Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.
Every storefront, including nested subdomains, uses its matching api.<hostname> endpoint.
