fix(plugins): resolve remote tenant from admin and app URLs

HMAC only matched tenant.domain, so k.montzar.ir / new.gholaktala.ir missed the row. Also return an empty store when catalog tables are missing.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/remote-sms-auth.guard.ts

@@ -135,6 +135,9 @@ export class RemoteSmsAuthGuard implements CanActivate {
         nameFa: true,
         domain: true,
         domains: true,
+        adminUrl: true,
+        appUrl: true,
+        nodeServer: true,
         product: true,
         isActive: true,
       },
@@ -152,15 +155,31 @@ export class RemoteSmsAuthGuard implements CanActivate {
   }
 
   private matchesHost(
-    tenant: { domain: string | null; domains: unknown },
+    tenant: {
+      domain: string | null;
+      domains: unknown;
+      adminUrl?: string | null;
+      appUrl?: string | null;
+      nodeServer?: string | null;
+    },
     host: string,
   ) {
-    const candidates = new Set<string>();
-    for (const value of [tenant.domain, ...this.readDomains(tenant.domains)]) {
+    const hostNoWww = host.replace(/^www\./, '');
+    const values = [
+      tenant.domain,
+      tenant.adminUrl,
+      tenant.appUrl,
+      tenant.nodeServer,
+      ...this.readDomains(tenant.domains),
+    ];
+    for (const value of values) {
       const normalized = this.normalizeHost(value);
-      if (normalized) candidates.add(normalized);
+      if (!normalized) continue;
+      if (normalized === host || normalized.replace(/^www\./, '') === hostNoWww) {
+        return true;
+      }
     }
-    return candidates.has(host);
+    return false;
   }
 
   private readDomains(raw: unknown): string[] {