feat: harden SaaS authentication and authorization

Tiku.Domain/Tenancy/TenantMembership.cs

@@ -1,4 +1,3 @@
-using System.Text.Json;
 using Tiku.Domain.Common;
 
 namespace Tiku.Domain.Tenancy;
@@ -6,16 +5,13 @@ namespace Tiku.Domain.Tenancy;
 public sealed class TenantMembership : AuditableTenantEntity
 {
     public Guid UserId { get; set; }
-    public Guid? RoleTemplateId { get; set; }
     public TenantRole Role { get; set; } = TenantRole.Student;
     public MembershipStatus Status { get; set; } = MembershipStatus.Active;
-    public JsonElement Permissions { get; set; } = JsonDefaults.Object();
     public string? LegacyRole { get; set; }
 }
 
 public enum TenantRole
 {
-    PlatformAdmin,
     TenantOwner,
     TenantAdmin,
     TenantOperator,