Add MQTT enrollment demo with Gitea deploy pipeline

Go backend plus C (libsodium) and C++ (OpenSSL) simulated boards enroll
through a Mosquitto 2.1 broker with Dynamic Security using X25519/HKDF/
Ed25519; a web view shows the run live. The Gitea workflow validates and
builds the images, redeploys the stack on the server with the viewer on
port 8099 and fails unless both boards pass all checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

run-libsodium.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Builds the libsodium C program and diffs its output against the Go program (run ./run.sh first).
+# With real libsodium headers installed, set LIBSODIUM_CFLAGS/LIBSODIUM_LIBS (or drop the shim).
+# Default: the machine's libsodium 1.0.20 shared library (no headers) plus the local shim header.
+set -euo pipefail
+cd "$(dirname "$0")"
+mkdir -p out
+
+SO="${LIBSODIUM_SO:-/nix/store/gaaqqkh7pvr85vh2vdclw8z2m4w1lq8q-libsodium-1.0.20/lib/libsodium.so}"
+if [ -n "${LIBSODIUM_LIBS:-}" ]; then
+  gcc -std=c11 -Wall -Wextra -O2 ${LIBSODIUM_CFLAGS:-} -o out/spike-sodium c-libsodium/main.c $LIBSODIUM_LIBS
+else
+  gcc -std=c11 -Wall -Wextra -O2 -Ic-libsodium/shim -o out/spike-sodium c-libsodium/main.c \
+    "$SO" -Wl,-rpath,"$(dirname "$SO")"
+fi
+
+./out/spike-sodium > out/sodium.txt
+diff out/go.txt out/sodium.txt && echo "go == c (libsodium)"