feat(infra): Phase 0 provisioning + dev status dashboard

- scripts/phase0-provision.sh: idempotent root setup (nginx, PostgreSQL,
  Redis, certbot/TLS, UFW). Opens 22/2222/80/443 before enabling UFW so SSH
  and Gitea git-SSH can't be locked out. Redis/Postgres stay localhost-only.
- infra/nginx/feedthepyre.com.conf: vhost serving the status page; commented
  web(:3000)/api(:4000) reverse-proxy blocks ready for app deploy.
- infra/status/: data-driven dev status dashboard (status.json + gen-status.mjs
  + prebuilt index.html), served at feedthepyre.com.
- ecosystem.config.cjs (PM2), infra/systemd/pm2-pyre.service, infra/logrotate/pyre,
  scripts/backup.sh — process mgmt + ops (inert until apps are built).

Built by 4 parallel agents, reviewed by 2 audit agents; audit fixes applied
(logs dir creation, port-citation accuracy, status truthfulness). pm2 installed
user-level. Privileged steps gated on `sudo bash scripts/phase0-provision.sh`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/status/README.md

@@ -0,0 +1,38 @@
+# PYRE Status Dashboard
+
+A static, self-contained dark "ember"-themed page the team uses to track PYRE MVP
+progress. It is a **snapshot**, not live telemetry.
+
+## Files
+
+- **`status.json`** — the single source of truth. All content on the page
+  (phases, checklists, infra, dates, links) comes from here.
+- **`index.html`** — the prebuilt rendered page. Committed so the page works even
+  before anyone runs the generator. Self-contained: inline CSS, no external
+  requests, no JS.
+- **`README.md`** — this file.
+
+## Editing & regenerating
+
+1. Edit **`status.json`** — flip an item's `"done"` to `true`, update a phase
+   `"state"` (`todo` / `in_progress` / `done`), or bump `"updated"`.
+2. Regenerate the page from the repo root:
+
+   ```bash
+   node scripts/gen-status.mjs
+   ```
+
+   The generator is dependency-free (plain Node ESM, no npm install). It reads
+   `infra/status/status.json` and rewrites `infra/status/index.html`, recomputing
+   the overall % complete from the item done-counts. It prints the output path
+   when finished.
+
+3. Commit the regenerated `index.html` alongside the `status.json` change so the
+   prebuilt page stays consistent with the data.
+
+## Deployment
+
+The provision script deploys `infra/status/*` to `/var/www/feedthepyre/status`,
+and nginx serves it as the site root (`feedthepyre.com`) until the real PYRE app
+ships. Because `index.html` is prebuilt and self-contained, deployment is a plain
+file copy — no build step or generator run is required on the server.