fix remote HMAC: match tenant domain only, not shared adminUrl

k.montzar.ir on Gholaktala adminUrl was selecting tenant app.gholaktala.ir. HMAC now uses primary domain (and its subdomain), not admin/app/node URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/tenant-host.util.spec.ts

@@ -1,10 +1,10 @@
 import { findTenantForHost, scoreTenantHost } from './tenant-host.util';
 
 const gholak = {
-  domain: 'gholaktala.ir',
+  domain: 'app.gholaktala.ir',
   domains: [],
-  appUrl: 'https://gholaktala.ir',
-  adminUrl: 'https://admin.gholaktala.ir',
+  appUrl: 'https://app.gholaktala.ir',
+  adminUrl: 'https://k.montzar.ir/admin',
   nodeServer: 'https://new.gholaktala.ir/server',
 };
 
@@ -25,22 +25,36 @@ const otherOnSameBox = {
 };
 
 describe('findTenantForHost', () => {
-  const tenants = [montzar, otherOnSameBox, gholak];
+  const tenants = [gholak, otherOnSameBox, montzar];
 
-  it('maps new.gholaktala.ir to gholaktala, not the first shared nodeServer tenant', () => {
-    expect(findTenantForHost(tenants, 'new.gholaktala.ir')?.domain).toBe(
-      'gholaktala.ir',
+  it('hmac does not treat shared adminUrl as gholaktala', () => {
+    expect(scoreTenantHost(gholak, 'k.montzar.ir', 'hmac')).toBe(0);
+    expect(findTenantForHost(tenants, 'k.montzar.ir', 'hmac')?.domain).toBe(
+      'k.montzar.ir',
     );
-    expect(scoreTenantHost(gholak, 'new.gholaktala.ir')).toBe(75);
-    expect(scoreTenantHost(montzar, 'new.gholaktala.ir')).toBe(10);
   });
 
-  it('maps k.montzar.ir to montzar by primary domain', () => {
+  it('hmac without montzar tenant does not fall back to gholak adminUrl', () => {
+    expect(
+      findTenantForHost([gholak, otherOnSameBox], 'k.montzar.ir', 'hmac'),
+    ).toBeUndefined();
+  });
+
+  it('full get_user still maps k.montzar.ir to montzar by primary domain', () => {
     expect(findTenantForHost(tenants, 'k.montzar.ir')?.domain).toBe(
       'k.montzar.ir',
     );
   });
 
+  it('maps new.gholaktala.ir to gholaktala via subdomain, not nodeServer', () => {
+    const gholakBare = { ...gholak, domain: 'gholaktala.ir' };
+    expect(
+      findTenantForHost([montzar, otherOnSameBox, gholakBare], 'new.gholaktala.ir')
+        ?.domain,
+    ).toBe('gholaktala.ir');
+    expect(scoreTenantHost(gholakBare, 'new.gholaktala.ir')).toBe(75);
+  });
+
   it('does not pick a random tenant when only nodeServer matches several rows', () => {
     const sharedOnly = [
       { ...montzar, domain: 'a.ir', domains: [] },