🐛 Return real image URLs from the JSON API and stop leaking internal fields

The API serialised donations with as_json, so image_url came back as the Active Storage attachment (with the whole record nested inside) instead of a URL, and every column was exposed - requesters, unsubscribers, transfer, transaction_id, and a comment's payment details. Responses are now built field by field, with image_url, thumbnail_url, charity logo_url and user avatar_url as URLs. Drafts 404 through the API for anyone but their owner, matching the web page. :sparkles: Double down on SEO and AEO Structured data on every public page (Organization sitewide, Product, NGO, Place, ProfilePage, CollectionPage, Article, BreadcrumbList), robots directives with noindex on personal and search-result pages, a sitewide RSS feed, image entries in the sitemap, and llms.txt / llms-full.txt rendered from the database instead of static files. Translate the SEO category landing pages and giving guides into Swedish, Norwegian, German, French and Spanish, and move the guides' hardcoded badges and calls to action into locale keys.