Organize local infrastructure and Vault secrets by service ownership

infra/README.md

@@ -0,0 +1,20 @@
+# Infrastructure
+
+Run `make build && make up` from the repository root. Local tooling needs Make,
+POSIX shell and Docker Compose/BuildKit; all other tools run in Docker.
+
+- `images/`: reusable Docker build definitions for product images and tooling.
+- `local/compose.yml`: isolated local stack and persistent volumes.
+- `local/bff/`, `local/notifications/`: application runtime configuration.
+- `local/frontend/`: Caddy configuration for Flutter files, browser HTTPS and API proxying.
+- `local/vault/`: server startup/configuration and per-service Agent templates.
+- `local/mongo/`, `local/nats/`: infrastructure startup and Mongo provisioning checks.
+- `local/scripts/`: bootstrap, migration, release resolution and verification.
+- `local/tools.sh`: host entry point used by Make.
+
+Local generated pins, identities and administrator material remain under ignored
+`.local/dev/`; they are never build inputs. Application source remains under
+`backend/` and `frontend/`.
+
+See [local development](../docs/local-development.md) for Vault paths, commands,
+Caddy trust, persistence and migration details.