fix: pass mqtt credentials through compose

tests/test_config_contracts.py

@@ -96,11 +96,37 @@ class ConfigurationTests(unittest.TestCase):
         config = load_config(environ=env)
         self.assertEqual(config.mqtt.host, "broker")
         self.assertEqual(config.mqtt.port, 2883)
+        self.assertEqual(config.mqtt.username, "user")
+        self.assertEqual(config.mqtt.password, "pass")
         self.assertEqual(config.storage.media_base, Path("/media-test"))
         self.assertEqual(config.storage.data_base, Path("/data-test"))
         self.assertIsNone(config.downloads.cookie_path)
         self.assertEqual(config.web.port, 9000)
 
+    def test_blank_optional_mqtt_credentials_are_treated_as_unset(self):
+        config = load_config(
+            environ={
+                "MQTT_USERNAME": "",
+                "MQTT_PASSWORD": "  ",
+            }
+        )
+        self.assertIsNone(config.mqtt.username)
+        self.assertIsNone(config.mqtt.password)
+
+    def test_blank_compose_credentials_do_not_mask_yaml_credentials(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "config.yaml"
+            path.write_text(
+                "mqtt:\n  username: yaml-user\n  password: yaml-pass\n",
+                encoding="utf-8",
+            )
+            config = load_config(
+                path,
+                environ={"MQTT_USERNAME": "", "MQTT_PASSWORD": ""},
+            )
+        self.assertEqual(config.mqtt.username, "yaml-user")
+        self.assertEqual(config.mqtt.password, "yaml-pass")
+
     def test_slot_count_cannot_break_stable_identities(self):
         with tempfile.TemporaryDirectory() as directory:
             path = Path(directory) / "config.yaml"