fix remote HMAC: identify tenant by domain, not shared nodeServer

new.gholaktala.ir is the API host of many versions. Prefer subdomain of the product domain and refuse ambiguous nodeServer ties. 403 names the matched tenant.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/plugins/plugin-store.service.ts

@@ -810,7 +810,17 @@ export class PluginStoreService implements OnModuleInit, OnModuleDestroy {
     }
     if (!tenantId) throw new ForbiddenException('نسخه نامعتبر است');
     if (!(await this.isStoreEnabled(tenantId))) {
-      throw new ForbiddenException('فروشگاه افزونه برای این نسخه خاموش است');
+      const tenant = await this.prisma.tenant.findUnique({
+        where: { id: tenantId },
+        select: { nameFa: true, domain: true },
+      });
+      const who = tenant
+        ? `${tenant.nameFa} (${tenant.domain})`
+        : tenantId;
+      this.logger.warn(`plugin store off for ${who}`);
+      throw new ForbiddenException(
+        `فروشگاه افزونه برای این نسخه خاموش است: ${who}`,
+      );
     }
   }