Add Swift team invitations with atomic membership acceptance

.github/workflows/team-invitations.yml

@@ -0,0 +1,38 @@
+name: Team Invitations
+on:
+  pull_request:
+    paths: ['applications/team-invitations/**', '.github/workflows/team-invitations.yml']
+  push:
+    paths: ['applications/team-invitations/**', '.github/workflows/team-invitations.yml']
+permissions:
+  contents: read
+jobs:
+  swift:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: applications/team-invitations
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install stable native Swift 6.4.0
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y binutils gnupg2 libc6-dev libcurl4-openssl-dev libedit2 libgcc-13-dev libncurses-dev libpython3-dev libsqlite3-0 libstdc++-13-dev libxml2-dev libz3-dev pkg-config tzdata zip unzip zlib1g-dev
+          url=https://download.swift.org/swift-6.4.0-release/ubuntu2404-aarch64/swift-6.4.0-RELEASE/swift-6.4.0-RELEASE-ubuntu24.04-aarch64.tar.gz
+          curl -fsSL --compressed --max-time 600 "$url" -o "$RUNNER_TEMP/swift.tar.gz"
+          curl -fsSL --compressed --max-time 60 "$url.sig" -o "$RUNNER_TEMP/swift.tar.gz.sig"
+          curl -fsSL --compressed --max-time 60 https://www.swift.org/keys/all-keys.asc -o "$RUNNER_TEMP/swift-keys.asc"
+          gpg --import "$RUNNER_TEMP/swift-keys.asc"
+          gpg --verify "$RUNNER_TEMP/swift.tar.gz.sig" "$RUNNER_TEMP/swift.tar.gz"
+          tar -xzf "$RUNNER_TEMP/swift.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/swift-6.4.0-RELEASE-ubuntu24.04-aarch64/usr/bin" >> "$GITHUB_PATH"
+      - name: Resolve pinned stable packages
+        run: |
+          swift --version
+          swift package resolve
+          git diff --exit-code -- Package.resolved
+      - name: Build and test without Cloud credentials
+        run: |
+          swift build --jobs 2
+          swift test --jobs 2

applications/team-invitations/.env.example

@@ -0,0 +1,9 @@
+PGHOST=your-managed-postgres-host
+PGPORT=5432
+PGDATABASE=postgres
+PGUSER=invites_app
+PGPASSWORD=replace-with-runtime-role-password
+PGSSLROOTCERT=/absolute/path/to/postgres-ca.pem
+PORT=3000
+# JSON maps existing seeded user UUIDs to distinct 32–256 character bearer credentials.
+USER_TOKENS='{"00000000-0000-4000-8000-000000000001":"replace_with_32_or_more_random_characters"}'

applications/team-invitations/.gitignore

@@ -0,0 +1,6 @@
+.build/
+.swiftpm/
+.deployment/
+.env
+*.log
+__pycache__/

applications/team-invitations/.swift-version

@@ -0,0 +1 @@
+6.4.0