Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Makefile

@@ -1,7 +1,19 @@
-IMAGE ?= webrestrict/control:0.2.0-phase2
-BUILD_VERSION ?= 0.2.0-phase2
+IMAGE ?= webrestrict/control:0.3.0-phase3
+BUILD_VERSION ?= 0.3.0-phase3
 
-.PHONY: help test vet build up down restart logs ps hash-password fmt
+# Bounded docker helper for the Go toolchain. The container runs as the current
+# user, so the repository and the module cache stay owned by you.
+GO_IMAGE ?= golang:1.25-alpine
+GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
+	  -e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
+	  -v "$$PWD":/src -w /src $(GO_IMAGE)
+
+# Scratch broker used by `make mqtt-verify` (see deploy/mosquitto/README.md).
+MQTT_VERIFY_PORT ?= 18883
+MQTT_IMAGE ?= eclipse-mosquitto:latest
+
+.PHONY: help test vet build up down restart logs ps hash-password deps fmt \
+        mqtt-tls mqtt-verify mqtt-config
 
 help:
 	@echo "make test           run go test ./... in golang:1.25-alpine"
@@ -10,21 +22,24 @@ help:
 	@echo "make up             docker compose up -d --build"
 	@echo "make down           docker compose down"
 	@echo "make logs           follow container logs"
+	@echo "make ps             docker compose ps"
 	@echo "make hash-password  generate a bcrypt hash (PASSWORD=...)"
+	@echo "make deps           go mod tidy + download (writes go.mod/go.sum)"
+	@echo "make mqtt-tls       generate the lab CA and broker certificate"
+	@echo "make mqtt-config    build the scratch broker config in deploy/mosquitto/build/"
+	@echo "make mqtt-verify    prove TLS + credentials + topic ACLs on a scratch broker"
 
 test:
-	docker run --rm --network host \
-	  -v "$$PWD":/src -w /src \
-	  -v webrestrict-go-mod:/go/pkg/mod \
-	  -v webrestrict-go-build:/root/.cache/go-build \
-	  golang:1.25-alpine sh -c 'go test ./...'
+	$(GO_RUN) go test ./...
 
 vet:
-	docker run --rm --network host \
-	  -v "$$PWD":/src -w /src \
-	  -v webrestrict-go-mod:/go/pkg/mod \
-	  -v webrestrict-go-build:/root/.cache/go-build \
-	  golang:1.25-alpine sh -c 'go vet ./...'
+	$(GO_RUN) go vet ./...
+
+deps:
+	$(GO_RUN) sh -c 'go mod tidy'
+
+fmt:
+	$(GO_RUN) sh -c 'go fmt ./...'
 
 build:
 	docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
@@ -47,3 +62,17 @@ ps:
 hash-password:
 	@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
 	docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'
+
+# --- MQTT ---------------------------------------------------------------
+# These targets never touch the shared Mosquitto. They build the material and
+# prove it on a scratch broker on $(MQTT_VERIFY_PORT). See deploy/mosquitto/README.md.
+
+mqtt-tls:
+	deploy/mosquitto/generate-tls.sh
+
+mqtt-config: mqtt-tls
+	deploy/mosquitto/build-config.sh
+
+mqtt-verify: mqtt-config
+	MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
+	  deploy/mosquitto/verify-isolation.sh