Aggiungo stack Supabase self-hosted e config di produzione

Stack Docker completo in infra/supabase/docker/ (vendored da supabase/supabase)
per svincolare dev e produzione da Lovable Cloud. Include override di
produzione che non espone porte pubblicamente e disattiva i servizi non
usati da CrAPP (Realtime, Storage, imgproxy, Edge Functions, pooler),
un Caddyfile con routing /api/* per un solo dominio, e i template .env
per app e stack. Forzo inoltre il preset Nitro a node-server in
vite.config.ts, dato che il default sarebbe Cloudflare Workers.

infra/supabase/docker/dev/data.sql

@@ -0,0 +1,48 @@
+create table profiles (
+  id uuid references auth.users not null,
+  updated_at timestamp with time zone,
+  username text unique,
+  avatar_url text,
+  website text,
+
+  primary key (id),
+  unique(username),
+  constraint username_length check (char_length(username) >= 3)
+);
+
+alter table profiles enable row level security;
+
+create policy "Public profiles are viewable by the owner."
+  on profiles for select
+  using ( auth.uid() = id );
+
+create policy "Users can insert their own profile."
+  on profiles for insert
+  with check ( auth.uid() = id );
+
+create policy "Users can update own profile."
+  on profiles for update
+  using ( auth.uid() = id );
+
+-- Set up Realtime
+begin;
+  drop publication if exists supabase_realtime;
+  create publication supabase_realtime;
+commit;
+alter publication supabase_realtime add table profiles;
+
+-- Set up Storage
+insert into storage.buckets (id, name)
+values ('avatars', 'avatars');
+
+create policy "Avatar images are publicly accessible."
+  on storage.objects for select
+  using ( bucket_id = 'avatars' );
+
+create policy "Anyone can upload an avatar."
+  on storage.objects for insert
+  with check ( bucket_id = 'avatars' );
+
+create policy "Anyone can update an avatar."
+  on storage.objects for update
+  with check ( bucket_id = 'avatars' );