fix(deploy): provision tenant API domains

Reconcile TLS, exact CORS, and backend proxying before release activation so every storefront uses its derived API host.

docs/backend/BACKEND-HANDOFF.md

@@ -8,6 +8,10 @@ Single entry point for a backend developer picking this up cold. Written 2026-08
 
 ## 1a. Multi-tenancy — the thing that shapes every endpoint
 
+The final executable infrastructure/backend contract is
+[TENANT-API-DOMAIN-HANDOFF.md](TENANT-API-DOMAIN-HANDOFF.md). Follow it for
+hostname normalization, CORS, nginx, TLS, CI secrets, and acceptance checks.
+
 One deployed bundle serves **every customer domain**. There is no per-tenant build. The chain is:
 
 1. [`TenantResolverService`](../../src/app/core/config/tenant-resolver.service.ts) reads the complete current browser hostname and protocol (localhost still uses the development proxy).
@@ -87,7 +91,12 @@ npm install     # pulls @marketplaces/auth over git, no credentials needed
 npm run build   # -> dist/dexarmarket
 ```
 
-Angular 22, Node 20+. nginx serves `/srv/marketplaces/current/frontend`, so deploying means copying `dist/dexarmarket` there — **manually, today.** There is no CD pipeline. Because of the multi-tenant design (§1a), one such deploy updates every domain at once.
+Angular 22, Node 24+. nginx serves `/srv/marketplaces/current/frontend`.
+[`deploy.yml`](../../.github/workflows/deploy.yml) builds and atomically deploys
+pushes to `main`; one deployment updates every domain at once. Before activation,
+the workflow reconciles TLS, exact CORS, and reverse proxying for every host in
+`STOREFRONT_DOMAINS`. Production deployment requires the documented CI secrets
+and the one-time [`server-setup.sh`](../../scripts/deploy/server-setup.sh) run.
 
 ## 7. Known open decisions