feat(mindspace): add SEO/GEO delivery, page template catalog, and admin hooks

Enable optional SEO/GEO injection and discovery routes for confirmed public pages while keeping private pages noindex. Add premium page template skills, portal catalog API, template shop UI, and Baidu push gated by memind_adm config.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -54,6 +54,7 @@ import { attachPortalMindSpaceChatShareRoutes } from './server/portal-mindspace-
 import { attachPortalMindSpacePageCoreRoutes } from './server/portal-mindspace-page-core-routes.mjs';
 import { attachPortalMindSpacePagePublishRoutes } from './server/portal-mindspace-page-publish-routes.mjs';
 import { attachPortalMindSpaceSpaceRoutes } from './server/portal-mindspace-space-routes.mjs';
+import { attachPortalTemplateCatalogRoutes } from './server/portal-template-catalog-routes.mjs';
 import { attachPortalPlazaDiscoveryRoutes } from './server/portal-plaza-discovery-routes.mjs';
 import { attachPortalPlazaRoutes } from './server/portal-plaza-routes.mjs';
 import { attachPortalPublicationRoutes } from './server/portal-publication-routes.mjs';
@@ -65,12 +66,15 @@ import {
 import { attachPortalRuntimeRoutes } from './server/portal-runtime-routes.mjs';
 import { attachPortalStaticDeliveryRoutes } from './server/portal-static-delivery-routes.mjs';
 import { createPortalWorkspacePublicationDelivery } from './server/portal-workspace-publication-delivery.mjs';
+import { attachPortalSeoDiscoveryRoutes } from './server/portal-seo-discovery-routes.mjs';
 import { createPortalAuthSessionHelpers } from './server/portal-auth-session-helpers.mjs';
 import { createPortalSessionCoordinator } from './server/portal-session-coordinator.mjs';
 import { attachPortalSessionRoutes } from './server/portal-session-routes.mjs';
 import { attachPortalUserMemoryRoutes } from './server/portal-user-memory-routes.mjs';
 import { attachPortalGoalRunRoutes } from './server/portal-goal-run-routes.mjs';
 import { assertMindSpaceRoute, mindspaceFlags } from './mindspace-flags.mjs';
+import { loadMindSpaceConfigCached } from './mindspace-config.mjs';
+import { createMindspaceSeoDiscoveryService } from './mindspace-seo-discovery-service.mjs';
 import { normalizeWorkspaceRelativePath } from './mindspace-pages.mjs';
 import {
   buildMindSpacePublicUrlForUser,
@@ -249,6 +253,7 @@ if (ACCESS_PASSWORD && !isDatabaseConfigured()) {
 }
 
 let userAuth = null;
+let templateCatalogService = null;
 let sessionAccess = null;
 let sessionStreamStore = null;
 let tkmindProxy = null;
@@ -420,6 +425,7 @@ async function bootstrapUserAuth() {
     wechatOAuthService =
       authServices.wechatOAuthService;
     rechargeService = authServices.rechargeService;
+    templateCatalogService = authServices.templateCatalogService;
     const agentServices =
       await bootstrapPortalAgentServices({
         pool,
@@ -866,6 +872,13 @@ attachPortalMindSpaceSpaceRoutes(api, {
   handleMindSpaceError: mindSpaceError,
 });
 
+attachPortalTemplateCatalogRoutes(api, {
+  getTemplateCatalog: () => templateCatalogService,
+  ensureMindSpaceEnabled,
+  sendData,
+  sendError,
+});
+
 function resolvePlazaPostUrlForRequest(postId, req) {
   const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(':')[0];
   const base = resolvePlazaPublicBase({
@@ -1385,6 +1398,7 @@ attachPortalAgentRuntimeRoutes(api, {
   getAgentRunGateway: () => agentRunGateway,
   getGoalRunService: () => goalRunService,
   getChatIntentRouter: () => chatIntentRouter,
+  getTemplateCatalog: () => templateCatalogService,
   getSessionAccess: () => sessionAccess,
   getMindSpaceAssetAgent: () => mindSpaceAssetAgent,
   getCodeRunPolicyService: () => agentCodeRunPolicyService,
@@ -1517,6 +1531,10 @@ const { serveUserPublishFile } =
       mindSpaceWorkspacePublicationDelivery,
     resolveRequestOrigin,
     removeQueryParam,
+    getMindSpaceConfig: () =>
+      authPool
+        ? loadMindSpaceConfigCached(authPool)
+        : Promise.resolve({ seoGeo: { enabled: false } }),
     logger: console,
   });
 // Express routing is case-insensitive by default, so the lowercase /mindspace API
@@ -1536,8 +1554,30 @@ const sendPublishedPage =
     getAuthPool: () => authPool,
     getUserAuth: () => userAuth,
     getMindSpacePages: () => mindSpacePages,
+    getMindSpaceConfig: () =>
+      authPool
+        ? loadMindSpaceConfigCached(authPool)
+        : Promise.resolve({ seoGeo: { enabled: false } }),
   });
 
+let mindspaceSeoDiscoveryService = null;
+function getMindspaceSeoDiscoveryService() {
+  if (!authPool) return null;
+  if (!mindspaceSeoDiscoveryService) {
+    mindspaceSeoDiscoveryService = createMindspaceSeoDiscoveryService(authPool);
+  }
+  return mindspaceSeoDiscoveryService;
+}
+attachPortalSeoDiscoveryRoutes(app, {
+  getAuthPool: () => authPool,
+  getMindSpaceConfig: () =>
+    authPool
+      ? loadMindSpaceConfigCached(authPool)
+      : Promise.resolve({ seoGeo: { enabled: false } }),
+  getSeoDiscoveryService: getMindspaceSeoDiscoveryService,
+  resolveRequestOrigin,
+});
+
 attachPortalPublicationRoutes({
   app,
   urlencodedBody: express.urlencoded({