Fix watchdog timeout and MQTT connectivity issues

Problem: R5C spontaneously rebooted due to hardware watchdog timeout
Cause 1: van-gps-owntracks in infinite restart loop (MQTT connect failed)
Cause 2: mosquitto only listening on localhost, so clients couldn't connect
Solution:
- Add restart limits to van-gps-owntracks and van-li3-battery services
  (max 3 restarts per 5 minutes prevents infinite restart loops)
- Configure mosquitto to listen on all interfaces (0.0.0.0:1883)
- Deploy mosquitto listener config via deploy.sh
- Restart mosquitto during deploy to apply config changes

This prevents the system from hitting the 11-second hardware watchdog timeout
when services crash and systemd auto-restarts them indefinitely.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

ha/esphome.container.bak

@@ -0,0 +1,35 @@
+# ESPHome dashboard as a Podman Quadlet, same pattern as homeassistant.container
+# (this isn't Home Assistant Supervised, so there's no add-on store — a sibling
+# container is the equivalent). Installed by deploy.sh to /etc/containers/systemd/;
+# systemd generates esphome.service from it.
+#
+# Host networking: the dashboard binds :6052 directly (http://10.42.0.1:6052),
+# and ESPHome's mDNS-based OTA discovery/flashing of already-provisioned nodes
+# needs to see the LAN as the host does — a bridged network would need explicit
+# port/mDNS forwarding for the same result.
+[Unit]
+Description=ESPHome dashboard (Podman container)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image=ghcr.io/esphome/esphome:stable
+ContainerName=esphome
+Network=host
+Volume=/srv/esphome:/config
+Environment=TZ=America/Toronto
+# Initial flash of a new device needs USB serial access; OTA re-flashes of an
+# already-provisioned node don't. Uncomment and set the real path to flash
+# over USB (find it with `ls /dev/ttyUSB* /dev/ttyACM*` after plugging the
+# device in):
+#Volume=/dev/ttyUSB0:/dev/ttyUSB0
+#AddCapability=SYS_ADMIN
+
+[Service]
+Restart=always
+# First start pulls the image; PlatformIO also downloads toolchains on a
+# node's first compile — both want a working WAN, not just a fast one.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target