Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

TRANSPORT_DESIGN.md

@@ -46,6 +46,50 @@ ground.
 | `restrict/<device>/cmd` | service → device | no | one-shot command |
 | `restrict/<device>/ack` | device → service | no | command result |
 
+`config`, `status` and `telemetry` are **implemented** (Phase 3,
+`internal/mqtt/`). `cmd` and `ack` are still design only: no phase uses them yet.
+
+`<device>` is `restrict/<slug>_<id>`, stored in `devices.topic` when the device
+is created, and never changes. `<id>` is also the device's MQTT username.
+
+### Payloads, as implemented (Phase 3)
+
+`restrict/<device>/config`, retained, written by the Control Service only:
+
+```json
+{"v":1,"device_id":1,"name":"Harry's phone","platform":"android",
+ "locked":true,"until":"2026-10-13T21:00:00Z","allow":[],"block":[],
+ "generated_at":"2026-10-13T03:30:27Z"}
+```
+
+`allow` and `block` are always arrays. `until` is `null` when the lock has no end
+time. Clients must ignore unknown fields; `v` is the schema version.
+
+`restrict/<device>/status`, retained, written by the device:
+
+```json
+{"online":true,"app":"com.spotify.music","at":"2026-10-13T03:30:27Z"}
+```
+
+The device publishes `{"online": true}` when it comes up and registers the will
+`{"online": false}` on the same topic in its CONNECT packet. The broker then
+publishes that will the moment the connection drops without DISCONNECT, which is
+the whole of presence detection (FR-6). A status payload with no `online` field
+counts as online, because the device just talked to us.
+
+`restrict/<device>/telemetry`, not retained, written by the device:
+
+```json
+{"day":"2026-10-13",
+ "apps":[{"name":"com.spotify.music","seconds":600}],
+ "domains":[{"name":"youtube.com","seconds":120}]}
+```
+
+Seconds are **totals for the day**, not deltas. A repeated report replaces the
+row for (device, day, app, domain), so a device may resend freely (migration
+`002_telemetry_unique.sql`). A flat single-row form (`{"app":"…","seconds":600}`)
+is also accepted.
+
 ### Example — the "phone off, desktop on" case
 
 ```
@@ -66,6 +110,20 @@ reconnects is locked again **immediately**, with no waiting.
   own** status. Without this, a child can publish a fake "unlocked".
 - Rotate device credentials when a device is removed.
 
+**Status (Phase 3).** Written, verified, not yet applied:
+`deploy/mosquitto/conf.d/webrestrict.conf` is the TLS listener, `.acl` is the
+topic policy, and `deploy/mosquitto/README.md` is the apply/rollback runbook.
+`make mqtt-verify` proves the policy on a throwaway broker. The Control Service
+is configured for TLS plus credentials, and refuses a plaintext,
+credential-less broker unless `CONTROL_MQTT_INSECURE=true` is set explicitly.
+
+The shared Mosquitto on `.13` still has only its original anonymous `1883`
+listener, so the running deployment uses that escape hatch and logs a warning.
+Applying the TLS listener means editing the shared broker's configuration and
+compose file, adding port 8883 and restarting it — a change to a shared
+household service, so it waits for Sam's approval instead of being applied
+unilaterally.
+
 ---
 
 ## Keep the HTTP API