feat(security): add distributed authorization foundation

Tiku.Application/Auth/AuthExceptions.cs

@@ -20,5 +20,8 @@ public sealed class SmsRateLimitedException()
 public sealed class AuthProviderNotConfiguredException(string provider)
     : AuthException("auth_provider_not_configured", $"The {provider} auth provider is not configured.");
 
+public sealed class AuthSecurityUnavailableException()
+    : AuthException("auth_security_unavailable", "Authentication security services are unavailable.");
+
 public sealed class InvalidAuthChallengeException(string code = "invalid_auth_challenge")
     : AuthException(code, "The authentication challenge is invalid, consumed, or expired.");

Tiku.Application/Security/ICapabilityAccessEvaluator.cs

@@ -0,0 +1,21 @@
+namespace Tiku.Application.Security;
+
+public enum CapabilityOperation
+{
+    Read,
+    Write
+}
+
+public interface ICapabilityAccessEvaluator
+{
+    Task<bool> IsAllowedAsync(
+        Guid tenantId,
+        string moduleCode,
+        CapabilityOperation operation,
+        CancellationToken cancellationToken = default);
+
+    Task<IReadOnlySet<string>> GetEnabledModulesAsync(
+        Guid tenantId,
+        CapabilityOperation operation = CapabilityOperation.Read,
+        CancellationToken cancellationToken = default);
+}

Tiku.Application/Security/IRedisSecurityStore.cs

@@ -0,0 +1,23 @@
+namespace Tiku.Application.Security;
+
+public sealed record DistributedRateLimitBucket(string Key, int PermitLimit, TimeSpan Window);
+
+public sealed record DistributedRateLimitResult(bool Allowed, TimeSpan? RetryAfter = null);
+
+public interface IRedisSecurityStore
+{
+    bool IsConfigured { get; }
+
+    Task<DistributedRateLimitResult> ConsumeAsync(
+        IReadOnlyCollection<DistributedRateLimitBucket> buckets,
+        CancellationToken cancellationToken = default);
+
+    Task<bool> PingAsync(CancellationToken cancellationToken = default);
+
+    Task SetInvalidationVersionAsync(
+        string realm,
+        Guid? tenantId,
+        Guid? userId,
+        long version,
+        CancellationToken cancellationToken = default);
+}

Tiku.Application/Security/ITenantExecutionScope.cs

@@ -1,16 +1,31 @@
 namespace Tiku.Application.Security;
 
+public enum SystemScopeCallerType
+{
+    Platform,
+    Worker,
+    Migrator,
+    PublicQuestionBank,
+    Test
+}
+
+public sealed record SystemScopeRequest(
+    Guid? TargetTenantId,
+    SystemScopeCallerType CallerType,
+    string Caller,
+    string Reason,
+    string CorrelationId);
+
 public interface ITenantExecutionScope
 {
     Task ExecuteAsync(
-        Guid? targetTenantId,
-        string reason,
+        SystemScopeRequest request,
         Func<IServiceProvider, CancellationToken, Task> operation,
         CancellationToken cancellationToken = default);
 
     Task<TResult> ExecuteAsync<TResult>(
-        Guid? targetTenantId,
-        string reason,
+        SystemScopeRequest request,
         Func<IServiceProvider, CancellationToken, Task<TResult>> operation,
         CancellationToken cancellationToken = default);
+
 }