Initial commit: Meshkee CMS API

NestJS backend with Prisma, Docker Compose for Postgres/Redis, and deploy docs for the production VM.

.cursor/rules/business-rbac.mdc

@@ -0,0 +1,34 @@
+---
+description: Business-scoped RBAC and permission patterns
+globs: src/**/*.controller.ts,src/**/*.service.ts
+alwaysApply: false
+---
+
+# Business RBAC
+
+## Permission slugs
+
+Format: `resource.action` — e.g. `products.read`, `categories.update`, `business.team.invite`
+
+Content resources: `products.*`, `categories.*`, `media.*`, `business.team.*`
+
+## Who gets access
+
+- `super_admin` → all permissions (bypasses business guard)
+- Business owner (`isOwner=true`) → `business_owner` role permissions
+- Team member → permissions from `business_users.role_id` (admin/editor/viewer)
+
+## Adding a business-scoped endpoint
+
+1. Route: `businesses/:businessId/<resource>`
+2. `@UseGuards(JwtAuthGuard, BusinessPermissionGuard)`
+3. `@RequireBusinessPermission('resource.action')` on handler
+4. `assertPermission()` again inside the service
+
+## Platform-only endpoints
+
+Super-admin routes (`/users`, `/businesses`, `/domains`) check `permissions.isSuperAdmin()` in the service — no `BusinessPermissionGuard`.
+
+## New permissions
+
+Add `INSERT INTO permissions` + `role_permissions` in a SQL migration, then assign to relevant team roles.