Wire skyai-finance push: cloud invoices flow into Sky AI's books

After InvoiceIngestWorker writes cost lines and matches resources, it
pushes a normalized invoice payload to skyai-finance-svc's new endpoint
POST /api/v1/integrations/cloud/import-invoice. Idempotent — finance
dedups on (tenant_id, source, external_id), so re-runs return "updated"
not duplicate rows.

ArcadiaCloud.Integrations.SkyaiFinance is the HTTP client. Auth is a
short-lived JWT minted via Guardian (shared secret per memory) with
identity {tenant_id: "platform-admin", roles: ["admin"]} — the role
satisfies finance's RequireWriteRole plug. Identity + base URL are
configurable; SKYAI_FINANCE_URL env var can override the default
http://localhost:4010 for arcadia-dev / prod.

GST line detection: lines whose description contains "gst" or "tax"
get summed into amount_tax_minor; everything else into amount_net_minor;
sum stays gross. Phase 1 enough — proper tax handling lands when
real per-tenant invoices flow.

cloud_invoices gains pushed_to_finance_at + finance_invoice_id so we
don't re-push uselessly (Billing.mark_invoice_pushed/2 records both).
A missing finance config (no :skyai_finance app env) makes the push a
silent skip rather than a worker failure — environments without finance
configured still get a working ingest.

Live verified end-to-end against both services:
- April 2026 DO invoice (33 lines, $86.92) lands in finance as a row
  with gross=$86.92, tax=$7.90, source=digitalocean, tenant=platform-admin
- DigitalOcean vendor auto-created (category=cloud) under platform-admin
- Re-running the worker returns action: "updated" not "created";
  finance still has exactly 1 row for the invoice

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config/dev.exs

@@ -27,6 +27,19 @@ config :arcadia_cloud, ArcadiaCloudWeb.Endpoint,
 config :arcadia_cloud, ArcadiaCloud.Guardian,
   secret_key: "DuMkIRN3Qcxk8VqOu8nHj5i7a7a7YgBHF4oXqKwDI4A="
 
+# skyai-finance push — service-to-service identity for cloud invoice push.
+# tenant_id="platform-admin" lands invoices in the platform's own books;
+# role "admin" satisfies finance's RequireWriteRole plug.
+config :arcadia_cloud, :skyai_finance,
+  base_url: System.get_env("SKYAI_FINANCE_URL") || "http://localhost:4010",
+  identity_claims: %{
+    "sub" => "platform-system:platform-admin",
+    "tenant_id" => "platform-admin",
+    "tenant_slug" => "platform-admin",
+    "email" => "platform-system@sky-ai.com",
+    "roles" => ["admin"]
+  }
+
 # ## SSL Support
 #
 # In order to use HTTPS in development, a self-signed