Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

database/migrations/035_domain_last_deploy.sql

@@ -0,0 +1,4 @@
+-- Track last website deploy attempt per domain (super-admin Websites page)
+ALTER TABLE domains
+  ADD COLUMN IF NOT EXISTS last_deployed_at TIMESTAMPTZ,
+  ADD COLUMN IF NOT EXISTS last_deploy_status VARCHAR(32);