Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/reports.go

@@ -0,0 +1,131 @@
+// Reports that arrive from devices over MQTT: presence and telemetry
+// (AGENTS.md §7, §11 Phase 3).
+//
+// The broker is transport only. Every report is written to SQLite here, because
+// SQLite is the source of truth (SYSTEM_MAP.md). A malformed or hostile report
+// must never take the service down: callers validate first, and a failed insert
+// is logged and dropped.
+package store
+
+import (
+	"context"
+	"fmt"
+	"time"
+)
+
+// SetPresence records that a device was seen and whether it is online now. It
+// returns whether the online flag changed.
+//
+// Presence comes from the broker's Last Will and Testament: a device publishes
+// a retained "online" status, and the broker publishes its retained will
+// ("online": false) when the connection drops without a clean disconnect.
+//
+// last_seen is refreshed on every report. The audit log only gets an entry when
+// the online flag changes, so a chatty device does not flood the log (FR-15).
+func (s *Store) SetPresence(ctx context.Context, id int64, online bool, at time.Time, actor string) (bool, error) {
+	if at.IsZero() {
+		at = time.Now()
+	}
+	at = at.UTC()
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return false, fmt.Errorf("set presence: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var current int
+	if err := tx.QueryRowContext(ctx, `SELECT online FROM devices WHERE id = ?`, id).Scan(&current); err != nil {
+		return false, fmt.Errorf("set presence: %w", err)
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		`UPDATE devices SET online = ?, last_seen = ?, updated_at = datetime('now') WHERE id = ?`,
+		boolToInt(online), at.Format(time.RFC3339), id); err != nil {
+		return false, fmt.Errorf("set presence: %w", err)
+	}
+
+	changed := (current != 0) != online
+	if changed {
+		action, detail := "device.offline", "last will received"
+		if online {
+			action, detail = "device.online", "status report"
+		}
+		if err := insertAudit(ctx, tx, actor, action, &id, detail); err != nil {
+			return false, err
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return false, fmt.Errorf("commit presence: %w", err)
+	}
+	return changed, nil
+}
+
+// TelemetryEntry is one app or domain row of a usage report.
+type TelemetryEntry struct {
+	App     string
+	Domain  string
+	Seconds int
+}
+
+// InsertTelemetry upserts a rolling daily usage total per (device, day, app,
+// domain). Reports are repeats, not deltas: a later report for the same key
+// replaces the earlier total (migration 002). It returns the number of rows
+// written.
+func (s *Store) InsertTelemetry(ctx context.Context, id int64, day string, entries []TelemetryEntry) (int, error) {
+	if len(entries) == 0 {
+		return 0, nil
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, fmt.Errorf("insert telemetry: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	n := 0
+	for _, e := range entries {
+		if e.Seconds < 0 {
+			continue
+		}
+		if _, err := tx.ExecContext(ctx, `
+			INSERT INTO telemetry (device_id, app, domain, seconds, day)
+			VALUES (?, ?, ?, ?, ?)
+			ON CONFLICT(device_id, day, app, domain) DO UPDATE SET
+				seconds = excluded.seconds,
+				created_at = datetime('now')`,
+			id, e.App, e.Domain, e.Seconds, day); err != nil {
+			return n, fmt.Errorf("insert telemetry: %w", err)
+		}
+		n++
+	}
+	if err := tx.Commit(); err != nil {
+		return n, fmt.Errorf("commit telemetry: %w", err)
+	}
+	return n, nil
+}
+
+// TelemetryForDay returns one device's usage rows for a day, biggest first.
+func (s *Store) TelemetryForDay(ctx context.Context, id int64, day string) ([]TelemetryEntry, error) {
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT app, domain, seconds FROM telemetry
+		WHERE device_id = ? AND day = ?
+		ORDER BY seconds DESC`, id, day)
+	if err != nil {
+		return nil, fmt.Errorf("telemetry for day: %w", err)
+	}
+	defer rows.Close()
+
+	out := make([]TelemetryEntry, 0, 8)
+	for rows.Next() {
+		var e TelemetryEntry
+		if err := rows.Scan(&e.App, &e.Domain, &e.Seconds); err != nil {
+			return nil, fmt.Errorf("scan telemetry: %w", err)
+		}
+		out = append(out, e)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("telemetry for day: %w", err)
+	}
+	return out, nil
+}