feat(mqtt-auth): put legacy "vesper" password behind MQTT_ALLOW_LEGACY_PASSWORD

The shared legacy password is still needed for boards on pre-HMAC
firmware, but it was accepted for any username. Now:
- controlled by MQTT_ALLOW_LEGACY_PASSWORD (config.py, default true;
  documented in .env.example) so it can be switched off without a deploy,
- only accepted for device-shaped usernames (uppercase alphanumeric
  segments joined by "-", optional "-kiosk"), never for app_ users or
  any other shape,
- every successful legacy login is logged at WARNING with the username,
  rate-limited to once per username per hour, so the boards still
  depending on it are visible before the flag is turned off.

HMAC auth is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/config.py

@@ -19,6 +19,9 @@ class Settings(BaseSettings):
     mqtt_admin_username: str = "admin"
     mqtt_admin_password: str = ""
     mqtt_secret: str = "change-me-in-production"
+    # Accept the old shared "vesper" password for device-shaped usernames
+    # (boards on pre-HMAC firmware). Turn off once the logs show no users.
+    mqtt_allow_legacy_password: bool = True
     mosquitto_password_file: str = "/etc/mosquitto/passwd"
     mqtt_client_id: str = "bellsystems-admin-panel"