Phoenix controller that serves RFC 9728 protected-resource metadata.

Routes mounted by AttestoMCP.Router.attesto_mcp_protected_resource_metadata/2 dispatch here. The controller reads the resource path and metadata options placed in conn.private by the route, builds the document with AttestoMCP.Metadata.protected_resource/3 (deriving the resource identifier and default authorization_servers from the live request origin), and renders it as JSON.

Because the resource identifier is derived from the same request origin that AttestoMCP.Plug.ProtectResource uses for its WWW-Authenticate resource_metadata challenge, the discovered metadata URL and the served resource value always match.

The controller compiles only when Phoenix is available; Plug-only consumers do not pull it in.