Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/modules/gebos-ingester.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.ingester;
+  ingester = pkgs.callPackage ../../ingester { };
+in
+{
+  options.services.gebos.ingester = {
+    enable = lib.mkEnableOption "Gebos MQTT → Postgres ingester";
+    mqttBroker = lib.mkOption {
+      type = lib.types.str;
+      example = "tcp://127.0.0.1:1883";
+    };
+    postgresUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "DSN without password — password comes from EnvironmentFile.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.gebos-ingester = {
+      description = "Gebos MQTT → Postgres ingester";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        GEBOS_MQTT_BROKER = cfg.mqttBroker;
+        GEBOS_POSTGRES_URL = cfg.postgresUrl;
+      };
+
+      serviceConfig = {
+        ExecStart = "${ingester}/bin/gebos-ingester";
+        DynamicUser = true;
+        EnvironmentFile = "/etc/gebos/secrets.env";  # GEBOS_POSTGRES_PASSWORD
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+  };
+}