Fix site_id isolation for demo sites

- Auto-derive site_id from demo directory paths (demos/demo-site -> 'demo', demos/simple/test-simple -> 'simple')
- Add validation requiring explicit site_id for non-demo paths with helpful error messages
- Remove JavaScript 'demo' fallback and add proper error messaging for missing site_id
- Ensure each demo site uses isolated content namespace to prevent content mixing

Resolves issue where /sites/simple and /sites/demo both used site_id=demo

cmd/enhance.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -49,6 +50,30 @@ func runEnhance(cmd *cobra.Command, args []string) {
 	siteID := viper.GetString("cli.site_id")
 	outputDir := viper.GetString("cli.output")
 
+	// Auto-derive site_id for demo paths or validate for production
+	if strings.Contains(inputDir, "/demos/") {
+		// Auto-derive site_id from demo path
+		siteID = content.DeriveOrValidateSiteID(inputDir, siteID)
+	} else {
+		// Validate site_id for non-demo paths
+		if siteID == "" || siteID == "demo" {
+			log.Fatalf(`❌ site_id must be explicitly configured for non-demo sites.
+
+💡 Examples:
+   # Set via command line:
+   insertr enhance --site-id mysite /path/to/site
+
+   # Set in insertr.yaml:
+   cli:
+     site_id: "mysite"
+
+   # Set via environment:
+   INSERTR_CLI_SITE_ID=mysite insertr enhance /path/to/site
+
+🚀 For demo sites under demos/, site_id is auto-derived from the directory name.`)
+		}
+	}
+
 	// Create content client
 	var client engine.ContentClient
 	if apiURL != "" {