Fase 0: scaffold monorepo, SvelteKit skeleton, and dev infrastructure

- Turborepo + pnpm workspaces with apps/web and packages/types
- SvelteKit app: Tailwind, Paraglide i18n (en/es), keycloak-js, Supabase client,
  auth/collective stores, PWA service worker skeleton, all route placeholders
- packages/types: domain types (User, Collective, ShoppingList, etc.) and
  database.ts placeholder for generated types
- Justfile with dev, db-*, kc-*, build, backup, restore, deploy recipes
- infra/docker-compose.dev.yml: Postgres 15, GoTrue, PostgREST, Realtime v2.83,
  Storage, Kong (port 8001), Studio, Keycloak 24
- infra/docker-compose.prod.yml, kong.yml, db-init scripts, backup/deploy scripts
- keycloak/realm-export.json with colectivo realm and 5 dev test users
- supabase/config.toml and seed.sql with sample collective and items
- GitHub Actions: ci.yml (lint+typecheck+build) and deploy.yml (GHCR + SSH)
- .env.example documenting all required variables
- Fixed docker-compose issues: Studio image tag, Kong port conflict (8001),
  internal role passwords init script, Realtime METRICS_JWT_SECRET/APP_NAME

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/scripts/deploy.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# deploy.sh — deploy to production via SSH
+# Called by: just deploy
+#
+# Prerequisites:
+#   - DEPLOY_HOST and DEPLOY_PATH set in .env
+#   - SSH key configured for passwordless access
+#   - Docker image already pushed to GHCR (done by CI)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Load env
+if [ -f "$SCRIPT_DIR/../../.env" ]; then
+  # shellcheck disable=SC1091
+  set -a; source "$SCRIPT_DIR/../../.env"; set +a
+fi
+
+DEPLOY_HOST="${DEPLOY_HOST:?Set DEPLOY_HOST in .env}"
+DEPLOY_PATH="${DEPLOY_PATH:-/opt/colectivo}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+
+echo "==> Deploying colectivo to $DEPLOY_HOST:$DEPLOY_PATH (tag: $IMAGE_TAG)"
+
+# 1. Copy compose file and scripts to server
+rsync -az --delete \
+  "$SCRIPT_DIR/../docker-compose.prod.yml" \
+  "$SCRIPT_DIR/../kong.yml" \
+  "$DEPLOY_HOST:$DEPLOY_PATH/infra/"
+
+# 2. SSH: pull image, restart services with zero downtime
+ssh "$DEPLOY_HOST" bash -s << EOF
+set -euo pipefail
+cd "$DEPLOY_PATH"
+
+echo "--- Pulling latest image (tag: $IMAGE_TAG)"
+IMAGE_TAG="$IMAGE_TAG" docker compose -f infra/docker-compose.prod.yml pull app
+
+echo "--- Rolling restart of app service"
+IMAGE_TAG="$IMAGE_TAG" docker compose -f infra/docker-compose.prod.yml up -d --no-deps app
+
+echo "--- Running pending DB migrations"
+docker compose -f infra/docker-compose.prod.yml exec -T db \
+  psql -U postgres -f /docker-entrypoint-initdb.d/migrations.sql 2>/dev/null || true
+
+echo "--- Pruning old images"
+docker image prune -f
+
+echo "--- Deploy done"
+EOF
+
+echo "==> Deployment complete"