feat: enforce tenant isolation and shared question bank

Tiku.Api/Controllers/TenantFrontendConfigController.cs

@@ -0,0 +1,51 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Api.Contracts;
+using Tiku.Application.Security;
+using Tiku.Application.Tenancy;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Authorize(Policy = TikuPolicies.TenantAdmin)]
+[Produces("application/json")]
+[Route("api/tenant-admin/frontend-config")]
+public sealed class TenantFrontendConfigController(
+    ITenantContext tenantContext,
+    ITenantFrontendConfigService frontendConfigService) : ControllerBase
+{
+    [HttpGet]
+    public Task<TenantFrontendConfigItem> Get(CancellationToken cancellationToken)
+    {
+        return frontendConfigService.GetAsync(RequireTenantId(), cancellationToken);
+    }
+
+    [HttpPut("draft")]
+    public Task<TenantFrontendConfigItem> SaveDraft(
+        SaveTenantFrontendConfigDraftDto request,
+        CancellationToken cancellationToken)
+    {
+        return frontendConfigService.SaveDraftAsync(
+            RequireTenantId(),
+            request.ToDraft(),
+            cancellationToken);
+    }
+
+    [HttpPost("publish")]
+    public Task<TenantFrontendConfigItem> Publish(
+        PublishTenantFrontendConfigDto request,
+        CancellationToken cancellationToken)
+    {
+        return frontendConfigService.PublishAsync(
+            RequireTenantId(),
+            request.ExpectedVersion,
+            cancellationToken);
+    }
+
+    private Guid RequireTenantId()
+    {
+        return tenantContext.TenantId ?? throw new TenantFrontendConfigException(
+            "tenant_not_resolved",
+            "Tenant was not resolved.");
+    }
+}