party-lock: add MQTT ACL-based plug lock service

Listener watches party-lock/<plug>/set and dynamically generates
mosquitto ACL deny rules. Test against bamboo first, then dj-booth.
Add lock button to CYD dashboard.

infra/compose.yaml

@@ -139,6 +139,22 @@ services:
       QOBUZ_USERNAME: "${QOBUZ_USERNAME:-}"
       QOBUZ_PASSWORD: "${QOBUZ_PASSWORD:-}"
 
+  # Party lock: blocks state changes to DJ Booth plug when locked.
+  # Watches party-lock/dj-booth/set and swaps mosquitto ACL file.
+  party-lock:
+    build: ./party-lock
+    container_name: party-lock
+    restart: unless-stopped
+    depends_on:
+      - mosquitto
+    volumes:
+      - ./mosquitto/config:/mosquitto/config
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      MQTT_HOST: mosquitto
+      MQTT_PORT: "1883"
+      TZ: America/Los_Angeles
+
 volumes:
   librespot_cache: