Fix MQTT TLS certificate generation and TLS-only broker behavior

[maakler]

Summary

Fixes MQTT TLS behavior for IoTempower systems using IOTEMPOWER_MQTT_USE_TLS=1.

Changes

• Generate MQTT server certificates with SANs so hostname/IP verification works.
• Keep EC keys instead of switching to RSA.
• Validate generated certificates with OpenSSL during generation.
• In TLS mode, make the included Mosquitto broker expose 8883 only.
• Do not expose plaintext 1883 from the included broker when TLS mode is enabled.
• Make mqtt_send, mqtt_listen, mqtt_action, and get_ips use 8883 plus the configured CA file in TLS mode.
• Add regression tests for certificate generation and TLS-only helper behavior.
• Update TLS documentation.

Validation

• bash -n on changed shell scripts: passed.
• git diff --check: passed.
• pytest -q tests/test_mqtt_tls_cert_generation.py tests/test_mqtt_tls_only_mode.py: 5 passed.
• deploy compile for wemos_d1_mini: passed.
• ESP8266 hardware test:
  • TLS publish/subscribe on 8883 worked.
  • plaintext publish to 1883 failed as expected.

[maakler]

Follow-up fix: iot_env previously printed only already-exported IOTEMPOWER variables, so values loaded from system.conf were lost when helper commands sourced iot_env output. This made TLS-mode helpers fall back to defaults unless users exported the variables manually. The update preserves loaded IOTEMPOWER* config values and was checked against TLS tests, non-TLS mode, install tests, and compile smoketest.