fix: harden tenant auth and quality gates

api/src/certification/certification.controller.ts

@@ -1,8 +1,10 @@
-import { Body, Controller, Get, Param, Post, Query } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Query, UsePipes } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import { CurrentSessionUserId } from '../auth/current-session-user.decorator';
-import { TenantId } from '../common/tenant-id.decorator';
-import { CertificationService, ReviewCertificationDto, SubmitCertificationDto } from './certification.service';
+import { CurrentTenantId } from '../auth/current-tenant-id.decorator';
+import { ClientCertificationSubmissionDto } from '../common/client-write.dto';
+import { strictValidationPipe } from '../common/strict-validation.pipe';
+import { CertificationService, ReviewCertificationDto } from './certification.service';
 
 @ApiTags('client-certification')
 @Controller('client/enterprise-certification')
@@ -10,13 +12,14 @@ export class ClientCertificationController {
   constructor(private readonly certifications: CertificationService) {}
 
   @Get()
-  list(@TenantId() tenantId?: string) {
+  list(@CurrentTenantId() tenantId: string) {
     return this.certifications.list(tenantId);
   }
 
   @Post()
-  submit(@Body() body: SubmitCertificationDto) {
-    return this.certifications.submit(body);
+  @UsePipes(strictValidationPipe)
+  submit(@CurrentTenantId() tenantId: string, @Body() body: ClientCertificationSubmissionDto) {
+    return this.certifications.submit({ ...body, tenantId });
   }
 }