Add Zod validation layer and AI blog generation

Introduce a schema-first validation layer and an AI blog generation
feature, plus one-command Cloudflare provisioning.

- src/schemas/ holds Zod input schemas for post, content, case,
  settings, AI, and keywords; parseForm() in src/lib/form.ts validates
  FormData and returns per-field errors.
- Migrate all admin POST handlers to parseForm, showing field-level
  errors and only redirecting once validation passes.
- Add blog_keywords table and posts.focus_keyword (migration 0002);
  uniqueSlug() centralised in src/data/content.ts.
- Add src/lib/ai.ts (OpenAI-compatible chat completions + optional
  Tavily research) and /admin/ai for AI settings, keyword queue, and
  draft generation.
- Add scripts/setup.mjs (npm run setup) to provision D1/KV, set
  secrets, and optionally migrate, seed, and deploy.
- Document AI secrets, Workers Builds deploy flow, and new schemas
  across README and AGENTS docs.

migrations/AGENTS.md

@@ -11,13 +11,14 @@ Cloudflare D1 的 schema migration 同種子資料。
 
 ## Local Contracts
 
-- **Migration 由工具產生**：`0000_*.sql`、`0001_*.sql` 由 `npm run db:generate`（drizzle-kit）依 `schema.ts` 產生；`migrations/meta/` 係產生檔。**唔好手改**呢啲檔或 meta。
+- **Migration 由工具產生**：`0000_*.sql`、`0001_*.sql`、`0002_*.sql` 由 `npm run db:generate`（drizzle-kit）依 `schema.ts` 產生；`migrations/meta/` 係產生檔。**唔好手改**呢啲檔或 meta。`0002_*.sql` 加咗 `posts.focus_keyword` 同 `blog_keywords` 表。
 - **`seed.sql` 係手寫、獨立於 migration**：全部用 `INSERT OR REPLACE`，可重複執行。`db:migrate` **唔會**執行 seed。
+- **Migration 唔會喺 CI 執行**：Cloudflare Workers Builds 只跑 build + deploy；改 schema 後要手動 `npm run db:migrate`（雲端）。
 - **指令**（本機用 `:local`，雲端省略）：
   - `npm run db:generate` — 由 schema 產生 migration
   - `npm run db:migrate:local` / `npm run db:migrate` — 套用 migration
   - `npm run db:seed:local` / `npm run db:seed` — 匯入種子
-- **Seed 內容**：公司資料（`site_settings`）、首頁內容（`content_items`：service/feature/step/faq）、`cases`、一篇示範 `posts`。
+- **Seed 內容**：公司資料（`site_settings`）、首頁內容（`content_items`：service/feature/step/faq）、`cases`、一篇示範 `posts`、三個示範 `blog_keywords`（`pending`）；另有 7 個 `ai_*` AI 設定 keys（獨立 seed block）。
 - DB 名稱 `yingfung-solar-db`，binding 喺 `wrangler.jsonc`（`database_id` 仍係佔位，部署前要填）。
 
 ## Work Guidance