feat: add dynamic site list search and resource locators

[christopherjnelson]

Scope

• This PR implements one bounded outcome and does not include unrelated cleanup.
• Added dependencies, public API changes, and release-strategy changes were explicitly approved.
• git diff --name-only matches the assignment's allowed-file list.

Summary

Implements dynamic site list search and converts the siteId parameter into an n8n resourceLocator across all site and analytics operations.

• List Search Implementation: Added nodes/OpenAnalytics/listSearch/getSites.ts using httpRequestWithAuthentication to query GET /v1/read/sites. Normalizes site objects to { name, value, description }, provides case-insensitive filtering by name or ID, respects custom baseUrl, and handles network errors gracefully.
• Node Wiring: Registered methods.listSearch.getSites on OpenAnalytics.node.ts.
• Resource Locators: Converted siteId parameter in resources/site.ts and resources/analytics.ts from string to resourceLocator with modes:
  • From List (searchListMethod: 'getSites')
  • By ID (type: 'string')
• Routing: Updated x-oa-site header routing expressions to '={{.siteId?.value || $parameter.siteId}}' to transparently support both resource locator objects and direct string expressions.
• Tests: Added 5 unit tests in tests/list-search.test.ts and updated tests/operation-contract.test.ts to assert resource locator structure and required controls.
• Documentation: Updated docs/api-matrix.md and README.md to document dynamic site selection.

Evidence

• Required operation controls and blank/default-state behavior are covered.
• Resource locators are tested with manual strings and list-mode objects where applicable.
• External API claims distinguish generated contract, human documentation, and observed behavior.
• Live fixtures, if any, are target-guarded, exact-owned, and assert cleanup.

Validation

• Format, lint, strict typecheck, and Vitest pass (30 tests across 5 test suites).
• Build and official source/built scanner preflight pass.
• Package boundary and compiled-registration load smoke pass.
• User-visible behavior was inspected in disposable n8n where practical; limitations are stated.
• Packed node/credential icons, provenance/hash, and contrasting light/dark rendering were reviewed.
• Release handoff requires the exact published version and a Creator Portal card version/logo check.

Safety

• No secrets, production data, publication, tag, release, or unrelated external mutation occurred.
• Destructive behavior is confirmed, exact-targeted, and does not retry implicitly.