openhop/repeater: fixes from first real deploy on ubuntuHEADmain

- create spi/gpio groups and udev device rules (Raspberry Pi OS ships them, Ubuntu does not)
- hardware CS via spidev (cs_pin -1); a manual cs_pin on a kernel-owned CE line fails EBUSY
- align RAK6421 pin maps with upstream's hardware catalog: en_pins for the FEM enables,
  gpiod backend on chip 0 (catalog says chip 1, wrong for Pi 4)
- us RF preset is now MeshCore USA/Canada (Recommended): 910.525 / SF7 / BW62.5 / CR5
- set storage.storage_dir; omit mqtt_brokers entirely (any key enables the MQTT pusher)
- fetch radio-settings/radio-presets json into the data dir (pip omits them and the web
  setup wizard's hardware step is empty without them)
- config deployed 0660 with a vaultable repeater.security block so the daemon can persist
  credentials and re-templates no longer wipe them
- sudoers rule so the web UI can restart the service after config changes

1 files changed, 21 insertions, 5 deletions

diff --git a/openhop/repeater/templates/config.yaml.j2 b/openhop/repeater/templates/config.yaml.j2
index ddd2772..a26cd05 100644
--- a/openhop/repeater/templates/config.yaml.j2
+++ b/openhop/repeater/templates/config.yaml.j2
@@ -12,6 +12,20 @@ repeater:
   score_threshold: 0.3
   send_advert_interval_hours: 10
   allow_discovery: true
+{% if repeater_admin_password or repeater_jwt_secret %}
+  security:
+{% if repeater_admin_password %}
+    admin_password: "{{ repeater_admin_password }}"
+{% endif %}
+{% if repeater_jwt_secret %}
+    jwt_secret: "{{ repeater_jwt_secret }}"
+{% endif %}
+{% endif %}
+
+# The daemon defaults its auth DB and telemetry to /var/lib/openhop_repeater
+# regardless of other paths, so point it at the role-managed data dir.
+storage:
+  storage_dir: "{{ repeater_data_dir }}"
 
 radio_type: sx1262
 
@@ -24,6 +38,9 @@ sx1262:
   irq_pin: {{ repeater_sx1262_irq_pin }}
   txen_pin: {{ repeater_sx1262_txen_pin }}
   rxen_pin: {{ repeater_sx1262_rxen_pin }}
+  en_pins: {{ repeater_sx1262_en_pins | to_json }}
+  gpio_chip: {{ repeater_sx1262_gpio_chip }}
+  use_gpiod_backend: {{ repeater_sx1262_use_gpiod_backend | string | lower }}
   en_pin: -1
   txled_pin: -1
   rxled_pin: -1
@@ -41,11 +58,10 @@ radio:
   preamble_length: {{ repeater_preamble_length }}
   implicit_header: false
 
-# Observer/telemetry disabled — repeater-only deployment.
-mqtt_brokers:
-  iata_code: "Test"
-  status_interval: 300
-  brokers: []
+# Observer/telemetry disabled: repeater-only deployment. The daemon enables
+# its MQTT pusher whenever an mqtt_brokers/letsmesh/mqtt key is present, even
+# with an empty broker list (and then warns on every noise-floor sample), so
+# the section must be omitted entirely.
 
 glass:
   enabled: false