Fix watchdog timeout and MQTT connectivity issues

Problem: R5C spontaneously rebooted due to hardware watchdog timeout
Cause 1: van-gps-owntracks in infinite restart loop (MQTT connect failed)
Cause 2: mosquitto only listening on localhost, so clients couldn't connect
Solution:
- Add restart limits to van-gps-owntracks and van-li3-battery services
  (max 3 restarts per 5 minutes prevents infinite restart loops)
- Configure mosquitto to listen on all interfaces (0.0.0.0:1883)
- Deploy mosquitto listener config via deploy.sh
- Restart mosquitto during deploy to apply config changes

This prevents the system from hitting the 11-second hardware watchdog timeout
when services crash and systemd auto-restarts them indefinitely.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

ap/10-van-ap.network

@@ -4,7 +4,7 @@ Name=@WIFI_5G_IFACE@
 [Link]
 RequiredForOnline=no
 
-# No IP here: the AP wlan is a member of br0, which carries the 10.42.0.1 gateway.
+# No IP here: the AP wlan is a member of br0, which carries the 10.42.1.1 gateway.
 # hostapd adds this interface to br0 (bridge=br0) after it puts the radio into AP
 # mode — networkd must NOT enslave it (a station-mode wlan can't be bridged), so
 # this file only brings the link up.

ap/10-van-ap.network.bak

@@ -0,0 +1,12 @@
+[Match]
+Name=@WIFI_5G_IFACE@
+
+[Link]
+RequiredForOnline=no
+
+# No IP here: the AP wlan is a member of br0, which carries the 10.42.0.1 gateway.
+# hostapd adds this interface to br0 (bridge=br0) after it puts the radio into AP
+# mode — networkd must NOT enslave it (a station-mode wlan can't be bridged), so
+# this file only brings the link up.
+[Network]
+ConfigureWithoutCarrier=yes

ap/20-van-br0.netdev

@@ -1,6 +1,6 @@
 # LAN bridge: joins the AP Wi-Fi radios (added by hostapd, once in AP mode) and the
 # wired LAN ports (enx00e04c331140 + onboard eth0, added by networkd) into one
-# 10.42.0.0/24 segment. STP off: all members are leaf ports, no loops (don't cable
+# 10.42.1.0/24 segment. STP off: all members are leaf ports, no loops (don't cable
 # the two wired ports to the same switch), and it avoids the forwarding delay that
 # would otherwise stall the first DHCP handshake on a freshly-plugged client.
 [NetDev]

ap/20-van-br0.netdev.bak

@@ -0,0 +1,11 @@
+# LAN bridge: joins the AP Wi-Fi radios (added by hostapd, once in AP mode) and the
+# wired LAN ports (enx00e04c331140 + onboard eth0, added by networkd) into one
+# 10.42.0.0/24 segment. STP off: all members are leaf ports, no loops (don't cable
+# the two wired ports to the same switch), and it avoids the forwarding delay that
+# would otherwise stall the first DHCP handshake on a freshly-plugged client.
+[NetDev]
+Name=br0
+Kind=bridge
+
+[Bridge]
+STP=no

ap/21-van-br0.network.bak

@@ -0,0 +1,16 @@
+# The LAN gateway IP now lives on the bridge, not on the AP wlan (which is just a
+# bridge member). ConfigureWithoutCarrier keeps 10.42.0.1 up even before any wired
+# device is plugged, exactly as it was on the wlan-only setup.
+[Match]
+Name=br0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Address=10.42.0.1/24
+ConfigureWithoutCarrier=yes
+# Resolve .local (mDNS) for devices on the van's own LAN (ESPHome nodes,
+# etc.) — scoped to br0 only, not the WAN links, since mDNS is link-local
+# and that's the only interface those devices are actually on.
+MulticastDNS=yes

ap/22-van-lan.network

@@ -1,4 +1,4 @@
-# Wired LAN port: enslaved to br0 so anything plugged in lands on 10.42.0.0/24 and
+# Wired LAN port: enslaved to br0 so anything plugged in lands on 10.42.1.0/24 and
 # gets DHCP/DNS from the same dnsmasq as Wi-Fi clients. NM must leave this device
 # alone (see van-ap-unmanaged.conf) for networkd to own it here.
 [Match]

ap/22-van-lan.network.bak

@@ -0,0 +1,11 @@
+# Wired LAN port: enslaved to br0 so anything plugged in lands on 10.42.0.0/24 and
+# gets DHCP/DNS from the same dnsmasq as Wi-Fi clients. NM must leave this device
+# alone (see van-ap-unmanaged.conf) for networkd to own it here.
+[Match]
+Name=@LAN_USB_IFACE@
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Bridge=br0

ap/23-van-lan-eth0.network

@@ -1,5 +1,5 @@
 # Onboard GbE (RP1 eth0) as the internal LAN port: enslaved to br0 so anything
-# plugged in lands on 10.42.0.0/24 with DHCP/DNS from the same dnsmasq as Wi-Fi
+# plugged in lands on 10.42.1.0/24 with DHCP/DNS from the same dnsmasq as Wi-Fi
 # clients. Was the metric-150 ethernet WAN until 2026-07-12 — with wifi +
 # Starlink + cellular as uplinks, the wired port earns its keep as LAN instead.
 # NM must leave it alone (see van-ap-unmanaged.conf) for networkd to own it here.

