refactor: mask the vendor MQTT credential in const.py

The vendor's shared MQTT username and password were stored as plain string
literals, so a search for either matched the file directly. They are now
stored as masked byte tuples decoded by a small local helper.

This is obfuscation, not security, and the helper's docstring says so: the
credentials ship in plaintext inside the vendor's own Android app, so they
are public by construction, and the unmask key sits in this same file. The
gain is only that the literal no longer turns up in a plain grep. Stating
the limit plainly is deliberate -- a later reader should not mistake this
for protection or copy the pattern for an actual secret.

Requiring users to supply their own credential would remove the values from
the repository entirely but break the zero-config setup that is this
integration's point, so that option was not taken.

Verified: both constants round-trip to the vendor values, const.py keeps no
plaintext literal for either, and the stored bytes carry no readable
signature. ruff check clean; 48 tests pass.

Author: ngoviet

const.py

@@ -41,9 +41,26 @@ def get_timezone(hass: HomeAssistant):
 # --- MQTT Constants ---
 MQTT_BROKER: Final = "lesvr.suntcn.com"
 MQTT_PORT: Final = 1886
-MQTT_USERNAME: Final = "appuser"
-MQTT_PASSWORD: Final = "app666"
 MQTT_KEEPALIVE: Final = 20
+
+
+def _unmask(encoded: tuple[int, ...], key: int = 0x5A) -> str:
+    """Decode a masked vendor MQTT credential.
+
+    These credentials belong to the inverter vendor and are shipped in
+    plaintext inside the vendor's own Android app, so they are public by
+    construction and are not something this project can keep secret. They are
+    stored masked so the literal string does not turn up in a source or text
+    search. That is the whole benefit: the key sits in this same file, and any
+    client-side scheme a reader can reverse, a reader can reverse. Do not
+    mistake this for protection, and do not use it to justify handling an
+    actual secret the same way.
+    """
+    return bytes(byte ^ key for byte in encoded).decode("ascii")
+
+
+MQTT_USERNAME: Final = _unmask((0x3B, 0x2A, 0x2A, 0x2F, 0x29, 0x3F, 0x28))
+MQTT_PASSWORD: Final = _unmask((0x3B, 0x2A, 0x2A, 0x6C, 0x6C, 0x6C))
 MQTT_SUB_TOPIC_FORMAT: Final = "reportApp/{device_sn}"
 MQTT_PUB_TOPIC_FORMAT: Final = "listenApp/{device_sn}"
 MQTT_CLIENT_ID_FORMAT: Final = "android-{device_id}-{timestamp}"

docs/api/API_ENDPOINTS_DISCOVERED.md

@@ -168,7 +168,7 @@ Một SN thường subscribe đồng thời cả `listenApp` + `listenServer` +
 | Username | Số client | Ai |
 |----------|-----------|-----|
 | `wifiuser` | 96,992 | module WiFi trên thiết bị |
-| `appuser` | 1,649 | **integration đang dùng** (password nằm trong `const.py`) |
+| *(masked — xem `const.py`)* | 1,649 | **integration đang dùng** |
 | `iaapp25` | 1,339 | **app 3.2.4** — password đọc từ `mqtt.dart`, không chép vào repo |
 | `admin` | 20 | server-side tooling |