feat: mount the Home Assistant /ssl directory read-only

The addon maps share, homeassistant_config and addon_config, but not the
standard Home Assistant `/ssl` directory. Certificates managed by addons such
as Let's Encrypt live there, so an MQTT TLS configuration pointing at them
fails at startup:

    error: z2m: MQTT failed to connect, exiting...
    (ENOENT: no such file or directory, open '/ssl/privkey.pem')

Copying the files into a mapped directory works but has to be redone on every
renewal, which defeats automated renewal; a symlink from the mapped config
directory is not followed.

Map `ssl` read-only, alongside the existing mappings. Read-only is sufficient:
the addon only needs to read the certificate and key, and the renewal is
performed by whichever addon manages them. Because the directory is mounted
rather than copied, renewals are picked up without further action.

Applied to both the stable and edge addons. The proxy addon is unchanged: it
does not connect to MQTT.

Closes #835

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: cmatte

zigbee2mqtt-edge/config.json

@@ -34,6 +34,10 @@
       "type": "addon_config",
       "read_only": false,
       "path": "/addon_config"
+    },
+    {
+      "type": "ssl",
+      "read_only": true
     }
   ],
   "ports": {

zigbee2mqtt/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [Unreleased]
+
+- Mount the Home Assistant SSL directory into the addon container read-only (`/ssl`), so certificates managed by addons such as Let's Encrypt can be used for MQTT TLS [#835](https://github.com/zigbee2mqtt/hassio-zigbee2mqtt/issues/835)
+
 ## 2.14.1-1
 - Updated Zigbee2MQTT to version [`2.14.1`](https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.14.1)
 

zigbee2mqtt/DOCS.md

@@ -70,6 +70,7 @@ If you are interested in adding support for new devices to Zigbee2MQTT see [How
 
 - Depending on your configuration, the MQTT server config may need to include the port, typically `1883` or `8883` for SSL communications. For example, `mqtt://core-mosquitto:1883` for Home Assistant's Mosquitto app.
 - To find out which serial ports you have exposed go to **Settings → System → Hardware → ⋮ → System hardware** and type the device name in the search bar.
+- The Home Assistant `/ssl` directory is mounted read-only, so certificates kept there (for example by the Let's Encrypt addon) can be referenced directly in the MQTT configuration, e.g. `key: /ssl/privkey.pem` and `cert: /ssl/fullchain.pem`. Because it is read-only, renewals performed by the managing addon are picked up without copying files.
 
 # Socat
 

zigbee2mqtt/config.json

@@ -37,6 +37,10 @@
       "type": "addon_config",
       "read_only": false,
       "path": "/addon_config"
+    },
+    {
+      "type": "ssl",
+      "read_only": true
     }
   ],
   "ports": {