Designing schema-per-site

Every SITESAFF website gets its own Postgres schema (site_<slug>), fully isolating its content data.

The core schema

Shared tables (users, organizations, sites, roles…) live in the core schema, not duplicated per site.

Per-site querying

Requests carry an X-Site-Id header; middleware resolves the matching schema and sets the search_path for the current transaction.