fix(mqtt): rebuild paho client on persistent reconnect failure

[cayossarian]

AsyncMqttBridge.connect() pins the panel's private CA into the paho client once and reuses it across every reconnect attempt. If the panel rotates its CA — most plausibly during a firmware upgrade — every subsequent _client.reconnect() raises ssl.SSLCertVerificationError, which the broad OSError clause silently swallows, and the bridge cannot recover without a manual config-entry reload (the symptom in SpanPanel/span#242).

Add _rebuild_client(): on the next reconnect attempt after threshold or any SSL error, re-fetch the CA, construct a fresh paho client via the new _make_paho_client() factory, fire the new pre-rebuild callback so SpanMqttClient can reset its Homie accumulator, tear down the old client, and submit the initial connect via the executor. Restores the previous client on any failure (panel temporarily unreachable, CA endpoint returns 502, etc.) so the loop continues retrying.

The counter resets after every rebuild attempt, success or fail, so rebuilds keep firing at the threshold cadence throughout extended outages — multi-day disconnections recover whenever the panel becomes usable again, including if the CA rotates a second time mid-outage.

SpanPanelAPIError is now in the bridge's CA-fetch exception list so a 502 from /api/v2/certificate/ca during rebuild doesn't kill the task.

Bumps to 2.6.4

[Copilot]

Pull request overview

Adds a self-healing rebuild path to AsyncMqttBridge._reconnect_loop so the bridge can recover from CA rotation (e.g. panel firmware upgrade) and other persistent reconnect failures without requiring a manual integration reload. After MQTT_FULL_REBUILD_AFTER_FAILURES (3) consecutive non-SSL failures, or immediately on any ssl.SSLError, it re-fetches the panel CA, builds a fresh paho client, and fires a pre-rebuild hook so SpanMqttClient can reset its Homie accumulator (clearing any stale $state=disconnected).

Changes:

• New _rebuild_client() + _make_paho_client() factory; reconnect loop rebuilds on SSL error or after threshold-many OSError failures, with old client restored on rebuild failure.
• New set_pre_rebuild_callback() bridge hook; SpanMqttClient._on_pre_rebuild() resets the accumulator (preserving schema-derived state and panel size).
• SpanPanelAPIError added to the bridge's CA-fetch exception list; coverage exclusion removed for mqtt/connection.py; version bumped to 2.6.4.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/span_panel_api/mqtt/connection.py	Adds rebuild path, paho-client factory, pre-rebuild callback, and threshold/SSL trigger in reconnect loop.
src/span_panel_api/mqtt/client.py	Caches _panel_size and registers _on_pre_rebuild hook to reset Homie accumulator while keeping schema state.
src/span_panel_api/mqtt/const.py	Introduces MQTT_FULL_REBUILD_AFTER_FAILURES constant.
tests/test_mqtt_connect_flow.py	Comprehensive new tests for SSL/threshold triggers, callback ordering, failure-restore, non-TLS path, and hardening edge cases.
pyproject.toml	Bumps version to 2.6.4 and removes coverage exclusion for mqtt/connection.py.
CHANGELOG.md	Documents the fix, additions, and behavior change.
uv.lock	Adds new wheel entries and updates span-panel-api to 2.6.4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.