Expand invoices with full templates, public viewer API, and account holder.

Add invoice template CRUD, key points/accounts, public GET endpoint, and migration 039 for account_holder_name.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/env-clients-deploy.mdc

@@ -0,0 +1,34 @@
+---
+description: Environment split — websites always use remote API; dashboards use local API in dev and remote after deploy; coordinate backend + dashboard releases.
+alwaysApply: true
+---
+
+# Backend ↔ dashboards ↔ websites
+
+## Who talks to which API
+
+| Client | Local development | After deploy (production) |
+|--------|-------------------|---------------------------|
+| **Business websites** (storefronts) | Still **remote** `https://api.meshkee.com` (or `https://api.{domain}`) | Same remote API |
+| **Dashboards** (manage / business / customer) | **Local** backend (`localhost`) | **Remote** `https://api.meshkee.com` |
+
+Websites never depend on a developer’s local API. Dashboards do during local work.
+
+## Release coordination
+
+Because deployed dashboards hit the **same** remote backend as production websites:
+
+1. **Dashboard-facing API changes** (routes under auth/CMS/`businesses/:id/...` used by dashboards) must ship **backend + dashboards together** (or backend first only if fully backward-compatible with the currently deployed dashboards).
+2. Do **not** deploy a dashboard that requires new backend fields/routes until that backend is live on `api.meshkee.com`.
+3. Do **not** deploy a breaking backend change for dashboards until the matching dashboard build is ready to deploy in the same window.
+4. **Website-facing** API changes go live for all storefronts as soon as the backend is deployed — keep `docs/website-api/` in sync (see `website-api-docs.mdc`). Prefer additive/backward-compatible changes when old websites may still be out.
+
+## Practical order
+
+```text
+Compatible API add  →  deploy backend  →  deploy dashboards (can use new APIs)
+Breaking API change →  deploy backend + dashboards in one coordinated release
+Website-only API    →  deploy backend (+ update website docs); websites pick it up from remote
+```
+
+Local dashboard work: run local backend; point dashboard env at local API. After merge/deploy, dashboards use remote API again.

.cursor/rules/meshkee-project.mdc

@@ -34,3 +34,5 @@ Do **not** use Prisma Migrate. SQL migrations are authoritative.
 - Reuse existing services/guards instead of reimplementing
 - No commits unless explicitly requested
 - **Production deploy:** push to git first, then pull/build on the API VM — see `.cursor/rules/git-deploy.mdc` (never rsync as the normal path)
+- **Website API docs:** when storefront APIs change, update `docs/website-api/` + `src/website-docs/static/` — see `.cursor/rules/website-api-docs.mdc`
+- **Clients:** websites always use remote API; dashboards use local API in dev and remote after deploy — coordinate dashboard releases with backend — see `.cursor/rules/env-clients-deploy.mdc`

.cursor/rules/website-api-docs.mdc

@@ -0,0 +1,29 @@
+---
+description: Keep the public Website API docs pack in sync whenever storefront-facing backend APIs change.
+alwaysApply: true
+---
+
+# Website API docs sync
+
+Whenever you add, change, or remove **storefront / website-facing** APIs (public `tenants/:host/...`, customer auth/addresses, cities, cart, orders, favorites), update the public docs pack in the **same change**.
+
+## Files to keep in sync (both copies)
+
+1. `docs/website-api/` — source of truth for humans / git
+2. `src/website-docs/static/` — served by Nest at `/docs/website` (must match)
+
+Update as needed:
+
+| File | When |
+|------|------|
+| `openapi.json` | Paths, methods, params, bodies, or auth change |
+| `Meshkee-Website-API.postman_collection.json` | Same — add/rename/fix requests |
+| `AI_PROMPT.md` | Flow or hard rules change |
+| `index.html` | Hub copy / links (use **absolute** `/docs/website/...` hrefs, never `./`) |
+
+## Rules
+
+- Docs are **domain-agnostic** (`YOUR_WEBSITE_DOMAIN` / `{domain}`), not tied to one business.
+- Do **not** document CMS/dashboard/super-admin routes in this pack.
+- After editing `docs/website-api/*`, copy the same files into `src/website-docs/static/`.
+- Prefer updating docs in the same PR/commit as the API change; don’t leave storefront contract drift.