Feature
Many sites, one install
Every event, token and query is scoped to a site.
The site id is derived on the server from the verified journey token's origin, never read from the request body. A site registry can give each site its own token key.
Agent tokens carry two separate grants: which endpoints they may call, and which site ids they may read. A token configured without a site grant is refused when the agent API loads its tokens.