Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/internal-ssl/internal-ssl.service.ts

@@ -0,0 +1,56 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '../prisma/prisma.service';
+
+@Injectable()
+export class InternalSslService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {}
+
+  private async listActiveApexHosts(): Promise<string[]> {
+    const domains = await this.prisma.domain.findMany({
+      where: { isActive: true },
+      select: { host: true },
+      orderBy: { host: 'asc' },
+    });
+
+    const hosts: string[] = [];
+    for (const { host } of domains) {
+      const apex = host.trim().toLowerCase();
+      if (apex) hosts.push(apex);
+    }
+    return hosts;
+  }
+
+  /** Dashboards VPS: manage + business./customer. per active apex. */
+  async listDashboardHosts(): Promise<{ hosts: string[] }> {
+    const adminHost =
+      this.config.get<string>('DASHBOARD_ADMIN_HOST')?.trim() || 'manage.meshkee.com';
+
+    const hosts = new Set<string>([adminHost]);
+    for (const apex of await this.listActiveApexHosts()) {
+      hosts.add(`business.${apex}`);
+      hosts.add(`customer.${apex}`);
+    }
+
+    return { hosts: [...hosts].sort() };
+  }
+
+  /**
+   * API VPS: central api host + api.{apex} aliases for each active domain.
+   * Same Nest process; nginx terminates TLS for every name on this list.
+   */
+  async listApiHosts(): Promise<{ hosts: string[] }> {
+    const centralHost =
+      this.config.get<string>('CENTRAL_API_HOST')?.trim() || 'api.meshkee.com';
+
+    const hosts = new Set<string>([centralHost]);
+    for (const apex of await this.listActiveApexHosts()) {
+      hosts.add(`api.${apex}`);
+    }
+
+    return { hosts: [...hosts].sort() };
+  }
+}