Fase 0: scaffold monorepo, SvelteKit skeleton, and dev infrastructure

- Turborepo + pnpm workspaces with apps/web and packages/types
- SvelteKit app: Tailwind, Paraglide i18n (en/es), keycloak-js, Supabase client,
  auth/collective stores, PWA service worker skeleton, all route placeholders
- packages/types: domain types (User, Collective, ShoppingList, etc.) and
  database.ts placeholder for generated types
- Justfile with dev, db-*, kc-*, build, backup, restore, deploy recipes
- infra/docker-compose.dev.yml: Postgres 15, GoTrue, PostgREST, Realtime v2.83,
  Storage, Kong (port 8001), Studio, Keycloak 24
- infra/docker-compose.prod.yml, kong.yml, db-init scripts, backup/deploy scripts
- keycloak/realm-export.json with colectivo realm and 5 dev test users
- supabase/config.toml and seed.sql with sample collective and items
- GitHub Actions: ci.yml (lint+typecheck+build) and deploy.yml (GHCR + SSH)
- .env.example documenting all required variables
- Fixed docker-compose issues: Studio image tag, Kong port conflict (8001),
  internal role passwords init script, Realtime METRICS_JWT_SECRET/APP_NAME

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/routes/+layout.svelte

@@ -0,0 +1,51 @@
+<script lang="ts">
+	import '../app.css';
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { page } from '$app/stores';
+	import { initAuth, getKeycloak, getUser } from '$lib/auth';
+	import { setSupabaseToken, clearSupabaseToken } from '$lib/supabase';
+	import { keycloak, isAuthenticated, currentUser, authLoading } from '$lib/stores/auth';
+	import { ParaglideJS } from '@inlang/paraglide-sveltekit';
+	import { i18n } from '$lib/i18n';
+
+	const PUBLIC_ROUTES = ['/invitation'];
+
+	onMount(async () => {
+		const kc = getKeycloak();
+		keycloak.set(kc);
+
+		const authenticated = await initAuth();
+		isAuthenticated.set(authenticated);
+
+		if (authenticated) {
+			const user = getUser(kc);
+			currentUser.set(user);
+			if (kc.token) setSupabaseToken(kc.token);
+
+			// Keep token in sync with Supabase client
+			kc.onTokenRefreshed = () => {
+				if (kc.token) setSupabaseToken(kc.token);
+			};
+			kc.onAuthLogout = () => {
+				clearSupabaseToken();
+				isAuthenticated.set(false);
+				currentUser.set(null);
+			};
+		}
+
+		authLoading.set(false);
+
+		// Redirect unauthenticated users unless on a public route
+		if (!authenticated) {
+			const isPublic = PUBLIC_ROUTES.some((r) => $page.url.pathname.startsWith(r));
+			if (!isPublic) {
+				kc.login();
+			}
+		}
+	});
+</script>
+
+<ParaglideJS {i18n}>
+	<slot />
+</ParaglideJS>