Site configuration

Every site in the portal has six configuration tabs. Each tab maps to a specific class of behavior at the edge.

Tab	What it controls
Origin	Where the edge fetches uncached content from
Caching	TTLs, cache keys, purge behavior
Delivery	Custom domains, .onion settings, TLS
Headers	Request and response header rules
Security	Rate limits, IP allow/deny, JWT-at-edge
Metrics	Per-site usage and observability

Configuration is versioned. Every save creates a new site_config row; the edge picks up the new version through the reconciler within ~30 seconds of save.

Status: skeleton

Per-tab pages are placeholders for now; full content lands in a follow-up pass.