fix(seo): exclude noindex aviso-legal page from sitemap; add full audit report

Sitemap filter was excluding cookies/ and privacidad/ but not
aviso-legal/, even though that page is marked noindex,follow -- a
noindexed page has no business being listed for crawl discovery.

Also adds docs/seo-audit/mnqcatering.com-audit/ -- the full multi-agent
SEO audit run this session against the corrected live domain
(www.mnqeventos.es), including the FULL-AUDIT-REPORT.md, ACTION-PLAN.md,
and per-category findings files.

docs/seo-audit/mnqcatering.com-audit/findings/sitemap.md

@@ -0,0 +1,87 @@
+# Sitemap Architecture Audit — mnqeventos.es (canonical live domain)
+
+Date: 2026-09-15
+Scope: live sitemap at `https://www.mnqeventos.es/sitemap-index.xml`, `src/pages/` route set, `astro.config.mjs`, `src/middleware.ts`, `@astrojs/sitemap` output.
+
+## Correction from earlier pass
+
+An earlier pass of this audit targeted `https://www.mnqcatering.com/sitemap-index.xml`. That domain is confirmed **not registered** (DNS `NXDOMAIN` on two resolvers, WHOIS "no match" for `MNQCATERING.COM`) — this was not a sandbox artifact, it's genuinely unregistered. The actual canonical, live, registered production domain is **`https://www.mnqeventos.es/`**. This report re-audits against that domain, checked live.
+
+## Summary — what's actually live right now
+
+Live-fetched and verified directly (not from local build):
+
+- `https://www.mnqeventos.es/sitemap-index.xml` → **HTTP 200**, valid XML, but its one `<sitemap><loc>` entry points to **`https://www.mnqcatering.com/sitemap-0.xml`** — i.e. the sitemap index is still wired to the old, unregistered domain.
+- Trying to actually fetch `https://www.mnqcatering.com/sitemap-0.xml` (the URL the live index points to) fails: `Could not resolve host`. **The referenced sub-sitemap is unreachable — Googlebot cannot follow the index to any URL list.**
+- `https://www.mnqeventos.es/sitemap-0.xml` (fetched directly, not via the index) does return HTTP 200 and 7 `<url>` entries, but **every `<loc>` inside it is still `https://www.mnqcatering.com/...`** — none of them use the live `mnqeventos.es` domain. Even a crawler that finds this file by luck gets a list of 7 dead URLs.
+- `https://www.mnqeventos.es/robots.txt` → live, `Sitemap:` line still points to `https://www.mnqcatering.com/sitemap-index.xml`.
+- `https://mnqeventos.es/` (bare apex, no `www`) did not respond in this environment (connect/timeout) — could not confirm apex→www redirect behavior live.
+
+**Net effect: right now, in production, the sitemap infrastructure at the real domain is 100% non-functional.** The index file exists and is valid XML, but every path a crawler can take from it (via `<sitemap><loc>`, or via `robots.txt`, or by url-list entries once inside `sitemap-0.xml`) terminates at the unregistered `mnqcatering.com` domain.
+
+## Codebase state vs. deployed state
+
+The source code has already been fixed, but **the fix is not deployed**:
+
+- `astro.config.mjs:6` → `site: 'https://www.mnqeventos.es'` (correct).
+- `src/middleware.ts:3` → `const CANONICAL_HOST = 'www.mnqeventos.es';`, with an explicit comment: *"www.mnqeventos.es is the real, registered, live production domain. mnqcatering.com was an ... do NOT set CANONICAL_HOST back to it..."*
+- This fix is **committed**: `git log` shows commit `a6692b7` — `fix(seo): correct canonical domain to www.mnqeventos.es` — at `2026-09-15 10:07:24 +0200` (today, this session).
+- A local `astro build` run against the current source produces a **correct** `dist/client/sitemap-0.xml` with all 7 `<loc>` entries on `https://www.mnqeventos.es/...`.
+- Conclusion: the commit is real and correct, but the running production deployment predates it and is serving a stale build. **This is a deploy/release gap, not a remaining code defect.**
+
+## Findings
+
+### 1. Live sitemap index points to a dead sub-sitemap on an unregistered domain
+- **Severity:** Critical
+- **Evidence:** live `https://www.mnqeventos.es/sitemap-index.xml` → `<loc>https://www.mnqcatering.com/sitemap-0.xml</loc>`; fetching that URL fails to resolve.
