feat: ContentGuardianAgent, onboarding UX, Team Activity action wiring, docs, agent help modal

ContentGuardianAgent consolidation:
- Merge 3 duplicate classes into single source in specialized/content_guardian.py
- Watchdog audit_committee() with heuristic scoring, coverage gaps, overlaps, alerts
- Remove misleading rejection_rate() helper; use acceptance_rate directly
- Integrate audit + alerts + trend signals into today_workflow_service.py

Team Activity page:
- QualityAuditPanel: health ring, per-agent critiques, coverage gaps, overlaps
- TrendSignalsPanel: opportunity cards with urgency/impact/coverage bars
- AlertBanner: persistent dismiss via POST /alerts/{id}/mark-read
- AgentHelpModal: dialog showing all 8 agents with descriptions, tools, schedule
- QualityAuditPanel action buttons: Fill gap -> /content-planning, Resolve overlap, View CTA on alerts/issues
- TrendSignalsPanel action buttons: Create content from this trend -> /blog-writer with trend context state

Onboarding system:
- Step 4 validation: no auto-pass via basic_ready; requires persona data or explicit progression
- Step 5 validation: logs warning on auto-pass without integration data
- OnboardingCompletionService: single DB session, transactional task creation, upsert pattern
- Business-without-website: nullable website_url on SIFIndexingTask and MarketTrendsTask
- DeepCompetitorAnalysisExecutor: 5-min timeout, 10-competitor cap, asyncio.wait_for
- Persona generation: async with 30s timeout, falls back to scheduler
- OnboardingProgressService.reset_onboarding(): resets session + pauses all DB tasks
- OnboardingControlService.reset_onboarding(): also cancels APScheduler jobs
- FinalStep TaskSchedulingPanel: shows scheduled/failed tasks after completion, 8s auto-redirect
- onboarding_completed agent activity event logged to feed

Documentation:
- docs-site/features/onboarding/: overview, steps, scheduler-tasks, technical-reference (4 pages)
- docs-site/mkdocs.yml: added Onboarding System nav section
- docs-site/features/sif-agents/: overview, agent-directory, committee-system, content-guardian (4 pages)
- docs-site/features/team-activity/: overview, quality-audit, trend-signals, alert-system (4 pages)
- docs-site/features/todays-workflow/: updated overview, technical-architecture, workflow-guide, api-reference

backend/services/integrations/wix/auth_utils.py

@@ -55,19 +55,20 @@ def get_wix_headers(
             if token.startswith('OauthNG.JWS.'):
                 # Wix OAuth token - use Bearer prefix
                 headers['Authorization'] = f'Bearer {token}'
-                logger.debug(f"Using Wix OAuth token with Bearer prefix (OauthNG.JWS. format detected)")
+                logger.debug("Using Wix OAuth token with Bearer prefix (OauthNG.JWS. format detected)")
+            elif token.startswith('IST.'):
+                # Wix Headless API key - send as-is, no Bearer
+                headers['Authorization'] = token
+                logger.debug("Using Wix API key for authorization (IST. format detected)")
             else:
-                # Count dots - JWT has exactly 2 dots
+                # Standard JWT has exactly 2 dots separating header.payload.signature
                 dot_count = token.count('.')
-                
-                if dot_count == 2 and len(token) < 500:
-                    # Likely OAuth JWT token - use Bearer prefix
+                if dot_count == 2:
                     headers['Authorization'] = f'Bearer {token}'
-                    logger.debug(f"Using OAuth Bearer token (JWT format detected)")
+                    logger.debug("Using OAuth Bearer token (JWT format: 2 dots detected)")
                 else:
-                    # Likely API key - use directly without Bearer prefix
                     headers['Authorization'] = token
-                    logger.debug(f"Using API key for authorization (non-JWT format detected)")
+                    logger.debug("Using token as-is (non-JWT format detected)")
     
     if client_id:
         headers['wix-client-id'] = client_id
@@ -125,8 +126,10 @@ def should_use_api_key(access_token: Optional[str] = None) -> bool:
             access_token = str(access_token)
     
     token = access_token.strip()
-    if token.count('.') != 2 or len(token) > 500:
+    if token.startswith('OauthNG.JWS.'):
+        return False
+    if token.startswith('IST.'):
         return True
-    
-    return False
+    # Standard JWT has exactly 2 dots
+    return token.count('.') != 2