ADR-037: Owner-only Search Console insights

Agent rule

/insights and GET /api/analytics/gsc require an owner session. Do not link Insights from the public footer or sitemap. Keep GSC credentials server-side (GSC_CLIENT_EMAIL + GSC_PRIVATE_KEY or GSC_SERVICE_ACCOUNT_JSON). Prefer folding new GSC endpoints into /api/analytics/[route] to stay under the Hobby function cap.

Status: Accepted

Context: Public /traffic covers on-site visits. Search queries, CTR, and indexing ops lived only in Google Search Console. Full Coverage reports are not fully API-exposed; Search Analytics + sitemaps are.

Decision: Ship an owner-gated Insights page that mirrors /traffic UX for Search Analytics (queries, pages, blog subset, daily impressions, sitemap fetch). Leave public vs private for later; reuse requireOwner().

Consequences: Needs one-time GCP service account + Users and permissions on the GSC property. Data lags ~2–3 days. Making Insights public later is a product decision, not a schema change.