Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/modules/gebos-postgres.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.postgres;
+in
+{
+  options.services.gebos.postgres = {
+    enable = lib.mkEnableOption "Gebos Postgres 17 + TimescaleDB";
+    listenAddresses = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "127.0.0.1" ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_17;
+      enableTCPIP = true;
+      settings = {
+        listen_addresses = lib.concatStringsSep "," cfg.listenAddresses;
+        shared_preload_libraries = "timescaledb,pg_stat_statements";
+      };
+      extensions = ps: with ps; [
+        timescaledb
+        pgjwt
+        pg_graphql
+        pgsodium
+        # supabase_vault — TODO: package or vendor
+      ];
+      # Init script creates Supabase's `auth`, `storage`, `_analytics`, `_supavisor`
+      # schemas, the gebos_ingest role (BYPASSRLS), and telemetry hypertables.
+      initialScript = ../supabase/init.sql;
+    };
+  };
+}