# TASK 3.1: Resolve enabled source services and extend bootstrap requests

## Summary

Extend provisioning logic so it resolves the enabled source-service set for a customer and passes that set into tenant bootstrap requests.

This task removes the current hardcoded single-source provisioning decision and introduces the bootstrap request model needed for selective staging.

## Dependencies

- [TASK 1.1](./TASK1.1.md) - Define split admin flow and credential-trigger boundaries
- [TASK 2.1](./TASK2.1.md) - Add background provisioning job and enqueue it from credential create and update

## Files to Modify

Expected implementation touch points:

- `backend/Kds.Ai.ApiService/Services/CustomerEtlProvisioningService.cs`
- `backend/Kds.Ai.Warehouse/Models/TenantWarehouseBootstrapRequest.cs`
- `backend/Kds.Ai.Data/Entities/CustomerCredentialEntry.cs` consumers as needed
- related tests under `backend/tests/Kds.Ai.ApiService.Tests/`

## Required Behavior

- Resolve enabled source services from current customer credentials.
- Use `CustomerCredentialEntry.Service` as the source selector.
- Read protected credential payload only when service-specific runtime flags such as `Enabled` must be evaluated.
- Extend `TenantWarehouseBootstrapRequest` so it can carry the enabled service set.
- Keep the implementation extensible for future services even though the current concrete service is `BrinkPos`.

## Acceptance Criteria

- [ ] Provisioning resolves enabled services from current credentials
- [ ] `CustomerCredentialEntry.Service` is the bootstrap routing selector
- [ ] Bootstrap request carries enabled service information
- [ ] The design remains extensible for future services

## Notes

- Do not teach bootstrap routing to inspect opaque protected payloads for source identity.
- This task defines the request model and service-resolution logic, not the SQL loader changes.