+- **Recommendation:** Deploy the already-committed fix (`a6692b7`) to production. Until deployed, Search Console will report the submitted sitemap as unreachable/errored, and no URLs from this site are discoverable via sitemap at all.
+
+### 2. Live sub-sitemap URLs all reference the unregistered domain
+- **Severity:** Critical
+- **Evidence:** `https://www.mnqeventos.es/sitemap-0.xml` (live, HTTP 200) lists all 7 URLs as `https://www.mnqcatering.com/...`.
+- **Recommendation:** Same fix/deploy as above resolves this; the local rebuilt `dist/client/sitemap-0.xml` already generates correct `mnqeventos.es` URLs from current source.
+
+### 3. `robots.txt` still points to the dead domain's sitemap
+- **Severity:** High
+- **Evidence:** live `https://www.mnqeventos.es/robots.txt` → `Sitemap: https://www.mnqcatering.com/sitemap-index.xml`.
+- **Recommendation:** Confirm `public/robots.txt` in source now reads correctly (it's generated from the same `site` config via `@astrojs/sitemap`/Astro, so it should self-correct once redeployed) and redeploy.
+
+### 4. Noindexed URL present in sitemap — `/aviso-legal/` (unchanged by the domain fix)
+- **Severity:** High
+- **Evidence:** `src/pages/aviso-legal.astro:8` sets `robots="noindex,follow"` (page is an explicitly-labeled placeholder pending final legal data), but `astro.config.mjs`'s sitemap filter only excludes `/cookies/` and `/privacidad/`, not `/aviso-legal/`. It's present in both the stale live sitemap and the freshly rebuilt one.
+- **Recommendation:** Add `/aviso-legal/` to the sitemap filter, or remove `noindex` once the page's legal content is finalized.
+
+### 5. Apex domain redirect unverified live
+- **Severity:** Medium
+- **Evidence:** `https://mnqeventos.es/` (no `www`) did not respond from this environment; could not confirm live 301 behavior to `www`.
+- **Recommendation:** Verify from an unrestricted network: `curl -I https://mnqeventos.es/` should 301 to `https://www.mnqeventos.es/`.
+
+### 6. Trailing-slash canonical inconsistency risk (code-level, still present after the domain fix)
+- **Severity:** Medium
+- **Evidence:** `astro.config.mjs` doesn't set `trailingSlash`; canonical tag in `src/layouts/MainLayout.astro:34` is built from `Astro.url.pathname` (the live request path), so `/aviso-legal` and `/aviso-legal/` could both 200 with differing self-referencing canonicals, while the sitemap only lists the trailing-slash form.
+- **Recommendation:** Set `trailingSlash: 'always'` and ensure the middleware/hosting layer redirects the non-slash form.
+
+## XML validity
+
+- `sitemap-index.xml` and `sitemap-0.xml`, both live and locally-rebuilt versions: well-formed XML, correct namespaces, no `priority`/`changefreq` clutter.
+- 7 URLs total — nowhere near the 50,000-URL limit; single-file index is appropriate.
+
+## Quality gates (location pages)
+
+Not applicable — 0 location pages, no programmatic page generation.
+
+## What already works well
+
+- The domain-migration bug is **already fixed in source and committed** (`a6692b7`) — this is a deploy-pipeline gap, not unresolved engineering work.
+- `/cookies/` and `/privacidad/` are correctly excluded from the sitemap and both carry matching `robots="noindex,follow"` — keep this as-is.
+- No deprecated `priority`/`changefreq` tags.
+- Sitemap-index wrapper used despite low URL count — future-proof.
+- No dynamic/programmatic routes, so no doorway-page risk.
+
+## Score: 25 / 100 (live, as currently deployed)
+
+The live sitemap infrastructure is currently non-functional end-to-end (index → sub-sitemap → robots.txt all point to an unregistered domain), which is as severe as it gets for this checklist even though the underlying code quality is otherwise reasonable. **This score will jump to roughly 75/100 immediately upon redeploying the already-committed fix** — the only remaining code-level issues at that point are the `/aviso-legal/` noindex contradiction (High) and the trailing-slash canonical gap (Medium), both pre-existing and unrelated to the domain migration.
+
+## Immediate action
+
+Redeploy production from current `master` (commit `a6692b7` or later) so the live sitemap, sub-sitemap, and `robots.txt` all resolve to `mnqeventos.es`. This is the single highest-impact fix available right now.