Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/devices.go

@@ -140,6 +140,10 @@ func auditLabel(action string) string {
 		return "Unlocked"
 	case "state.expired":
 		return "Lock expired"
+	case "device.online":
+		return "Device online"
+	case "device.offline":
+		return "Device offline"
 	case "login.success":
 		return "Signed in"
 	case "login.failed":
@@ -221,6 +225,7 @@ func (s *Server) handleDeviceCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device created", "id", dev.ID, "name", dev.Name, "topic", dev.Topic)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Added "+dev.Name), http.StatusSeeOther)
 }
 
@@ -294,6 +299,7 @@ func (s *Server) handleDeviceUpdate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device updated", "id", dev.ID, "name", dev.Name)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Saved "+dev.Name), http.StatusSeeOther)
 }
 
@@ -329,6 +335,7 @@ func (s *Server) handleDeviceLock(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device locked", "id", dev.ID, "name", dev.Name, "minutes", minutes)
+	s.publishConfig(ctx, *dev)
 	msg := "Locked " + dev.Name
 	if minutes > 0 {
 		msg = fmt.Sprintf("Locked %s for %d min", dev.Name, minutes)
@@ -358,6 +365,7 @@ func (s *Server) handleDeviceUnlock(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device unlocked", "id", dev.ID, "name", dev.Name)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Unlocked "+dev.Name), http.StatusSeeOther)
 }
 

internal/web/devices_test.go

@@ -44,7 +44,7 @@ func newTestApp(t *testing.T) *testApp {
 		AppEnv:        "test",
 		DBPath:        ":memory:",
 	}
-	srv, err := New(cfg, st, am, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	srv, err := New(cfg, st, am, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
 	if err != nil {
 		t.Fatalf("web.New: %v", err)
 	}

internal/web/server.go

@@ -32,10 +32,22 @@ type Server struct {
 	auth  *auth.Manager
 	tmpl  *template.Template
 	log   *slog.Logger
+	pub   Publisher
 }
 
-// New builds a Server and parses the embedded templates.
-func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger) (*Server, error) {
+// Publisher pushes device config to the broker and reports the link's health.
+// Only the Control Service publishes config (AGENTS.md §10 rule 5). It is nil
+// when MQTT is switched off, and every call site tolerates that.
+type Publisher interface {
+	Broker() string
+	Connected() bool
+	Stats() (received, published int64, lastMessageAt time.Time, lastErr string)
+	PublishDeviceConfig(ctx context.Context, dev store.Device) error
+	PublishAll(ctx context.Context) (int, error)
+}
+
+// New builds a Server and parses the embedded templates. pub may be nil.
+func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger, pub Publisher) (*Server, error) {
 	funcs := template.FuncMap{
 		"year": func() int { return time.Now().Year() },
 		"now":  func() time.Time { return time.Now() },
@@ -48,7 +60,24 @@ func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger
 	if err != nil {
 		return nil, fmt.Errorf("parse templates: %w", err)
 	}
-	return &Server{cfg: cfg, store: st, auth: am, tmpl: tmpl, log: log}, nil
+	return &Server{cfg: cfg, store: st, auth: am, tmpl: tmpl, log: log, pub: pub}, nil
+}
+
+// publishConfig pushes one device's desired state to the broker, retained. A
+// publish failure never fails the HTTP request: SQLite already holds the new
+// state, and the link republishes everything when it reconnects, so the broker
+// catches up on its own.
+func (s *Server) publishConfig(ctx context.Context, dev store.Device) {
+	if s.pub == nil {
+		s.log.Debug("mqtt disabled; config kept in SQLite only", "device", dev.Name)
+		return
+	}
+	if err := s.pub.PublishDeviceConfig(ctx, dev); err != nil {
+		s.log.Error("mqtt publish config", "device", dev.Name, "topic", dev.Topic, "err", err)
+		return
+	}
+	s.log.Info("mqtt config published", "device", dev.Name, "topic", dev.Topic,
+		"locked", dev.Locked)
 }
 
