Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

.gitea/workflows/check.yml

@@ -0,0 +1,13 @@
+name: check
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  flake-check:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix flake check
+      - run: nix build .#ingester .#frontend

.gitea/workflows/deploy.yml

@@ -0,0 +1,31 @@
+name: deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup deploy SSH key
+        run: |
+          mkdir -p ~/.ssh
+          install -m 600 /dev/stdin ~/.ssh/id_ed25519 <<< "${{ secrets.DEPLOY_SSH_KEY }}"
+          ssh-keyscan -H db-host.gebos.internal app-host.gebos.internal ingest.ge-bos.de >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Build all closures
+        run: nix flake check --no-build
+
+      # Order matters: db schema migrations are part of db-host's activation,
+      # so it must land first. App-host's Supabase compose stack expects the
+      # schemas to exist. mqtt-ingest only needs the network paths to db-host.
+      - name: Deploy db-host
+        run: nix run github:serokell/deploy-rs -- .#db-host --skip-checks
+
+      - name: Deploy app-host
+        run: nix run github:serokell/deploy-rs -- .#app-host --skip-checks
+
+      - name: Deploy mqtt-ingest
+        run: nix run github:serokell/deploy-rs -- .#mqtt-ingest --skip-checks