Assert SITE_URL is XML-safe in sitemap-pages route #71

`app/sitemap-pages.xml/route.ts:15` interpolates `SITE_URL` raw into `` element bodies. The accompanying comment correctly documents that `slug` is XML-safe because of `SLUG_RE`, but `SITE_URL` carries no equivalent guard.

Today this is fine because `lib/links.ts` sets it to a known-safe value. But a future preview-URL or query-string accident introducing `&`, `<`, `>`, `"`, or `'` would silently emit invalid XML, and search engines reject the sitemap.

Fix

One-line assert at module top:

```ts
if (/[<>&"']/.test(SITE_URL)) {
throw new Error(`[sitemap] SITE_URL contains XML-significant characters: ${SITE_URL}`);
}
```

Found during PR review of #61.