 // Handler returns the fully wrapped HTTP handler.
@@ -234,6 +263,15 @@ type statusData struct {
 	DBPath     string
 	ServerTime string
 	ServerUp   string
+
+	// MQTT link health (Phase 3).
+	MQTTEnabled     bool
+	MQTTConnected   bool
+	MQTTBroker      string
+	MQTTReceived    int64
+	MQTTPublished   int64
+	MQTTLastMessage string
+	MQTTLastError   string
 }
 
 type dashboardData struct {
@@ -259,6 +297,12 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 		s.log.Error("expire locks", "err", err)
 	} else if n > 0 {
 		s.log.Info("expired timed locks", "count", n)
+		// The lock lifted, so the retained config is stale. Republish.
+		if s.pub != nil {
+			if _, err := s.pub.PublishAll(ctx); err != nil {
+				s.log.Error("mqtt republish after expiry", "err", err)
+			}
+		}
 	}
 	devs, err := s.store.ListDevices(ctx)
 	if err != nil {
@@ -290,12 +334,25 @@ func (s *Server) handleStatusPartial(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) buildStatusData(ctx context.Context) statusData {
-	return statusData{
+	data := statusData{
 		DBHealthy:  s.store.Ping(ctx) == nil,
 		DBPath:     s.cfg.DBPath,
 		ServerTime: time.Now().Format("Mon 02 Jan 2006 15:04:05"),
 		ServerUp:   time.Since(serverStarted).Round(time.Second).String(),
 	}
+	if s.pub != nil {
+		data.MQTTEnabled = true
+		data.MQTTConnected = s.pub.Connected()
+		data.MQTTBroker = s.pub.Broker()
+		rx, tx, last, lastErr := s.pub.Stats()
+		data.MQTTReceived = rx
+		data.MQTTPublished = tx
+		data.MQTTLastError = lastErr
+		if !last.IsZero() {
+			data.MQTTLastMessage = last.Local().Format("15:04:05")
+		}
+	}
+	return data
 }
 
 func (s *Server) render(w http.ResponseWriter, _ *http.Request, name string, data any) {

internal/web/templates/partials/status.html

@@ -18,6 +18,22 @@
     <span class="status-pill status-pill--muted">{{if .DBHealthy}}ok{{else}}error{{end}}</span>
   </article>
 
+  <article class="tool-card">
+    <div class="tool-card__icon tool-card__icon--purple" aria-hidden="true">⇄</div>
+    <h3 class="tool-card__title">Broker</h3>
+    <p class="tool-card__desc">
+      {{if not .MQTTEnabled}}MQTT switched off{{else if .MQTTConnected}}{{.MQTTBroker}}{{else}}{{.MQTTBroker}} · reconnecting{{end}}
+    </p>
+    <span class="status-pill {{if not .MQTTEnabled}}status-pill--muted{{else if .MQTTConnected}}status-pill--on{{else}}status-pill--off{{end}}">
+      <span class="dot {{if .MQTTConnected}}dot--on{{else}}dot--off{{end}}"></span>
+      {{if not .MQTTEnabled}}disabled{{else if .MQTTConnected}}connected{{else}}offline{{end}}
+    </span>
+    {{if .MQTTEnabled}}
+    <p class="tool-card__desc">{{.MQTTPublished}} published · {{.MQTTReceived}} received{{if .MQTTLastMessage}} · last report {{.MQTTLastMessage}}{{end}}</p>
+    {{if .MQTTLastError}}<p class="tool-card__desc">last error: {{.MQTTLastError}}</p>{{end}}
+    {{end}}
+  </article>
+
   <article class="tool-card">
     <div class="tool-card__icon tool-card__icon--purple" aria-hidden="true">⏱</div>
     <h3 class="tool-card__title">Uptime</h3>