Re-provision storefront nginx when domain host is renamed.

Also create origin HTTPS with a self-signed cert on provision so Cloudflare Full does not fall through to another site's default SSL vhost.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/business-admin/business-admin.service.ts

@@ -619,15 +619,19 @@ export class BusinessAdminService {
     let deploySlug = domain.deploySlug;
     let provisionError: string | null = null;
     let nextGitRepoUrl = domain.gitRepoUrl;
+    const hostChanged = domain.host !== host;
+    const effectiveGitRepoUrl = gitRepoUrl || domain.gitRepoUrl?.trim() || null;
 
-    // Only provision when wiring a new/changed repo or when deploy slug is missing.
-    // Re-saving the same git URL must not block the API on clone/nginx/certbot again.
+    // Only provision when wiring a new/changed repo, deploy slug is missing, or
+    // the apex host changed (nginx vhost is keyed by host — rename must bind the new name).
+    // Re-saving the same git URL + same host must not block the API on clone again.
     const alreadyWired =
-      !!gitRepoUrl &&
+      !!effectiveGitRepoUrl &&
       !!domain.deploySlug?.trim() &&
-      domain.gitRepoUrl?.trim() === gitRepoUrl;
+      (!gitRepoUrl || domain.gitRepoUrl?.trim() === gitRepoUrl) &&
+      !hostChanged;
 
-    if (gitRepoUrl && !alreadyWired) {
+    if (effectiveGitRepoUrl && !alreadyWired) {
       const slug = domain.deploySlug?.trim() || deploySlugFromHost(host);
       if (!slug) {
         throw new BadRequestException('Could not derive deploy slug from host');
@@ -645,10 +649,10 @@ export class BusinessAdminService {
         await this.websiteDeployAgent.provision({
           slug,
           host,
-          gitRepoUrl: normalizeGitRepoUrlForClone(gitRepoUrl),
+          gitRepoUrl: normalizeGitRepoUrlForClone(effectiveGitRepoUrl),
         });
         deploySlug = slug;
-        nextGitRepoUrl = gitRepoUrl;
+        nextGitRepoUrl = effectiveGitRepoUrl;
       } catch (err) {
         if (err && typeof err === 'object' && 'message' in err && typeof err.message === 'string') {
           provisionError = err.message;
@@ -658,7 +662,7 @@ export class BusinessAdminService {
       }
     } else if (alreadyWired) {
       deploySlug = domain.deploySlug;
-      nextGitRepoUrl = gitRepoUrl;
+      nextGitRepoUrl = effectiveGitRepoUrl;
     }
 
     const updated = await this.prisma.domain.update({