# TASK 3.1: Add backend customer, API key, and document management endpoints

## Summary

Expose the backend API surface required for Laravel to stop reading and writing local database state.

## Dependencies

- TASK 2.1 complete
- TASK 2.2 complete
- TASK 2.3 complete

## Files to Modify

Likely files:

- `backend/Kds.Ai.ApiService/Program.cs`
- new endpoint files under `backend/Kds.Ai.ApiService/Endpoints`
- corresponding repositories/services in `backend/Kds.Ai.Data`

## Required Behavior

The backend must expose authenticated endpoints for:

- customer list/get/create/update/delete,
- customer API key list/create/update/delete,
- document list/get/remove and any metadata needed by the portal.

These endpoints should enforce role and tenant scope appropriately.

## Acceptance Criteria

- [ ] Customer management endpoints exist
- [ ] Customer API key management endpoints exist
- [ ] Document listing and management endpoints exist
- [ ] Endpoints are protected by backend auth/authorization
- [ ] Tenant-scoped users cannot access another tenant's records
- [ ] Admin behavior is clearly separated from tenant-scoped user behavior

## Notes

- Keep contracts aligned with current UI needs to minimize BFF churn.
- Prefer adding targeted endpoints instead of generic over-broad admin surfaces.