feat: enforce tenant isolation and shared question bank

Tiku.Application/Security/ITenantExecutionScope.cs

@@ -0,0 +1,16 @@
+namespace Tiku.Application.Security;
+
+public interface ITenantExecutionScope
+{
+    Task ExecuteAsync(
+        Guid? targetTenantId,
+        string reason,
+        Func<IServiceProvider, CancellationToken, Task> operation,
+        CancellationToken cancellationToken = default);
+
+    Task<TResult> ExecuteAsync<TResult>(
+        Guid? targetTenantId,
+        string reason,
+        Func<IServiceProvider, CancellationToken, Task<TResult>> operation,
+        CancellationToken cancellationToken = default);
+}