Add EMQX broker setup guide and bring-up watcher

Target broker is EMQX 5.x at 192.168.1.31.

Probed its current state and documented it in docs/MQTT_SETUP.md: all
listeners up, retained messages working, management API protected (401),
but the MQTT data plane has no authenticator -- anonymous connects are
accepted, and so are arbitrary made-up credentials. Until an authenticator
exists, the broker account values in the local config header are decorative
and a successful connection proves nothing about them.

The guide covers creating the password-based authenticator, separate
soil-node and homeassistant accounts, per-account ACLs (including setting
no-match to Deny, without which the rules are cosmetic), pointing the HA
MQTT integration at EMQX, and a CONNACK/PubSubClient troubleshooting table.

tools/mqtt_watch.py watches the broker directly during bring-up. It answers
what the HA UI cannot: whether the retained discovery configs are actually
on the broker. Those are what HA rebuilds entities from after a restart, so
a node can look healthy today and disappear on the next HA restart if they
are missing. It reads its broker account secret from a file or environment
variable rather than argv, which is visible process-wide.

The broker IP is deliberately kept out of the committed template header,
since the Gitea repo is public.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -23,6 +23,11 @@ pio run -e mains -t upload -t monitor
 The node appears in Home Assistant under **Settings → Devices → MQTT** as
 *Soil Node XXXXXX* within a few seconds. No YAML.
 
+Broker and Home Assistant setup — including EMQX authentication and ACLs — is
+in [docs/MQTT_SETUP.md](docs/MQTT_SETUP.md). Read it before flashing: the
+broker at 192.168.1.31 currently accepts anonymous connections, so a node that
+connects successfully proves nothing about your credentials being right.
+
 Then calibrate the probes — see [docs/CALIBRATION.md](docs/CALIBRATION.md).
 The shipped calibration constants are placeholders and will read wrong.
 
@@ -70,6 +75,8 @@ src/net.*               Wi-Fi + MQTT session, LWT
 src/ha_discovery.*      HA auto-discovery payloads
 src/node_id.*           MAC-derived unique node identity
 docs/img/*.svg          Architecture, schematics and flow diagrams
+docs/MQTT_SETUP.md      EMQX auth/ACL + Home Assistant wiring
+tools/mqtt_watch.py     Broker-side bring-up watcher
 ```
 
 ## Diagrams