# TASK 1.1: Add Runtime Tenant Resolver and Configuration

## Summary

Add the runtime tenant configuration and resolver needed by single-store Redshift reads.

This task creates the temporary default-tenant shortcut for current local/dev and single-store runtime flows.

It does not implement authenticated user-to-tenant access or store-group RBAC.

## Dependencies

- Redshift Foundation slice complete

## Files to Create

### 1. Runtime tenant options

Create an options/settings model equivalent to:

- `WarehouseRuntimeOptions`
- `WarehouseRuntimeSettings`

Minimum logical field:

- `DefaultTenantId`

Optional fields:

- strict/default tenant enabled flag,
- future request override flag,
- diagnostic labels for local/dev use.

### 2. Runtime tenant resolver abstraction

Create an abstraction equivalent to:

- `IRuntimeTenantResolver`
- `IDefaultTenantResolver`

The resolver should return exactly one tenant for this slice.

## Files to Modify

### 3. DI/configuration registration

Register the options and resolver in the modules that will consume runtime warehouse reads.

Likely consumers:

- `backend/Kds.Ai.AnomalyDetector`
- `backend/Kds.Ai.ApiService`
- `backend/Kds.Ai.Cli`

## Required Behavior

The resolver must:

- return an explicit tenant id when provided by a dev/CLI/request context if that path is implemented,
- otherwise return the configured default tenant id,
- fail clearly when no tenant id can be resolved,
- stay independent from authenticated RBAC,
- not return multiple tenants.

## Status

Completed.

Implemented in:

- `backend/Kds.Ai.Warehouse/Configuration/WarehouseRuntimeOptions.cs`
- `backend/Kds.Ai.Warehouse/Abstractions/IRuntimeTenantResolver.cs`
- `backend/Kds.Ai.Warehouse/Services/DefaultRuntimeTenantResolver.cs`
- `backend/Kds.Ai.Warehouse/DependencyInjectionExtensions.cs`
- `backend/Kds.Ai.AppHost/AppHost.cs`

## Acceptance Criteria

- [x] Runtime tenant options exist
- [x] Default tenant id can be configured
- [x] Runtime tenant resolver abstraction exists
- [x] Resolver returns one tenant id
- [x] Resolver fails clearly when no tenant id is available
- [x] Resolver does not implement full RBAC or store groups
- [x] DI/configuration wiring exists for runtime consumers
- [x] Solution builds without errors

## Notes

- The default tenant shortcut must be obvious in naming/configuration.
- Do not hide this as production-ready RBAC.
- The future authenticated tenant resolver should be able to replace this without changing data access tools deeply.