fix(api): derive host from storefront domain

Every storefront, including nested subdomains, uses its matching api.<hostname> endpoint.

docs/DEPLOYMENT.md

@@ -1,12 +1,14 @@
 # Deployment — server provisioning, CD, TLS
 
-Frontend only. The backend service (`:8080`) is a separate developer's responsibility; nginx proxies the same-origin `/backend/` gateway (and the legacy direct `/api/` route) to it and will `502` until it exists.
+Frontend only. The backend service (`:8080`) is a separate developer's responsibility. API hostnames are separate reverse proxies and will return `502` until their upstream exists.
 
 **Multi-tenant, one bundle.** Every customer domain is served by the same build. The SPA resolves its tenant from the `Host` header ([BACKEND-HANDOFF §1a](backend/BACKEND-HANDOFF.md)). One deploy updates every domain simultaneously — there is no per-tenant build and no per-tenant deploy.
 
-All browser API traffic uses `{origin}/backend/...`. nginx removes `/backend/`
-before forwarding and preserves `Host`; do not replace this with a hardcoded API
-domain or a direct backend port, because that breaks custom domains and CORS.
+The SPA derives its API origin from the complete storefront hostname:
+`example.com` uses `api.example.com`, and `store1.example.com` uses
+`api.store1.example.com`. Provision DNS, TLS, reverse proxying, and CORS for
+every derived API hostname. A single-label wildcard certificate does not cover
+nested names such as `api.store1.example.com`.
 
 ---