Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/modules/gebos-caddy.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.caddy;
+
+  siteBlock = host: site:
+    if site ? staticRoot then ''
+      ${host} {
+        root * ${site.staticRoot}
+        file_server
+        try_files {path} /index.html
+        encode zstd gzip
+      }
+    ''
+    else if site ? upstream then ''
+      ${host} {
+        reverse_proxy ${site.upstream}
+        encode zstd gzip
+      }
+    ''
+    else if site ? tcpProxy then ''
+      ${host}:8883 {
+        # TLS termination for MQTT — Caddy's `layer4` app would be ideal here;
+        # for now, document that the upstream HiveMQ port is ${site.tcpProxy}.
+        # TODO: switch to the caddy-l4 module or terminate TLS in HiveMQ directly.
+      }
+    ''
+    else throw "site `${host}` needs one of: staticRoot, upstream, tcpProxy";
+in
+{
+  options.services.gebos.caddy = {
+    enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
+    sites = lib.mkOption {
+      type = lib.types.attrsOf lib.types.attrs;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.caddy = {
+      enable = true;
+      email = "ops@ge-bos.de";  # TODO: confirm ACME contact
+      extraConfig = lib.concatStringsSep "\n"
+        (lib.mapAttrsToList siteBlock cfg.sites);
+    };
+  };
+}