BF-001-BF-008: Complete P0 SEO, privacy, mobile, and Pipeline Builder fixes

[baixiangcpp]

Summary

• Adds legacy taxonomy redirects/canonical targets, filtered All Tools noindex handling, and shared canonical/hreflang route policy.
• Adds prominent shared sensitive-input warnings to token, secret, certificate, log, HAR, env, HTTP request, and hash flows.
• Fixes 390px mobile overflow risks across All Tools and core tool layouts.
• Improves Pipeline Builder first-run onboarding, empty states, drag/drop and keyboard reordering, and privacy preview gates for save/export/share.
• Sanitizes Pipeline Builder persistence so saved/exported/shared recipes contain structure only, not runtime payloads.

Issues

Closes #93
Closes #95
Closes #98
Closes #101
Closes #103
Closes #106
Closes #108
Closes #110

Implementation details

• Routing: centralized legacy taxonomy mapping and localized alternates in src/core/routing/seo-route-policy.ts; added Netlify-style 301 redirects in public/_redirects.
• Metadata: legacy taxonomy layouts now point canonicals/hreflang to their canonical destinations; clean All Tools pages remain indexable; query-filtered All Tools states get runtime noindex,follow robots metadata.
• Sitemap: legacy taxonomy slugs are filtered from sitemap output; sitemap lastmod data was regenerated for the touched pages.
• Storage: Pipeline Builder save/export/share paths now pass through recipe sanitization; saved IndexedDB data and share URLs exclude runtime input/output/log/file payloads.
• UI: shared SensitiveInputWarning component placed near primary inputs; mobile controls wrap/stack; Pipeline Builder adds onboarding, empty-state copy, privacy preview modal, drag handles, and keyboard move controls.
• Tests: added P0 guard tests for SEO routing, mobile layout patterns, sensitive warnings, and Pipeline Builder privacy preview/sanitized recipe behavior.

Privacy review

• No tool payloads are stored by default.
• Pipeline Builder persistence stores structure only: name, description, step IDs/order, tool IDs, labels, adapter version, public options, and settings.
• Runtime input, output, logs, file contents, secrets, private headers, and constant inputs are removed before save/export/share.
• No new external requests run automatically or through byteflow.tools backend processing.
• Analytics behavior was not changed.
• localStorage/sessionStorage/IndexedDB/cache usage was reviewed: this batch adds only a safe onboarding-dismissal preference in localStorage and sanitized Pipeline Builder recipe storage in IndexedDB.

SEO review

• Legacy taxonomy URLs redirect or canonicalize to canonical destinations and are removed from sitemap generation.
• Clean localized All Tools pages remain indexable and self-canonicalize.
• Searched/filtered All Tools query states are excluded from robots/sitemap indexing surfaces and receive noindex,follow.
• Canonical and hreflang generation now uses one route-policy source of truth with reciprocal localized alternates.

Accessibility review

• Pipeline Builder steps support keyboard reordering with accessible labels and live announcements.
• Drag handles and privacy-preview controls have labels.
• Existing visible focus styles remain in use; mobile touch targets were expanded for form controls and tool actions.
• Dynamic privacy and reorder feedback uses modal semantics/live regions where relevant.

Tests

Targeted checks run:

• npm run test -- tests/guards/bf-p0-seo-routing.test.ts tests/guards/all-tools-route-guard.test.ts tests/guards/sitemap.test.ts tests/guards/sensitive-input-warning-guard.test.ts tests/guards/bf-p0-mobile-layout-guard.test.ts tests/guards/sensitive-tool-persistence-policy.test.ts tests/unit/pipeline-foundation.test.ts tests/component/phase3-pipeline-builder-page.test.tsx tests/guards/pipeline-builder-privacy-preview-guard.test.ts tests/guards/i18n.test.ts
• npm run check:i18n
• npm run check:types -- --pretty false
• git ls-files --others --modified --exclude-standard | rg '\.(ts|tsx|js|mjs|cjs)$' | tr '\n' '\0' | xargs -0 npm run lint --
• Scripted Playwright 390px overflow smoke check for /en/all-tools?search=json, /en/json-formatter, /en/regex-tester, /en/image-resizer, /en/json-diff-viewer, /en/text-diff-checker, and /en/pipeline-builder.

Batch-level checks run:

• npm run generate:sitemap-lastmod
• npm run build

Full CI:

• Local full build was run once for this batch. Remote CI will run on the PR/merge path if configured.

[cloudflare-workers-and-pages]

Deploying byteflow with    Cloudflare Pages

Latest commit:	3e18ceb
Status:	✅  Deploy successful!
Preview URL:	https://6dcb451b.byteflow-c58.pages.dev
Branch Preview URL:	https://codex-bf-p0-batch1.byteflow-c58.pages.dev

View logs