Problem (security hole): every /api/sites/{siteId}/* endpoint is unauthenticated — anyone who knows a siteId can read another project's analytics, errors, sessions, etc. (audit: src/router.ts, handlers/*).
Scope: an auth middleware that resolves the session user and checks they are a member of siteId before the handler runs; 401/403 otherwise. Apply to all read + write site routes (and the stealth /api/p aliases).
Done when: a logged-out request, or a member of a different project, cannot read/modify a site's data.