Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/git-deploy.mdc

@@ -0,0 +1,37 @@
+---
+description: Backend production deploy must use git push then git pull on the API VM — never rsync/scp as the primary deploy path.
+alwaysApply: true
+---
+
+# Backend deploy (git only)
+
+When deploying the Meshkee CMS API to production (`api.meshkee.com` / VM `/opt/meshkee/app`):
+
+1. **Commit** the changes (only when the user asked to commit/deploy).
+2. **Push** to `origin` (`https://git.meshkee.com/Meshkee/backend.git`, usually `main`).
+3. **On the API VM**, update from git and rebuild — do **not** rsync/scp the app tree as the normal deploy path.
+
+```bash
+ssh -i ~/.ssh/id_ed25519 root@185.164.72.119 'bash -s' <<'REMOTE'
+set -euo pipefail
+cd /opt/meshkee/app
+git fetch origin
+git reset --hard origin/main
+./database/migrate.sh
+npm ci
+npm run prisma:generate
+npm run build
+pm2 restart meshkee-api
+REMOTE
+```
+
+## Hard rules
+
+- Never use `rsync`/`scp` of the full project as the default deploy once the VM has a working git remote.
+- Preserve the server `.env` (never overwrite it from the laptop).
+- Exclude: do not commit `.env`, secrets, `node_modules`, or `dist`.
+- If `git pull` fails (missing deploy key / auth), fix git access on the VM — do not silently fall back to rsync unless the user explicitly allows an emergency sync.
+
+## VM git access
+
+Deploy key (read-only) on `git.meshkee.com` for repo `Meshkee/backend`, installed as `/root/.ssh/id_ed25519` on the API VM. Remote should be SSH: `git@git.meshkee.com:Meshkee/backend.git`.

.cursor/rules/meshkee-project.mdc

@@ -33,3 +33,4 @@ Do **not** use Prisma Migrate. SQL migrations are authoritative.
 - Minimize diff scope; match existing module patterns
 - Reuse existing services/guards instead of reimplementing
 - No commits unless explicitly requested
+- **Production deploy:** push to git first, then pull/build on the API VM — see `.cursor/rules/git-deploy.mdc` (never rsync as the normal path)