Record the applied MQTT TLS listener on the shared Mosquitto

Follow-up to the Phase 3 commit (14b304e), after Sam accepted the confirmation
on AUD-80. The operational change itself lives outside this repository; this
commit updates the documentation so it matches reality.

Applied on .13 (backups: mosquitto.conf.bak.aud80-20261013-152648 and
docker-compose.yml.bak.aud80-20261013-152648):
- mosquitto.conf gains per_listener_settings true and
  include_dir /mosquitto/config/conf.d; its original 1883 listener and
  allow_anonymous true are untouched.
- docker-compose.yml publishes 8883 and mounts the new conf.d and tls
  directories (the compose mounts mosquitto.conf as a single file, so the
  include_dir fails without them).
- conf.d/webrestrict.{conf,acl,passwd} and tls/{ca.crt,server.crt,server.key}
  are installed from deploy/mosquitto/.
- The Control Service now uses tls://host.docker.internal:8883 with the
  control-service account and CONTROL_MQTT_INSECURE=false.

Verified live after the restart: the 1883 plane still carries anonymous traffic,
8883 refuses anonymous clients and a wrong password, each device reads only its
own retained config, a device cannot write another device's status or its own
config, and a client killed without DISCONNECT drove the retained will into an
offline transition recorded in SQLite.

Docs: deploy/mosquitto/README.md records the exact host diff, the runbook gap
that caused one restart-loop (the missing bind mounts), the per_listener_settings
deprecation caveat and the rollback. README.md and TRANSPORT_DESIGN.md now
describe the applied state.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

TRANSPORT_DESIGN.md

@@ -110,19 +110,22 @@ reconnects is locked again **immediately**, with no waiting.
   own** status. Without this, a child can publish a fake "unlocked".
 - Rotate device credentials when a device is removed.
 
-**Status (Phase 3).** Written, verified, not yet applied:
-`deploy/mosquitto/conf.d/webrestrict.conf` is the TLS listener, `.acl` is the
-topic policy, and `deploy/mosquitto/README.md` is the apply/rollback runbook.
-`make mqtt-verify` proves the policy on a throwaway broker. The Control Service
-is configured for TLS plus credentials, and refuses a plaintext,
+**Status (Phase 3). Applied on `.13` 2026-10-13.** The shared Mosquitto now runs
+two planes: its original anonymous `1883` listener, unchanged, and a TLS
+listener on `8883` that requires an account
+(`deploy/mosquitto/conf.d/webrestrict.conf` + `.acl`). The Control Service
+connects to `8883` as `control-service` with the lab CA, and refuses a plaintext,
 credential-less broker unless `CONTROL_MQTT_INSECURE=true` is set explicitly.
 
-The shared Mosquitto on `.13` still has only its original anonymous `1883`
-listener, so the running deployment uses that escape hatch and logs a warning.
-Applying the TLS listener means editing the shared broker's configuration and
-compose file, adding port 8883 and restarting it — a change to a shared
-household service, so it waits for Sam's approval instead of being applied
-unilaterally.
+`make mqtt-verify` proves the policy on a throwaway broker, so it can be
+re-checked without touching the shared one. `deploy/mosquitto/README.md` holds
+the design, the exact host changes, the notes from the live apply and the
+rollback.
+
+One caveat to carry forward: `per_listener_settings true` is deprecated in
+Mosquitto 2.1 and is removed in 3.0. It is kept because it is the only way on
+2.1 to give the two listeners different `password_file`/`acl_file` values. Pin
+the broker image tag before upgrading, or rework the two planes.
 
 ---