feat: enforce tenant isolation and shared question bank

Tiku.Application/QuestionBanks/IQuestionReferenceService.cs

@@ -0,0 +1,27 @@
+using Tiku.Domain.Content;
+
+namespace Tiku.Application.QuestionBanks;
+
+public interface IPublicQuestionAccessPolicy
+{
+    Task EnsureCanStartAsync(Guid tenantId, CancellationToken cancellationToken = default);
+}
+
+public interface IQuestionReferenceService
+{
+    Task<TenantQuestionReference> ResolveAsync(
+        Guid tenantId,
+        Guid? userId,
+        QuestionLocator locator,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed class PublicQuestionAccessDeniedException(string code, string message) : Exception(message)
+{
+    public string Code { get; } = code;
+}
+
+public sealed class QuestionLocatorException(string code, string message) : Exception(message)
+{
+    public string Code { get; } = code;
+}