Umsetzungsstand MQTT/FMM003 nachtragen: Zertifikate erzeugt, DuckDNS/Dual-Stack bestätigt, Cloudflare-Frage geklärt

- Eigene CA + Server-/Client-Zertifikate erzeugt und Mosquitto konfiguriert
- Dateinamen-Endungs-Stolperstein am FMM003-Configurator dokumentiert (.pem/.pem.crt/.pem.key)
- Dual-Stack am Router bestaetigt, Portfreigabe-Risiko damit ausgeraeumt
- Klargestellt: Cloudflare ersetzt DuckDNS+Portfreigabe+Mosquitto nicht, sondern ergaenzt sie
  fuer einen anderen Zweck (App-Erreichbarkeit statt Fahrzeug-MQTT)
- AGENTS.md Open-Items-Liste entsprechend abgehakt

AGENTS.md

@@ -198,10 +198,16 @@ capacitor/iframe/browser (`umgebung.ts`), types + entity table (`types.ts`), fac
       against the existing HA API
 - [ ] Define the reverse-proxy path allowlist (depends on final entity/service names)
 - [ ] Install/wire the FMM003; record firmware version (Codec JSON is firmware-dependent)
-- [ ] Generate TLS certificates for Mosquitto + device (small private CA); FMM003 refuses MQTT
-      without them
-- [ ] Decide broker reachability for the vehicle: port-forward 8883 vs. VPS broker with
-      Mosquitto bridge over Tailscale
+- [x] Generate TLS certificates for Mosquitto + device (small private CA) — done 2026-08-11, 10-year
+      validity; Mosquitto configured (`certfile`/`keyfile`/`cafile`/`require_certificate: true`).
+      Remaining: upload root/client cert/key to the FMM003 Security tab — filenames must end in
+      `.pem`/`.pem.crt`/`.pem.key` (Configurator rejects plain `.crt`/`.key`, content-agnostic check)
+- [x] Decide broker reachability for the vehicle — port-forward 8883 (not VPS bridge), decided
+      2026-08-11; DuckDNS hostname `datametric360.duckdns.org` set up, Dual-Stack confirmed on the
+      router (no DS-Lite blocker). Remaining: the port-forward itself on the Speedport Smart 4 Plus
+- [ ] MQTT Client Type on the FMM003: "Custom server" (value 3, seen in Configurator help text) was
+      not selectable in practice — use **"AWS IoT Custom"** pointed at the own broker instead
+      (confirmed working by two independent community reports); verify once the device is live
 - [ ] Capture the first real Codec JSON message (`mosquitto_sub`/MQTT Explorer) and build the
       field mapping from it — **do not guess beforehand** (explicit decision)
 - [ ] Move trip detection to FMM003 ignition (reuse the `fahrterkennung.py` pattern, keep pause