[ops] Library > aem.page

As an operations person, I would like da.live to send all Library requests to aem.page instead of content.da.live so high frequency content requests are not hitting R2 directly if there's a higher availability alternative.

## Additional context
Accessing `aem.page` from `da.live` has been historically problematic due to the Helix site token and sites with auth. With the introduction of the token exchange API, DA can start sending all Library requests to aem.page.

We actually started normalizing library URLs where if an admin input `https://main--...` we would normalize out to `content.da.live...`.

I have always disliked that `content.da.live` was exposed to customers, so it would be nice to remove this from a customer facing surface.

## Criteria of acceptance
1. If `content.da.live/{org}/{site}` is listed in library, it is normalized out to `https://main--{site}--{org}.aem.page`.
2. Uses [getAemSiteToken](https://github.com/adobe/da-live/blob/main/blocks/shared/utils.js#L390-L411) so protected sites can be accessed.
3. There is some mechanism to ensure authors know they need to _at least_ preview when they make a Library document.
4. docs.da.live are updated to recommend using `https://main...` instead of `content.da.live`.

## Nice to have
1. A content migration so customer configs are upgraded from `content.da.live` to `https://main...`.

Start by reading getAemSiteToken in blocks/shared/utils.js and tracing the Library URL-normalization and request path. Check how docs.da.live currently describes Library URLs. Done means protected Library requests use the normalized aem.page URL, authors are told to preview, and the documentation recommends the main-- URL.

Written by the indexing model from the issue text.