Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/supabase/README.md

@@ -0,0 +1,40 @@
+# Supabase compose stack
+
+Vendored from the official Supabase self-hosting bundle, with two deliberate
+changes:
+
+1. The bundled `db` service is removed. Every service that talks to Postgres
+   reads `POSTGRES_HOST` / `POSTGRES_PORT` from the environment and connects to
+   the external `db-host`. The systemd unit (`nix/modules/gebos-supabase.nix`)
+   injects these from `/etc/gebos/secrets.env`.
+
+2. Studio is bound to `127.0.0.1` only. There is **no public route** to it.
+   To use it from your laptop:
+
+   ```
+   ssh -L 3000:127.0.0.1:3000 app-host
+   open http://localhost:3000
+   ```
+
+   This is intentional — Studio runs with the `service_role` JWT and bypasses
+   RLS. Putting it on the public internet behind only HTTP basic auth (the
+   default) is too thin.
+
+## What's in here
+
+- `docker-compose.yml` — the stack itself
+- `init.sql` — schemas, roles, and extensions Postgres needs before the
+  compose services come up. Loaded by `nix/modules/gebos-postgres.nix`.
+- `kong.yml` — Kong's declarative routing (to be vendored alongside the compose
+  file when we copy it in).
+
+## Updating the vendored compose
+
+When upstream Supabase ships a new compose layout, re-vendor by:
+
+1. Copy upstream `docker/docker-compose.yml` over `docker-compose.yml`.
+2. Remove the `db:` service block.
+3. Replace every `db:5432` / `postgres:5432` reference with
+   `${POSTGRES_HOST}:${POSTGRES_PORT}`.
+4. Bind Studio to `${STUDIO_BIND}:3000` instead of `0.0.0.0:3000`.
+5. Commit, deploy, smoke-test through the SSH tunnel.