Problem: ANALYTICS_REQUIRE_AUTH defaults OFF; GET /api/sites is unguarded and with no session lists EVERY site (misc.ts legacy fallback); POST /api/sites needs no session.
Scope: flip enforcement to on-by-default (opt out with ANALYTICS_REQUIRE_AUTH=false for kiosk/legacy installs); when enforcing, no-session /api/sites (list+create) → 401 and the all-sites fallback is dead; collection endpoints (/collect, /t, /p, /errors/collect, /issues/report), /script.js, /sdk.js, and auth endpoints stay public.
Done when: a fresh server shows nothing without an account; tracker auto-created (ownerless) sites are invisible to other users.