fix(deploy): provision tenant API domains

Reconcile TLS, exact CORS, and backend proxying before release activation so every storefront uses its derived API host.

scripts/deploy/add-domain.sh

@@ -115,6 +115,17 @@ certbot --nginx "${CERT_ARGS[@]}" \
 nginx -t
 systemctl reload nginx
 
+echo "==> companion API domain(s)"
+CONFIGURE_API="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/configure-api-domain.sh"
+[[ -x "$CONFIGURE_API" ]] || {
+  echo "ERROR: configure-api-domain.sh must be executable and next to add-domain.sh" >&2
+  exit 1
+}
+"$CONFIGURE_API" --domain "$DOMAIN" --email "$EMAIL"
+if [[ $WITH_WWW -eq 1 ]]; then
+  "$CONFIGURE_API" --domain "www.$DOMAIN" --email "$EMAIL"
+fi
+
 echo "==> renewal timer"
 systemctl enable --now certbot.timer
 systemctl status certbot.timer --no-pager | head -3 || true