feat: enforce tenant isolation and shared question bank

Tiku.Api/Controllers/RuntimeController.cs

@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.Security;
+using Tiku.Application.Tenancy;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[AllowAnonymous]
+[Produces("application/json")]
+[Route("api/runtime")]
+public sealed class RuntimeController(
+    ITenantContext tenantContext,
+    ITenantFrontendConfigService frontendConfigService) : ControllerBase
+{
+    [HttpGet("bootstrap")]
+    [EndpointSummary("获取租户前端运行时配置")]
+    [ProducesResponseType<TenantRuntimeBootstrap>(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status304NotModified)]
+    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<TenantRuntimeBootstrap>> Bootstrap(CancellationToken cancellationToken)
+    {
+        if (!tenantContext.TenantId.HasValue)
+        {
+            return NotFound(new ProblemDetails
+            {
+                Title = "Tenant was not found.",
+                Status = StatusCodes.Status404NotFound
+            });
+        }
+
+        var runtime = await frontendConfigService.GetRuntimeAsync(
+            tenantContext.TenantId.Value,
+            cancellationToken);
+        var etag = $"\"{runtime.TenantCode}-{runtime.ConfigVersion}\"";
+        if (Request.Headers.IfNoneMatch.Any(value => string.Equals(value, etag, StringComparison.Ordinal)))
+        {
+            return StatusCode(StatusCodes.Status304NotModified);
+        }
+
+        Response.Headers.ETag = etag;
+        Response.Headers.CacheControl = "public,max-age=60,must-revalidate";
+        return Ok(runtime);
+    }
+}