Record the applied MQTT TLS listener on the shared Mosquitto

Follow-up to the Phase 3 commit (14b304e), after Sam accepted the confirmation
on AUD-80. The operational change itself lives outside this repository; this
commit updates the documentation so it matches reality.

Applied on .13 (backups: mosquitto.conf.bak.aud80-20261013-152648 and
docker-compose.yml.bak.aud80-20261013-152648):
- mosquitto.conf gains per_listener_settings true and
  include_dir /mosquitto/config/conf.d; its original 1883 listener and
  allow_anonymous true are untouched.
- docker-compose.yml publishes 8883 and mounts the new conf.d and tls
  directories (the compose mounts mosquitto.conf as a single file, so the
  include_dir fails without them).
- conf.d/webrestrict.{conf,acl,passwd} and tls/{ca.crt,server.crt,server.key}
  are installed from deploy/mosquitto/.
- The Control Service now uses tls://host.docker.internal:8883 with the
  control-service account and CONTROL_MQTT_INSECURE=false.

Verified live after the restart: the 1883 plane still carries anonymous traffic,
8883 refuses anonymous clients and a wrong password, each device reads only its
own retained config, a device cannot write another device's status or its own
config, and a client killed without DISCONNECT drove the retained will into an
offline transition recorded in SQLite.

Docs: deploy/mosquitto/README.md records the exact host diff, the runbook gap
that caused one restart-loop (the missing bind mounts), the per_listener_settings
deprecation caveat and the rollback. README.md and TRANSPORT_DESIGN.md now
describe the applied state.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

environment.d/control-service.env.example

@@ -46,21 +46,24 @@ CONTROL_ADMIN_PASSWORD=change-me
 CONTROL_MQTT_ENABLED=true
 
 # The shared Mosquitto on `.13`, seen from inside this container. The compose
-# file maps host.docker.internal to the host gateway.
-# When the TLS listener exists, change this to tls://host.docker.internal:8883.
-CONTROL_MQTT_BROKER=tcp://host.docker.internal:1883
+# file maps host.docker.internal to the host gateway. The TLS listener on 8883
+# has been live since 2026-10-13 (deploy/mosquitto/README.md).
+CONTROL_MQTT_BROKER=tls://host.docker.internal:8883
 
 # The Control Service identity. The broker ACL gives it write access to every
 # config topic and read access to every status and telemetry topic, nothing else.
+# Generate the account with deploy/mosquitto/provision-clients.sh, which writes
+# the values into deploy/mosquitto/clients.env (gitignored).
 CONTROL_MQTT_CLIENT_ID=control-service
-# CONTROL_MQTT_USERNAME=control-service
-# CONTROL_MQTT_PASSWORD=change-me
+CONTROL_MQTT_USERNAME=control-service
+CONTROL_MQTT_PASSWORD=change-me
 
 # PEM bundle used to verify the broker certificate. Required for a tls:// broker.
+# docker-compose.yml mounts deploy/mosquitto/tls/ here read-only.
 CONTROL_MQTT_CA_FILE=/etc/webrestrict/tls/ca.crt
 
-# TEMPORARY. The shared Mosquitto has no TLS listener yet, so a plaintext,
-# credential-less link is allowed. The service refuses to start without
-# credentials or TLS unless this is true, and it logs a warning when it is.
-# Set to false as soon as deploy/mosquitto/ is applied (AGENTS.md §10 rule 6).
-CONTROL_MQTT_INSECURE=true
+# Escape hatch for a broker that has no TLS listener: it allows a plaintext,
+# credential-less link. The service refuses to start without credentials or TLS
+# unless this is true, and it logs a warning when it is. Leave it false against
+# the shared Mosquitto (AGENTS.md §10 rule 6).
+CONTROL_MQTT_INSECURE=false