Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/web/devices.go

@@ -140,6 +140,10 @@ func auditLabel(action string) string {
 		return "Unlocked"
 	case "state.expired":
 		return "Lock expired"
+	case "device.online":
+		return "Device online"
+	case "device.offline":
+		return "Device offline"
 	case "login.success":
 		return "Signed in"
 	case "login.failed":
@@ -221,6 +225,7 @@ func (s *Server) handleDeviceCreate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device created", "id", dev.ID, "name", dev.Name, "topic", dev.Topic)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Added "+dev.Name), http.StatusSeeOther)
 }
 
@@ -294,6 +299,7 @@ func (s *Server) handleDeviceUpdate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device updated", "id", dev.ID, "name", dev.Name)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Saved "+dev.Name), http.StatusSeeOther)
 }
 
@@ -329,6 +335,7 @@ func (s *Server) handleDeviceLock(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device locked", "id", dev.ID, "name", dev.Name, "minutes", minutes)
+	s.publishConfig(ctx, *dev)
 	msg := "Locked " + dev.Name
 	if minutes > 0 {
 		msg = fmt.Sprintf("Locked %s for %d min", dev.Name, minutes)
@@ -358,6 +365,7 @@ func (s *Server) handleDeviceUnlock(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.log.Info("device unlocked", "id", dev.ID, "name", dev.Name)
+	s.publishConfig(ctx, *dev)
 	http.Redirect(w, r, "/?ok="+url.QueryEscape("Unlocked "+dev.Name), http.StatusSeeOther)
 }