Sync websites

Associates an explicit selection of websites with the configuration; unlike the dashboard's website replacement, this adds to the existing selection and never removes one. Answers **200** at once with `meta.status` (`applied` when at least one website changed, `skipped` when none did), `meta.updated` and `meta.skipped` - there is nothing to poll.\n\n**Body** (JSON):\n- `sites` (array of website ids, required, 1 to 50), validated for existence only.\n\n`meta.updated` entries carry `site_id`, `site_name` and `alert_id`. A website already associated, or outside the token's reach, is answered in `meta.skipped` with a `reason_code` (`ALREADY_APPLIED`, `PERMISSION_DENIED`) and a message instead of failing the call.\n\nRequires a full-access token (read-only tokens answer 403). Body validation runs before authorization: a foreign configuration with an invalid body (e.g. missing `sites`) answers 422; only a foreign configuration with a valid body answers 404.