Allow instances to set robots.txt to Disallow all

Add a no spider option to the about page that when enabled serves up a
robots.txt file that disallows all. If not set then serves up the normal
robots.txt

Also adds middleware to serve up robots.txt which means moving the file
to views as otherwise the static serving kicks in first and we need to
process this later on in order to get access to the instance settings.

This does also have the side effect that we have separate robots.txt
files for the hosting and instance apps.

Fixes #692
I think it would be clearer if this used `app.get`, e.g.

```js
app.get('/robots.txt', require('…'));
```

And that would also simplify the robots middleware as you wouldn't need to test `req.url`.