Add MQTT enrollment demo with Gitea deploy pipeline

Go backend plus C (libsodium) and C++ (OpenSSL) simulated boards enroll
through a Mosquitto 2.1 broker with Dynamic Security using X25519/HKDF/
Ed25519; a web view shows the run live. The Gitea workflow validates and
builds the images, redeploys the stack on the server with the viewer on
port 8099 and fails unless both boards pass all checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker/broker/mosquitto.conf

@@ -0,0 +1,18 @@
+# Plain MQTT on 1883 (demo only: a real deployment must use TLS).
+listener 1883
+# Boards have no credentials before enrollment; Dynamic Security decides what anonymous clients may do.
+allow_anonymous true
+
+# Dynamic Security plugin: users, roles and ACLs live in a JSON file and are changed over MQTT.
+plugin /usr/lib/mosquitto_dynamic_security.so
+plugin_opt_config_file /mosquitto/data/dynamic-security.json
+
+# Verbose logging (connections, subscribes, dynsec commands) so broker behaviour is visible.
+log_dest stdout
+log_type error
+log_type warning
+log_type notice
+log_type information
+log_type subscribe
+log_type unsubscribe
+log_timestamp true