Marketing site (bargevasat.ir) + admin-editable store links + subdomain split

- New standalone Next.js marketing site under site/ (static export, SEO):
  landing, download/install guide (Bazaar/Myket/iOS-PWA/web), FAQ (JSON-LD),
  privacy, terms, support, /admin link editor. fa RTL, sitemap/robots/manifest.
- Backend: SiteLinksService (JSON-file persisted) + GET /api/site/links (public)
  + POST /api/admin/site/links (X-Admin-Token). ADMIN_TOKEN + Site__DataDir via env.
- compose: hokm-site service (:1520) + hokm_data volume for links JSON.
- CI deploy job builds + deploys the site container.
- deploy/SUBDOMAIN_SPLIT.md: nginx blocks, cert reissue, DNS, ENV split.
- Exclude site/ from root tsc + web docker context.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/ENV_FILE.example

@@ -56,6 +56,24 @@ IAB_MYKET_ACCESS_TOKEN=
 # store creds). NEVER true in production.
 IAB_ALLOW_UNVERIFIED=false
 
+# ──────────────────────────────────────────────────────────────────────────
+# Marketing site (bargevasat.ir) + subdomain split
+# Game → app.bargevasat.ir ; marketing site → bargevasat.ir
+# ──────────────────────────────────────────────────────────────────────────
+SITE_PORT=1520
+# Browser-facing URLs baked into the marketing site at BUILD time:
+NEXT_PUBLIC_APP_URL=https://app.bargevasat.ir     # the game (CTA buttons)
+NEXT_PUBLIC_SITE_URL=https://bargevasat.ir        # canonical/SEO base
+# (NEXT_PUBLIC_SERVER_URL above is reused by the site to read store links.)
+
+# Admin panel (edit Bazaar/Myket/iOS links at /admin). Shared-token auth.
+# Generate with: openssl rand -hex 24
+ADMIN_TOKEN=7ec8b2b242695de7d2692185acb4f1d345a589866ddd2de6
+
+# With the split, set these too (game bundle + CORS for all 3 hosts):
+#   NEXT_PUBLIC_SERVER_URL=https://api.bargevasat.ir
+#   CORS_ORIGINS=https://bargevasat.ir,https://www.bargevasat.ir,https://app.bargevasat.ir
+
 # ──────────────────────────────────────────────────────────────────────────
 # PRODUCTION (bargevasat.ir) — use these values instead of the local ones above,
 # and deploy with the Caddy overlay (see PRODUCTION.md). DNS: bargevasat.ir,