Route payment bank callbacks through storefront domains.

ZarinPal rejects api.meshkee.com when the terminal is registered to the store apex; nginx now proxies /meshkee/payments/{gateway}/callback to a host-scoped API route.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/AI_PROMPT.md

@@ -36,7 +36,8 @@ You are building a **Meshkee business website (storefront)**. You must use the M
 5. Cart checkout with `addressId` or inline `shippingAddress` + `payment`
    - For online pay: `payment.type = "e_payment_gate"`, `gatewayType` (e.g. `"mellat"` or `"zarinpal"`), and absolute `returnUrl`
    - Response includes `payment.redirect` `{ method, url, fields }` — POST/redirect shopper to the bank
-   - Bank callback hits API then redirects to `returnUrl?status=success|failed&orderId=…`
+   - Meshkee registers the bank `callback_url` on the **store apex** (`https://YOUR_WEBSITE_DOMAIN/meshkee/payments/{gateway}/callback`), which nginx proxies to the API. ZarinPal/Mellat domain checks must match the store domain, not `api.meshkee.com`.
+   - After verify, API redirects the browser to `returnUrl?status=success|failed&orderId=…`
    - Enabled gateways: `GET /tenants/{domain}` → `ePayment`, or `GET /businesses/{businessId}/payments/methods`
 
 ### User products (customer listings)