feat: harden SaaS authentication and authorization

Tiku.Application/Backoffice/BackofficeModels.cs

@@ -1,15 +1,43 @@
 using System.Text.Json;
+using Tiku.Application.Security;
 using Tiku.Domain.Operations;
 
 namespace Tiku.Application.Backoffice;
 
-public sealed record BackofficeActor(Guid UserId, Guid? TenantId, bool IsPlatform);
+public sealed record BackofficeActor(Guid UserId, Guid? TenantId, bool IsPlatform)
+{
+    public static BackofficeActor FromTenantAccess(CurrentAccessSnapshot access)
+    {
+        if (access.UserId is not { } userId ||
+            access.TenantId is not { } tenantId ||
+            !access.IsCurrentTenantMember)
+        {
+            throw new InvalidOperationException("Tenant backoffice actor was not resolved.");
+        }
+
+        return new BackofficeActor(userId, tenantId, false);
+    }
+
+    public static BackofficeActor FromPlatformAccess(CurrentAccessSnapshot access)
+    {
+        if (access.UserId is not { } userId || !access.IsUserActive)
+        {
+            throw new InvalidOperationException("Platform backoffice actor was not resolved.");
+        }
+
+        return new BackofficeActor(userId, null, true);
+    }
+}
 
 public sealed record BackofficeBootstrap(
     IReadOnlyCollection<BackofficePermissionItem> Permissions,
     IReadOnlyCollection<BackofficeMenuItem> Menus,
     IReadOnlyCollection<BackofficeRoleItem> Roles);
 
+public sealed record BackofficeUiBootstrap(
+    IReadOnlyCollection<string> PermissionCodes,
+    IReadOnlyCollection<BackofficeMenuItem> Menus);
+
 public sealed record BackofficePermissionItem(
     Guid Id,
     string Code,