Add MQTT enrollment demo with Gitea deploy pipeline

Go backend plus C (libsodium) and C++ (OpenSSL) simulated boards enroll
through a Mosquitto 2.1 broker with Dynamic Security using X25519/HKDF/
Ed25519; a web view shows the run live. The Gitea workflow validates and
builds the images, redeploys the stack on the server with the viewer on
port 8099 and fails unless both boards pass all checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,39 @@
+name: Test and deploy enrollment demo
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+concurrency:
+  group: mqtt-security-test
+  cancel-in-progress: false
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate the compose files
+        run: |
+          docker compose -f docker/compose.yaml config -q
+          docker compose -f docker/compose.yaml -f docker/compose.restart.yaml config -q
+      - name: Build every image (compiles the Go, C and C++ programs)
+        run: docker compose -f docker/compose.yaml build
+  deploy:
+    needs: test
+    if: gitea.event_name != 'pull_request' && gitea.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy on the server's Docker daemon (viewer published on port 8099)
+        env:
+          VIEWER_BIND: "0.0.0.0"
+          COMPOSE_PROJECT_NAME: crypto-interop-spike
+        run: |
+          set -eu
+          # --force-recreate gives every deployment a fresh broker and a full new run of the demo.
+          docker compose -f docker/compose.yaml up -d --build --force-recreate --remove-orphans
+      - name: Wait for the run and require every board check to pass
+        env:
+          COMPOSE_PROJECT_NAME: crypto-interop-spike
+        run: sh scripts/ci-verify.sh