favycon.app has no DNS records at all, so favycon.vercel.app is the only
hostname this site answers on and the canonical is unambiguous. It uses the
SITE_URL constant, so it cannot disagree with og:url.
The sitemap is a single static URL. Its loc is written without a trailing
slash to match the canonical string exactly — the two forms are the same
URL per RFC 3986, but nothing here forces them to differ, so they don't.
No lastmod: a hand-maintained file would claim a freshness it can't know.
robots.txt gains the Sitemap line and a note that /api/favycon is POST-only
and answers a GET with 405. It stays out of the disallow list deliberately:
a 405 tells a crawler more than a rule it has to fetch robots.txt to find.
