Marketing site (bargevasat.ir) + admin-editable store links + subdomain split

- New standalone Next.js marketing site under site/ (static export, SEO):
  landing, download/install guide (Bazaar/Myket/iOS-PWA/web), FAQ (JSON-LD),
  privacy, terms, support, /admin link editor. fa RTL, sitemap/robots/manifest.
- Backend: SiteLinksService (JSON-file persisted) + GET /api/site/links (public)
  + POST /api/admin/site/links (X-Admin-Token). ADMIN_TOKEN + Site__DataDir via env.
- compose: hokm-site service (:1520) + hokm_data volume for links JSON.
- CI deploy job builds + deploys the site container.
- deploy/SUBDOMAIN_SPLIT.md: nginx blocks, cert reissue, DNS, ENV split.
- Exclude site/ from root tsc + web docker context.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -63,6 +63,12 @@ services:
       Iab__BazaarRefreshToken: ${IAB_BAZAAR_REFRESH_TOKEN:-}
       Iab__MyketAccessToken: ${IAB_MYKET_ACCESS_TOKEN:-}
       Iab__AllowUnverified: ${IAB_ALLOW_UNVERIFIED:-false}
+      # Admin panel (marketing-site links editor) — shared-token auth.
+      Admin__Token: ${ADMIN_TOKEN:-}
+      # Where the admin-editable site-links JSON is persisted (mounted volume).
+      Site__DataDir: /data
+    volumes:
+      - hokm_data:/data
     ports:
       - "${API_PORT:-1505}:5005"
     healthcheck:
@@ -98,5 +104,29 @@ services:
       retries: 6
       start_period: 10s
 
+  # Marketing website (bargevasat.ir) — separate static Next.js project in ./site.
+  site:
+    build:
+      context: ./site
+      dockerfile: Dockerfile
+      args:
+        # Browser-facing API (for reading admin-editable store links) + game URL.
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_SERVER_URL:-http://localhost:1505}
+        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:1500}
+        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-http://localhost:1520}
+        NPM_REGISTRY: ${NPM_REGISTRY:-http://171.22.25.73:8081/repository/npm-group/}
+    image: hokm-site:latest
+    container_name: hokm-site
+    restart: unless-stopped
+    ports:
+      - "${SITE_PORT:-1520}:80"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O-", "http://127.0.0.1/"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 10s
+
 volumes:
   hokm_db_data:
+  hokm_data: