feat: enforce tenant isolation and shared question bank

Tiku.Worker/Worker.cs

@@ -1,16 +1,43 @@
+using Microsoft.Extensions.Options;
+using Tiku.Application.Security;
+using Tiku.Application.Tenancy;
+
 namespace Tiku.Worker;
 
-public class Worker(ILogger<Worker> logger) : BackgroundService
+public class Worker(
+    IServiceScopeFactory scopeFactory,
+    IOptions<DomainLifecycleOptions> options,
+    ILogger<Worker> logger) : BackgroundService
 {
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
         while (!stoppingToken.IsCancellationRequested)
         {
-            if (logger.IsEnabled(LogLevel.Information))
+            try
             {
-                logger.LogInformation("Worker running at: {time}", DateTimeOffset.Now);
+                await using var scope = scopeFactory.CreateAsyncScope();
+                scope.ServiceProvider.GetRequiredService<ITenantContextInitializer>()
+                    .InitializeSystem(null, "Tenant domain DNS and TLS lifecycle worker");
+                var processed = await scope.ServiceProvider
+                    .GetRequiredService<ITenantDomainLifecycleService>()
+                    .ProcessPendingAsync(stoppingToken);
+                if (processed > 0)
+                {
+                    logger.LogInformation("Processed {Count} pending tenant domains.", processed);
+                }
             }
-            await Task.Delay(1000, stoppingToken);
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                break;
+            }
+            catch (Exception exception)
+            {
+                logger.LogError(exception, "Tenant domain lifecycle processing failed.");
+            }
+
+            await Task.Delay(
+                TimeSpan.FromSeconds(Math.Clamp(options.Value.PollSeconds, 10, 3600)),
+                stoppingToken);
         }
     }
 }