app.get('/api/preview/:siteId', requireAuth, async (req, res) => {
  const site = await Site.findOne({ id: req.params.siteId, userId: req.session.userId });
  if (!site) return res.status(404).json({ error: 'Site bulunamadı' });
  res.send(site.html);
});