Add MQTT username/password auth and ACL generation

[maakler]

Stacked on fix/mqtt-tls-san-validation. Do not merge before the TLS PR.

Adds MQTT username/password authentication and broker ACL generation on top of TLS hardening.

Behavior:

• auth requires TLS context
• partial credentials fail closed
• anonymous mode is not used when credentials are configured
• firmware config receives MQTT credential fields
• client helper options are deduplicated

Known limitation: (already fixed. see comment below)
MQTT helper credential confidentiality against local process inspection is not claimed. Current helpers still pass passwords to mosquitto_pub/sub via command-line arguments. Follow-up PR planned.

[maakler]

Made some changes, right now the whole thing:

• Adds TLS-gated MQTT username/password auth,
• broker ACL generation,
• helper auth options,
• and fail-closed firmware credential generation so credentials are not emitted unless TLS is enabled.

[maakler]

Updated this draft with the follow-up helper credential fix. MQTT helper scripts now avoid passing the configured username/password through mosquitto_pub/sub argv; authenticated calls use private temporary XDG_CONFIG_HOME client config files with 0700 directory / 0600 file permissions and cleanup traps. Also includes tests/checks for no password exposure in helper argv and temp config cleanup.