feat: ContentGuardianAgent, onboarding UX, Team Activity action wiring, docs, agent help modal

ContentGuardianAgent consolidation:
- Merge 3 duplicate classes into single source in specialized/content_guardian.py
- Watchdog audit_committee() with heuristic scoring, coverage gaps, overlaps, alerts
- Remove misleading rejection_rate() helper; use acceptance_rate directly
- Integrate audit + alerts + trend signals into today_workflow_service.py

Team Activity page:
- QualityAuditPanel: health ring, per-agent critiques, coverage gaps, overlaps
- TrendSignalsPanel: opportunity cards with urgency/impact/coverage bars
- AlertBanner: persistent dismiss via POST /alerts/{id}/mark-read
- AgentHelpModal: dialog showing all 8 agents with descriptions, tools, schedule
- QualityAuditPanel action buttons: Fill gap -> /content-planning, Resolve overlap, View CTA on alerts/issues
- TrendSignalsPanel action buttons: Create content from this trend -> /blog-writer with trend context state

Onboarding system:
- Step 4 validation: no auto-pass via basic_ready; requires persona data or explicit progression
- Step 5 validation: logs warning on auto-pass without integration data
- OnboardingCompletionService: single DB session, transactional task creation, upsert pattern
- Business-without-website: nullable website_url on SIFIndexingTask and MarketTrendsTask
- DeepCompetitorAnalysisExecutor: 5-min timeout, 10-competitor cap, asyncio.wait_for
- Persona generation: async with 30s timeout, falls back to scheduler
- OnboardingProgressService.reset_onboarding(): resets session + pauses all DB tasks
- OnboardingControlService.reset_onboarding(): also cancels APScheduler jobs
- FinalStep TaskSchedulingPanel: shows scheduled/failed tasks after completion, 8s auto-redirect
- onboarding_completed agent activity event logged to feed

Documentation:
- docs-site/features/onboarding/: overview, steps, scheduler-tasks, technical-reference (4 pages)
- docs-site/mkdocs.yml: added Onboarding System nav section
- docs-site/features/sif-agents/: overview, agent-directory, committee-system, content-guardian (4 pages)
- docs-site/features/team-activity/: overview, quality-audit, trend-signals, alert-system (4 pages)
- docs-site/features/todays-workflow/: updated overview, technical-architecture, workflow-guide, api-reference

backend/services/integrations/wix/utils.py

@@ -85,24 +85,45 @@ def decode_wix_token(access_token: str) -> Dict[str, Any]:
     if token_str.startswith('OauthNG.JWS.'):
         jwt_part = token_str[12:]
         return jwt.decode(jwt_part, options={"verify_signature": False, "verify_aud": False})
+    if token_str.startswith('IST.'):
+        jwt_part = token_str[4:]
+        return jwt.decode(jwt_part, options={"verify_signature": False, "verify_aud": False})
     return jwt.decode(token_str, options={"verify_signature": False, "verify_aud": False})
 
 
+def _extract_data_payload(payload: Dict[str, Any]) -> Dict[str, Any]:
+    data_payload = payload.get('data', {})
+    if isinstance(data_payload, str):
+        try:
+            data_payload = json.loads(data_payload)
+        except Exception:
+            data_payload = {}
+    return data_payload if isinstance(data_payload, dict) else {}
+
+
 def extract_meta_from_token(access_token: str) -> Dict[str, Optional[str]]:
     try:
         payload = decode_wix_token(access_token)
-        data_payload = payload.get('data', {})
-        if isinstance(data_payload, str):
-            try:
-                data_payload = json.loads(data_payload)
-            except Exception:
-                pass
-        instance = (data_payload or {}).get('instance', {})
-        return {
+        data_payload = _extract_data_payload(payload)
+        instance = (data_payload or {}).get('instance', {}) or {}
+        result = {
             'siteMemberId': instance.get('siteMemberId'),
             'metaSiteId': instance.get('metaSiteId'),
             'permissions': instance.get('permissions'),
         }
+        # Only fall back to tenant.id for OAuth tokens (not IST. API keys)
+        # IST. tokens have tenant.id = account_id, which is NOT the site metaSiteId
+        token_str = str(access_token)
+        if not result.get('metaSiteId') and not token_str.startswith('IST.'):
+            tenant = data_payload.get('tenant', {}) or {}
+            tenant_id = tenant.get('id')
+            if tenant_id:
+                result['metaSiteId'] = tenant_id
+        if not result.get('metaSiteId'):
+            meta_site_id = payload.get('metaSiteId') or payload.get('site_id')
+            if meta_site_id:
+                result['metaSiteId'] = meta_site_id
+        return result
     except Exception:
         return {'siteMemberId': None, 'metaSiteId': None, 'permissions': None}