feat: 404 log and report endpoint

- POST /_seo/api/v1/notfound with the golem15.seo.notfound_token bearer
  (constant-time, off when unset), URL and referer caps, a row cap with
  an hourly warning, throttle bucket seo-notfound
- golem15.seo.notfound list by hits with Resolved rows, a preview with the
  resolved hint, a prompted 301 and a 410 record action, a bulk 410 that
  refuses a selection with a covered address
- every /_seo/api/v1 answer carries X-Robots-Tag: noindex

admin_navigation.go

@@ -24,6 +24,13 @@ func (*Plugin) Navigation() []pact.NavigationItem {
 				Permissions: []string{controllers.PermissionManage},
 				Controller:  controllers.RedirectsControllerID,
 			},
+			{
+				Code:        "notfound",
+				Label:       "golem15.seo::lang.nav.notfound",
+				Icon:        "triangle-alert",
+				Permissions: []string{controllers.PermissionManage},
+				Controller:  controllers.NotFoundControllerID,
+			},
 			{
 				Code:        "rules",
 				Label:       "golem15.seo::lang.nav.rules",