Fix watchdog timeout and MQTT connectivity issues

Problem: R5C spontaneously rebooted due to hardware watchdog timeout
Cause 1: van-gps-owntracks in infinite restart loop (MQTT connect failed)
Cause 2: mosquitto only listening on localhost, so clients couldn't connect
Solution:
- Add restart limits to van-gps-owntracks and van-li3-battery services
  (max 3 restarts per 5 minutes prevents infinite restart loops)
- Configure mosquitto to listen on all interfaces (0.0.0.0:1883)
- Deploy mosquitto listener config via deploy.sh
- Restart mosquitto during deploy to apply config changes

This prevents the system from hitting the 11-second hardware watchdog timeout
when services crash and systemd auto-restarts them indefinitely.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

ha/esphome.container

@@ -3,7 +3,7 @@
 # container is the equivalent). Installed by deploy.sh to /etc/containers/systemd/;
 # systemd generates esphome.service from it.
 #
-# Host networking: the dashboard binds :6052 directly (http://10.42.0.1:6052),
+# Host networking: the dashboard binds :6052 directly (http://10.42.1.1:6052),
 # and ESPHome's mDNS-based OTA discovery/flashing of already-provisioned nodes
 # needs to see the LAN as the host does — a bridged network would need explicit
 # port/mDNS forwarding for the same result.

ha/esphome.container.bak

@@ -0,0 +1,35 @@
+# ESPHome dashboard as a Podman Quadlet, same pattern as homeassistant.container
+# (this isn't Home Assistant Supervised, so there's no add-on store — a sibling
+# container is the equivalent). Installed by deploy.sh to /etc/containers/systemd/;
+# systemd generates esphome.service from it.
+#
+# Host networking: the dashboard binds :6052 directly (http://10.42.0.1:6052),
+# and ESPHome's mDNS-based OTA discovery/flashing of already-provisioned nodes
+# needs to see the LAN as the host does — a bridged network would need explicit
+# port/mDNS forwarding for the same result.
+[Unit]
+Description=ESPHome dashboard (Podman container)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image=ghcr.io/esphome/esphome:stable
+ContainerName=esphome
+Network=host
+Volume=/srv/esphome:/config
+Environment=TZ=America/Toronto
+# Initial flash of a new device needs USB serial access; OTA re-flashes of an
+# already-provisioned node don't. Uncomment and set the real path to flash
+# over USB (find it with `ls /dev/ttyUSB* /dev/ttyACM*` after plugging the
+# device in):
+#Volume=/dev/ttyUSB0:/dev/ttyUSB0
+#AddCapability=SYS_ADMIN
+
+[Service]
+Restart=always
+# First start pulls the image; PlatformIO also downloads toolchains on a
+# node's first compile — both want a working WAN, not just a fast one.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ha/homeassistant.container

@@ -4,7 +4,7 @@
 # /etc/containers/systemd/; systemd generates homeassistant.service from it.
 #
 # Host networking: HA binds :8123 on the host directly, so the LAN URL is
-# http://10.42.0.1:8123 (name: homeassistant) — no bridge port, no DNAT.
+# http://10.42.1.1:8123 (name: homeassistant) — no bridge port, no DNAT.
 # /run/dbus gives HA the host BlueZ stack = the Pi's onboard Bluetooth (hci0).
 [Unit]
 Description=Home Assistant (Podman container)

ha/homeassistant.container.bak

@@ -0,0 +1,37 @@
+# Home Assistant Container as a Podman Quadlet (replaced the ha_van HAOS VM
+# 2026-07-07 — the fixed 2 GiB VM allocation starved the 4 GB Pi; VM domain XML
+# is in git history under ha/ha_van.xml). Installed by deploy.sh to
+# /etc/containers/systemd/; systemd generates homeassistant.service from it.
+#
+# Host networking: HA binds :8123 on the host directly, so the LAN URL is
+# http://10.42.0.1:8123 (name: homeassistant) — no bridge port, no DNAT.
+# /run/dbus gives HA the host BlueZ stack = the Pi's onboard Bluetooth (hci0).
+[Unit]
+Description=Home Assistant (Podman container)
+Wants=network-online.target bluetooth.service
+After=network-online.target bluetooth.service
+
+[Container]
+Image=ghcr.io/home-assistant/home-assistant:stable
+ContainerName=homeassistant
+Network=host
+Volume=/srv/homeassistant:/config
+Volume=/run/dbus:/run/dbus:ro
+Environment=TZ=America/Toronto
+# Bluetooth needs two escapes: Ubuntu's dbus-daemon mediates D-Bus per
+# AppArmor label and the default containers profile can't send to BlueZ
+# (AddMatch denied), and habluetooth wants NET_ADMIN+NET_RAW for adapter
+# recovery. HA is rootful + host-net anyway.
+PodmanArgs=--security-opt apparmor=unconfined
+AddCapability=NET_ADMIN NET_RAW
+# Podman's default 10s stop window SIGKILLs HA mid-flush and the recorder
+# complains about an unclean sqlite shutdown on the next start.
+StopTimeout=120
+
+[Service]
+Restart=always
+# First start pulls the image (~600 MB) — allow for a slow uplink.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target