Site: holding mode and site share links

**Decided 14 September 2026** after a four-way design review: the first design (a `ComingSoon` switch and one preview key) was too specific. What ships instead:

- **Site mode.** The `site` settings get `Mode` (`Live` or `Holding`, unset means `Live`) and `HoldingPath`, the path of an ordinary page shown on every route while holding. It covers launch, maintenance and a seasonal break. It is presentation for frontends and hides nothing at the API; content that must stay hidden before launch stays unpublished with a scheduled publish.
- **Site share links** in core for previewing a holding site: many per site, each with a label and an expiry (default 30 days, at most 90), revocable, audited, stored hashed and never in public settings. Created by anyone who may update the `site` type. A link is `{site Url}/_share#{key}`, so the key never reaches server logs or a referrer.
- **Later:** entry and page scoped links, and folding `POST /api/preview` into share links, on 4.4.0 with #840; a `Private` mode enforced by the API has no milestone until a site needs it.

---

barakoPress coming soon mode (BaryoDev/barakoPress#28, PR BaryoDev/barakoPress#35, stacked on #31 and #34) reads three fields from the tenant's `site` entry that the built-in `site` blueprint (#793) does not declare yet.

## Change

Add to `barakoCMS/Blueprints/site.json`:

- `ComingSoon`: bool, default false.
- `ComingSoonBlocks`: json, the holding page's blocks. Empty means barakoPress shows a default holding page from the theme.
- `PreviewKeyHash`: string, the hex SHA-256 of the preview key.

**The preview key.** The `site` entry is publicly deliverable, so only the hash is stored and the hash is readable by anyone. A short or guessable key could be recovered from it offline. The key must therefore be generated, never typed: barakoBrew's Site screen (BaryoDev/barakoBrew#134) gets a "Generate preview link" action that creates a random key of at least 32 bytes, stores only its hash, and shows the link once. A way to set the hash directly through the API stays possible for barista, with the same length rule documented.

- Either mark `PreviewKeyHash` Sensitive, so delivery never serves it and barakoPress reads it with its renderer key (#823), or keep it Public with the generated-key rule above. Pick one in the PR; Sensitive is the safer default if barakoPress can read it authenticated.
- `docs/site-settings.md` documents the three fields and the flow.

## Done when

- Applying the `site` blueprint on a fresh tenant creates the three fields, and `SiteBlueprintTests` covers them.
- The chosen visibility for `PreviewKeyHash` is tested: either absent from `/api/public/site` or documented with the generated-key rule.

Start with barakoCMS/Blueprints/site.json and the existing SiteBlueprintTests to understand how fresh-tenant fields and visibility are defined. Then read docs/site-settings.md and check the public site delivery behavior relevant to PreviewKeyHash. Done means the three fields are created, the chosen PreviewKeyHash visibility is tested or its generated-key rule is documented, and the settings flow is documented.

Written by the indexing model from the issue text.