feat(security): add distributed authorization foundation

Tiku.IntegrationTests/Api/ProductionConfigurationTests.cs

@@ -85,4 +85,24 @@ public sealed class ProductionConfigurationTests
             MasterKey = Convert.ToBase64String(new byte[32])
         }));
     }
+
+    [Fact]
+    public void Production_network_configuration_requires_formal_hosts_allowed_hosts_and_proxy()
+    {
+        var developmentDefaults = new TenantResolutionOptions();
+        var wildcard = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["AllowedHosts"] = "*" })
+            .Build();
+        Assert.False(OptionsValidation.BeValidTenantResolutionOptions(developmentDefaults, wildcard, true));
+
+        var production = new TenantResolutionOptions
+        {
+            PlatformHosts = ["admin.example.com"],
+            TrustedProxyAddresses = ["10.0.0.10"]
+        };
+        var explicitHosts = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["AllowedHosts"] = "admin.example.com;api.example.com" })
+            .Build();
+        Assert.True(OptionsValidation.BeValidTenantResolutionOptions(production, explicitHosts, true));
+    }
 }