Multi-tenant leak when ANALYTICS_REQUIRE_AUTH=false

Severity: Medium · Where: misc.ts:292-303, router.ts:175-180,351-356 With auth enforcement off, unauthenticated GET /api/sites / /api/projects returns all tenants' sites. Trigger: explicit misconfiguration (ANALYTICS_REQUIRE_AUTH=false), but exposure is total. Fix: Scope listing to the caller even in open mode, or hard-gate these routes.