Bootstrap EDEN: Fase 0 (arquitetura) e Fase 1 (monorepo + infra)

Fase 0 — descoberta e arquitetura:
- Inventário do projeto, glossário de domínio, arquitetura com bounded
  contexts e topologia de containers, threat model inicial.
- 12 ADRs cobrindo modular monolith, topologia de containers (Postgres
  isolado + eden-core/parceiros/assinante em containers e portas
  distintos), auth/sessões, modelo de permissões, criptografia/segredos,
  contrato first-class, stock ledger, separação billing/finance/fiscal,
  outbox transacional, adapters SaperX e Focus NFe, e identidade
  compartilhada entre as 3 apps.
- 14 subagentes e 7 skills especializados por domínio em .claude/.
- Hooks de segurança (PreToolUse/PostToolUse/Stop) testados via pipe.

Fase 1 — plataforma (em andamento):
- Monorepo pnpm workspaces + Turborepo: apps/{api,worker,core-web,
  reseller-web,subscriber-web} + 9 packages compartilhados.
- apps/api: NestJS mínimo com /health/live e /health/ready (checando
  Postgres real via @eden/database).
- 3 frontends Vite + React + TypeScript + Tailwind, com o favicon
  oficial do EDEN.
- packages/database: migration baseline (node-pg-migrate) criando
  roles/role_permissions/applications/users/user_applications/sessions/
  audit_log — audit log append-only com hash-chain, testado ao vivo
  (UPDATE/DELETE bloqueados pelo trigger).
- compose.yaml implementando a topologia da ADR-0002, validada de ponta
  a ponta: os 6 containers sobem e ficam saudáveis com um único
  `docker compose up`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

compose.yaml

@@ -0,0 +1,155 @@
+# EDEN — topologia de containers (docs/adr/0002-container-topology.md)
+#
+# Postgres isolado, credencial de banco só no serviço eden-api. Cada uma das
+# 3 aplicações web em container e porta próprios, falando só com a API via
+# HTTP — nunca direto com o banco. Rodar a partir da raiz do repositório:
+#
+#   docker compose --env-file .env up -d
+#
+name: eden
+
+services:
+  eden-postgres:
+    image: postgres:18-alpine
+    container_name: eden-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${EDEN_DATABASE_NAME:-eden}
+      POSTGRES_USER: ${EDEN_DATABASE_USER:-eden}
+      POSTGRES_PASSWORD: ${EDEN_DATABASE_PASSWORD:?defina EDEN_DATABASE_PASSWORD no .env}
+    volumes:
+      # Postgres 18's official image switched to a pg_ctlcluster-style layout:
+      # mount the parent dir, not .../data — see
+      # https://github.com/docker-library/postgres/pull/1259
+      - eden_pgdata:/var/lib/postgresql
+    # Mapeado ao host só para acesso de ferramenta local em desenvolvimento,
+    # numa porta alta não-padrão — nunca 5432:5432, nunca exposto em produção
+    # (ver docs/adr/0002-container-topology.md). Remover este bloco em prod.
+    ports:
+      - "${EDEN_POSTGRES_DEV_PORT:-55432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${EDEN_DATABASE_USER:-eden} -d ${EDEN_DATABASE_NAME:-eden}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    networks: [eden_net]
+
+  eden-api:
+    build:
+      context: .
+      dockerfile: infra/docker/Dockerfile.node
+      args:
+        APP_NAME: api
+    container_name: eden-api
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgres://${EDEN_DATABASE_USER:-eden}:${EDEN_DATABASE_PASSWORD}@eden-postgres:5432/${EDEN_DATABASE_NAME:-eden}
+      EDEN_API_PORT: ${EDEN_API_PORT:-8080}
+      JWT_SIGNING_SECRET: ${JWT_SIGNING_SECRET}
+      SIGNATURE_OTP_SECRET: ${SIGNATURE_OTP_SECRET}
+      EDEN_FIELD_ENCRYPTION_KEY: ${EDEN_FIELD_ENCRYPTION_KEY}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT}
+      SMTP_USER: ${SMTP_USER}
+      SMTP_PASS: ${SMTP_PASS}
+      SMTP_FROM: ${SMTP_FROM}
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_REGION: ${S3_REGION}
+      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
+      S3_BUCKET: ${S3_BUCKET}
+      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL}
+    ports:
+      - "${EDEN_API_PORT:-8080}:${EDEN_API_PORT:-8080}"
+    depends_on:
+      eden-postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://localhost:'+ (process.env.EDEN_API_PORT||8080) +'/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks: [eden_net]
+
+  eden-worker:
+    build:
+      context: .
+      dockerfile: infra/docker/Dockerfile.node
+      args:
+        APP_NAME: worker
+    container_name: eden-worker
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgres://${EDEN_DATABASE_USER:-eden}:${EDEN_DATABASE_PASSWORD}@eden-postgres:5432/${EDEN_DATABASE_NAME:-eden}
+    depends_on:
+      eden-postgres:
+        condition: service_healthy
+    networks: [eden_net]
+
+  eden-core:
+    build:
+      context: .
+      dockerfile: infra/docker/Dockerfile.web
+      args:
+        APP_NAME: core-web
+    container_name: eden-core
+    restart: unless-stopped
+    ports:
+      - "${EDEN_CORE_PORT:-3001}:80"
+    depends_on:
+      eden-api:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks: [eden_net]
+
+  eden-parceiros:
+    build:
+      context: .
+      dockerfile: infra/docker/Dockerfile.web
+      args:
+        APP_NAME: reseller-web
+    container_name: eden-parceiros
+    restart: unless-stopped
+    ports:
+      - "${EDEN_PARCEIROS_PORT:-3002}:80"
+    depends_on:
+      eden-api:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks: [eden_net]
+
+  eden-assinante:
+    build:
+      context: .
+      dockerfile: infra/docker/Dockerfile.web
+      args:
+        APP_NAME: subscriber-web
+    container_name: eden-assinante
+    restart: unless-stopped
+    ports:
+      - "${EDEN_ASSINANTE_PORT:-3003}:80"
+    depends_on:
+      eden-api:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks: [eden_net]
+
+networks:
+  eden_net:
+    driver: bridge
+
+volumes:
+  eden_pgdata: