Per-institution subdomains

• No institution picker — the host identifies the tenant, so users land on a branded sign-in.
• Branding, sign-in and email links all follow the subdomain.
• Fully isolated data. Isolation is enforced at the data layer regardless of host; the subdomain is the visible half of it.

1. 1
   An admin claims it during institution setup

   The subdomain is recorded against the institution.

2. 2
   DNS resolves it

   Tenant records are codified in Terraform alongside the wildcard certificate.

3. 3
   It resolves to the same application

   There is no per-tenant deployment. One application, resolving its tenant from the host.

On a tenant subdomain the institution arrives asynchronously as the host is resolved. The application holds the redirect until that lookup settles rather than bouncing the user to the picker and back — a detail that matters because the alternative is a visible flicker on every cold load.

The shared host keeps working alongside subdomains and shows the institution picker. It remains the fallback for institutions that have not claimed a subdomain.