fix(analytics): use Umami SSO for SEO/GEO API on SSO-only deploy

Production Umami rejects password login when MEMIND_UMAMI_SSO_ONLY=1;
server-side memind-pages fetch now authenticates via MEMIND_UMAMI_SSO_SECRET.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/umami-analytics.test.mjs

@@ -23,12 +23,12 @@ test('fetchMemindDiscoveryPages rejects missing website id', async () => {
   );
 });
 
-test('fetchMemindDiscoveryPages rejects missing admin password', async () => {
+test('fetchMemindDiscoveryPages rejects missing auth credentials', async () => {
   await assert.rejects(
     () => fetchMemindDiscoveryPages(
       { discoveryChannel: 'geo', startAt: '1', endAt: '2' },
       { env: {}, analyticsConfig: { websiteId: 'site-1' } },
     ),
-    /未配置 UMAMI_ADMIN_PASSWORD/,
+    /未配置 UMAMI_ADMIN_PASSWORD 或 MEMIND_UMAMI_SSO_SECRET/,
   );
 });