Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker-compose.yml

@@ -1,6 +1,9 @@
 # Internet Use Control — Control Service (own image, own container, own port).
 # Deploy on .13:  cd /home/sam/paseo/projects/internet_use_control && docker compose up -d --build
 # The service is the single source of truth (SYSTEM_MAP.md). Only it publishes config.
+#
+# MQTT is transport, not storage: the service publishes retained config to the
+# shared Mosquitto on `.13:1883` and writes what devices report into SQLite.
 
 name: webrestrict
 
@@ -9,16 +12,24 @@ services:
     build:
       context: .
       args:
-        VERSION: "0.2.0-phase2"
-    image: webrestrict/control:0.2.0-phase2
+        VERSION: "0.3.0-phase3"
+    image: webrestrict/control:0.3.0-phase3
     container_name: webrestrict-control
     restart: unless-stopped
     env_file:
       - environment.d/control-service.env
     ports:
       - "8791:8791"
+    # The broker is the Mosquitto container on the host. No host IP is baked
+    # in: the gateway is resolved at start, so CONTROL_MQTT_BROKER can stay
+    # "tcp://host.docker.internal:1883".
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     volumes:
       - webrestrict-data:/data
+      # The lab CA for broker TLS verification. Read-only and optional: the
+      # file is absent until the TLS listener exists.
+      - ./deploy/mosquitto/tls:/etc/webrestrict/tls:ro
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8791/health"]
       interval: 30s