docs: add Finland/Iran infra topology Cursor rule [skip ci]

.cursor/rules/infra-finland-iran.mdc

@@ -0,0 +1,24 @@
+---
+description: Finland git/CI/Telegram vs Iran app runtime topology
+alwaysApply: true
+---
+
+# Infra topology (Finland vs Iran)
+
+Ghabilee product apps (backend, admin, frontend) follow this split:
+
+| Concern | Where |
+| --- | --- |
+| Git (`git.ghabilee.ir`) + Gitea Actions runners | **Finland** |
+| All Telegram ops / deploy notifications | **Finland** (Actions secrets `TELEGRAM_*`, send from the runner) |
+| App runtime (Docker Compose, Postgres, Redis, nginx, uploads) | **Iran** VPS |
+
+## Rules for agents
+
+- Do **not** send Telegram from the Iran VPS (`api.telegram.org` is unreachable there).
+- Do **not** `source` full backend `.env` in shell notify paths (cron globs like `BOOKING_EXPIRY_CRON=*` break `sh`).
+- Do **not** run heavy `docker build` / `next build` on the Iran box by default (OOM risk on small VPS).
+- CI deploy should **build on Finland**, transfer the image to Iran, then `compose up` on Iran.
+- Secrets: `VPS_*` = Iran runtime SSH; `FINLAND_*` = Finland build SSH; `TELEGRAM_*` = notify from Finland.
+- Exception: `telegrambot` / telegram-relay **runs on Finland** (that is intentional).
+