Scenario 18: After adding a second SecurityFilterChain bean for an admin subdomain, requests to /api/** that used to work now return 401 unexpectedly.

FilterChainProxy picks exactly ONE matching SecurityFilterChain per request based on @Order and securityMatcher — if the new chain's matcher is too broad (or declared with a lower @Order value, making it evaluated first) it can unintentionally intercept requests meant for the original chain, applying the wrong (stricter) rules. Fix by tightening each chain's securityMatcher to the exact intended URL pattern and setting @Order values deliberately so the more specific chain is evaluated first.