nginx owns the validated CORS response; the live :445 backend rejects requests when the browser Origin is forwarded.
Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.
Reconcile TLS, exact CORS, and backend proxying before release activation so every storefront uses its derived API host.