Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deploy/mosquitto/conf.d/webrestrict.acl

@@ -0,0 +1,28 @@
+# Topic ACL for the Internet Use Control MQTT plane (AGENTS.md §10 rule 6).
+#
+# Included by conf.d/webrestrict.conf, which is reached only over TLS on 8883.
+# A device may read only its own config and write only its own status and
+# telemetry. Without this, a child can publish a fake "unlocked" (TRANSPORT_
+# DESIGN.md "Security").
+#
+# The MQTT username of a device IS its topic token: the middle level of its
+# config topic. For restrict/harry_phone_2/config the account is
+# `harry_phone_2`. List the tokens with:
+#
+#     docker exec webrestrict-control /app/control mqtt-clients
+#
+# and create the accounts with deploy/mosquitto/provision-clients.sh.
+
+# The Control Service. It publishes every device's config and reads every
+# device's reports. It cannot read configs and cannot write status or telemetry.
+user control-service
+topic write restrict/+/config
+topic read restrict/+/status
+topic read restrict/+/telemetry
+
+# One rule set for every device. %u expands to the authenticated username, so a
+# device is confined to its own topics by construction — no per-device edit is
+# needed when a device is added.
+pattern read restrict/%u/config
+pattern write restrict/%u/status
+pattern write restrict/%u/telemetry

deploy/mosquitto/conf.d/webrestrict.conf

@@ -0,0 +1,35 @@
+# Per-device MQTT security for the Internet Use Control Control Service.
+#
+# APPLY WITH deploy/mosquitto/README.md. This fragment is included by the shared
+# Mosquitto on `.13`; it does not replace its configuration (AGENTS.md §11
+# Phase 3, §10 rule 6).
+#
+# Two listeners, two planes:
+#   * 1883 stays exactly as it is — plain, anonymous. n8n and the rest of the
+#     lab keep working (N8N_DEFAULT_MQTT_BROKER_URL=mqtt://192.168.20.13:1883).
+#   * 8883 is new and is the ONLY listener the kids' devices use: TLS, a
+#     required account, and a topic ACL.
+#
+# `per_listener_settings true` belongs in the main mosquitto.conf, before the
+# first listener, not here. It is what keeps the 1883 plane anonymous while the
+# 8883 plane requires credentials.
+
+listener 8883 0.0.0.0
+
+# No anonymous devices. A device reads only its own config and writes only its
+# own status and telemetry (webrestrict.acl).
+allow_anonymous false
+password_file /mosquitto/config/conf.d/webrestrict.passwd
+acl_file /mosquitto/config/conf.d/webrestrict.acl
+
+# TLS. The lab CA is generated by generate-tls.sh; every device and the Control
+# Service trust the same CA, so a rogue broker on the LAN cannot hand a device
+# its rules.
+tls_version tlsv1.2
+cafile /mosquitto/config/tls/ca.crt
+certfile /mosquitto/config/tls/server.crt
+keyfile /mosquitto/config/tls/server.key
+
+# A device proves who it is with a password; it does not need its own client
+# certificate.
+require_certificate false