Add MQTT diagnostics, broker connection probe, and switch to Debian base

The MQTT publisher now tracks connection state, publish counters, discovery
and availability timestamps, and the last error, exposed at /api/mqtt and on
the dashboard as an MQTT card and a Home Assistant section. Connection
failures, disconnects, and dropped publishes are logged; paho's
on_connect_fail callback was not registered before, so failed attempts were
silent. MQTT connect, disconnect, and unreachable events go to the timeline.

When a connection attempt fails the service runs a probe from inside the
container: system resolver, each nameserver from resolv.conf queried directly,
/etc/hosts, and a TCP connect to every address found. The result is shown as
a summary and raw JSON on the dashboard and can be rerun via
POST /api/mqtt/probe.

The image base moves from Alpine to Debian slim. musl queries all
nameservers in parallel and accepts the first reply, so a fast public
NXDOMAIN beats a slower local server that knows the name. glibc asks the
nameservers in order.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -16,6 +16,8 @@ Assistant as a device with sensors and no manual configuration.
 | `/` | Dashboard: status, Wi-Fi, graphs, timeline |
 | `/api/status` | Latest state of every monitor as JSON |
 | `/api/wifi` | Interface list, link details, last scan results |
+| `/api/mqtt` | MQTT connection state, counters, last error, last published payload, last probe |
+| `POST /api/mqtt/probe` | Run the broker connection probe now and return its result |
 | `/api/events?limit=200` | Timeline events, newest first |
 | `/api/samples?prefix=reach.&range=3600` | Bucketed samples for graphs |
 
@@ -89,6 +91,7 @@ All settings are environment variables. Intervals are in seconds.
 - Wi-Fi connected, disconnected, roamed to another BSSID
 - Host rebooted
 - Health check service started
+- MQTT connected, disconnected, cannot reach broker
 
 ## Home Assistant
 
@@ -100,6 +103,23 @@ availability to `healthcheck/<device_id>/availability`. When Home Assistant
 restarts it announces itself on `homeassistant/status` and the service
 re-publishes discovery.
 
+The dashboard has an MQTT card and a Home Assistant section showing the
+connection state, when it last connected or failed, how many messages were
+published or dropped, when discovery and availability were last sent, and the
+last state payload. The same data is at `/api/mqtt`. Use it to tell an app-side
+problem (not connected, publishes dropped) from a Home Assistant-side one
+(connected and publishing, but the device is still unavailable).
+
+When a connection attempt fails the service runs a probe from inside the
+container, at most every two minutes: it resolves the broker name with the
+system resolver, queries each nameserver from `/etc/resolv.conf` directly,
+checks `/etc/hosts`, and tries a TCP connect to every address it found. The
+result is shown as a summary and as raw JSON in the Home Assistant section, and
+can be rerun from the dashboard. If the nameservers disagree about the broker
+name, for example a local server that knows it and a public one that does not,
+the probe says so. The image is Debian based, so glibc asks the nameservers in
+resolv.conf order and only moves on when one does not answer.
+
 Entities per device:
 
 - Internet, DNS, Wi-Fi (binary sensors, `connectivity` class)
@@ -119,5 +139,5 @@ Publish a new image for all Raspberry Pi architectures:
 
 ```sh
 docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 \
-  -t hiimmilan/health-check:latest -t hiimmilan/health-check:2.0.0 --push .
+  -t hiimmilan/health-check:latest -t hiimmilan/health-check:2.3.0 --push .
 ```