Phase 0 scaffold: arcadia-cloud Phoenix service

API-only Phoenix 1.8 project for cloud-ops, inventory, billing, and
provisioning sagas. Validates arcadia JWTs via shared Guardian secret
(verify-only; arcadia-app remains the issuer).

Deps beyond default Phoenix: guardian, cors_plug, oban, req.
Postgres on local port 5433 per arcadia stack convention.
Endpoint runs on :4005.

Endpoints:
- GET /api/health         — public, returns service identifier
- GET /api/v1/inventory   — auth-gated, returns empty list (phase 0 stub)

Oban configured with the queues phase 1+ will need:
provisioning / cloud_sync_fast|full|slow / cloud_billing / metering.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/arcadia_cloud/guardian.ex

@@ -0,0 +1,63 @@
+defmodule ArcadiaCloud.Guardian do
+  @moduledoc """
+  Verify-only Guardian implementation.
+
+  arcadia-cloud never issues tokens — that is arcadia-app's job. We only
+  decode and verify tokens minted by `Arcadia.Guardian`, then expose the
+  claims as a lightweight identity struct.
+
+  Token contract (set by arcadia-app):
+    sub          => "<user_id>:<tenant_id>"
+    tenant_id    => UUID string
+    tenant_slug  => string
+    email        => string
+    roles        => [string]
+  """
+
+  use Guardian, otp_app: :arcadia_cloud
+
+  def subject_for_token(%{"sub" => sub}, _claims) when is_binary(sub), do: {:ok, sub}
+  def subject_for_token(_resource, _claims), do: {:error, :not_token_issuer}
+
+  def resource_from_claims(claims) when is_map(claims) do
+    {user_id, tenant_id_from_sub} = parse_subject(claims["sub"])
+
+    {:ok,
+     %{
+       user_id: user_id,
+       tenant_id: claims["tenant_id"] || tenant_id_from_sub,
+       tenant_slug: claims["tenant_slug"],
+       email: claims["email"],
+       roles: claims["roles"] || []
+     }}
+  end
+
+  def resource_from_claims(_), do: {:error, :invalid_claims}
+
+  @doc """
+  Dev/test helper: mint a JWT using the local secret. Production tokens
+  are minted by arcadia-app.
+  """
+  def mint_dev_token(claims_overrides \\ %{}) do
+    defaults = %{
+      "sub" => "user-dev:tenant-dev",
+      "tenant_id" => "tenant-dev",
+      "tenant_slug" => "dev",
+      "email" => "dev@example.com",
+      "roles" => ["platform_admin"]
+    }
+
+    claims = Map.merge(defaults, claims_overrides)
+    {:ok, token, _claims} = encode_and_sign(claims, claims, token_type: :access)
+    {:ok, token}
+  end
+
+  defp parse_subject(nil), do: {nil, nil}
+
+  defp parse_subject(subject) when is_binary(subject) do
+    case String.split(subject, ":", parts: 2) do
+      [user_id, tenant_id] -> {user_id, tenant_id}
+      [user_id] -> {user_id, nil}
+    end
+  end
+end