Fase 0: scaffold monorepo, SvelteKit skeleton, and dev infrastructure

- Turborepo + pnpm workspaces with apps/web and packages/types
- SvelteKit app: Tailwind, Paraglide i18n (en/es), keycloak-js, Supabase client,
  auth/collective stores, PWA service worker skeleton, all route placeholders
- packages/types: domain types (User, Collective, ShoppingList, etc.) and
  database.ts placeholder for generated types
- Justfile with dev, db-*, kc-*, build, backup, restore, deploy recipes
- infra/docker-compose.dev.yml: Postgres 15, GoTrue, PostgREST, Realtime v2.83,
  Storage, Kong (port 8001), Studio, Keycloak 24
- infra/docker-compose.prod.yml, kong.yml, db-init scripts, backup/deploy scripts
- keycloak/realm-export.json with colectivo realm and 5 dev test users
- supabase/config.toml and seed.sql with sample collective and items
- GitHub Actions: ci.yml (lint+typecheck+build) and deploy.yml (GHCR + SSH)
- .env.example documenting all required variables
- Fixed docker-compose issues: Studio image tag, Kong port conflict (8001),
  internal role passwords init script, Realtime METRICS_JWT_SECRET/APP_NAME

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/lib/auth.ts

@@ -0,0 +1,78 @@
+import Keycloak from 'keycloak-js';
+import { browser } from '$app/environment';
+import { PUBLIC_KEYCLOAK_URL, PUBLIC_KEYCLOAK_REALM, PUBLIC_KEYCLOAK_CLIENT_ID } from '$env/static/public';
+
+export interface KeycloakUser {
+	id: string;
+	email: string;
+	displayName: string;
+	preferredUsername: string;
+}
+
+let keycloak: Keycloak | null = null;
+
+export function getKeycloak(): Keycloak {
+	if (!keycloak) {
+		keycloak = new Keycloak({
+			url: PUBLIC_KEYCLOAK_URL,
+			realm: PUBLIC_KEYCLOAK_REALM,
+			clientId: PUBLIC_KEYCLOAK_CLIENT_ID
+		});
+	}
+	return keycloak;
+}
+
+export async function initAuth(): Promise<boolean> {
+	if (!browser) return false;
+
+	const kc = getKeycloak();
+
+	const authenticated = await kc.init({
+		onLoad: 'check-sso',
+		silentCheckSsoRedirectUri: `${window.location.origin}/silent-check-sso.html`,
+		// Safari blocks third-party cookies in iframes — must be false
+		checkLoginIframe: false,
+		pkceMethod: 'S256'
+	});
+
+	if (authenticated) {
+		// Schedule proactive token refresh (60s before expiry)
+		scheduleTokenRefresh(kc);
+	}
+
+	return authenticated;
+}
+
+function scheduleTokenRefresh(kc: Keycloak): void {
+	setInterval(
+		async () => {
+			try {
+				await kc.updateToken(60);
+			} catch {
+				// Token refresh failed — redirect to login
+				kc.login();
+			}
+		},
+		30 * 1000 // check every 30s
+	);
+}
+
+export function getUser(kc: Keycloak): KeycloakUser | null {
+	if (!kc.authenticated || !kc.tokenParsed) return null;
+
+	const token = kc.tokenParsed as Record<string, unknown>;
+	return {
+		id: token['sub'] as string,
+		email: token['email'] as string,
+		displayName: (token['name'] as string) ?? (token['preferred_username'] as string),
+		preferredUsername: token['preferred_username'] as string
+	};
+}
+
+export async function login(): Promise<void> {
+	getKeycloak().login();
+}
+
+export async function logout(): Promise<void> {
+	getKeycloak().logout({ redirectUri: window.location.origin });
+}

apps/web/src/lib/i18n.ts

@@ -0,0 +1,6 @@
+import { createI18n } from '@inlang/paraglide-sveltekit';
+import * as runtime from '$lib/paraglide/runtime';
+
+export const i18n = createI18n(runtime, {
+	defaultLanguageTag: 'en'
+});

apps/web/src/lib/stores/auth.ts

@@ -0,0 +1,10 @@
+import { writable, derived } from 'svelte/store';
+import type Keycloak from 'keycloak-js';
+import type { KeycloakUser } from '$lib/auth';
+
+export const keycloak = writable<Keycloak | null>(null);
+export const isAuthenticated = writable<boolean>(false);
+export const currentUser = writable<KeycloakUser | null>(null);
+export const authLoading = writable<boolean>(true);
+
+export const token = derived(keycloak, ($kc) => $kc?.token ?? null);

apps/web/src/lib/stores/collective.ts

@@ -0,0 +1,22 @@
+import { writable } from 'svelte/store';
+
+export interface Collective {
+	id: string;
+	name: string;
+	emoji: string;
+	created_at: string;
+}
+
+export interface CollectiveMember {
+	user_id: string;
+	collective_id: string;
+	role: 'admin' | 'member' | 'guest';
+	display_name: string;
+	avatar_type: 'initials' | 'emoji' | 'upload';
+	avatar_emoji: string | null;
+	avatar_url: string | null;
+}
+
+export const currentCollective = writable<Collective | null>(null);
+export const collectiveMembers = writable<CollectiveMember[]>([]);
+export const userCollectives = writable<Collective[]>([]);

apps/web/src/lib/supabase.ts

@@ -0,0 +1,44 @@
+import { createClient, type SupabaseClient } from '@supabase/supabase-js';
+import { browser } from '$app/environment';
+import { PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY } from '$env/static/public';
+import type { Database } from '@colectivo/types';
+
+let supabase: SupabaseClient<Database> | null = null;
+
+export function getSupabase(): SupabaseClient<Database> {
+	if (!supabase) {
+		supabase = createClient<Database>(PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_ANON_KEY, {
+			auth: {
+				// Auth is handled by Keycloak — disable Supabase GoTrue auth flows
+				autoRefreshToken: false,
+				persistSession: false,
+				detectSessionInUrl: false
+			},
+			global: {
+				headers: {}
+			}
+		});
+	}
+	return supabase;
+}
+
+/**
+ * Set the Keycloak access token on the Supabase client so RLS policies
+ * resolve auth.uid() to the Keycloak sub claim.
+ */
+export function setSupabaseToken(accessToken: string): void {
+	const client = getSupabase();
+	// @ts-expect-error — internal API to inject a custom JWT
+	client.rest.headers['Authorization'] = `Bearer ${accessToken}`;
+	if (browser) {
+		// Also set on the realtime client
+		// @ts-expect-error
+		client.realtime.setAuth(accessToken);
+	}
+}
+
+export function clearSupabaseToken(): void {
+	const client = getSupabase();
+	// @ts-expect-error
+	delete client.rest.headers['Authorization'];
+}