Route payment bank callbacks through storefront domains.

ZarinPal rejects api.meshkee.com when the terminal is registered to the store apex; nginx now proxies /meshkee/payments/{gateway}/callback to a host-scoped API route.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/Meshkee-Website-API.postman_collection.json

@@ -1705,7 +1705,7 @@
               "raw": "{\n  \"addressId\": \"{{addressId}}\",\n  \"customerNotes\": \"Deliver after 5pm\",\n  \"returnUrl\": \"https://YOUR_WEBSITE_DOMAIN/checkout/result\",\n  \"payment\": {\n    \"type\": \"e_payment_gate\",\n    \"gatewayType\": \"mellat\"\n  }\n}"
             },
             "url": "{{baseUrl}}/businesses/{{businessId}}/cart/checkout",
-            "description": "Creates a pending order + transaction, calls the gateway, and returns payment.redirect { method, url, fields }. Website must POST/redirect the shopper to the bank. After payment, bank hits /payments/{gateway}/callback which redirects to returnUrl?status=success|failed."
+            "description": "Creates a pending order + transaction, calls the gateway, and returns payment.redirect { method, url, fields }. Website must POST/redirect the shopper to the bank. After payment, the bank hits https://YOUR_WEBSITE_DOMAIN/meshkee/payments/{gateway}/callback (nginx → API), which redirects to returnUrl?status=success|failed."
           }
         }
       ]
@@ -1723,7 +1723,64 @@
           }
         },
         {
-          "name": "Mellat callback (bank → API)",
+          "name": "Mellat callback via store domain (gateway → nginx → API)",
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/x-www-form-urlencoded"
+              }
+            ],
+            "body": {
+              "mode": "urlencoded",
+              "urlencoded": [
+                {
+                  "key": "ResCode",
+                  "value": "0"
+                },
+                {
+                  "key": "SaleOrderId",
+                  "value": "{{transactionId}}"
+                },
+                {
+                  "key": "SaleReferenceId",
+                  "value": "123456789"
+                },
+                {
+                  "key": "RefId",
+                  "value": "{{refId}}"
+                }
+              ]
+            },
+            "url": "https://YOUR_WEBSITE_DOMAIN/meshkee/payments/mellat/callback",
+            "description": "Preferred path: bank posts to the store apex; nginx proxies to /tenants/{host}/payments/mellat/callback. Verifies+settles, then 303 redirect to returnUrl."
+          }
+        },
+        {
+          "name": "ZarinPal callback via store domain (gateway → nginx → API)",
+          "request": {
+            "method": "GET",
+            "header": [],
+            "url": {
+              "raw": "https://YOUR_WEBSITE_DOMAIN/meshkee/payments/zarinpal/callback?Authority={{authority}}&Status=OK",
+              "host": ["YOUR_WEBSITE_DOMAIN"],
+              "path": [
+                "meshkee",
+                "payments",
+                "zarinpal",
+                "callback"
+              ],
+              "query": [
+                { "key": "Authority", "value": "{{authority}}" },
+                { "key": "Status", "value": "OK" }
+              ]
+            },
+            "description": "Preferred path: ZarinPal redirects to the store apex; nginx proxies to /tenants/{host}/payments/zarinpal/callback. Verifies payment, then 303 redirect to returnUrl."
+          }
+        },
+        {
+          "name": "Mellat callback (legacy API URL)",
           "request": {
             "method": "POST",
             "header": [
@@ -1754,11 +1811,11 @@
               ]
             },
             "url": "{{baseUrl}}/businesses/{{businessId}}/payments/mellat/callback",
-            "description": "Called by Mellat (not by the website). Verifies+settles, then 303 redirect to returnUrl."
+            "description": "Legacy direct API callback. Prefer store-domain /meshkee/payments/... so gateway domain checks match the merchant terminal."
           }
         },
         {
-          "name": "ZarinPal callback (gateway → API)",
+          "name": "ZarinPal callback (legacy API URL)",
           "request": {
             "method": "GET",
             "header": [],
@@ -1777,7 +1834,7 @@
                 { "key": "Status", "value": "OK" }
               ]
             },
-            "description": "Called by ZarinPal (not by the website). Verifies payment, then 303 redirect to returnUrl."
+            "description": "Legacy direct API callback. Prefer store-domain /meshkee/payments/... so ZarinPal domain checks match the merchant terminal."
           }
         }
       ]