feat: enforce tenant isolation and shared question bank

Tiku.Api/Contracts/ContentManagementDtos.cs

@@ -1,7 +1,9 @@
 using System.ComponentModel.DataAnnotations;
 using System.Text.Json;
 using Tiku.Application.Content;
+using Tiku.Application.QuestionBanks;
 using Tiku.Domain.Common;
+using Tiku.Domain.Content;
 
 namespace Tiku.Api.Contracts;
 
@@ -252,6 +254,9 @@ public sealed class CollectionQuestionDto
     [Required]
     public Guid QuestionId { get; set; }
 
+    [Required]
+    public QuestionSource Source { get; set; } = QuestionSource.Tenant;
+
     [StringLength(100)]
     public string? SectionKey { get; set; }
 
@@ -265,7 +270,13 @@ public sealed class CollectionQuestionDto
 
     public CollectionQuestionCommand ToCommand()
     {
-        return new CollectionQuestionCommand(QuestionId, SectionKey, Order, Score, Required, Metadata);
+        return new CollectionQuestionCommand(
+            new QuestionLocator(Source, QuestionId),
+            SectionKey,
+            Order,
+            Score,
+            Required,
+            Metadata);
     }
 }