Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/DEPLOY.md

@@ -6,7 +6,9 @@ App path on server: `/opt/meshkee/app`
 
 API domain: `api.meshkee.com` → `https://api.meshkee.com/api/v1`
 
-> **Note:** Until the Git remote is accessible from the VM (deploy key / credentials), updates can be synced with `rsync` from your laptop. Pin `sharp@0.33.5` — this VM CPU lacks x64-v2 required by sharp 0.35+.
+Per-business API aliases (same Nest app on this VM): `api.{apex}` e.g. `api.sanihome.ir` → `https://api.sanihome.ir/api/v1`. Storefronts still pass the **website apex** in paths (`/tenants/sanihome.ir/...`); only the API hostname changes.
+
+> **Deploy path:** push to `git.meshkee.com` (`Meshkee/backend`), then on the API VM `git fetch` + `reset --hard origin/main` + build + `pm2 restart`. Do **not** rsync the app as the normal update path. The API VM uses a read-only SSH deploy key (`meshkee-api-vm-deploy`). Pin `sharp@0.33.5` — this VM CPU lacks x64-v2 required by sharp 0.35+.
 
 ## Prerequisites
 
@@ -126,12 +128,28 @@ curl -s http://127.0.0.1:3000/api/v1/ | head
 
 ## 6. Nginx + HTTPS
 
+### DNS (per business website domain)
+
+On the **business domain** DNS (e.g. zone `sanihome.ir`), add a subdomain that points at this **API VM** (same target as `api.meshkee.com`):
+
+| Type | Name / host | Value | Notes |
+|------|-------------|-------|--------|
+| **A** (preferred) | `api` | `<API_VM_PUBLIC_IP>` | Resolves `api.sanihome.ir` → API server |
+| **CNAME** (alternative) | `api` | `api.meshkee.com` | Same effect if your DNS panel allows CNAME on subdomains |
+
+Do **not** point `api.{apex}` at the websites VM or dashboards VM — only the Nest API VM.
+
+Repeat for each storefront apex (`api.ali-mohammadi.ir`, etc.). Central Meshkee DNS already has `api.meshkee.com` → this VM.
+
+### Nginx
+
 Create `/etc/nginx/sites-available/meshkee-api`:
 
 ```nginx
 server {
     listen 80;
-    server_name api.example.com;   # replace with your domain
+    # Central + per-business aliases (add more api.{apex} as domains go live)
+    server_name api.meshkee.com api.sanihome.ir;
 
     client_max_body_size 15M;
 
@@ -146,29 +164,68 @@ server {
 }
 ```
 
-Enable and get a certificate:
+Enable and get certificates:
 
 ```bash
 sudo ln -sf /etc/nginx/sites-available/meshkee-api /etc/nginx/sites-enabled/
 sudo rm -f /etc/nginx/sites-enabled/default
 sudo nginx -t && sudo systemctl reload nginx
-sudo certbot --nginx -d api.example.com
+sudo certbot --nginx -d api.meshkee.com -d api.sanihome.ir
+# later, when another business goes live:
+# sudo certbot --nginx -d api.meshkee.com -d api.sanihome.ir -d api.other-site.ir
 ```
 
-API base URL: `https://api.example.com/api/v1`
+API base URLs (identical Nest routes):
 
-## Ongoing updates
+- Central: `https://api.meshkee.com/api/v1`
+- Alias example: `https://api.sanihome.ir/api/v1`
+
+### Website API docs (global link for storefront teams)
+
+After deploy, these are public (no auth):
+
+- Hub: `https://api.meshkee.com/docs/website`
+- OpenAPI: `https://api.meshkee.com/docs/website/openapi.json`
+- Postman: `https://api.meshkee.com/docs/website/Meshkee-Website-API.postman_collection.json`
+- AI brief: `https://api.meshkee.com/docs/website/AI_PROMPT.md`
+
+Files live in `docs/website-api/` and are served by Nest from process cwd. Keep that folder on the VM when deploying.
+
+### Automated cert host list (API VPS)
+
+After deploy, a sync agent on this VM can pull names to cover:
 
 ```bash
+curl -s -H "X-SSL-Sync-Token: $SSL_SYNC_TOKEN" \
+  https://api.meshkee.com/api/v1/internal/ssl/api-hosts
+# → { "hosts": ["api.ali-mohammadi.ir", "api.meshkee.com", "api.sanihome.ir", ...] }
+```
+
+Dashboards VPS keeps using `GET /api/v1/internal/ssl/hosts` (`business.` / `customer.` / `manage`) — do not mix the two lists.
+
+## Ongoing updates (git only)
+
+From your laptop:
+
+1. Commit and **push** to `origin/main` (`git.meshkee.com/Meshkee/backend`).
+2. Deploy on the API VM from that commit (never rsync the tree as the primary path):
+
+```bash
+ssh -i ~/.ssh/id_ed25519 root@185.164.72.119 'bash -s' <<'REMOTE'
+set -euo pipefail
 cd /opt/meshkee/app
-git pull
-./database/migrate.sh    # if there are new SQL migrations
+git fetch origin
+git reset --hard origin/main
+./database/migrate.sh
 npm ci
 npm run prisma:generate
 npm run build
 pm2 restart meshkee-api
+REMOTE
 ```
 
+Preserve `/opt/meshkee/app/.env` on the server. App remote must be SSH: `git@git.meshkee.com:Meshkee/backend.git` with the VM deploy key registered as a **read-only deploy key** on the repo.
+
 ## Useful commands
 
 ```bash