Tenant subdomains route through api.<base-domain>; nginx forwards the exact storefront host derived from the validated browser origin.