van-router-mqtt: broker credentials in a separate 0600 file; log refused connects

config.json is re-rendered every deploy, so credentials go in
/etc/van-router-mqtt/credentials.json (seeded empty if absent, never
overwritten). The service logs MQTT connect/refuse/disconnect state changes,
and --post-check warns when the broker refuses the service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -330,6 +330,13 @@ post_check() {  # read-only live checks; every probe is guarded, warns instead o
     if [ -z "$out" ]; then warn "post-deploy: no default route"
     elif ping -c1 -W2 1.1.1.1 >/dev/null 2>&1; then echo "   ok    uplink: default route, 1.1.1.1 reachable"
     else warn "post-deploy: default route present but 1.1.1.1 does not answer ping"; fi
+    # g2. van-router-mqtt refused by the MQTT broker (logs state changes only, so the latest state line decides)
+    out=$(timeout 5 journalctl -u van-router-mqtt -b --no-pager -n 60 -q 2>/dev/null) || out=
+    out=$(awk '/MQTT connect refused by broker/ { s = "refused" } /MQTT connected/ { s = "connected" } END { print s }' <<<"$out")
+    case "$out" in
+        refused) warn "post-deploy: van-router-mqtt is refused by the MQTT broker — add credentials to /etc/van-router-mqtt/credentials.json (see the service journal)" ;;
+        connected) echo "   ok    van-router-mqtt: MQTT connection ok" ;;
+    esac
     if [ "$ENABLE_NM_WAN" = 1 ]; then
         local sysnet=${VANLINK_SYSNET:-/sys/class/net} nmst fst as_f as_l
         # h. NetworkManager must leave the AP/LAN radios and ports alone
@@ -1039,6 +1046,12 @@ echo "== router status (MQTT -> Home Assistant, replacing the Cockpit plugin abo
 install -D -m0755 router-status/van-router-mqtt        /usr/local/sbin/van-router-mqtt
 install_rendered router-status/config.json              /etc/van-router-mqtt/config.json
 install -D -m0644 router-status/van-router-mqtt.service /etc/systemd/system/van-router-mqtt.service
+# MQTT credentials live only on the system (0600, seeded empty if absent, never
+# overwritten): config.json above is re-rendered every deploy. Empty username =
+# anonymous, the correct state on brokers that allow it, so no warn here.
+if [ ! -f /etc/van-router-mqtt/credentials.json ]; then
+    install -D -m0600 router-status/credentials.json.example /etc/van-router-mqtt/credentials.json
+fi
 python3 -c 'import paho.mqtt' 2>/dev/null \
     || warn "python3-paho-mqtt missing (apt install python3-paho-mqtt) — van-router-mqtt won't start"
 # MQTT broker must listen on all interfaces (not just localhost) for clients on br0