Document storefront mini-cart and customer-dashboard checkout.

Website agents must add variants to a local guest cart and redirect to customer.{domain} for login and checkout instead of building those pages on the shop.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/index.html

@@ -89,9 +89,48 @@
       <li>Variable <code>domain</code> = website apex only (no <code>www</code>/<code>api</code>/<code>customer</code>/<code>business</code>).</li>
       <li><code>GET /tenants/{domain}</code> → <code>businessId</code>.</li>
       <li>Public pages: <code>/tenants/{domain}/...</code> (no auth) — products, <strong>user-products</strong>, blogs, portfolios, store-items, etc.</li>
-      <li>Cart / orders / favorites: <code>/businesses/{businessId}/...</code> + Bearer JWT.</li>
+      <li>Favorites (optional, if cookies exist): <code>/businesses/{businessId}/...</code> + Bearer JWT.</li>
+      <li>Login, checkout, server cart, orders: <strong>customer dashboard</strong> at <code>https://customer.{domain}</code> — not pages on the shop.</li>
     </ol>
 
+    <h2>Shared login with customer dashboard</h2>
+    <p>
+      Do <strong>not</strong> build a login / register / OTP page on the storefront.
+      Send shoppers to <code>https://customer.{domain}/login</code>.
+      The customer dashboard writes parent-domain cookies; the shop only
+      <strong>reads</strong> them to detect an existing session:
+    </p>
+    <ul>
+      <li><code>meshkee_customer_access_token</code></li>
+      <li><code>meshkee_customer_refresh_token</code></li>
+    </ul>
+    <p>
+      Set <code>Domain=.{domain}</code>, <code>Path=/</code>, <code>SameSite=Lax</code>.
+      API auth is still <code>Authorization: Bearer &lt;accessToken&gt;</code> (cookies are not sent to the API).
+      Do not use <code>/auth/handoff</code> for shoppers (staff-only into the business dashboard).
+      Full detail: <a href="/docs/website/AI_PROMPT.md">AI_PROMPT.md</a>.
+    </p>
+
+    <h2>Shopping cart on the storefront</h2>
+    <p>
+      The shop implements a <strong>mini-cart only</strong>: header icon, quantity badge,
+      popup, Continue. Persist a guest cart as <code>meshkee-guest-cart</code>
+      (localStorage + parent-domain cookie). Each line <code>id</code> is
+      <code>storeItemVariantId</code>.
+      Add-to-cart: <code>GET /tenants/{domain}/store-items/by-product/{productId}</code>,
+      list variants if there is more than one, then add the chosen variant
+      (same id already in cart → increment quantity). Continue goes to the customer dashboard:
+    </p>
+    <ul>
+      <li>Logged in → <code>https://customer.{domain}/checkout/cart?guestCart=…</code></li>
+      <li>Not logged in → <code>https://customer.{domain}/login?redirect=/checkout/cart?guestCart=…</code></li>
+    </ul>
+    <p>
+      Do not call <code>/cart</code> or <code>/cart/checkout</code> from the website,
+      and do not add shop <code>/login</code> or <code>/checkout</code> routes.
+      Encoding and payload: <a href="/docs/website/AI_PROMPT.md">AI_PROMPT.md</a> (Shopping cart).
+    </p>
+
     <h2>Branding (favicon + logos)</h2>
     <p>
       <code>GET /tenants/{domain}/website/favicon</code> returns