Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/mosquitto/build-config.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+#
+# Build the scratch broker configuration used by `make mqtt-verify`.
+#
+# It mirrors the proposed change to the shared Mosquitto on `.13` exactly:
+# the existing plain listener is left as it is, and the webrestrict listener is
+# added beside it. The verification runs this config on a separate, throwaway
+# container, so nothing shared is touched.
+#
+#   build/mosquitto.conf  the scratch main configuration (generated)
+#   conf.d/               the real listener, ACL and password files
+
+set -euo pipefail
+
+here="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+out="$here/build"
+
+mkdir -p "$out"
+
+cat >"$out/mosquitto.conf" <<'EOF'
+# GENERATED by deploy/mosquitto/build-config.sh — do not edit.
+#
+# The scratch broker for `make mqtt-verify`. It is the proposed shape of the
+# shared Mosquitto on `.13`:
+#
+#   * the plain 1883 listener is unchanged, still anonymous, so n8n and the rest
+#     of the lab keep working;
+#   * the 8883 listener (conf.d/webrestrict.conf) is TLS-only and needs an
+#     account;
+#   * `per_listener_settings true` is what keeps those two planes apart. It
+#     belongs in the main configuration, before the first listener, and is the
+#     only change to the existing lines of mosquitto.conf.
+persistence false
+log_dest stdout
+connection_messages true
+
+per_listener_settings true
+
+listener 1883 0.0.0.0
+allow_anonymous true
+
+include_dir /mosquitto/config/conf.d
+EOF
+
+echo "build-config: wrote $out/mosquitto.conf"