feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

server/internal/shared/config/config.go

@@ -0,0 +1,121 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+type Config struct {
+	Server     ServerConfig     `mapstructure:"server"`
+	Database   DatabaseConfig   `mapstructure:"database"`
+	Redis      RedisConfig      `mapstructure:"redis"`
+	JWT        JWTConfig        `mapstructure:"jwt"`
+	Log        LogConfig        `mapstructure:"log"`
+	LLM        LLMConfig        `mapstructure:"llm"`
+	Generation GenerationConfig `mapstructure:"generation"`
+}
+
+type ServerConfig struct {
+	Port int    `mapstructure:"port"`
+	Mode string `mapstructure:"mode"`
+}
+
+type DatabaseConfig struct {
+	Host         string `mapstructure:"host"`
+	Port         int    `mapstructure:"port"`
+	User         string `mapstructure:"user"`
+	Password     string `mapstructure:"password"`
+	DBName       string `mapstructure:"dbname"`
+	SSLMode      string `mapstructure:"sslmode"`
+	MaxOpenConns int    `mapstructure:"max_open_conns"`
+	MaxIdleConns int    `mapstructure:"max_idle_conns"`
+}
+
+func (d DatabaseConfig) DSN() string {
+	return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s",
+		d.User, d.Password, d.Host, d.Port, d.DBName, d.SSLMode)
+}
+
+type RedisConfig struct {
+	Addr string `mapstructure:"addr"`
+	DB   int    `mapstructure:"db"`
+}
+
+type JWTConfig struct {
+	Secret     string        `mapstructure:"secret"`
+	AccessTTL  time.Duration `mapstructure:"access_ttl"`
+	RefreshTTL time.Duration `mapstructure:"refresh_ttl"`
+}
+
+type LogConfig struct {
+	Level  string `mapstructure:"level"`
+	Format string `mapstructure:"format"`
+}
+
+type LLMConfig struct {
+	Provider        string        `mapstructure:"provider"`
+	APIKey          string        `mapstructure:"api_key"`
+	BaseURL         string        `mapstructure:"base_url"`
+	Model           string        `mapstructure:"model"`
+	Timeout         time.Duration `mapstructure:"timeout"`
+	MaxOutputTokens int64         `mapstructure:"max_output_tokens"`
+	Temperature     float64       `mapstructure:"temperature"`
+}
+
+type GenerationConfig struct {
+	QueueSize         int  `mapstructure:"queue_size"`
+	WorkerConcurrency int  `mapstructure:"worker_concurrency"`
+	StreamEnabled     bool `mapstructure:"stream_enabled"`
+}
+
+func Load(configPath string) (*Config, error) {
+	v := viper.New()
+	v.SetConfigFile(configPath)
+	v.AutomaticEnv()
+	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+
+	if err := v.ReadInConfig(); err != nil {
+		return nil, fmt.Errorf("read config: %w", err)
+	}
+
+	// Allow local overrides
+	v.SetConfigFile(strings.Replace(configPath, ".yaml", ".local.yaml", 1))
+	_ = v.MergeInConfig()
+
+	var cfg Config
+	if err := v.Unmarshal(&cfg); err != nil {
+		return nil, fmt.Errorf("unmarshal config: %w", err)
+	}
+
+	applyEnvOverrides(&cfg)
+
+	return &cfg, nil
+}
+
+func applyEnvOverrides(cfg *Config) {
+	if cfg == nil {
+		return
+	}
+
+	if apiKey, ok := lookupNonEmptyEnv("LLM_API_KEY"); ok {
+		cfg.LLM.APIKey = apiKey
+	}
+}
+
+func lookupNonEmptyEnv(key string) (string, bool) {
+	value, ok := os.LookupEnv(key)
+	if !ok {
+		return "", false
+	}
+
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return "", false
+	}
+
+	return value, true
+}

server/internal/shared/config/config_test.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadPrefersEnvLLMAPIKey(t *testing.T) {
+	t.Setenv("LLM_API_KEY", "env-priority-key")
+
+	configPath := writeTestConfig(t, `
+llm:
+  provider: ark
+  api_key: "config-file-key"
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.LLM.APIKey != "env-priority-key" {
+		t.Fatalf("expected env api key, got %q", cfg.LLM.APIKey)
+	}
+}
+
+func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
+	t.Setenv("LLM_API_KEY", "")
+
+	configPath := writeTestConfig(t, `
+llm:
+  provider: ark
+  api_key: "config-file-key"
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.LLM.APIKey != "config-file-key" {
+		t.Fatalf("expected config api key, got %q", cfg.LLM.APIKey)
+	}
+}
+
+func writeTestConfig(t *testing.T, body string) string {
+	t.Helper()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	return path
+}