Stops demo and shop rows that share one API URL from colliding, and skips phone-like adminUrl values when resolving X-Abshode-Domain.
Co-authored-by: Cursor <cursoragent@cursor.com>
HMAC only matched tenant.domain, so k.montzar.ir / new.gholaktala.ir missed the row. Also return an empty store when catalog tables are missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Products can authenticate with one shared secret and tenant domain instead of per-version tokens; Bearer token remains as fallback.
Co-authored-by: Cursor <cursoragent@cursor.com>