Add infra/ — full stack config as deployed on RPi 3B+

Captures everything needed to rebuild the stack from scratch:

infra/compose.yaml
- mosquitto (eclipse-mosquitto:latest)
- zigbee2mqtt (ghcr.io/pine64/zigbee2mqtt:latest-dev, BLZ fork)
- nodered (nodered/node-red:latest)

infra/mosquitto/config/mosquitto.conf
- anonymous listener on 1883, file logging, persistence on

infra/zigbee2mqtt/
- configuration.yaml: 5 paired devices with friendly names, 1 group
- coordinator_backup.json: zigbee network key + pan id (recovery)
- state.json: per-device persisted state (ON/OFF, linkquality)

infra/nodered/
- settings.js: nodered defaults (flowFile: flows.json, no auth)
- start.sh: patches Dashboard 2.0 SPA with <base href> at startup

Also:
- Updated z2m groups section to rename Laser & Fog -> DJ Booth
  (matches the friendly_name already in devices section)
- Pushed the same change to live /root/zigbee2mqtt/configuration.yaml
  and restarted the zigbee2mqtt container
- .gitignore: output/ (regenerated on every build, churns uuid ids)
- README.md: link to infra/README.md for rebuild procedure

README.md

@@ -5,10 +5,11 @@ Declarative Node-RED flows with conftest/Rego validation. Generates `flows.json`
 ## Layout
 
 ```
-flows/<name>.yaml          # declarative spec
-scripts/flow2json.py       # YAML → JSON generator
-policy/flow.rego           # Rego policy pack (conftest)
-output/<name>.json         # generated flows.json
+infra/                           # host stack config (compose, z2m, mosquitto, nodered settings)
+flows/<name>.yaml                # declarative spec
+scripts/flow2json.py             # YAML → JSON generator
+policy/flow.rego                 # Rego policy pack (conftest)
+output/<name>.json               # generated flows.json
 ```
 
 ## Quick start
@@ -20,6 +21,8 @@ just validate              # generate + validate
 just deploy                # push to Node-RED at 192.168.81.147:1880
 ```
 
+See `infra/README.md` for the full Docker stack and rebuild procedure.
+
 ## Generation invariants
 
 These are enforced by `policy/flow.rego` and burned in from real bugs found in deployment. The generator follows them by construction; the policy is the second line of defense.