feat(security): complete capability messaging workflows

Tiku.Application/Security/ConsumerAuthorizationMetadata.cs

@@ -0,0 +1,15 @@
+namespace Tiku.Application.Security;
+
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = false, Inherited = false)]
+public sealed class ConsumerAuthorizationMetadataAttribute(
+    string realm,
+    string module,
+    CapabilityOperation operation,
+    string auditAction) : Attribute
+{
+    public string Realm { get; } = realm;
+    public string Module { get; } = module;
+    public CapabilityOperation Operation { get; } = operation;
+    public string AuditAction { get; } = auditAction;
+    public bool RequiresSystemScope { get; init; }
+}

Tiku.Application/Security/ITenantExecutionScope.cs

@@ -14,7 +14,8 @@ public sealed record SystemScopeRequest(
     SystemScopeCallerType CallerType,
     string Caller,
     string Reason,
-    string CorrelationId);
+    string CorrelationId,
+    bool IsGlobal = false);
 
 public interface ITenantExecutionScope
 {

Tiku.Application/Security/ProductModuleCatalog.cs

@@ -0,0 +1,23 @@
+namespace Tiku.Application.Security;
+
+public static class ProductModuleCatalog
+{
+    public static readonly IReadOnlyDictionary<string, string> All =
+        new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["dashboard"] = "Dashboard",
+            ["staff"] = "Staff",
+            ["role"] = "Roles",
+            ["student"] = "Students",
+            ["content"] = "Content",
+            ["settings"] = "Settings",
+            ["provider"] = "Providers",
+            ["commerce"] = "Commerce",
+            ["crm"] = "CRM",
+            ["commission"] = "Commission",
+            ["job"] = "Background Jobs"
+        };
+
+    public static bool Contains(string moduleCode) =>
+        All.ContainsKey(moduleCode.Trim().ToLowerInvariant());
+}