feat(enterprise-site): add PbootCMS enterprise site publisher

Introduce a new enterprise-site publishing channel that lets tenants push
articles to self-hosted PbootCMS sites alongside the existing media supply
flow.

Backend (server/internal/tenant):
- enterprise_site_service: CRUD, ping, category sync, and article publish
- enterprise_site_pbootcms: PbootCMS API client integration
- enterprise_site_crypto: encrypt/decrypt stored site credentials
- enterprise_site_handler + routes under /enterprise-sites
- migrations for the enterprise site publisher tables
- config: add SERVER_PUBLIC_BASE_URL (Server.PublicBaseURL) for callbacks
- article/media services adjusted to support the publish flow

Frontend (apps/admin-web):
- PublishArticleModal & ArticlePublishStatus: enterprise-site publish UI
- MediaView: manage enterprise sites and categories
- api + shared-types: enterprise site endpoints and types
- http-client: add PATCH method support

Integrations:
- pbootcms GeoPublisher controller plugin + install guide
- docs/enterprise-site-publisher-v1.md design doc

server/internal/tenant/transport/router.go

@@ -104,6 +104,17 @@ func RegisterRoutes(app *bootstrap.App) {
 	media := tenantProtected.Group("/media")
 	media.GET("/platforms", mediaHandler.ListPlatforms)
 
+	enterpriseSiteHandler := NewEnterpriseSiteHandler(app)
+	enterpriseSites := tenantProtected.Group("/enterprise-sites")
+	enterpriseSites.GET("", enterpriseSiteHandler.List)
+	enterpriseSites.POST("", enterpriseSiteHandler.Create)
+	enterpriseSites.PATCH("/:id", enterpriseSiteHandler.Update)
+	enterpriseSites.DELETE("/:id", enterpriseSiteHandler.Delete)
+	enterpriseSites.POST("/:id/ping", enterpriseSiteHandler.Ping)
+	enterpriseSites.GET("/:id/categories", enterpriseSiteHandler.Categories)
+	enterpriseSites.POST("/:id/categories/sync", enterpriseSiteHandler.SyncCategories)
+	enterpriseSites.POST("/:id/publish", middleware.RequireCurrentBrand(), enterpriseSiteHandler.PublishArticle)
+
 	desktopClient := tenantProtected.Group("/desktop-client")
 	desktopClient.GET("/releases/downloadable", desktopReleaseHandler.ListDownloadable)