router-status: replace Cockpit's Van Router plugin with MQTT -> Home Assistant

Cockpit's login was unreliable (Firefox rejected sometimes, Android failed
outright with a TLS handshake error) and it was a resource hog on this Pi.
van-router-mqtt publishes the same AP/client/WAN/Starlink/modem status and
accepts the same control actions (AP/modem restart, WAN connect/disconnect,
prefer) via MQTT with HA discovery, using the local Mosquitto broker already
running here. It republishes van-failover/van-thermal's own state.json files
verbatim rather than modifying either daemon (van-thermal is deliberately
stdlib-only; van-failover's control loop wasn't worth an added dependency).

Adds a Lovelace dashboard (ha/dashboards/van-router.yaml) consuming those
entities. Cockpit's plugin is left deployed for now, not yet retired.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S2tpeaiHUriQbbnQ4SCbkf

deploy.sh

@@ -176,6 +176,18 @@ install -D -m0644 cockpit/cockpit-session-nofile.conf /etc/systemd/system/cockpi
 command -v grpcurl >/dev/null 2>&1 \
     || warn "grpcurl missing (Starlink card will say so): install linux_arm64 binary from github.com/fullstorydev/grpcurl/releases"
 
+echo "== router status (MQTT -> Home Assistant, replacing the Cockpit plugin above) =="
+# Same status/actions as the cockpit plugin, published via MQTT discovery
+# instead of a web UI of its own (Cockpit's login was unreliable and it was a
+# resource hog on this Pi). No secrets in config.json (the local Mosquitto
+# broker currently allows anonymous connections) so it's rendered + installed
+# every deploy, same as failover/config.json.
+install -D -m0755 router-status/van-router-mqtt        /usr/local/sbin/van-router-mqtt
+install_rendered router-status/config.json              /etc/van-router-mqtt/config.json
+install -D -m0644 router-status/van-router-mqtt.service /etc/systemd/system/van-router-mqtt.service
+python3 -c 'import paho.mqtt' 2>/dev/null \
+    || warn "python3-paho-mqtt missing (apt install python3-paho-mqtt) — van-router-mqtt won't start"
+
 echo "== gps (cellular modem GNSS -> gpsd) =="
 if dpkg -s gpsd >/dev/null 2>&1; then
     install -D -m0644 gps/77-modem-gps.rules /etc/udev/rules.d/77-modem-gps.rules
@@ -260,7 +272,7 @@ systemctl restart systemd-resolved
 # its wait-online would just stall network-online.target. NM-wait-online covers WANs.
 systemctl mask systemd-networkd-wait-online.service >/dev/null 2>&1 || true
 systemctl unmask hostapd >/dev/null 2>&1 || true
-systemctl enable regdomain.service hostapd hostapd-2g van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-nvme-watch van-ap-watchdog van-ap-watchdog-2g van-wlan-watchdog van-modem-watch van-sms-watch van-gps-owntracks van-li3-battery >/dev/null 2>&1 || true
+systemctl enable regdomain.service hostapd hostapd-2g van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-nvme-watch van-ap-watchdog van-ap-watchdog-2g van-wlan-watchdog van-modem-watch van-sms-watch van-gps-owntracks van-li3-battery van-router-mqtt >/dev/null 2>&1 || true
 # bluetooth: host BlueZ serves the onboard hci0 to the HA container over D-Bus
 systemctl enable --now bluetooth >/dev/null 2>&1 || true
 systemctl start homeassistant || warn "homeassistant failed to start (podman/quadlet — check journalctl -u homeassistant)"
@@ -271,6 +283,7 @@ systemctl restart van-nvme-watch
 systemctl restart van-sms-watch
 systemctl restart van-gps-owntracks
 systemctl restart van-li3-battery
+systemctl restart van-router-mqtt
 # Pick up unmanaged-devices changes so NM releases/keeps the right interfaces.
 nmcli general reload 2>/dev/null || systemctl reload NetworkManager 2>/dev/null || true
 # restart in dependency order: bridge + members first, then hostapd enslaves the
@@ -297,4 +310,5 @@ echo "  cat /run/van-failover/state.json"
 echo "  cat /run/van-thermal/state.json"
 echo "  cat /run/van-nvme-watch/state.json"
 echo "  journalctl -u van-li3-battery -n 20"
+echo "  journalctl -u van-router-mqtt -n 20 ; mosquitto_sub -h localhost -t 'van/router/#' -v -C 8"
 echo "  journalctl -u van-sms-watch -n 20 ; tail -f /var/log/van-sms.jsonl"