feat: enforce tenant isolation and shared question bank

Tiku.Api/Controllers/ReferralController.cs

@@ -4,6 +4,7 @@ using Microsoft.EntityFrameworkCore;
 using Tiku.Api.Contracts;
 using Tiku.Application.Growth;
 using Tiku.Application.Security;
+using Tiku.Application.Tenancy;
 using Tiku.Domain.Tenancy;
 using Tiku.Infrastructure.Persistence;
 
@@ -15,8 +16,9 @@ namespace Tiku.Api.Controllers;
 public sealed class ReferralController(
     IReferralService referralService,
     ICurrentUser currentUser,
-    ICurrentTenant currentTenant,
-    TikuDbContext dbContext) : ControllerBase
+    ITenantContext currentTenant,
+    ITenantContextInitializer tenantInitializer,
+    ITenantDirectory tenantDirectory) : ControllerBase
 {
     [HttpPost("invite-code")]
     [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
@@ -223,13 +225,9 @@ public sealed class ReferralController(
             throw new TenantNotFoundException();
         }
 
-        var tenantId = await dbContext.Tenants
-            .Where(tenant =>
-                tenant.Slug == resolvedTenantCode.Trim() &&
-                tenant.Status == TenantStatus.Active)
-            .Select(tenant => (Guid?)tenant.Id)
-            .SingleOrDefaultAsync(cancellationToken);
-
-        return tenantId ?? throw new TenantNotFoundException();
+        var tenant = await tenantDirectory.FindByCodeAsync(resolvedTenantCode.Trim(), cancellationToken)
+            ?? throw new TenantNotFoundException();
+        tenantInitializer.Initialize(tenant.TenantId, tenant.TenantCode, TenantResolutionSource.TenantCode);
+        return tenant.TenantId;
     }
 }