feat: enforce tenant isolation and shared question bank

Tiku.IntegrationTests/Api/ReferralEndpointTests.cs

@@ -114,7 +114,7 @@ public sealed class ReferralEndpointTests
         Assert.Equal($"ref={qrcodeItem.RefCode}", qrcodeGenerator.LastRequest.Scene);
         Assert.Equal("fake-referral-qrcode-generator", qrcodeItem.Metadata.GetProperty("generatedBy").GetString());
 
-        using var scope = factory.Services.CreateScope();
+        using var scope = factory.CreateSystemScope();
         var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
         Assert.Contains(dbContext.ReferralLeads, item =>
             item.TenantId == seed.TenantId &&
@@ -294,7 +294,7 @@ public sealed class ReferralEndpointTests
             "/api/auth/login/password",
             new PasswordLoginDto
             {
-                TenantId = seed.TenantId,
+                TenantCode = seed.TenantId.ToString("N"),
                 Phone = seed.Phone,
                 Password = "passw0rd!"
             });