hub: actually send start/stop commands over MQTT

The /cameras/{id}/start and /stop handlers only wrote a recording_events
row — they never published the command, so the camera never recorded.
Add Subscriber.PublishCommand (publishes {"command":...} to
remoterig/cameras/<id>/command, which the XIAO forwards to the ESP-01S),
thread a CommandPublisher into the recording handlers, and wire mqttSub in
via apiRouter. Tests pass nil (publish skipped).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/api/recording.go

@@ -9,8 +9,14 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
+// CommandPublisher sends a command to a camera (implemented by the MQTT
+// subscriber). Nil is allowed (e.g. in tests) — the command is then skipped.
+type CommandPublisher interface {
+	PublishCommand(cameraID, command string) error
+}
+
 // StartRecording returns a handler for POST /cameras/{id}/start.
-func StartRecording(database *db.DB) http.HandlerFunc {
+func StartRecording(database *db.DB, pub CommandPublisher) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
 		if !validateCameraID(w, cameraID) {
@@ -45,6 +51,15 @@ func StartRecording(database *db.DB) http.HandlerFunc {
 		rowsAffected, _ := result.RowsAffected()
 		log.Printf("Recording started on %s (%d rows affected)", cameraID, rowsAffected)
 
+		// Send the actual command to the camera over MQTT.
+		if pub != nil {
+			if err := pub.PublishCommand(cameraID, "start_recording"); err != nil {
+				log.Printf("Error sending start_recording to %s: %v", cameraID, err)
+				respondError(w, http.StatusBadGateway, "failed to send command to camera", err.Error())
+				return
+			}
+		}
+
 		respondJSON(w, http.StatusOK, map[string]string{
 			"status":    "recording_started",
 			"camera_id": cameraID,
@@ -53,7 +68,7 @@ func StartRecording(database *db.DB) http.HandlerFunc {
 }
 
 // StopRecording returns a handler for POST /cameras/{id}/stop.
-func StopRecording(database *db.DB) http.HandlerFunc {
+func StopRecording(database *db.DB, pub CommandPublisher) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
 		if !validateCameraID(w, cameraID) {
@@ -88,6 +103,15 @@ func StopRecording(database *db.DB) http.HandlerFunc {
 		rowsAffected, _ := result.RowsAffected()
 		log.Printf("Recording stopped on %s (%d rows affected)", cameraID, rowsAffected)
 
+		// Send the actual command to the camera over MQTT.
+		if pub != nil {
+			if err := pub.PublishCommand(cameraID, "stop_recording"); err != nil {
+				log.Printf("Error sending stop_recording to %s: %v", cameraID, err)
+				respondError(w, http.StatusBadGateway, "failed to send command to camera", err.Error())
+				return
+			}
+		}
+
 		respondJSON(w, http.StatusOK, map[string]string{
 			"status":    "recording_stopped",
 			"camera_id": cameraID,