feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

server/internal/tenant/transport/auth_handler.go

@@ -0,0 +1,76 @@
+package transport
+
+import (
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/geo-platform/tenant-api/internal/bootstrap"
+	"github.com/geo-platform/tenant-api/internal/shared/auth"
+	"github.com/geo-platform/tenant-api/internal/shared/response"
+	"github.com/geo-platform/tenant-api/internal/tenant/app"
+	"github.com/geo-platform/tenant-api/internal/tenant/repository"
+)
+
+type AuthHandler struct {
+	svc *app.AuthService
+}
+
+func NewAuthHandler(a *bootstrap.App) *AuthHandler {
+	return &AuthHandler{
+		svc: app.NewAuthService(repository.NewAuthRepository(a.DB), a.JWT, a.Sessions),
+	}
+}
+
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req app.LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, response.ErrBadRequest(40001, "invalid_params", err.Error()))
+		return
+	}
+	resp, err := h.svc.Login(c.Request.Context(), req)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+	response.Success(c, resp)
+}
+
+func (h *AuthHandler) Refresh(c *gin.Context) {
+	var req app.RefreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, response.ErrBadRequest(40001, "invalid_params", err.Error()))
+		return
+	}
+	resp, err := h.svc.Refresh(c.Request.Context(), req)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+	response.Success(c, resp)
+}
+
+func (h *AuthHandler) Me(c *gin.Context) {
+	actor, ok := auth.ActorFromCtx(c.Request.Context())
+	if !ok {
+		response.Error(c, response.ErrUnauthorized(40100, "not_authenticated", "not authenticated"))
+		return
+	}
+	resp, err := h.svc.Me(c.Request.Context(), actor)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+	response.Success(c, resp)
+}
+
+func (h *AuthHandler) Logout(c *gin.Context) {
+	header := c.GetHeader("Authorization")
+	parts := strings.SplitN(header, " ", 2)
+	token := ""
+	if len(parts) == 2 {
+		token = parts[1]
+	}
+	_ = h.svc.Logout(c.Request.Context(), token)
+	response.Success(c, nil)
+}