fix(tunnel-client): resolve module → user domain via cluster/module_domains

NS8 stores consumer-to-domain bindings in the cluster/module_domains hash
(written by cluster/bind-user-domains), not on the consumer's environment.
fetchModuleDomain was only reading USER_DOMAIN from
module/{id}/environment, which is empty for most consumers (webtop, mail,
…), so the support session manifest reported no domain mapping and the UI
hid the per-module domain credentials. Read the cluster mapping first and
fall back to the per-module USER_DOMAIN for the providers that do expose
it directly.

Author: edospadoni

services/support/cmd/tunnel-client/internal/users/configurator.go

@@ -288,18 +288,35 @@ func discoverLocalModulesFromRedis() map[string]*moduleInfo {
 	return result
 }
 
-// fetchModuleDomain reads USER_DOMAIN from Redis for a module instance.
+// fetchModuleDomain returns the user domain bound to a module instance.
+// NS8 stores consumer-to-domain bindings in the cluster/module_domains hash
+// (set by the cluster/bind-user-domains action); some providers also expose
+// USER_DOMAIN directly in their own environment, so fall back to that when
+// the cluster mapping is missing. When a module is bound to multiple
+// domains we pick the first one — the support session only provisions one
+// domain user per module today.
 func fetchModuleDomain(moduleID string) string {
-	cmd := exec.Command("redis-cli", "HGET", fmt.Sprintf("module/%s/environment", moduleID), "USER_DOMAIN") //nolint:gosec // redis-cli is trusted
+	if v := redisOutput("HGET", "cluster/module_domains", moduleID); v != "" {
+		if fields := strings.Fields(v); len(fields) > 0 {
+			return fields[0]
+		}
+	}
+	return redisOutput("HGET", fmt.Sprintf("module/%s/environment", moduleID), "USER_DOMAIN")
+}
+
+// redisOutput runs `redis-cli <args...>` and returns the trimmed stdout,
+// or the empty string when the call fails or the value is nil.
+func redisOutput(args ...string) string {
+	cmd := exec.Command("redis-cli", args...) //nolint:gosec // redis-cli is trusted
 	output, err := cmd.Output()
 	if err != nil {
 		return ""
 	}
-	domain := string(bytes.TrimSpace(output))
-	if domain == "" || domain == "(nil)" {
+	v := string(bytes.TrimSpace(output))
+	if v == "" || v == "(nil)" {
 		return ""
 	}
-	return domain
+	return v
 }
 
 // discoverPlugins scans usersDir for valid executable plugin files.