Fix R15: pass MQTT passwords to the broker without shell interpolation

gen-passwd.sh embedded passwords in `sh -c "..."`, which breaks or injects for
strong passwords containing quotes/$/;. Export them and forward with bare
`-e NAME`, reading them as env vars inside a single-quoted container script — any
character is now handled safely.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/mosquitto/gen-passwd.sh

@@ -24,11 +24,18 @@ LPASS="$(ensure_pw MQTT_AUTH_PASSWORD)"
 SPASS="$(ensure_pw MQTT_SHELLY_PASSWORD)"
 DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)"
 
-docker run --rm -v "$(pwd)/docker/mosquitto/config:/cfg" eclipse-mosquitto:2 sh -c "
-    rm -f /cfg/passwd
-    mosquitto_passwd -c -b /cfg/passwd laravel '${LPASS}'
-    mosquitto_passwd -b /cfg/passwd shelly  '${SPASS}'
-    mosquitto_passwd -b /cfg/passwd sidecar '${DPASS}'
-    chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
-"
+# Export + forward with bare `-e NAME` so docker passes the values verbatim (no host
+# interpolation). Read inside the container (single-quoted body) as env vars, so any
+# character in a password — quotes, $, ;, backticks — is handled safely.
+export LPASS SPASS DPASS
+
+docker run --rm -e LPASS -e SPASS -e DPASS \
+    -v "$(pwd)/docker/mosquitto/config:/cfg" \
+    eclipse-mosquitto:2 sh -c '
+        rm -f /cfg/passwd
+        mosquitto_passwd -c -b /cfg/passwd laravel "$LPASS"
+        mosquitto_passwd -b /cfg/passwd shelly  "$SPASS"
+        mosquitto_passwd -b /cfg/passwd sidecar "$DPASS"
+        chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
+    '
 echo 'Mosquitto passwd generated (users: laravel, shelly, sidecar).'