feat(enterprise-site): add PbootCMS enterprise site publisher

Introduce a new enterprise-site publishing channel that lets tenants push
articles to self-hosted PbootCMS sites alongside the existing media supply
flow.

Backend (server/internal/tenant):
- enterprise_site_service: CRUD, ping, category sync, and article publish
- enterprise_site_pbootcms: PbootCMS API client integration
- enterprise_site_crypto: encrypt/decrypt stored site credentials
- enterprise_site_handler + routes under /enterprise-sites
- migrations for the enterprise site publisher tables
- config: add SERVER_PUBLIC_BASE_URL (Server.PublicBaseURL) for callbacks
- article/media services adjusted to support the publish flow

Frontend (apps/admin-web):
- PublishArticleModal & ArticlePublishStatus: enterprise-site publish UI
- MediaView: manage enterprise sites and categories
- api + shared-types: enterprise site endpoints and types
- http-client: add PATCH method support

Integrations:
- pbootcms GeoPublisher controller plugin + install guide
- docs/enterprise-site-publisher-v1.md design doc

server/migrations/20260605110000_add_enterprise_site_publisher.down.sql

@@ -0,0 +1,20 @@
+DROP INDEX IF EXISTS idx_publish_records_enterprise_site_active;
+DROP INDEX IF EXISTS uk_publish_records_batch_enterprise_site;
+
+DELETE FROM publish_records
+WHERE target_type = 'enterprise_site';
+
+ALTER TABLE publish_records
+    DROP CONSTRAINT IF EXISTS ck_publish_records_target_ref,
+    DROP CONSTRAINT IF EXISTS ck_publish_records_target_type,
+    DROP COLUMN IF EXISTS target_connection_id,
+    DROP COLUMN IF EXISTS target_type;
+
+ALTER TABLE publish_records
+    ALTER COLUMN platform_account_id SET NOT NULL;
+
+DELETE FROM media_platforms
+WHERE platform_id = 'pbootcms';
+
+DROP TABLE IF EXISTS enterprise_site_categories;
+DROP TABLE IF EXISTS enterprise_site_connections;

server/migrations/20260605110000_add_enterprise_site_publisher.up.sql

@@ -0,0 +1,96 @@
+CREATE TABLE enterprise_site_connections (
+    id                    BIGSERIAL PRIMARY KEY,
+    tenant_id             BIGINT NOT NULL REFERENCES tenants(id),
+    workspace_id          BIGINT NOT NULL REFERENCES workspaces(id),
+    created_by_user_id    BIGINT NOT NULL REFERENCES users(id),
+    name                  VARCHAR(160) NOT NULL,
+    site_url              TEXT NOT NULL,
+    cms_type              VARCHAR(32) NOT NULL,
+    auth_type             VARCHAR(32) NOT NULL DEFAULT 'native_api',
+    appid                 VARCHAR(160) NOT NULL,
+    credential_ciphertext TEXT NOT NULL,
+    default_acode         VARCHAR(32),
+    default_mcode         VARCHAR(32),
+    default_scode         VARCHAR(64),
+    status                VARCHAR(20) NOT NULL DEFAULT 'draft',
+    plugin_version        VARCHAR(40),
+    site_name             VARCHAR(160),
+    last_ping_at          TIMESTAMPTZ,
+    last_sync_at          TIMESTAMPTZ,
+    last_publish_at       TIMESTAMPTZ,
+    last_error            TEXT,
+    created_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    deleted_at            TIMESTAMPTZ,
+    CONSTRAINT ck_enterprise_site_connections_cms_type
+        CHECK (cms_type IN ('pbootcms', 'wordpress', 'dedecms', 'phpcms')),
+    CONSTRAINT ck_enterprise_site_connections_status
+        CHECK (status IN ('draft', 'connected', 'error', 'disabled'))
+);
+
+CREATE UNIQUE INDEX uk_enterprise_site_connections_active_site
+    ON enterprise_site_connections (tenant_id, workspace_id, lower(site_url), cms_type)
+    WHERE deleted_at IS NULL;
+
+CREATE INDEX idx_enterprise_site_connections_tenant_workspace
+    ON enterprise_site_connections (tenant_id, workspace_id, status, created_at DESC)
+    WHERE deleted_at IS NULL;
+
+CREATE TABLE enterprise_site_categories (
+    id               BIGSERIAL PRIMARY KEY,
+    tenant_id        BIGINT NOT NULL REFERENCES tenants(id),
+    workspace_id     BIGINT NOT NULL REFERENCES workspaces(id),
+    connection_id    BIGINT NOT NULL REFERENCES enterprise_site_connections(id) ON DELETE CASCADE,
+    remote_id        VARCHAR(128) NOT NULL,
+    parent_remote_id VARCHAR(128),
+    name             VARCHAR(160) NOT NULL,
+    slug             VARCHAR(160),
+    raw_payload_json JSONB,
+    synced_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT uk_enterprise_site_categories_remote
+        UNIQUE (connection_id, remote_id)
+);
+
+CREATE INDEX idx_enterprise_site_categories_connection
+    ON enterprise_site_categories (connection_id, remote_id);
+
+ALTER TABLE publish_records
+    ALTER COLUMN platform_account_id DROP NOT NULL;
+
+ALTER TABLE publish_records
+    ADD COLUMN target_type VARCHAR(32) NOT NULL DEFAULT 'platform_account',
+    ADD COLUMN target_connection_id BIGINT REFERENCES enterprise_site_connections(id);
+
+ALTER TABLE publish_records
+    ADD CONSTRAINT ck_publish_records_target_type
+        CHECK (target_type IN ('platform_account', 'enterprise_site'));
+
+ALTER TABLE publish_records
+    ADD CONSTRAINT ck_publish_records_target_ref
+        CHECK (
+            (target_type = 'platform_account' AND platform_account_id IS NOT NULL AND target_connection_id IS NULL)
+            OR
+            (target_type = 'enterprise_site' AND platform_account_id IS NULL AND target_connection_id IS NOT NULL)
+        );
+
+CREATE UNIQUE INDEX uk_publish_records_batch_enterprise_site
+    ON publish_records (publish_batch_id, target_connection_id)
+    WHERE target_type = 'enterprise_site';
+
+CREATE INDEX idx_publish_records_enterprise_site_active
+    ON publish_records (tenant_id, article_id, target_connection_id, updated_at DESC, id DESC)
+    WHERE target_type = 'enterprise_site';
+
+INSERT INTO media_platforms (platform_id, name, category, short_name, accent_color, login_url, logo_url, status, sort_order)
+VALUES ('pbootcms', 'PBootCMS', 'enterprise', 'P', '#1d4ed8', NULL, NULL, 'active', 900)
+ON CONFLICT (platform_id)
+DO UPDATE SET
+    name = EXCLUDED.name,
+    category = EXCLUDED.category,
+    short_name = EXCLUDED.short_name,
+    accent_color = EXCLUDED.accent_color,
+    status = EXCLUDED.status,
+    sort_order = EXCLUDED.sort_order,
+    updated_at = NOW();