[codex] Add private actor metadata to website response

[seemayr]

Summary

This adds a small privateActor block to GET /v1/websites for private API key callers.

The new response data tells trusted dashboard clients whether:

• the private key is already linked to a teammate
• the linked teammate can be resolved from the website team
• actor-aware routes still require an explicit X-Actor-User-Id

privateActor stays null for public key requests.

Why

Mac dashboard clients already call GET /v1/websites during connect/bootstrap. That makes it the cleanest place to expose actor-mode metadata without adding a second discovery request before the client can decide how to behave.

A concrete use case is dashboard inbox/read-state correctness for private REST clients:

• linked private keys can act immediately as their linked teammate
• unlinked private keys need an explicit actor selection before actor-aware routes are fully reliable
• clients can now make that decision up front during connect instead of discovering it later from stale read/unread behavior

Implementation

• adds privateWebsiteActorSchema to the website API types
• extends publicWebsiteResponseSchema with nullable privateActor
• populates privateActor in the /websites REST route from the authenticated API key and already loaded website-access users
• covers public, unlinked-private, and linked-private cases in the route tests

Notes

The change is intentionally small and read-only:

• no new endpoint
• no auth-flow changes
• no required request headers on /websites
• no extra query needed beyond the website-access users already loaded by the route

Validation

• bun test apps/api/src/rest/routers/website.test.ts
• bun x tsc -p packages/types/tsconfig.json --noEmit

[vercel]

@seemayr is attempting to deploy a commit to the cossistant Team on Vercel.

A member of the Team first needs to authorize it.