fix(api): share base-domain API host

Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.

scripts/deploy/add-domain.sh

@@ -121,10 +121,17 @@ CONFIGURE_API="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/configure-api-domai
   echo "ERROR: configure-api-domain.sh must be executable and next to add-domain.sh" >&2
   exit 1
 }
-"$CONFIGURE_API" --domain "$DOMAIN" --email "$EMAIL"
-if [[ $WITH_WWW -eq 1 ]]; then
-  "$CONFIGURE_API" --domain "www.$DOMAIN" --email "$EMAIL"
+IFS=. read -ra DOMAIN_LABELS <<< "$DOMAIN"
+LABEL_COUNT=${#DOMAIN_LABELS[@]}
+TAKE=2
+TLD=${DOMAIN_LABELS[LABEL_COUNT-1]}
+SECOND_LEVEL=${DOMAIN_LABELS[LABEL_COUNT-2]}
+if (( LABEL_COUNT >= 3 && ${#TLD} == 2 && ${#SECOND_LEVEL} <= 3 )); then
+  TAKE=3
 fi
+START=$((LABEL_COUNT - TAKE))
+API_BASE_DOMAIN=$(IFS=.; echo "${DOMAIN_LABELS[*]:START}")
+"$CONFIGURE_API" --domain "$API_BASE_DOMAIN" --email "$EMAIL"
 
 echo "==> renewal timer"
 systemctl enable --now certbot.timer