Add per-enclosure temperature metrics + Home Assistant MQTT publisher

- enclosure: fetch SES element descriptor page (0x07) and label temp/fan/
  psu/voltage elements with human-readable names
- temps service + /api/temps: per-enclosure hotspot (max across SES sensors
  and housed drive temps) plus named SES sensor list
- mqtt_publisher: paho-mqtt with HA discovery (device per enclosure, hotspot
  + per-sensor entities), LWT availability, opt-in via MQTT_HOST
- secrets: OpenBao KV v2 reader; MQTT creds sourced from secret/home_assistant
  with env fallback
- compose/requirements/README updated

docker-compose.yml

@@ -11,6 +11,8 @@ services:
       - /dev:/dev
       - /sys:/sys:ro
       - /run/udev:/run/udev:ro
+      # OpenBao RO token (claude-read) mounted read-only; never bake into image.
+      - /etc/jbod-monitor/openbao-token:/run/secrets/openbao-token:ro
     environment:
       - TZ=America/Denver
       - UVICORN_LOG_LEVEL=info
@@ -20,6 +22,22 @@ services:
       - REDIS_DB=0
       - SMART_CACHE_TTL=120
       - SMART_POLL_INTERVAL=90
+      # Home Assistant MQTT publishing (opt-in: leave MQTT_HOST unset to disable).
+      # EMQX at 10.5.30.3 is reachable by IP and bridged to the Mosquitto HA
+      # add-on, so discovery reaches Home Assistant either way.
+      - MQTT_HOST=10.5.30.3
+      - MQTT_PORT=1883
+      - MQTT_DISCOVERY_PREFIX=homeassistant
+      - MQTT_BASE_TOPIC=jbod-monitor
+      - MQTT_PUBLISH_INTERVAL=60
+      # Broker credentials sourced from OpenBao (secret/home_assistant,
+      # keys: mqtt_user/mqtt_pass). Falls back to MQTT_USERNAME/MQTT_PASSWORD
+      # env if the read fails. Token is the read-only claude-read token.
+      - OPENBAO_ADDR=https://vault.adamksmith.xyz
+      - OPENBAO_TOKEN_FILE=/run/secrets/openbao-token
+      - MQTT_SECRET_PATH=home_assistant
+      - MQTT_SECRET_USER_KEY=mqtt_user
+      - MQTT_SECRET_PASS_KEY=mqtt_pass
     depends_on:
       - redis