feat(enterprise-site): add PbootCMS enterprise site publisher

Introduce a new enterprise-site publishing channel that lets tenants push
articles to self-hosted PbootCMS sites alongside the existing media supply
flow.

Backend (server/internal/tenant):
- enterprise_site_service: CRUD, ping, category sync, and article publish
- enterprise_site_pbootcms: PbootCMS API client integration
- enterprise_site_crypto: encrypt/decrypt stored site credentials
- enterprise_site_handler + routes under /enterprise-sites
- migrations for the enterprise site publisher tables
- config: add SERVER_PUBLIC_BASE_URL (Server.PublicBaseURL) for callbacks
- article/media services adjusted to support the publish flow

Frontend (apps/admin-web):
- PublishArticleModal & ArticlePublishStatus: enterprise-site publish UI
- MediaView: manage enterprise sites and categories
- api + shared-types: enterprise site endpoints and types
- http-client: add PATCH method support

Integrations:
- pbootcms GeoPublisher controller plugin + install guide
- docs/enterprise-site-publisher-v1.md design doc

apps/admin-web/src/lib/api.ts

@@ -28,6 +28,7 @@ import type {
   CreateKolPromptRequest,
   CreateMediaSupplyOrderRequest,
   CreateMediaSupplyOrderResponse,
+  CreateEnterpriseSiteConnectionRequest,
   CreatePluginSessionRequest,
   CreatePluginSessionResponse,
   CreatePublishBatchRequest,
@@ -39,6 +40,10 @@ import type {
   DesktopClientDownloadableReleaseListResponse,
   DesktopClientReleaseCheckResponse,
   DesktopClientReleaseDownloadURLResponse,
+  EnterpriseSiteCapability,
+  EnterpriseSiteCategory,
+  EnterpriseSiteConnection,
+  EnterpriseSitePublishResponse,
   FolderDeletePreview,
   GenerateFromRuleRequest,
   GenerateFromRuleResponse,
@@ -109,6 +114,7 @@ import type {
   PromptRuleSimple,
   PromptRuleStatusRequest,
   PublishKolPromptRequest,
+  PublishEnterpriseSiteArticleRequest,
   PublishRecord,
   Question,
   QuestionCandidateResult,
@@ -144,6 +150,7 @@ import type {
   TemplateTitleTaskResultResponse,
   TenantPublishTaskListResponse,
   UpdateArticleRequest,
+  UpdateEnterpriseSiteConnectionRequest,
   UpdateKolPackageRequest,
   UpdateKolPromptRequest,
   UpdateQuestionRequest,
@@ -339,6 +346,7 @@ const currentBrandScopedPathPatterns = [
   /^\/api\/tenant\/instant-tasks(?:\/|$)/,
   /^\/api\/tenant\/publish-jobs(?:\/|$)/,
   /^\/api\/tenant\/publish-tasks\/[^/]+\/retry(?:\/|$)/,
+  /^\/api\/tenant\/enterprise-sites\/[^/]+\/publish(?:\/|$)/,
   /^\/api\/tenant\/media-supply\/orders(?:\/|$)/,
   /^\/api\/tenant\/prompt-rules(?:\/|$)/,
 ]
@@ -1378,6 +1386,48 @@ export const publishTasksApi = {
   },
 }
 
+export const enterpriseSitesApi = {
+  list() {
+    return apiClient.get<EnterpriseSiteConnection[]>('/api/tenant/enterprise-sites')
+  },
+  create(payload: CreateEnterpriseSiteConnectionRequest) {
+    return apiClient.post<EnterpriseSiteConnection, CreateEnterpriseSiteConnectionRequest>(
+      '/api/tenant/enterprise-sites',
+      payload,
+    )
+  },
+  update(id: number, payload: UpdateEnterpriseSiteConnectionRequest) {
+    return apiClient.patch<EnterpriseSiteConnection, UpdateEnterpriseSiteConnectionRequest>(
+      `/api/tenant/enterprise-sites/${id}`,
+      payload,
+    )
+  },
+  remove(id: number) {
+    return apiClient.remove<null>(`/api/tenant/enterprise-sites/${id}`)
+  },
+  ping(id: number) {
+    return apiClient.post<EnterpriseSiteCapability>(
+      `/api/tenant/enterprise-sites/${id}/ping`,
+    )
+  },
+  categories(id: number) {
+    return apiClient.get<EnterpriseSiteCategory[]>(
+      `/api/tenant/enterprise-sites/${id}/categories`,
+    )
+  },
+  syncCategories(id: number) {
+    return apiClient.post<EnterpriseSiteCategory[]>(
+      `/api/tenant/enterprise-sites/${id}/categories/sync`,
+    )
+  },
+  publish(id: number, payload: PublishEnterpriseSiteArticleRequest) {
+    return apiClient.post<EnterpriseSitePublishResponse, PublishEnterpriseSiteArticleRequest>(
+      `/api/tenant/enterprise-sites/${id}/publish`,
+      payload,
+    )
+  },
+}
+
 export const complianceApi = {
   runtimeStatus() {
     return apiClient.get<ComplianceRuntimeStatus>('/api/tenant/compliance/runtime-status')