🚧 Add broker status page

backend/app/main.py

@@ -66,6 +66,21 @@ async def lifespan(app: FastAPI):
     try:
         dynsec_client.connect()
         logger.info("dynamic security channel connected")
+        from app import metrics
+
+        dynsec_client.set_event_sink(metrics.handle_sys_message)
+        # Best effort: ensure the management identity can read $SYS —
+        # the 2.1 auto-generated admin role set does not guarantee it
+        # (see the compose healthcheck note). sys-observe is one of the
+        # plugin's default roles (read-only $SYS/#); addClientRole is
+        # idempotent broker-side.
+        try:
+            dynsec_client.add_client_role(
+                settings.mosquitto_dynsec_username, "sys-observe", priority=1
+            )
+            logger.info("sys-observe role granted to the management identity")
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("could not grant sys-observe: %s", exc)
     except Exception as exc:  # noqa: BLE001 - startup should not crash the API
         logger.warning("dynsec channel not ready yet: %s", exc)
     yield