feat(core): implement tenant-scoped system store manager

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

shared/lib/SystemStore/InvalidKeyException.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXF\SystemStore;
+
+use InvalidArgumentException;
+
+/**
+ * Raised when a logical system-store key is not safely normalized.
+ */
+final class InvalidKeyException extends InvalidArgumentException
+{
+}

shared/lib/SystemStore/StoreReference.php

@@ -24,8 +24,17 @@ final readonly class StoreReference
             throw new InvalidArgumentException('System-store service cannot be empty');
         }
 
-        if ($this->namespace === '') {
-            throw new InvalidArgumentException('System-store namespace cannot be empty');
+        if (
+            $this->namespace === ''
+            || str_starts_with($this->namespace, '/')
+            || str_ends_with($this->namespace, '/')
+            || str_contains($this->namespace, '\\')
+            || str_contains($this->namespace, "\0")
+            || in_array('', explode('/', $this->namespace), true)
+            || in_array('.', explode('/', $this->namespace), true)
+            || in_array('..', explode('/', $this->namespace), true)
+        ) {
+            throw new InvalidArgumentException('System-store namespace must be a normalized relative key');
         }
     }
 

shared/lib/SystemStore/SystemStoreException.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXF\SystemStore;
+
+use RuntimeException;
+
+/**
+ * Raised when a tenant system store cannot be resolved or trusted.
+ */
+final class SystemStoreException extends RuntimeException
+{
+}