Aggiungo stack Supabase self-hosted e config di produzione

Stack Docker completo in infra/supabase/docker/ (vendored da supabase/supabase)
per svincolare dev e produzione da Lovable Cloud. Include override di
produzione che non espone porte pubblicamente e disattiva i servizi non
usati da CrAPP (Realtime, Storage, imgproxy, Edge Functions, pooler),
un Caddyfile con routing /api/* per un solo dominio, e i template .env
per app e stack. Forzo inoltre il preset Nitro a node-server in
vite.config.ts, dato che il default sarebbe Cloudflare Workers.

infra/supabase/docker/volumes/functions/hello/index.ts

@@ -0,0 +1,37 @@
+// Follow this setup guide to integrate the Deno language server with your editor:
+// https://deno.land/manual/getting_started/setup_your_environment
+// This enables autocomplete, go to definition, etc.
+
+// Setup type definitions for built-in Supabase Runtime APIs
+import "@supabase/functions-js/edge-runtime.d.ts"
+import { withSupabase } from "@supabase/server"
+
+// Logs are visible from 'functions' container inspector
+console.log("Hello from Functions!");
+
+// This endpoint uses 'publishable' | 'secret' access, apiKey is required.
+// Use publishable for Client-facing, key-validated endpoints
+// Use secret for Server-to-server, internal calls
+export default {
+  fetch: withSupabase({ auth: ["publishable", "secret"] }, async (req, ctx) => {
+    // Called by another service with a secret key
+    // ctx.supabaseAdmin bypasses RLS — use for privileged operations
+    /*
+    if (ctx.authMode === "secret") {
+      const { user_id } = await req.json();
+      const { data } = await ctx.supabaseAdmin.auth.admin.getUserById(user_id);
+
+      return Response.json({
+        email: data?.user?.email,
+      });
+    }
+    */
+
+    return Response.json({ message: "Hello from Edge Functions!" });
+  }),
+};
+
+// To invoke:
+// curl 'http://localhost:<API_GW_HTTP_PORT>/functions/v1/hello' \
+//   --header 'apiKey: <sb_publishable/sb_secret key>'
+