Slug input filtering, title-derived slugs, reserved file names

Slug inputs in the site editor now filter as you type via slugify.js
(built on the transliteration npm package: unicode incl. asian scripts
folds to ASCII, spaces become hyphens, anything outside [a-z0-9-] is
dropped) instead of erroring on commit. A new page left with an empty
slug gets one derived from its title. Server-side, _check_reserved
additionally rejects reserved root file names (robots.txt, ads.txt,
sitemap.xml, openapi.json, favicon.ico, site.webmanifest) with a
human-readable reason, which the editor surfaces in its error line so
the row can be edited and committed again; those URLs are also never
looked up as content when serving.

frontend/package-lock.json

@@ -14,6 +14,7 @@
         "@codemirror/view": "^6.43.8",
         "@lezer/highlight": "^1.2.3",
         "codemirror": "^6.0.2",
+        "transliteration": "^2.6.1",
         "vue": "^3.5.26",
         "vuedraggable": "^4.1.0"
       },
@@ -2528,6 +2529,19 @@
         "node": ">=6"
       }
     },
+    "node_modules/transliteration": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/transliteration/-/transliteration-2.6.1.tgz",
+      "integrity": "sha512-hJ9BhrQAOnNTbpOr1MxsNjZISkn7ppvF5TKUeFmTE1mG4ZPD/XVxF0L0LUoIUCWmQyxH0gJpVtfYLAWf298U9w==",
+      "license": "MIT",
+      "bin": {
+        "slugify": "dist/bin/slugify",
+        "transliterate": "dist/bin/transliterate"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/unplugin-utils": {
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/unplugin-utils/-/unplugin-utils-0.3.2.tgz",