18 commits since v0.6.1 (minor bump)

- feat(media): download button in lightbox
- fix(proxy): resolve ?site=<id> for /api/* in middleware (covers all 52 routes)
- fix(upload): respect ?site=<id> query param for token-based callers
- feat(uploads): public /api/uploads/* + ?site= so ICD sites can fetch images
- fix(fly): raise concurrency limit 25→250
- fix(config-writer): preserve locales/defaultLocale on every schema edit
- fix(schema): invalidate site-pool cache after PUT/POST/DELETE
- fix(schema): admin always sees Edit-schema button, no toggle gate
- fix(lighthouse): export contains both mobile + desktop, not just one
- feat(lighthouse): Export report button → AI-ready Markdown
- fix(icd): surface file-ownership drift before it eats writes
- fix(ui): trash row uses inline Yes/No confirm pattern
- feat(favorites): heart toggle on collection pages
- fix(translate): include tags + auto-suggest read time