feat: enforce tenant isolation and shared question bank

Tiku.Api/Controllers/TaxonomyController.cs

@@ -0,0 +1,36 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Api.Contracts;
+using Tiku.Application.Catalog;
+using Tiku.Application.Security;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Produces("application/json")]
+[Route("api/taxonomy/nodes")]
+public sealed class TaxonomyController(
+    ITenantContext tenantContext,
+    ITaxonomyService taxonomyService) : ControllerBase
+{
+    [HttpGet]
+    public Task<IReadOnlyCollection<TaxonomyNodeItem>> List(CancellationToken cancellationToken)
+    {
+        return taxonomyService.ListAsync(RequireTenantId(), cancellationToken);
+    }
+
+    [HttpPost]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    public Task<TaxonomyNodeItem> Create(
+        CreateTaxonomyNodeDto request,
+        CancellationToken cancellationToken)
+    {
+        return taxonomyService.CreateAsync(RequireTenantId(), request.ToCommand(), cancellationToken);
+    }
+
+    private Guid RequireTenantId()
+    {
+        return tenantContext.TenantId ?? throw new InvalidOperationException("Tenant was not resolved.");
+    }
+}