Add local MQTT broker and IoT hardware ingress pipeline

[d3mocide]

Adds Mosquitto as a core container (always-on, no profile flag) and a new
mqtt_subscriber poller that dispatches incoming messages to per-normalizer
handlers. Replaces the unstable TinyGS REST-only integration with a proper
local-node MQTT path while keeping the REST poller as an opt-in fallback.

Infrastructure:

• docker-compose.yml: mosquitto service (eclipse-mosquitto:2), mosquitto_data
  volume, LAN port 1883 (MQTT_PORT), poller now depends on mosquitto health
• infra/mosquitto/mosquitto.conf: anonymous, plaintext, local-network-only

Data pipeline (poller):

• pollers/mqtt_subscriber.py: groups sources by broker, one aiomqtt connection
  per broker, MQTT wildcard topic matching, reconnects on failure
• normalizers/tinygs_mqtt.py: tinygs_satellite entities + satellite_contact
  events from local TinyGS node packets (SNR, RSSI, satPos, decoded payload)
• normalizers/rtl_433.py: rf_sensor entities at home coords from RTL_433 SDR
  decoded frames (temperature, humidity, wind, power, etc.)
• normalizers/meshtastic_mqtt.py: mesh_node entities from Meshtastic JSON MQTT
  uplink; text messages fenced from MeshCore by source_url prefix "mqtt:"
• normalizers/ais_mqtt.py: vessel entities via AIS-catcher MQTT output,
  delegates to existing normalize_ais_catcher, alternative to WebSocket poller
• db.py: add write_mesh_message() for Meshtastic MQTT chat persistence

Config layer (both backend and poller):

• config_loader.py (x2): MqttSourceEntry model, added to SourcesConfig
• config_writer.py: add/remove/update_mqtt_entry keyed by name (not url)
• config_sync.py: _sync_mqtt_sources with full config/user diff semantics
• db/init/10_mqtt_sources.sql: mqtt_sources table (no credential columns)

API:

• routers/sources.py: GET/POST/PATCH/DELETE /sources/mqtt endpoints
• routers/admin.py: tinygs_satellite and rf_sensor added to _TYPE_TO_POLLER
• db/models.py: MqttSource ORM model

Auth: boolean auth_enabled gate per source; credentials from env vars
MQTT_{UPPER_SNAKE_NAME}_USERNAME/PASSWORD — never stored in DB or YAML

Frontend:

• storeTypes.ts: tinygs_satellite and rf_sensor added to EntityTypeFilter
• store.ts: defaults (true) and TTLs (3600s satellite, 900s sensor)
• MapOverlay.tsx: entityFilterRef initializer updated to include new types

Config docs:

• sources.example.yml: mqtt_sources section with all four source types
• .env.example: MQTT_PORT, auth credential naming convention, updated
  TINYGS_ENABLED comment pointing users toward local MQTT path