fix: pass mqtt credentials through compose

tests/test_config_contracts.py

@@ -96,11 +96,37 @@ class ConfigurationTests(unittest.TestCase):
         config = load_config(environ=env)
         self.assertEqual(config.mqtt.host, "broker")
         self.assertEqual(config.mqtt.port, 2883)
+        self.assertEqual(config.mqtt.username, "user")
+        self.assertEqual(config.mqtt.password, "pass")
         self.assertEqual(config.storage.media_base, Path("/media-test"))
         self.assertEqual(config.storage.data_base, Path("/data-test"))
         self.assertIsNone(config.downloads.cookie_path)
         self.assertEqual(config.web.port, 9000)
 
+    def test_blank_optional_mqtt_credentials_are_treated_as_unset(self):
+        config = load_config(
+            environ={
+                "MQTT_USERNAME": "",
+                "MQTT_PASSWORD": "  ",
+            }
+        )
+        self.assertIsNone(config.mqtt.username)
+        self.assertIsNone(config.mqtt.password)
+
+    def test_blank_compose_credentials_do_not_mask_yaml_credentials(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "config.yaml"
+            path.write_text(
+                "mqtt:\n  username: yaml-user\n  password: yaml-pass\n",
+                encoding="utf-8",
+            )
+            config = load_config(
+                path,
+                environ={"MQTT_USERNAME": "", "MQTT_PASSWORD": ""},
+            )
+        self.assertEqual(config.mqtt.username, "yaml-user")
+        self.assertEqual(config.mqtt.password, "yaml-pass")
+
     def test_slot_count_cannot_break_stable_identities(self):
         with tempfile.TemporaryDirectory() as directory:
             path = Path(directory) / "config.yaml"

tests/test_runtime_assets.py

@@ -213,6 +213,18 @@ class ComposeRuntimeTests(unittest.TestCase):
                     published_targets.add(match.group(1))
         self.assertIn("7531", published_targets)
 
+    def test_compose_passes_all_supported_mqtt_environment_overrides(self):
+        environment = _environment_map(self.service.get("environment"))
+        for name in (
+            "MQTT_HOST",
+            "MQTT_PORT",
+            "MQTT_USERNAME",
+            "MQTT_PASSWORD",
+            "MQTT_CLIENT_ID",
+        ):
+            with self.subTest(name=name):
+                self.assertIn(name, environment)
+
     def test_compose_uses_dedicated_data_media_and_cookie_mounts(self):
         mounts = _volume_mounts(self.service.get("volumes"))
         by_target = {target: (source, read_only) for source, target, read_only in mounts}