feat: enforce tenant isolation and shared question bank

Tiku.IntegrationTests/Api/AssetAccessEndpointTests.cs

@@ -33,7 +33,7 @@ public sealed class AssetAccessEndpointTests
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);
         Assert.Equal("https://storage.example.test/download.pdf", body.RootElement.GetProperty("url").GetProperty("url").GetString());
 
-        using var scope = factory.Services.CreateScope();
+        using var scope = factory.CreateSystemScope();
         var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
         Assert.Equal(1, dbContext.ContentAssets.Single(asset => asset.Id == assetId).DownloadCount);
         Assert.Contains(dbContext.ContentAssetAccessEvents, item =>
@@ -251,7 +251,7 @@ public sealed class AssetAccessEndpointTests
             "/api/auth/login/password",
             new PasswordLoginDto
             {
-                TenantId = seed.TenantId,
+                TenantCode = seed.TenantId.ToString("N"),
                 Phone = seed.Phone,
                 Password = "passw0rd!"
             });