chore: stabilize pipeline and harden infrastructure

- Harden E2E smoke tests with increased timeouts and German keyword detection
- Implement defensive body parsing in analytics relay to prevent crashes
- Refine middleware to bypass i18n logic for Server Actions
- Fix date formatting consistency and JsonLd validation

app/stats/api/send/route.ts

@@ -24,14 +24,34 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ status: 'ignored_in_dev' }, { status: 200 });
     }
 
-    const body = await request.json();
+    let body;
+    try {
+      body = await request.json();
+    } catch (parseError) {
+      logger.warn('Received malformed or empty JSON in analytics proxy');
+      return NextResponse.json({ status: 'ignored_bad_payload' }, { status: 200 });
+    }
+
+    if (!body || typeof body !== 'object') {
+      logger.warn('Received invalid body type in analytics proxy', { type: typeof body });
+      return NextResponse.json({ status: 'ignored_invalid_body' }, { status: 200 });
+    }
+
     const { type, payload } = body;
 
+    if (!type || !payload) {
+      logger.warn('Received incomplete analytics payload', { 
+        hasType: !!type, 
+        hasPayload: !!payload 
+      });
+      return NextResponse.json({ status: 'ignored_incomplete_payload' }, { status: 200 });
+    }
+
     // Inject the secret websiteId from server config
     const websiteId = config.analytics.umami.websiteId;
     if (!websiteId) {
       logger.warn('Umami tracking received but no Website ID configured on server');
-      return NextResponse.json({ status: 'ignored' }, { status: 200 });
+      return NextResponse.json({ status: 'ignored_no_config' }, { status: 200 });
     }
 
     // Prepare the enhanced payload with the secret ID