nodered: its MQTT broker comes from the mesh

Node-RED's one broker node pointed at zurag.be:1884, where nothing listens. nodered now requires
mqtt-topic (asking for every topic: flows follow the devices' own) and a run-once `mqtt` step —
declared last, restarted when the binding, credential or settings change — points the mesh's broker
nodes at the bound broker through Node-RED's admin API with the module's api-token: the node the
step makes itself when none is named, or the ones an assignment names in `mqtt.brokers`. Only host,
port, TLS and the login change; the broker is asked first whether it takes the login; the deploy is
against the revision read ("nodes", so only that node restarts) and a digest makes a rerun a no-op.
A broker node nobody named is never touched. settings.js keeps `mqtt` and `topics` out of Node-RED.

modules/nodered/client.ts

@@ -82,6 +82,35 @@ export class NodeRedClient {
     return modules.map((m) => ({ name: m.name, version: m.version, types: m.types ?? [] }));
   }
 
+  /** The whole flow configuration with its revision (API v2), for a deploy that must not clobber
+   *  a change made meanwhile. */
+  async flowsWithRev(): Promise<{ rev: string; flows: any[] }> {
+    const body = await this.req("/flows", { headers: this.headers({ "Node-RED-API-Version": "v2" }) });
+    return { rev: String(body?.rev ?? ""), flows: Array.isArray(body?.flows) ? body.flows : [] };
+  }
+
+  /** A node's stored credentials as Node-RED shows them: plain fields, and `has_<field>` for secret ones. */
+  async credentials(type: string, id: string): Promise<{ user?: string; has_password?: boolean }> {
+    return (await this.req(`/credentials/${encodeURIComponent(type)}/${encodeURIComponent(id)}`, { headers: this.headers() })) ?? {};
+  }
+
+  /**
+   * Deploy the flow configuration read at `rev`. Node-RED answers 409 when the flows changed since,
+   * rather than overwriting what someone deployed in between. A node carrying `credentials` has them
+   * stored (encrypted) and counts as changed, so a "nodes" deploy restarts it and nothing else.
+   */
+  async deployFlowsAt(rev: string, config: any[], type = "nodes"): Promise<void> {
+    await this.req("/flows", {
+      method: "POST",
+      headers: this.headers({
+        "Content-Type": "application/json",
+        "Node-RED-API-Version": "v2",
+        "Node-RED-Deployment-Type": type,
+      }),
+      body: JSON.stringify({ rev, flows: config }),
+    });
+  }
+
   /**
    * Replace the whole flow configuration and deploy. Returns the new revision. `type` maps to
    * Node-RED's deployment types — "full" (default), "nodes", or "flows".