The /api/site surface

GET  /api/site/whoami            # site, customer, platform, environment, modules
GET  /api/site/content           # managed copy; ?section= filter
GET  /api/site/content/<slug>    # one content row (site-specific beats shared)
GET  /api/site/files             # the site's files + shared brand assets
GET  /api/site/locations         # business name + locations (+ per-location files)
GET  /api/site/products          # ACTIVE products only; ?category= filter
GET  /api/site/categories        # ACTIVE categories only
GET  /api/site/forms/<form_key>  # a dashboard-built form definition
POST /api/site/forms/<form_key>  # submit (validated, throttled, honeypotted)
POST /api/site/leads             # contact-form lead → `contact` record
POST /api/site/insights          # the analytics beacon
POST /api/site/cdn/manifest      # CDN deploy: what needs uploading
POST /api/site/cdn/uploaded      # CDN deploy: confirm uploads
POST /api/site/cdn/activate      # CDN deploy: atomic activation
GET  /api/site/cdn/status        # active deployment + asset prefix