feat: brand 白名单下发(站点覆盖/租户头像/CORS) + widget/chat 客户端 key 租户化 + 会话站点标

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/engine/routes/chat_rest.py

@@ -47,6 +47,12 @@ async def chat_session(req: SessionRequest, request: Request):
     if xf:
         client_info["ip"] = xf
 
+    # Task 10: ?site=<slug> 记入 client_info 作会话站点标(与 WS init 的
+    # site 字段同语义)——只加记录,不参与业务逻辑
+    site_slug = request.query_params.get("site", "").strip()
+    if site_slug:
+        client_info["site"] = site_slug
+
     # Task 5b: 租户运行时经 state/默认租户兜底解析(过渡期无中间件);
     # manager 由装配线从 runtime 造(db 会话 + runtime 引用)
     runtime = get_runtime(request)