Create Site Session

Create a short-lived session token for a public property website.

This endpoint is intentionally unauthenticated. The browser's static JS calls it with the site_id embedded in the page. Origin validation is handled by SiteCorsMiddleware before this handler runs.