The rewrite was stripping /api/ from the path, but the Go backend expects routes at /api/tenants, /api/dashboard etc.