# TASK 1.2: Add backend authentication, authorization, and tenant resolution

## Summary

Implement secure backend authentication and tenant scoping that replaces the current unauthenticated `X-Tenant-Id` request pattern.

## Dependencies

- TASK 1.1 complete

## Files to Modify

### 1. Backend authentication and authorization wiring

Likely files:

- `backend/Kds.Ai.ApiService/Program.cs`
- new auth/authorization support classes under `backend/Kds.Ai.ApiService`

### 2. Tenant resolution pipeline

Likely files:

- `backend/Kds.Ai.ApiService/Tenancy/TenantMiddleware.cs`
- new tenant resolution abstractions and services under `backend/Kds.Ai.ApiService` or `backend/Kds.Ai.Data`

## Required Behavior

The backend must:

- validate authenticated requests against Keycloak-backed identity,
- reject unauthenticated requests for protected application APIs,
- derive caller roles from trusted identity information,
- derive tenant scope from verified identity or backend membership lookup,
- stop trusting arbitrary `X-Tenant-Id` for authorization,
- expose the resolved tenant context to data access code.

Development-only shortcuts, if any, must be explicit and isolated from production behavior.

## Acceptance Criteria

- [ ] Backend authentication is configured
- [ ] Backend authorization is configured for protected APIs
- [ ] Tenant resolution no longer relies on an arbitrary caller-provided tenant header
- [ ] Tenant scope is available to `KdsAiDbContext` and protected endpoints
- [ ] Requests with missing or invalid identity are rejected
- [ ] Requests cannot access another tenant by spoofing a header value

## Notes

- This task is a security boundary task, not a cosmetic refactor.
- Minimize fallback modes. If local development needs a bypass, make it obvious and environment-scoped.