feat: enforce tenant isolation and shared question bank

Tiku.Application/Tenancy/TenantDomainLifecycleModels.cs

@@ -0,0 +1,39 @@
+namespace Tiku.Application.Tenancy;
+
+public sealed class DomainLifecycleOptions
+{
+    public bool Enabled { get; set; } = true;
+    public int PollSeconds { get; set; } = 60;
+    public int BatchSize { get; set; } = 50;
+    public string DnsJsonEndpoint { get; set; } = "https://cloudflare-dns.com/dns-query";
+    public string VerificationRecordPrefix { get; set; } = "_tiku-verification";
+    public string[] AllowedCnameTargets { get; set; } = [];
+    public string? GatewayBaseUrl { get; set; }
+    public string? GatewayApiKey { get; set; }
+}
+
+public sealed record DomainOwnershipResult(bool Verified, bool Configured, string? FailureReason);
+public sealed record DomainGatewayResult(bool TlsReady, bool Configured, string? FailureReason);
+
+public interface IDomainOwnershipVerifier
+{
+    Task<DomainOwnershipResult> VerifyAsync(
+        string host,
+        string verificationToken,
+        CancellationToken cancellationToken = default);
+}
+
+public interface IDomainGatewayProvisioner
+{
+    Task<DomainGatewayResult> EnsureTlsAsync(string host, CancellationToken cancellationToken = default);
+}
+
+public interface ITenantDomainLifecycleService
+{
+    Task<int> ProcessPendingAsync(CancellationToken cancellationToken = default);
+}
+
+public interface ITenantRuntimeCacheInvalidator
+{
+    void Invalidate(Guid tenantId);
+}