEY in the server's .env to get the render tier. The site works without it, but render calls keep using the visitor budget.
• Behaviour changes:
  • The registry chips on /packages are now links and select one registry at a time instead of several.
  • "Load more" is replaced by numbered pages.
  • The release list briefly holds 10 versions on long packages until the full list arrives.
• Verification: no build or test was run locally. CI passes, but the changes have not been exercised on a running site.
• Tests: ssr-smoke.test.mjs and package.spec.ts are updated only where this change alters what they assert or mock. No new tests were added.
• Not in this pull request: comparison URLs (they depend on this work) and the remaining audit items (per-page JSON-LD, thin pages, title and heading cleanup, self-hosted fonts). Published posts were not edited; noindex is the only change to them.

Checklist

• This pull request is linked to an issue (Closes #NNN above)
• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description