Deploy MQTT test backend with private viewer and Gitea CI/CD

deploy/scripts/healthcheck.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Secrets are read from a protected config file, never process arguments.
+set -eu
+conf=/run/mqtt-secrets/health.conf
+topic=robot-market/test/health/check
+token="health-$(date +%s)-$$"
+cleanup() {
+    timeout 4 mosquitto_pub -o "$conf" -h localhost -p 8883 \
+        --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -r -n \
+        >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+# Retain only for the subscribe check so startup scheduling cannot lose the probe.
+timeout 5 mosquitto_pub -o "$conf" -h localhost -p 8883 \
+    --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -r -m "$token" \
+    >/dev/null 2>&1 || exit 1
+received=$(timeout 7 mosquitto_sub -o "$conf" -h localhost -p 8883 \
+    --cafile /mosquitto/certs/ca.crt -V mqttv5 -q 1 -t "$topic" -C 1 -W 5 \
+    2>/dev/null) || exit 1
+[ "$received" = "$token" ]