feat: enforce tenant isolation and shared question bank

Tiku.DbMigrator/DesignTimeTikuDbContextFactory.cs

@@ -1,5 +1,6 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Design;
+using Tiku.Application.Security;
 using Tiku.Infrastructure.Persistence;
 
 namespace Tiku.DbMigrator;
@@ -17,6 +18,8 @@ public sealed class DesignTimeTikuDbContextFactory : IDesignTimeDbContextFactory
                 npgsql.MigrationsAssembly(typeof(TikuDbContext).Assembly.FullName))
             .Options;
 
-        return new TikuDbContext(options);
+        var tenantContext = new TenantContext();
+        tenantContext.InitializeSystem(null, "EF Core design-time model generation");
+        return new TikuDbContext(options, tenantContext);
     }
 }

Tiku.DbMigrator/Program.cs

@@ -4,6 +4,7 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Tiku.Infrastructure;
 using Tiku.Infrastructure.Persistence;
+using Tiku.Application;
 
 var builder = Host.CreateApplicationBuilder(args);
 var connectionString =
@@ -12,6 +13,7 @@ var connectionString =
     throw new InvalidOperationException(
         "Database connection is required. Configure ConnectionStrings:Database or DATABASE_URL.");
 
+builder.Services.AddApplication();
 builder.Services.AddInfrastructure(connectionString);
 
 using var host = builder.Build();