Add broker checker; correct EMQX version to 6.0.1

The broker is EMQX 6.0.1, not 5.x as first assumed -- 6.x keeps serving its
management API under /api/v5 for backward compatibility, so the API path is
not a version indicator. Menu paths in the setup guide verified against the
current EMQX documentation.

tools/check_broker.py verifies broker configuration end to end: anonymous
refused, made-up credentials refused, the configured account accepted, and
publishes permitted to both topic trees the firmware uses. It reads the local
config header by path and never prints the account secret, so its output is
safe to paste anywhere.

Two bugs found and fixed while testing it against the live broker:

  - paho 2.x hands the VERSION2 on_connect callback a ReasonCode object, not
    an int. int(rc) raised, every probe fell back to the timeout path, and the
    script reported an open broker as secure -- a false pass on the one check
    that most needs to be trustworthy.
  - An inconclusive result (timeout, transport error) was rendered as a pass.
    It now reports INCONCLUSIVE and fails the run, because "could not tell"
    must never read as "locked down".

The reason-code table now covers both MQTT 3.1.1 CONNACK codes and the MQTT 5
numbering paho normalises onto, so refusals print as text rather than 134/135.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/MQTT_SETUP.md

@@ -1,47 +1,62 @@
 # EMQX + Home Assistant setup
 
-Broker for this deployment: **EMQX 5.x at 192.168.1.31**.
+Broker for this deployment: **EMQX 6.0.1 at 192.168.1.31**.
 
-## 0. Starting state (probed 2026-08-14)
+Note that EMQX 6.x still serves its management API under `/api/v5` for
+backward compatibility — the API path is not a version indicator.
 
-| Check | Result |
-|---|---|
-| Listeners 1883 / 8883 / 8083 / 8084 / 18083 | all open |
-| Anonymous MQTT connect | **accepted** |
-| Connect with a made-up username/password | **accepted** |
-| Retained message publish + replay to a new client | works |
-| Existing retained topics on the broker | none — broker is empty |
-| Management API (`/api/v5/clients` etc.) | protected, HTTP 401 |
-| Public `/api/v5/status` | 200 (normal, by design) |
+## 0. Broker state
 
-**The MQTT data plane has no authenticator configured.** Any client on the LAN
-can connect, subscribe to `#`, and publish anywhere — including publishing to
-`homeassistant/...` discovery topics, which means anything on the network can
-create or overwrite entities in Home Assistant. The dashboard itself is fine;
-it's only the broker side that is open.
+Probed 2026-08-14, before and after the authenticator was created:
 
-Until step 1 is done, the `MQTT_USER` / `MQTT_PASSWORD` values in `secrets.h`
-are decorative — EMQX accepts them without checking, so a working node proves
-nothing about whether the credentials are right.
+| Check | Before | After |
+|---|---|---|
+| Listeners 1883 / 8883 / 8083 / 8084 / 18083 | all open | all open |
+| Anonymous MQTT connect | **accepted** | refused (bad username or password) |
+| Connect with a made-up username/password | **accepted** | refused (not authorized) |
+| Connect as `soil-node` from `secrets.h` | n/a | accepted |
+| Publish to `soil/#` | allowed | allowed |
+| Publish to `homeassistant/sensor/#` | allowed | allowed |
+| Retained publish + replay to a new client | works | works |
+| Management API (`/api/v5/clients`) | protected, HTTP 401 | protected |
+| Public `/api/v5/status` | 200 (normal, by design) | 200 |
 
-## 1. Enable authentication in EMQX
+The "before" column is what an EMQX install looks like with **no authenticator
+configured**: every client on the LAN can connect, subscribe to `#`, and
+publish anywhere — including to `homeassistant/...` discovery topics, meaning
+anything on the network could create or overwrite entities in Home Assistant.
+
+In that state the `MQTT_USER` / `MQTT_PASSWORD` values in `secrets.h` are
+decorative: EMQX accepts them without checking, so a node connecting
+successfully proves nothing about whether the credentials are correct.
+
+Re-run the check at any time:
+
+```bash
+python3 tools/check_broker.py
+```
+
+## 1. Enable authentication in EMQX  ✅ done
 
 Dashboard → **http://192.168.1.31:18083**
 
-1. **Access Control → Authentication → Create**
-2. Mechanism **Password-Based**, backend **Built-in Database**
+1. **Access Control → Authentication**, then **Create** (top right)
+2. Mechanism **Password-Based**, Backend **Built-in Database** → Next
 3. Configure:
-   - User ID Type: `username`
-   - Password Hash: `bcrypt` (salt rounds 10)
+   - **UserID Type**: `username` (matches the CONNECT packet's Username field,
+     which is what `MQTT_USER` in `secrets.h` sets)
+   - **Password Hash**: `bcrypt`
+   - **Salt Rounds**: 10 (valid range 5–10; higher is better)
 4. Create.
 
 The moment an authenticator exists, EMQX stops accepting anonymous
-connections — so create the users in step 2 before flashing anything, and
-expect Home Assistant to drop off the broker until you give it credentials too.
+connections. Existing sessions stay up until they next reconnect, so there is
+a grace period — but create the accounts in step 2 immediately, and expect
+Home Assistant to fall off the broker until you give it credentials too.
 
 ## 2. Create one account per client
 
-Under the authenticator you just made → **Users → Add**:
+Click the authenticator row you just created, then the **Users** tab → **Add**:
 
 | Username | Used by |
 |---|---|