Hide members-only media from previews

[phucnguyen1707]

Bug fixed: members-only media was gated in the page body, but public preview paths could still expose it.

Steps:

1. Use an approved media item tagged members-only, such as the nsfw tag.
2. Open its detail URL as a non-member, or inspect its OpenGraph/Twitter metadata and direct RSS feed at /rss/m/{slug}.xml.

Expected:
Non-members should see the gated upsell only, and public metadata/RSS/related-media surfaces should not expose the protected item or its real image preview.

Actual:
The page body was gated, but generateMetadata still used the real title/image, /rss/m/{slug}.xml could publish the item, and related-media lookups could include members-only items by default.

Fix:

• Adds a shared members-only tag helper.
• Uses safe noindex metadata without the real image for members-only detail pages.
• Returns 404 for direct members-only media RSS feeds.
• Excludes members-only media from related-media queries by default, while still allowing lifetime members to see related gated media on the detail page.

Verification:

• pnpm --filter @aiornot/web typecheck
• pnpm --filter @aiornot/web test
• pnpm --filter @aiornot/web build