Get a site's FraseCMS delivery token

Returns the site's CURRENT headless delivery token — the bearer credential the public FraseCMS read endpoints accept. Non-mutating: the token is rebuilt (HMAC) from the site's stored secret and version, so repeated calls return the SAME token. It is therefore NOT a show-once secret: as long as the site's secret exists you can fetch the live token again here. Only rotation (POST /sites/{siteId}/cms-token/rotate) changes it, and only revocation removes it. If the token has been revoked (the site's secret was nulled), this returns 200 with { "revoked": true } and nothing else — the endpoint NEVER re-mints a revoked token; re-issue explicitly by rotating. Gates: requires the write:sites scope even though the verb is GET, because the response reveals a live credential — a read-only key is refused with 403. Responses carry Cache-Control: no-store; never cache or log the token. An org-scoped bucket allows 60 calls per minute per organization on top of your API key's own limits; exceeding it returns a data-wrapped 429 carrying no Retry-After header. Token format is fcms_<base64url(siteId:version:hmac)>; api_endpoint is the ready-to-call posts URL that embeds it. OPTIONS is supported for CORS preflight (204, Access-Control-Allow-Methods: GET, OPTIONS).