You are working on the codebase behind duckduckgo.com.

An external scan of the deployed site found the tells listed below — the specific things that make it read as assembled by a website builder rather than built. Fix them in the order given. Each item names the evidence observed on the live page, so you can confirm the problem before you change anything.

Rules for this task:
- Do not redesign the site. Change only what each item asks for.
- Do not change any URL, route or page title beyond what an item explicitly requires.
- If an item does not match what you find in the code, say so and skip it rather than inventing a change.
- Work through the list top to bottom and report what you changed for each.

## Unfinished production basics

### 1. Unknown URLs return 200 instead of 404 (SPA catch-all)
Observed on the live site: GET /is-vibecoded-probe-1t5wjlh → 200 (expected 404)

Make unknown URLs return a real HTTP 404. The catch-all currently answers 200 for paths that do not exist (GET /is-vibecoded-probe-1t5wjlh → 200 (expected 404)), so every typo and dead link gets indexed as a duplicate page. Serve the not-found view with a 404 status code, not a client-side redirect.

## When you are done

Re-run the checks yourself before reporting: fetch the deployed page with curl and confirm the markers above are gone from the HTML, that unknown paths return 404, and that `/robots.txt` and `/sitemap.xml` answer 200. Then summarise anything you deliberately did not change and why.