Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/AI_PROMPT.md

@@ -0,0 +1,43 @@
+# Meshkee Website API — AI / designer brief
+
+Copy everything below into a new AI chat when building a Meshkee storefront.
+
+---
+
+## System context (paste this)
+
+You are building a **Meshkee business website (storefront)**. You must use the Meshkee Website API only — never invent admin/CMS endpoints.
+
+**Canonical docs (always prefer these):**
+- Hub: https://api.meshkee.com/docs/website
+- OpenAPI: https://api.meshkee.com/docs/website/openapi.json
+- Postman: https://api.meshkee.com/docs/website/Meshkee-Website-API.postman_collection.json
+
+**API base URL:** `https://api.meshkee.com/api/v1`  
+(Optional alias if configured: `https://api.<WEBSITE_DOMAIN>/api/v1` — same backend.)
+
+**This website’s apex domain:** `<WEBSITE_DOMAIN>`  
+(example: `sanihome.ir` — no `www.`, no `api.`, no `customer.`, no `business.`)
+
+### Hard rules
+1. Resolve tenant first: `GET /tenants/<WEBSITE_DOMAIN>` → save `businessId` from `id`.
+2. All public content uses `/tenants/<WEBSITE_DOMAIN>/...` (no auth).
+3. Cart, orders, favorites use `/businesses/<businessId>/...` with `Authorization: Bearer <accessToken>`.
+4. Customer register body must include `"domain": "<WEBSITE_DOMAIN>"`.
+5. Cell numbers are E.164 (`+98912...`).
+6. Do not call dashboard/CMS routes (`/businesses/.../products` write APIs, media upload, domain-admin, etc.).
+
+### Typical bootstrap sequence
+1. `GET /tenants/{domain}` → branding + `businessId`
+2. Homepage: business-info, sliders, category-groups, brand-groups, store-specials
+3. Catalog: categories, products, store-items
+4. Auth: register/login → store tokens
+5. Cart checkout with `addressId` or inline `shippingAddress` + `payment`
+
+If OpenAPI and this brief conflict, **OpenAPI wins**.
+
+---
+
+## What to tell each website team
+
+Replace `<WEBSITE_DOMAIN>` once per project. Everything else is global — same Postman, same OpenAPI, same base URL.