MS ANALYTICS API v1 — READ-ONLY INTEGRATION GUIDE
===============================================
Base: https://analytics.ms.sy/api/v1/
Authentication: Authorization: Bearer msk_...
No login cookies are used and keys must stay on trusted backend servers.
NEVER embed a key in a frontend app, public repository, URL, or analytics event.

Admin UI: My Account and login remain separate from API permissions.
Create/revoke keys: API & Integrations page (password + fresh TOTP if enabled).
Tokens are shown once; only SHA-256 digests are retained in PostgreSQL.

Endpoints:
 GET /api/v1/meta                     Key details (no secret)
 GET /api/v1/stats?days=7             Stats scope
 GET /api/v1/reports?days=30          Reports scope
 GET /api/v1/goals?days=30            Goals scope
 GET /api/v1/traffic?days=7           Traffic scope
 GET /api/v1/acquisition?days=30      Acquisition scope
 GET /api/v1/export/reports?section=sites&days=30
 GET /api/v1/export/goals?days=30
 GET /api/v1/export/traffic?type=daily&days=7
 GET /api/v1/export/acquisition?type=campaigns&days=30

Export endpoints need the matching read scope. No API key permits write actions.
Most endpoints accept site=<site-public-key> and days=7|30|90.
For site-restricted API keys, the site filter is ENFORCED server-side.
Site-restricted credentials cannot request another site's data.

Example (run on a trusted terminal; do not paste the secret into chat):
 read -rsp 'API key: ' MS_API_KEY; echo
 curl --fail-with-body --silent --show-error \
   -H "Authorization: Bearer $MS_API_KEY" \
   'https://analytics.ms.sy/api/v1/stats?days=7'
 unset MS_API_KEY

Status codes: 200 success, 400 invalid period, 401 invalid/expired/revoked key,
403 insufficient scope/site mismatch, 404 unrecognized route, 429 rate limit.
Rate limits: atomic per-key fixed 60-second windows in PostgreSQL (10–120/min).
Usage logs store time, route and HTTP status only; no token/IP/visitor ID.
No CORS access is granted to public browser pages.

NO OUTBOUND WEBHOOKS OR NOTIFICATION DELIVERY ARE ENABLED BY THIS MODULE.
The existing WhatsApp/Telegram/SMTP/Turnstile integrations remain unchanged.