feat(zigbee): add MQTT TLS support with optional cert verify skip

- Schema: mqtt_tls + mqtt_tls_insecure flags on import + test-connection
  requests; model_validator enforces insecure requires tls
- Service: _build_tls_context() using ssl.create_default_context();
  logger.warning when verification disabled; tls_context plumbed into
  aiomqtt.Client for both fetch_networkmap and test_mqtt_connection
- Route: passes tls flags through to service
- Frontend: TLS checkbox auto-toggles port 1883<->8883 unless user
  edited; insecure checkbox disabled until TLS on, red-tinted; password
  field marked autocomplete=new-password
- Tests: 7 new backend tests (TLS context build, client kwargs assertion,
  router happy path, insecure-without-tls 422)

backend/app/api/routes/zigbee.py

@@ -38,6 +38,8 @@ async def import_zigbee_network(
             base_topic=payload.base_topic,
             username=payload.mqtt_username,
             password=payload.mqtt_password,
+            tls=payload.mqtt_tls,
+            tls_insecure=payload.mqtt_tls_insecure,
         )
     except ImportError as exc:
         raise HTTPException(status_code=500, detail=str(exc)) from exc
@@ -68,6 +70,8 @@ async def test_zigbee_connection(
             mqtt_port=payload.mqtt_port,
             username=payload.mqtt_username,
             password=payload.mqtt_password,
+            tls=payload.mqtt_tls,
+            tls_insecure=payload.mqtt_tls_insecure,
         )
         return ZigbeeTestConnectionResponse(connected=True, message="Connection successful")
     except ImportError as exc:

backend/app/schemas/zigbee.py

@@ -1,6 +1,6 @@
 """Pydantic v2 schemas for Zigbee2MQTT import."""
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
 
 
 class ZigbeeImportRequest(BaseModel):
@@ -9,6 +9,16 @@ class ZigbeeImportRequest(BaseModel):
     mqtt_username: str | None = Field(None, description="MQTT username (optional)")
     mqtt_password: str | None = Field(None, description="MQTT password (optional)")
     base_topic: str = Field("zigbee2mqtt", description="Zigbee2MQTT base topic")
+    mqtt_tls: bool = Field(False, description="Enable TLS (typically port 8883)")
+    mqtt_tls_insecure: bool = Field(
+        False, description="Skip TLS certificate verification (self-signed only)"
+    )
+
+    @model_validator(mode="after")
+    def _insecure_requires_tls(self) -> "ZigbeeImportRequest":
+        if self.mqtt_tls_insecure and not self.mqtt_tls:
+            raise ValueError("mqtt_tls_insecure requires mqtt_tls=true")
+        return self
 
 
 class ZigbeeTestConnectionRequest(BaseModel):
@@ -16,6 +26,14 @@ class ZigbeeTestConnectionRequest(BaseModel):
     mqtt_port: int = Field(1883, ge=1, le=65535)
     mqtt_username: str | None = None
     mqtt_password: str | None = None
+    mqtt_tls: bool = False
+    mqtt_tls_insecure: bool = False
+
+    @model_validator(mode="after")
+    def _insecure_requires_tls(self) -> "ZigbeeTestConnectionRequest":
+        if self.mqtt_tls_insecure and not self.mqtt_tls:
+            raise ValueError("mqtt_tls_insecure requires mqtt_tls=true")
+        return self
 
 
 class ZigbeeDeviceData(BaseModel):

backend/app/services/zigbee_service.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import ssl
 from typing import Any
 
 logger = logging.getLogger(__name__)
@@ -20,6 +21,19 @@ _CONNECTION_TIMEOUT = 5.0   # seconds to verify broker reachability
 _NETWORKMAP_TIMEOUT = 10.0  # seconds to wait for the networkmap response
 
 
+def _build_tls_context(insecure: bool) -> ssl.SSLContext:
+    """Build an SSL context for MQTT TLS. If insecure, skip verification."""
+    ctx = ssl.create_default_context()
+    if insecure:
+        logger.warning(
+            "MQTT TLS certificate verification is DISABLED — "
+            "use only with self-signed brokers on trusted networks."
+        )
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+    return ctx
+
+
 def _z2m_type_to_homelable(device_type: str) -> str:
     """Map a Z2M device type string to a homelable node type."""
     mapping = {
@@ -159,6 +173,8 @@ async def fetch_networkmap(
     base_topic: str,
     username: str | None = None,
     password: str | None = None,
+    tls: bool = False,
+    tls_insecure: bool = False,
 ) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
     """Connect to the MQTT broker, request the Z2M networkmap, and return (nodes, edges).
 
@@ -179,6 +195,8 @@ async def fetch_networkmap(
     result_event: asyncio.Event = asyncio.Event()
     response_payload: dict[str, Any] = {}
 
+    tls_context = _build_tls_context(tls_insecure) if tls else None
+
     try:
         async with aiomqtt.Client(
             hostname=mqtt_host,
@@ -186,6 +204,7 @@ async def fetch_networkmap(
             username=username,
             password=password,
             timeout=_CONNECTION_TIMEOUT,
+            tls_context=tls_context,
         ) as client:
             await client.subscribe(response_topic)
             await client.publish(
@@ -229,6 +248,8 @@ async def test_mqtt_connection(
     mqtt_port: int,
     username: str | None = None,
     password: str | None = None,
+    tls: bool = False,
+    tls_insecure: bool = False,
 ) -> bool:
     """Attempt a quick MQTT connection to verify broker reachability.
 
@@ -237,6 +258,8 @@ async def test_mqtt_connection(
     if aiomqtt is None:  # pragma: no cover
         raise ImportError("aiomqtt is required")
 
+    tls_context = _build_tls_context(tls_insecure) if tls else None
+
     try:
         async with aiomqtt.Client(
             hostname=mqtt_host,
@@ -244,6 +267,7 @@ async def test_mqtt_connection(
             username=username,
             password=password,
             timeout=_CONNECTION_TIMEOUT,
+            tls_context=tls_context,
         ):
             return True
     except aiomqtt.MqttError as exc: