Merge branch 'B2B'

nginx owns the validated CORS response; the live :445 backend rejects requests when the browser Origin is forwarded.

docs/backend/TENANT-API-DOMAIN-HANDOFF.md

@@ -77,7 +77,10 @@ It creates the shared `api.gorbushka.market`, issues/renews its certificate,
 configures CORS for `gorbushka.market` and its subdomains, and proxies all paths
 to the backend. A request from `store1.gorbushka.market` reaches upstream with
 `Host` and `X-Storefront-Host` set to `store1.gorbushka.market`, while
-`X-Forwarded-Host` remains `api.gorbushka.market`.
+`X-Forwarded-Host` remains `api.gorbushka.market`. nginx terminates CORS and
+strips the browser `Origin` before proxying because the current `:445` service
+rejects direct browser origins; tenant identity is carried by the trusted
+storefront header instead.
 
 `store1.example.com` requires no additional API DNS or certificate; it uses the
 same `api.example.com` certificate as the root storefront.

scripts/deploy/configure-api-domain.sh

@@ -72,6 +72,9 @@ server {
         proxy_set_header Host              \$storefront_host;
         proxy_set_header X-Forwarded-Host  $API_DOMAIN;
         proxy_set_header X-Storefront-Host \$storefront_host;
+        # nginx has already validated and answered CORS. The existing backend
+        # rejects browser Origin on :445, so do not forward it a second time.
+        proxy_set_header Origin            "";
         proxy_set_header X-Real-IP         \$remote_addr;
         proxy_set_header X-Forwarded-For   \$proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;