feat: harden SaaS authentication and authorization

Tiku.Api/Controllers/TenantsController.cs

@@ -1,7 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using System.Text.Json;
 using Tiku.Application.Auth;
 using Tiku.Application.Security;
 using Tiku.Domain.Tenancy;
@@ -39,8 +38,7 @@ public sealed class TenantsController(
                     tenant.Name,
                     tenant.Slug,
                     tenant.Status,
-                    membership.Role,
-                    membership.Permissions))
+                    membership.Role))
             .SingleOrDefaultAsync(cancellationToken);
 
         if (result is null)
@@ -60,11 +58,9 @@ public sealed class TenantsController(
 /// <param name="TenantSlug">租户编码。</param>
 /// <param name="Status">租户状态。</param>
 /// <param name="Role">当前用户在租户内的角色。</param>
-/// <param name="Permissions">当前用户在租户内的权限扩展。</param>
 public sealed record CurrentTenantResponse(
     Guid TenantId,
     string TenantName,
     string TenantSlug,
     TenantStatus Status,
-    TenantRole Role,
-    JsonElement Permissions);
+    TenantRole Role);