Reference tenant-scoped resource (global-tenancy S2 · FR-5). Both routes are gated by
TenantIsolationGuard (fail-closed: no active tenant → 403) and read/write exclusively
through the tenant-scoped repository — the handler never names a tenant id. This is the
template future business features copy, so the isolation boundary is idiomatic, not bolted on.
posts 租户级参考资源的 HTTP 控制器（多租户 S2 · FR-5 样板）。
Remarks
Reference tenant-scoped resource (global-tenancy S2 · FR-5). Both routes are gated by
TenantIsolationGuard(fail-closed: no active tenant → 403) and read/write exclusively through the tenant-scoped repository — the handler never names a tenant id. This is the template future business features copy, so the isolation boundary is idiomatic, not bolted on.