I believe the problem is here:
// handle AJAX calls for both logged in and guest users
add_action('wp_action_websites_cpt_create_post', [$this, 'create_post']);
add_action('wp_action_nopriv_websites_cpt_create_post', [$this, 'create_post']);
Because the format should be:
add_action( 'wp_ajax_{ACTION_NAME}', [ $this, 'create_post' ] );
add_action( 'wp_ajax_nopriv_{ACTION_NAME}', [ $this, 'create_post' ] );
..where {ACTION_NAME}
is the “action” name, e.g. websites_cpt_create_post.
See wp_ajax_{$_REQUEST['action']}
and wp_ajax_nopriv_{$_REQUEST['action']}
.