Add MQTT enrollment demo with Gitea deploy pipeline

Go backend plus C (libsodium) and C++ (OpenSSL) simulated boards enroll
through a Mosquitto 2.1 broker with Dynamic Security using X25519/HKDF/
Ed25519; a web view shows the run live. The Gitea workflow validates and
builds the images, redeploys the stack on the server with the viewer on
port 8099 and fails unless both boards pass all checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker/broker/Dockerfile

@@ -0,0 +1,4 @@
+FROM eclipse-mosquitto:2.1-alpine
+COPY mosquitto.conf /mosquitto/config/mosquitto.conf
+COPY entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/bin/sh", "/entrypoint.sh"]

docker/broker/entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Demo broker start-up. Dynamic Security state is recreated on every start so each run begins clean:
+# `dynsec init` writes a config containing a single admin client ("backend") that may only manage the
+# plugin. The backend then creates every other role and client over MQTT.
+set -e
+mkdir -p /mosquitto/data
+rm -f /mosquitto/data/dynamic-security.json
+mosquitto_ctrl dynsec init /mosquitto/data/dynamic-security.json backend "$ADMIN_PASSWORD" >/dev/null
+chown -R mosquitto:mosquitto /mosquitto/data
+echo "[broker] dynamic security initialised; starting mosquitto (anonymous clients allowed, ACLs via dynsec)"
+exec mosquitto -c /mosquitto/config/mosquitto.conf

docker/broker/mosquitto.conf

@@ -0,0 +1,18 @@
+# Plain MQTT on 1883 (demo only: a real deployment must use TLS).
+listener 1883
+# Boards have no credentials before enrollment; Dynamic Security decides what anonymous clients may do.
+allow_anonymous true
+
+# Dynamic Security plugin: users, roles and ACLs live in a JSON file and are changed over MQTT.
+plugin /usr/lib/mosquitto_dynamic_security.so
+plugin_opt_config_file /mosquitto/data/dynamic-security.json
+
+# Verbose logging (connections, subscribes, dynsec commands) so broker behaviour is visible.
+log_dest stdout
+log_type error
+log_type warning
+log_type notice
+log_type information
+log_type subscribe
+log_type unsubscribe
+log_timestamp true