fix(proxy): allow unauthenticated access to /opengraph-image

Social-media crawlers (Facebook, Twitter/X, Slack, Discord) never
have a Clerk session, so the new OG image route was 307-redirecting
every one of them to /sign-in instead of serving the image — found
while live-testing right after deploy, same class of bug as the
GDPR-export route fix.

src/proxy.ts

@@ -9,6 +9,7 @@ const isPublicRoute = createRouteMatcher([
   "/verify-email(.*)",
   "/health-card/(.*)",
   "/api/gdpr-export/(.*)",
+  "/opengraph-image",
   "/impressum",
   "/datenschutz",
   "/nutzungsbedingungen",