Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/lists.go

@@ -0,0 +1,74 @@
+// Per-device allow and block lists, and device lookup by MQTT topic
+// (AGENTS.md §7 blocklist/allowlist, §11 Phase 3).
+//
+// The editors for these lists arrive in Phase 6. Phase 3 already publishes them
+// in the device config, so a device that is onboarded later gets the real lists
+// without another protocol change. Migration 001 created both tables.
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// DeviceLists returns the site/app values that stay allowed and the values that
+// are blocked for one device. A row with a NULL device_id applies to every
+// device (§7). Rows are returned in insertion order, de-duplicated.
+func (s *Store) DeviceLists(ctx context.Context, id int64) (allow, block []string, err error) {
+	if allow, err = s.listValues(ctx, "allowlist", id); err != nil {
+		return nil, nil, err
+	}
+	if block, err = s.listValues(ctx, "blocklist", id); err != nil {
+		return nil, nil, err
+	}
+	return allow, block, nil
+}
+
+func (s *Store) listValues(ctx context.Context, table string, id int64) ([]string, error) {
+	// The table name is a package constant, never caller input.
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT value FROM `+table+` WHERE device_id = ? OR device_id IS NULL ORDER BY id`, id)
+	if err != nil {
+		return nil, fmt.Errorf("list %s: %w", table, err)
+	}
+	defer rows.Close()
+
+	out := make([]string, 0, 4)
+	seen := make(map[string]struct{}, 4)
+	for rows.Next() {
+		var v string
+		if err := rows.Scan(&v); err != nil {
+			return nil, fmt.Errorf("scan %s: %w", table, err)
+		}
+		v = strings.TrimSpace(v)
+		if v == "" {
+			continue
+		}
+		if _, dup := seen[v]; dup {
+			continue
+		}
+		seen[v] = struct{}{}
+		out = append(out, v)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("list %s: %w", table, err)
+	}
+	return out, nil
+}
+
+// DeviceByConfigTopic finds a device from a topic the device wrote to, for
+// example "restrict/harry_phone_2/status". Only the Control Service reads the
+// topic table, so a topic the service does not know is ignored.
+func (s *Store) DeviceByConfigTopic(ctx context.Context, topic string) (*Device, error) {
+	dev, err := scanDevice(s.db.QueryRowContext(ctx, selectDevice+` WHERE d.topic = ?`, topic))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("device by topic: %w", err)
+	}
+	return dev, nil
+}