Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/hosts/db-host.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.hostName = "db-host";
+
+  # Skeleton: real hardware-configuration.nix + boot/fs lives next to this file
+  # once we have the actual box. Marked here so the structure is visible.
+  # imports = [ ./db-host.hardware.nix ];
+
+  services.gebos.postgres = {
+    enable = true;
+    listenAddresses = [ "0.0.0.0" ];
+    # Telemetry, auth, _supavisor, _analytics live in the same cluster.
+    # See nix/supabase/init.sql for schema/role bootstrap.
+  };
+
+  # Postgres exposed only to the app-host and mqtt-ingest private addresses.
+  networking.firewall.extraInputRules = ''
+    ip saddr { 10.0.0.0/8 } tcp dport 5432 accept
+  '';
+}