van-router-mqtt: broker credentials in a separate 0600 file; log refused connects

config.json is re-rendered every deploy, so credentials go in
/etc/van-router-mqtt/credentials.json (seeded empty if absent, never
overwritten). The service logs MQTT connect/refuse/disconnect state changes,
and --post-check warns when the broker refuses the service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

README.md

@@ -149,6 +149,9 @@ hog); left in place until the Home Assistant dashboard fully covers its actions.
 | `van-router-mqtt` | `/usr/local/sbin/van-router-mqtt` | status+control daemon (Python, paho-mqtt): AP/clients/Starlink/WAN/modem, HA MQTT discovery; republishes van-failover/van-thermal/van-battery's own state.json verbatim rather than recomputing them |
 | `config.json` | `/etc/van-router-mqtt/config.json` | broker + interface identifiers (`@TOKEN@` templated like `failover/config.json` — no secrets, rendered fresh every deploy) |
 | `van-router-mqtt.service` | `/etc/systemd/system/van-router-mqtt.service` | `Restart=always` |
+| `credentials.json.example` | → `/etc/van-router-mqtt/credentials.json` (seeded if absent) | MQTT `username`/`password`, needed only when the broker requires authentication (empty username = anonymous); 0600, never overwritten by deploys since `config.json` is re-rendered each time |
+
+The MQTT credentials live in `/etc/van-router-mqtt/credentials.json` (0600, not overwritten by deploys) and are needed only when the broker requires authentication. The service logs a refused connect once, and `./deploy.sh --post-check` flags it.
 
 ### `power/` — never sleep + thermal monitor
 | file | → installs to | purpose |