Move shared infrastructure to a separate Infrastructure repo

Postgres, Zitadel, SeaweedFS, RabbitMQ and Jaeger no longer run as part
of this stack. They're shared services (used by Musify, Ping and
docker-manager) that now live in a separate Infrastructure repository
and must already be running.

deploy/compose.yml keeps only what's specific to Musify: its own
database connection, its own OIDC app and storage bucket (created
against the shared Zitadel/SeaweedFS via zitadel-init/seaweedfs-init),
and the application containers. A new wait-for-postgres one-shot
replaces the in-file Postgres health check, which no longer works now
that Postgres lives in a different compose project.

compose.prod.yml joins Infrastructure's infra-net network instead of
running its own copies. Docs and READMEs updated to match.

deploy/compose.prod.yml

@@ -1,16 +1,19 @@
 name: musify-prod
 
-# Production overlay: adds the nginx edge and the host-mounted secrets.
-# Nothing but nginx publishes a port; every other service is reachable only on
-# the internal `musify-prod_default` network.
+# Production overlay: adds the nginx edge and joins Infrastructure's shared
+# `infra-net` network so this project's containers can reach Postgres,
+# Zitadel, SeaweedFS, RabbitMQ and Jaeger by container name. None of them
+# run as part of this compose project anymore (see
+# ../../../Infrastructure/README.md, which must already be up). Nothing but
+# nginx publishes a port; every other service is reachable only on infra-net.
 #
 #   docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml up -d
 #   docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml --profile apps up -d --build
-#
-# The first command starts the infrastructure, the nginx edge and the
-# one-shot bootstrap jobs (stream keys, migrations, Zitadel project/apps); the
-# second builds and starts the applications, picking up the OIDC client ids
-# the first command just wrote into deploy/.env.prod. See deploy/README.md.
+
+networks:
+  default:
+    name: infra-net
+    external: true
 
 services:
   # zitadel-init (compose.yml) edits whichever env file is mounted here.
@@ -20,16 +23,13 @@ services:
 
   # Every vhost proxies through `set $upstream ...; proxy_pass $upstream;`
   # with the embedded Docker DNS resolver (see nginx/templates), so nginx
-  # does not need api/gateway/web-player to exist at its own startup — only
+  # does not need api/gateway/web-player to exist at its own startup, only
   # at request time. That is what lets it start in the FIRST command
   # (profile-gated services aren't part of that invocation yet) and still be
   # reachable at the auth domain for zitadel-init to provision through.
   nginx:
     image: nginx:1.27-alpine
     container_name: musify-nginx
-    depends_on:
-      zitadel:
-        condition: service_started
     environment:
       # The entrypoint renders /etc/nginx/templates/*.template with envsubst.
       # The filter keeps it from eating nginx's own $host / $remote_addr.