feat: enforce tenant isolation and shared question bank

Tiku.IntegrationTests/Api/CrmEndpointTests.cs

@@ -55,7 +55,7 @@ public sealed class CrmEndpointTests
         Assert.Equal("tenant_secrets:crm:webhook:default", config!.SecretRef);
         Assert.Equal("RoundRobin", config.AssignmentMode);
 
-        using var scope = factory.Services.CreateScope();
+        using var scope = factory.CreateSystemScope();
         var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
         Assert.Contains(dbContext.TenantSecrets, item =>
             item.TenantId == seed.TenantId &&
@@ -146,7 +146,7 @@ public sealed class CrmEndpointTests
             "/api/auth/login/password",
             new PasswordLoginDto
             {
-                TenantId = seed.TenantId,
+                TenantCode = seed.TenantId.ToString("N"),
                 Phone = seed.Phone,
                 Password = "passw0rd!"
             });