Record the applied MQTT TLS listener on the shared Mosquitto

Follow-up to the Phase 3 commit (14b304e), after Sam accepted the confirmation
on AUD-80. The operational change itself lives outside this repository; this
commit updates the documentation so it matches reality.

Applied on .13 (backups: mosquitto.conf.bak.aud80-20261013-152648 and
docker-compose.yml.bak.aud80-20261013-152648):
- mosquitto.conf gains per_listener_settings true and
  include_dir /mosquitto/config/conf.d; its original 1883 listener and
  allow_anonymous true are untouched.
- docker-compose.yml publishes 8883 and mounts the new conf.d and tls
  directories (the compose mounts mosquitto.conf as a single file, so the
  include_dir fails without them).
- conf.d/webrestrict.{conf,acl,passwd} and tls/{ca.crt,server.crt,server.key}
  are installed from deploy/mosquitto/.
- The Control Service now uses tls://host.docker.internal:8883 with the
  control-service account and CONTROL_MQTT_INSECURE=false.

Verified live after the restart: the 1883 plane still carries anonymous traffic,
8883 refuses anonymous clients and a wrong password, each device reads only its
own retained config, a device cannot write another device's status or its own
config, and a client killed without DISCONNECT drove the retained will into an
offline transition recorded in SQLite.

Docs: deploy/mosquitto/README.md records the exact host diff, the runbook gap
that caused one restart-loop (the missing bind mounts), the per_listener_settings
deprecation caveat and the rollback. README.md and TRANSPORT_DESIGN.md now
describe the applied state.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

README.md

@@ -75,7 +75,7 @@ reads only the process environment.
 | `CONTROL_MQTT_USERNAME` | — | Control Service broker account |
 | `CONTROL_MQTT_PASSWORD` | — | its password |
 | `CONTROL_MQTT_CA_FILE` | `/etc/webrestrict/tls/ca.crt` | PEM bundle that verifies the broker (TLS only) |
-| `CONTROL_MQTT_INSECURE` | `false` | **Temporary.** Allow a plaintext, credential-less broker |
+| `CONTROL_MQTT_INSECURE` | `false` | Allow a plaintext, credential-less broker. Only for a broker with no TLS listener |
 
 Generate a bcrypt hash without host Go:
 
@@ -86,11 +86,12 @@ docker run --rm --entrypoint /app/control webrestrict/control:0.3.0-phase3 \
 
 `CONTROL_MQTT_USERNAME`/`CONTROL_MQTT_PASSWORD` are required unless
 `CONTROL_MQTT_INSECURE=true`, and a non-TLS broker is refused unless
-`CONTROL_MQTT_INSECURE=true` (AGENTS.md §10 rule 6). The shared Mosquitto on
-`.13` has no TLS listener yet, so the running deployment sets the escape hatch
-and logs a warning. `deploy/mosquitto/README.md` holds the TLS listener, the
-per-device credentials and the topic ACL, verified but not yet applied — see
-that file for the apply and rollback steps.
+`CONTROL_MQTT_INSECURE=true` (AGENTS.md §10 rule 6). The escape hatch exists for
+a broker that has no TLS listener; the running deployment on `.13` does not use
+it. Since 2026-10-13 the shared Mosquitto also serves a TLS listener on 8883
+with per-device credentials and a topic ACL
+(`tls://host.docker.internal:8883`), so `CONTROL_MQTT_INSECURE=false`.
+`deploy/mosquitto/README.md` is the design, the apply runbook and the rollback.
 
 ## MQTT (Phase 3)
 
@@ -108,6 +109,10 @@ Broker: the shared **Mosquitto on `.13`**. A second broker is not added
 - The service publishes each device's config **retained** on startup, after every
   lock, unlock, expiry, create and edit, and again every 15 minutes so a broker
   that lost its retained store is repaired from SQLite.
+- Devices use the **8883 TLS listener** with one account each; the broker's ACL
+  lets a device read only its own config and write only its own status and
+  telemetry, and the Control Service is the only identity that may publish
+  config.
 - A device registers the will `{"online": false}` on its status topic, so the
   broker reports the drop the moment the connection dies. That is presence
   (FR-6); no polling.