Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/control-service.env.example

@@ -34,5 +34,33 @@ CONTROL_ADMIN_USERNAME=sam
 CONTROL_ADMIN_PASSWORD=change-me
 
 # Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
-# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.1.0-phase1 hash-password 'your-password'
+# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.3.0-phase3 hash-password 'your-password'
 # CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...
+
+# --- MQTT (Phase 3) --------------------------------------------------------
+# The broker is transport only. SQLite stays the source of truth, and only the
+# Control Service publishes config (AGENTS.md §10 rules 5-6).
+
+# Turn the broker link on or off. With it off the dashboard still works and the
+# config stays in SQLite, unpublished.
+CONTROL_MQTT_ENABLED=true
+
+# The shared Mosquitto on `.13`, seen from inside this container. The compose
+# file maps host.docker.internal to the host gateway.
+# When the TLS listener exists, change this to tls://host.docker.internal:8883.
+CONTROL_MQTT_BROKER=tcp://host.docker.internal:1883
+
+# The Control Service identity. The broker ACL gives it write access to every
+# config topic and read access to every status and telemetry topic, nothing else.
+CONTROL_MQTT_CLIENT_ID=control-service
+# CONTROL_MQTT_USERNAME=control-service
+# CONTROL_MQTT_PASSWORD=change-me
+
+# PEM bundle used to verify the broker certificate. Required for a tls:// broker.
+CONTROL_MQTT_CA_FILE=/etc/webrestrict/tls/ca.crt
+
+# TEMPORARY. The shared Mosquitto has no TLS listener yet, so a plaintext,
+# credential-less link is allowed. The service refuses to start without
+# credentials or TLS unless this is true, and it logs a warning when it is.
+# Set to false as soon as deploy/mosquitto/ is applied (AGENTS.md §10 rule 6).
+CONTROL_MQTT_INSECURE=true