feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

server/internal/shared/config/config_test.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadPrefersEnvLLMAPIKey(t *testing.T) {
+	t.Setenv("LLM_API_KEY", "env-priority-key")
+
+	configPath := writeTestConfig(t, `
+llm:
+  provider: ark
+  api_key: "config-file-key"
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.LLM.APIKey != "env-priority-key" {
+		t.Fatalf("expected env api key, got %q", cfg.LLM.APIKey)
+	}
+}
+
+func TestLoadFallsBackToConfigLLMAPIKey(t *testing.T) {
+	t.Setenv("LLM_API_KEY", "")
+
+	configPath := writeTestConfig(t, `
+llm:
+  provider: ark
+  api_key: "config-file-key"
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.LLM.APIKey != "config-file-key" {
+		t.Fatalf("expected config api key, got %q", cfg.LLM.APIKey)
+	}
+}
+
+func writeTestConfig(t *testing.T, body string) string {
+	t.Helper()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	return path
+}