feat: Phase 3 manufacturing + firmware management

.env.example

@@ -13,11 +13,16 @@ MQTT_BROKER_PORT=1883
 MQTT_ADMIN_USERNAME=admin
 MQTT_ADMIN_PASSWORD=your-mqtt-admin-password
 MOSQUITTO_PASSWORD_FILE=/etc/mosquitto/passwd
+# HMAC secret used to derive per-device MQTT passwords (must match firmware)
+MQTT_SECRET=change-me-in-production
 
 # App
 BACKEND_CORS_ORIGINS=["http://localhost:5173"]
 DEBUG=true
+# Port nginx binds on the host (use 90 on VPS if 80 is taken)
+NGINX_PORT=80
 
 # Local file storage (override if you want to store data elsewhere)
 SQLITE_DB_PATH=./mqtt_data.db
 BUILT_MELODIES_STORAGE_PATH=./storage/built_melodies
+FIRMWARE_STORAGE_PATH=./storage/firmware