feat: mount the Home Assistant /ssl directory read-only

[cmatte]

Closes #835.

The addon maps share, homeassistant_config and addon_config, but not the standard Home Assistant /ssl directory. Certificates managed by addons such as Let's Encrypt live there, so an MQTT TLS configuration that points at them fails at startup:

error: z2m: MQTT failed to connect, exiting...
(ENOENT: no such file or directory, open '/ssl/privkey.pem')

Copying the certificate and key into a mapped directory works, but has to be repeated on every renewal — which defeats the point of automated renewal. A symlink from the mapped config directory into /ssl is not followed.

Change

Map ssl alongside the existing mappings, read-only:

{
  "type": "ssl",
  "read_only": true
}

Read-only is sufficient — the addon only needs to read the certificate and key, and renewal is performed by whichever addon manages them. Because the directory is mounted rather than copied, renewals are picked up with no further action.

Users can then reference the certificates directly:

mqtt:
  server: mqtts://core-mosquitto:8883
  key: /ssl/privkey.pem
  cert: /ssl/fullchain.pem

Scope

• Applied to both zigbee2mqtt and zigbee2mqtt-edge.
• zigbee2mqtt-proxy is unchanged — it does not connect to MQTT.
• No version bump, following the /addon_config mount which was recorded under ## [Unreleased] in the changelog; happy to bump if you would prefer.
• Documented under Notes in DOCS.md.

13 lines added, none removed. All three addon configs still parse as valid JSON and every mapped type is a valid Home Assistant addon folder.

🤖 Generated with Claude Code

[Koenkk]

Thanks!