Add shared infrastructure base stack

Postgres, Zitadel and SeaweedFS were previously duplicated or fragilely
cross-referenced across the Musify, Ping and docker-manager repos. This
consolidates them into one place: compose.yml is the production shape
(no published ports, joins infra-net), compose.dev.yml is a thin overlay
that publishes ports for local development.

.env.prod.example

@@ -0,0 +1,32 @@
+# Production configuration for compose.yml (no overlay needed — the base
+# file is already the production shape: no published ports, everything
+# reachable only on infra-net).
+#
+#   cp .env.prod.example .env.prod
+#   chmod 600 .env.prod
+#   docker compose --env-file .env.prod -f compose.yml up -d
+#
+# Replace every CHANGE_ME with a strong random value (`openssl rand -hex 24`;
+# the Zitadel masterkey needs exactly 32 characters) and auth.example.com
+# with the real hostname the edge (e.g. Musify's nginx) terminates TLS for.
+
+# --- PostgreSQL ---------------------------------------------------------------
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=CHANGE_ME
+
+# --- Zitadel (OIDC) ----------------------------------------------------------
+ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
+ZITADEL_EXTERNAL_DOMAIN=auth.example.com
+ZITADEL_EXTERNAL_PORT=443
+ZITADEL_EXTERNAL_SECURE=true
+ZITADEL_DATABASE_PASSWORD=CHANGE_ME
+ZITADEL_ADMIN_USERNAME=admin
+ZITADEL_ADMIN_PASSWORD=CHANGE_ME
+
+# --- SeaweedFS (S3) ----------------------------------------------------------
+S3_ACCESS_KEY=CHANGE_ME
+S3_SECRET_KEY=CHANGE_ME
+
+# --- RabbitMQ -----------------------------------------------------------------
+RABBITMQ_DEFAULT_USER=CHANGE_ME
+RABBITMQ_DEFAULT_PASS=CHANGE_ME