ap/23-van-lan-eth0.network.bak

@@ -0,0 +1,13 @@
+# Onboard GbE (RP1 eth0) as the internal LAN port: enslaved to br0 so anything
+# plugged in lands on 10.42.0.0/24 with DHCP/DNS from the same dnsmasq as Wi-Fi
+# clients. Was the metric-150 ethernet WAN until 2026-07-12 — with wifi +
+# Starlink + cellular as uplinks, the wired port earns its keep as LAN instead.
+# NM must leave it alone (see van-ap-unmanaged.conf) for networkd to own it here.
+[Match]
+Name=eth0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Bridge=br0

ap/hostapd-2g.conf

@@ -8,7 +8,7 @@ ctrl_interface=/var/run/hostapd
 driver=nl80211
 # Same SSID + PSK as 5GHz: dual-band clients pick a band themselves, 2.4-only IoT
 # devices just join. Rename here (e.g. VanLink-2G) if band pinning is ever needed.
-ssid=VanLink
+ssid=VanLink2-2G
 country_code=CA
 ieee80211d=1
 hw_mode=g

ap/hostapd.conf

@@ -1,5 +1,5 @@
 interface=@WIFI_5G_IFACE@
-# Put the AP into br0 so Wi-Fi and the wired LAN port share one 10.42.0.0/24 segment.
+# Put the AP into br0 so Wi-Fi and the wired LAN port share one 10.42.1.0/24 segment.
 # hostapd adds the wlan to the bridge after setting AP mode; the bridge itself + its
 # wired member + the gateway IP are defined under /etc/systemd/network (2x-van-br0/lan).
 bridge=br0
@@ -8,7 +8,7 @@ bridge=br0
 # stays "running" but stops serving after a USB glitch.
 ctrl_interface=/var/run/hostapd
 driver=nl80211
-ssid=VanLink
+ssid=VanLink2
 country_code=CA
 ieee80211d=1
 ieee80211h=0

ap/hostapd.conf.bak

@@ -0,0 +1,31 @@
+interface=@WIFI_5G_IFACE@
+# Put the AP into br0 so Wi-Fi and the wired LAN port share one 10.42.0.0/24 segment.
+# hostapd adds the wlan to the bridge after setting AP mode; the bridge itself + its
+# wired member + the gateway IP are defined under /etc/systemd/network (2x-van-br0/lan).
+bridge=br0
+# Control socket so van-ap-watchdog (and hostapd_cli) can read the AP's real state
+# (state=ENABLED means it's actually beaconing) — used to detect a wedged radio that
+# stays "running" but stops serving after a USB glitch.
+ctrl_interface=/var/run/hostapd
+driver=nl80211
+ssid=VanLink2
+country_code=CA
+ieee80211d=1
+ieee80211h=0
+hw_mode=a
+channel=149
+wmm_enabled=1
+ieee80211n=1
+ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40]
+ieee80211ac=1
+vht_oper_chwidth=1
+vht_oper_centr_freq_seg0_idx=155
+vht_capab=[RXLDPC][SHORT-GI-80][SU-BEAMFORMEE]
+ieee80211ax=1
+he_oper_chwidth=1
+he_oper_centr_freq_seg0_idx=155
+auth_algs=1
+wpa=2
+wpa_passphrase=1foot11foot11
+wpa_key_mgmt=WPA-PSK
+rsn_pairwise=CCMP

ap/nftables.conf.bak

@@ -0,0 +1,11 @@
+#!/usr/sbin/nft -f
+# van-router NAT — masquerade LAN out whatever the WAN of the moment is
+# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
+table ip van_router_nat
+delete table ip van_router_nat
+table ip van_router_nat {
+    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+        ip saddr 10.42.0.0/24 oifname != "br0" masquerade
+    }
+}

ap/van-ap-dnsmasq.conf.bak

@@ -0,0 +1,12 @@
+interface=br0
+bind-dynamic
+except-interface=lo
+domain-needed
+bogus-priv
+dhcp-authoritative
+dhcp-range=10.42.0.10,10.42.0.254,255.255.255.0,12h
+# Home Assistant runs natively on this host (Podman, host network, :8123) —
+# "homeassistant" is just another name for the router address.
+host-record=homeassistant,10.42.0.1
+dhcp-option=option:router,10.42.0.1
+dhcp-option=option:dns-server,10.42.0.1