Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

ingester/main.go

@@ -0,0 +1,41 @@
+// Package main — Gebos MQTT → Postgres ingester.
+//
+// Skeleton. Target: < 200 lines.
+//
+// Subscribes to topics of the form `t/<tenant_id>/d/<device_id>/<metric>`,
+// extracts tenant_id and device_id from the topic, writes rows into
+// public.telemetry on db-host as the gebos_ingest role (BYPASSRLS).
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+func main() {
+	broker := os.Getenv("GEBOS_MQTT_BROKER")
+	pgURL := os.Getenv("GEBOS_POSTGRES_URL")
+	pgPassword := os.Getenv("GEBOS_POSTGRES_PASSWORD")
+
+	if broker == "" || pgURL == "" || pgPassword == "" {
+		log.Fatal("GEBOS_MQTT_BROKER, GEBOS_POSTGRES_URL and GEBOS_POSTGRES_PASSWORD must be set")
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	// TODO:
+	//   1. pgxpool.New with password injected into the DSN
+	//   2. paho MQTT client.Connect, Subscribe("t/+/d/+/+")
+	//   3. on message: parse topic → (tenant_id, device_id, metric), parse
+	//      payload (JSON for now), INSERT INTO public.telemetry
+	//   4. batch with a short flush interval (50–100ms) for throughput
+	//   5. shutdown on ctx.Done
+
+	log.Printf("gebos-ingester: broker=%s db=<redacted> (stub)", broker)
+	<-ctx.Done()
+	log.Println("gebos-ingester: shutting down")
+}