Fase 0: scaffold monorepo, SvelteKit skeleton, and dev infrastructure

- Turborepo + pnpm workspaces with apps/web and packages/types
- SvelteKit app: Tailwind, Paraglide i18n (en/es), keycloak-js, Supabase client,
  auth/collective stores, PWA service worker skeleton, all route placeholders
- packages/types: domain types (User, Collective, ShoppingList, etc.) and
  database.ts placeholder for generated types
- Justfile with dev, db-*, kc-*, build, backup, restore, deploy recipes
- infra/docker-compose.dev.yml: Postgres 15, GoTrue, PostgREST, Realtime v2.83,
  Storage, Kong (port 8001), Studio, Keycloak 24
- infra/docker-compose.prod.yml, kong.yml, db-init scripts, backup/deploy scripts
- keycloak/realm-export.json with colectivo realm and 5 dev test users
- supabase/config.toml and seed.sql with sample collective and items
- GitHub Actions: ci.yml (lint+typecheck+build) and deploy.yml (GHCR + SSH)
- .env.example documenting all required variables
- Fixed docker-compose issues: Studio image tag, Kong port conflict (8001),
  internal role passwords init script, Realtime METRICS_JWT_SECRET/APP_NAME

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/scripts/backup.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# backup.sh — manual backup of a service
+# Usage: just backup supabase
+# Uploads a timestamped dump to Backblaze B2.
+
+set -euo pipefail
+
+SERVICE="${1:-supabase}"
+TIMESTAMP=$(date -u +"%Y%m%dT%H%M%SZ")
+BACKUP_DIR="${BACKUP_DIR:-/tmp/colectivo-backups}"
+mkdir -p "$BACKUP_DIR"
+
+case "$SERVICE" in
+  supabase|postgres|db)
+    DUMP_FILE="$BACKUP_DIR/postgres-$TIMESTAMP.dump"
+    echo "==> Dumping PostgreSQL → $DUMP_FILE"
+    docker compose -f "$(dirname "$0")/../docker-compose.prod.yml" exec -T db \
+      pg_dumpall -U postgres --clean --if-exists \
+      | gzip > "$DUMP_FILE.gz"
+    DUMP_FILE="$DUMP_FILE.gz"
+    ;;
+  keycloak)
+    DUMP_FILE="$BACKUP_DIR/keycloak-$TIMESTAMP.json"
+    echo "==> Exporting Keycloak realm → $DUMP_FILE"
+    docker compose -f "$(dirname "$0")/../docker-compose.prod.yml" exec keycloak \
+      /opt/keycloak/bin/kc.sh export \
+        --realm colectivo \
+        --users realm_file \
+        --file /tmp/kc-export.json
+    docker compose -f "$(dirname "$0")/../docker-compose.prod.yml" cp \
+      keycloak:/tmp/kc-export.json "$DUMP_FILE"
+    gzip "$DUMP_FILE"
+    DUMP_FILE="$DUMP_FILE.gz"
+    ;;
+  *)
+    echo "Unknown service: $SERVICE. Use 'supabase' or 'keycloak'." >&2
+    exit 1
+    ;;
+esac
+
+echo "==> Uploading $(basename "$DUMP_FILE") to B2 bucket: ${B2_BUCKET_NAME}"
+b2 file upload \
+  --contentType application/octet-stream \
+  "$B2_BUCKET_NAME" \
+  "$DUMP_FILE" \
+  "backups/$(basename "$DUMP_FILE")"
+
+echo "==> Backup complete: $(basename "$DUMP_FILE")"
+rm -f "$DUMP_FILE"