k.montzar.ir on Gholaktala adminUrl was selecting tenant app.gholaktala.ir. HMAC now uses primary domain (and its subdomain), not admin/app/node URLs.
Co-authored-by: Cursor <cursoragent@cursor.com>
new.gholaktala.ir is the API host of many versions. Prefer subdomain of the product domain and refuse ambiguous nodeServer ties. 403 names the matched tenant.
Co-authored-by: Cursor <cursoragent@cursor.com>