Static sitemap publishes /repositories which has no page, and omits the homepage

**Describe the bug**

`BaseSitemap.STATIC_ROUTES` (`backend/src/apps/sitemap/views/base.py`) has drifted out of sync with the actual Next.js routes in both directions. Production is currently publishing a URL that returns 404, and the homepage is not in the sitemap at all.

**Live evidence**

The sitemap advertises `/repositories`:

```
$ curl -s https://nest.owasp.org/sitemap.xml | grep -A3 "https://nest.owasp.org/repositories"
https://nest.owasp.org/repositories
2026-08-14T16:40:34.550786+00:00
weekly
0.7
```

That URL 404s:

```
$ curl -s -o /dev/null -w "%{http_code}\n" https://nest.owasp.org/repositories
404
```

This is what https://nest.owasp.org/repositories renders right now:


And the homepage is absent from all 22,739 URLs in the sitemap:

```
$ curl -s https://nest.owasp.org/sitemap.xml | grep -c "https://nest.owasp.org/"
0
```

**Why `/repositories` 404s**

There is no `/repositories` page in the frontend. The only repository page is nested at `frontend/src/app/organizations/[organizationKey]/repositories/[repositoryKey]`. There is no top level `repositories` directory under `frontend/src/app`, no route group or catch-all that would resolve it, and the only `rewrites` in `next.config.ts` are `/csrf/` and `/graphql/` under `NEXT_PUBLIC_E2E_BACKEND_BASE_URL`. So the request falls through to `not-found.tsx`.

To be clear, `RepositorySitemap.location()` is already correct. It overrides the base and returns `/organizations/{org}/repositories/{key}`. The stale entry is only the top level static one in `STATIC_ROUTES`.

**Routes that exist but are not in the sitemap**

These pages are publicly reachable with no session check, and none of them appear in the sitemap:

| Route | Page file |
|---|---|
| `/` | `frontend/src/app/page.tsx` |
| `/about` | `frontend/src/app/about/page.tsx` |
| `/community` | `frontend/src/app/community/page.tsx` |
| `/community/snapshots` | `frontend/src/app/community/snapshots/page.tsx` |
| `/mentorship/programs` | `frontend/src/app/mentorship/programs/page.tsx` |

The homepage being missing is the part that surprised me most.

I also see `/projects/dashboard` and `/projects/dashboard/metrics` with no session check in their `page.tsx`, but they are linked from `UserMenu.tsx`, so they may be excluded on purpose. Happy to leave those alone.

**To Reproduce**

Steps to reproduce the behavior:

1. Run `curl -s https://nest.owasp.org/sitemap.xml | grep "https://nest.owasp.org/repositories"` and see the entry is published.
2. Run `curl -s -o /dev/null -w "%{http_code}\n" https://nest.owasp.org/repositories` and see 404.
3. Open https://nest.owasp.org/repositories in a browser and see the "404 Page Not Found" screen.
4. Run `curl -s https://nest.owasp.org/sitemap.xml | grep -c "https://nest.owasp.org/"` and see 0 for the homepage.

**Expected behavior**

`STATIC_ROUTES` should list exactly the public static pages that actually exist. Concretely:

- Drop `/repositories`, or add a real top level repositories page if one is intended. Right now the sitemap sends crawlers to a 404.
- Add `/`, `/about`, `/community`, `/community/snapshots` and `/mentorship/programs`.

A test that walks `frontend/src/app` and asserts every `STATIC_ROUTES` path has a matching `page.tsx` would keep this from drifting again, since this is the second time the list has gone stale.

**Related issues**

#5349 covers the `/snapshots` prefix specifically, so I have left that route out of this report to avoid overlapping it. Worth mentioning that `/snapshots` currently 404s in production too, same as `/repositories`.

#5259 proposes adding `"/repositories": Repository` to `StaticSitemap.lastmod`'s `path_to_model`. The `lastmod` of `2026-08-14T16:40:34` in the output above is the regeneration timestamp, so that report is accurate. Flagging that the two issues interact: if `/repositories` is removed because no such page exists, that mapping is not needed. If instead a repositories page is going to be added, #5259's fix is right and this issue becomes about adding the page. Either way the two are probably best decided together.

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

**Additional context**

Checked against `main` and against production at the time of writing. All the commands above are reproducible by anyone.

Start in backend/src/apps/sitemap/views/base.py and compare STATIC_ROUTES with the listed Next.js page files under frontend/src/app. Verify the generated sitemap with the curl commands in the issue, ensuring the stale route is gone and the homepage and specified public routes are present. Check the interaction with #5259 and avoid the overlapping /snapshots work in #5349.

Written by the indexing model from the issue text.