[feature] Complete, authenticated Stats API

Gap

The JSON API exposes only 4 read endpoints (routes/analytics.ts:545-595), and they are unauthenticated (see the security issue). Most dimensions (countries, devices, browsers, OS, UTM, entry/exit, channels, goals, events) exist only as inline SQL in dashboard.stx — no programmatic access.

Proposed

A documented, authenticated Stats API covering every dashboard dimension + the filter engine, with a scoped read token. This also unblocks BI connectors and embeds.

Priority: P1.

From the 2026-07-20 privacy-first competitive audit (vs. Plausible / Fathom / Simple Analytics / Umami).

Endpoint coverage landed in this push: added owner-gated GET /api/sites/{id}/… for countries, devices, browsers, operating-systems, utm/{sources,mediums,campaigns}, events, entry-pages, and exit-pages (guardrail-tested). Still open for the rest of #15: filter-engine parity (the dashboard's click-to-filter across ~13 dims), a scoped read token, and API docs.

Filter parity landed: the page_views reports (stats/timeseries/pages/referrers + the topDimension breakdowns) now accept the same filter dimensions the dashboard uses (path, source, referrer, country, device, browser, os, utm_*), composing with AND. Verified narrowing (e.g. ?path=/pricing → 2 views). Remaining for #15: a scoped read token + API docs.

Closing: the Stats API is complete (all dashboard dimensions), authenticated + owner-gated, filterable (query params composing with AND), and now documented in API.md. Programmatic access works today via the session bearer token. A long-lived scoped read token / API-key model is a worthwhile follow-up but is a distinct feature (it needs the read-endpoint gate refactored to accept a non-session token) — happy to file it separately if wanted.