Route payment bank callbacks through storefront domains.

ZarinPal rejects api.meshkee.com when the terminal is registered to the store apex; nginx now proxies /meshkee/payments/{gateway}/callback to a host-scoped API route.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/website-api/openapi.json

@@ -3210,7 +3210,8 @@
         "tags": [
           "Payments"
         ],
-        "summary": "Bank payment callback (public; redirects browser to returnUrl)",
+        "summary": "Bank payment callback — legacy direct API URL (prefer store-domain path)",
+        "description": "Still supported. Prefer https://{store}/meshkee/payments/{gateway}/callback so gateway domain checks match the merchant terminal.",
         "parameters": [
           {
             "$ref": "#/components/parameters/businessId"
@@ -3255,7 +3256,7 @@
         "tags": [
           "Payments"
         ],
-        "summary": "Bank payment callback (GET variant)",
+        "summary": "Bank payment callback GET — legacy direct API URL",
         "parameters": [
           {
             "$ref": "#/components/parameters/businessId"
@@ -3282,6 +3283,96 @@
           }
         }
       }
+    },
+    "/tenants/{host}/payments/{gateway}/callback": {
+      "post": {
+        "tags": [
+          "Payments"
+        ],
+        "summary": "Bank payment callback via store host (nginx proxies /meshkee/payments/... here)",
+        "description": "Public. Resolves business from host. Used after storefront nginx proxies https://{store}/meshkee/payments/{gateway}/callback.",
+        "parameters": [
+          {
+            "name": "host",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "example": "YOUR_WEBSITE_DOMAIN"
+            }
+          },
+          {
+            "name": "gateway",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "mellat",
+                "sep",
+                "snappay",
+                "digipay",
+                "zarinpal"
+              ]
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "303": {
+            "description": "Redirect to checkout returnUrl with status=success|failed"
+          }
+        }
+      },
+      "get": {
+        "tags": [
+          "Payments"
+        ],
+        "summary": "Bank payment callback GET via store host (ZarinPal)",
+        "parameters": [
+          {
+            "name": "host",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "example": "YOUR_WEBSITE_DOMAIN"
+            }
+          },
+          {
+            "name": "gateway",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "mellat",
+                "sep",
+                "snappay",
+                "digipay",
+                "zarinpal"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "303": {
+            "description": "Redirect to checkout returnUrl with status=success|failed"
+          }
+        }
+      }
     }
   }
 }