Brand comes from the host, never from the browser
The correctness question in a multi-brand system is: where does the brand come from? If it is anything the browser can send — a form field, a query parameter, a stored preference — then an order can be recorded against the wrong brand, and it will eventually happen.
We resolve it from the request hostname and pass it to the order routine directly. The client is never asked which brand it is on, so it cannot answer incorrectly. Order numbering derives from the same source, which means the order number itself is evidence of which brand took the sale.
Preview and staging hosts are the one place an override is allowed, and real domains ignore it entirely. That keeps testing convenient without opening a path that matters in production.
