fix: skip X-Tenant-Id header when EXPRESS_SERVER_URL points to remote

src/index.ts

@@ -144,9 +144,13 @@ interface SyncResponse {
 function canvasHeaders(extra?: Record<string, string>): Record<string, string> {
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
-    'X-Tenant-Id': dbGetActiveTenantId(),
     ...extra
   };
+  // Only send tenant header when targeting local canvas (EXPRESS_SERVER_URL unset).
+  // Remote servers (e.g. production) handle routing via default tenant.
+  if (!process.env.EXPRESS_SERVER_URL) {
+    headers['X-Tenant-Id'] = dbGetActiveTenantId();
+  }
   // Forward API key to canvas when auth is enabled — required for two-service
   // Docker deployments where canvas runs with EXCALIDRAW_API_KEY set.
   const apiKey = process.env.EXCALIDRAW_API_KEY;