Fix watchdog timeout and MQTT connectivity issues

Problem: R5C spontaneously rebooted due to hardware watchdog timeout
Cause 1: van-gps-owntracks in infinite restart loop (MQTT connect failed)
Cause 2: mosquitto only listening on localhost, so clients couldn't connect
Solution:
- Add restart limits to van-gps-owntracks and van-li3-battery services
  (max 3 restarts per 5 minutes prevents infinite restart loops)
- Configure mosquitto to listen on all interfaces (0.0.0.0:1883)
- Deploy mosquitto listener config via deploy.sh
- Restart mosquitto during deploy to apply config changes

This prevents the system from hitting the 11-second hardware watchdog timeout
when services crash and systemd auto-restarts them indefinitely.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

ha/homeassistant.container.bak

@@ -0,0 +1,37 @@
+# Home Assistant Container as a Podman Quadlet (replaced the ha_van HAOS VM
+# 2026-07-07 — the fixed 2 GiB VM allocation starved the 4 GB Pi; VM domain XML
+# is in git history under ha/ha_van.xml). Installed by deploy.sh to
+# /etc/containers/systemd/; systemd generates homeassistant.service from it.
+#
+# Host networking: HA binds :8123 on the host directly, so the LAN URL is
+# http://10.42.0.1:8123 (name: homeassistant) — no bridge port, no DNAT.
+# /run/dbus gives HA the host BlueZ stack = the Pi's onboard Bluetooth (hci0).
+[Unit]
+Description=Home Assistant (Podman container)
+Wants=network-online.target bluetooth.service
+After=network-online.target bluetooth.service
+
+[Container]
+Image=ghcr.io/home-assistant/home-assistant:stable
+ContainerName=homeassistant
+Network=host
+Volume=/srv/homeassistant:/config
+Volume=/run/dbus:/run/dbus:ro
+Environment=TZ=America/Toronto
+# Bluetooth needs two escapes: Ubuntu's dbus-daemon mediates D-Bus per
+# AppArmor label and the default containers profile can't send to BlueZ
+# (AddMatch denied), and habluetooth wants NET_ADMIN+NET_RAW for adapter
+# recovery. HA is rootful + host-net anyway.
+PodmanArgs=--security-opt apparmor=unconfined
+AddCapability=NET_ADMIN NET_RAW
+# Podman's default 10s stop window SIGKILLs HA mid-flush and the recorder
+# complains about an unclean sqlite shutdown on the next start.
+StopTimeout=120
+
+[Service]
+Restart=always
+# First start pulls the image (~600 MB) — allow for a slow uplink.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target