M7: security hardening (cross-cutting)

[MJohnson459]

M7 security hardening: the broker stops being anonymous and the fleet API's read routes stop being open.

Why. Through M3 the fleet had one credential on one path — an operator token on dispatch — and everything else leaned on the tailnet. The argument for changing that is not that WireGuard is weak, but that a single boundary makes every robot as trusted as the fleet server: a robot is physically reachable and carries the largest dependency tree in the system, so one compromised robot would own the fleet. M7 does not replace the tailnet; it stops it being the only thing in the way.

What changed.

• Broker credentials, generated from the registry. New mote_fleet/server/credentials.py renders mosquitto's password_file and acl_file into $MOTE_FLEET_HOME/broker/, and the broker re-reads them on SIGHUP (broker.sh reload, which records whether it started a local process or a container). Who may connect is therefore derived, never hand-maintained — a revoked operator disappears because the query no longer returns them. Three principals, disjoint by construction: a robot (username = its robot_id) publishes only under its own prefix and reads only its own task/command; an operator (op_<slug>_<hex>) subscribes fleet-wide and publishes nothing; fleet_server alone may write task/command. A robot_id is a lowercase DNS label so it can never contain the underscore the other two carry — no runtime collision check needed.
• Credentials are issued at enrollment inside the same transaction, returned once (only the hash is stored), so rotation is just running enroll again. $MOTE_HOME/fleet.yaml and the registry are both 0600.
• Every /v1 route needs an operator token, checked by one gate in front of routing — so a route added later is authenticated by default, and an unauthenticated caller gets 401 rather than a 404 that would disclose which routes exist. /healthz and the static UI stay open, the latter because the page must load before it can ask for a token. /v1/config hands the browser that operator's subscribe-only broker credential, which is why it needs one: "the browser cannot publish" is now the broker's rule, not only our client's missing PUBLISH encoder.
• Tailnet policy committed as mote_bringup/tailscale/policy.hujson (source of truth; pasted into the admin console), whose own tests block asserts robots cannot reach each other — Tailscale refuses to save a policy that fails it.
• Packages: provisioning now runs pixi install --locked, so a robot installs the dependency set that was tested rather than silently re-solving. Signing waits for M5, when there is a package to sign.
• Bonus fix: hidden was not hiding anything in the dashboard since M3 — .dispatch { display: flex } outranks the UA's [hidden] { display: none }, so the dispatch form and Foxglove link were on screen whenever the code believed otherwise.

How it was verified.

• 471 colcon tests pass, 0 failures (pixi run test), plus pixi run -e dev test-fleet at 212/212 and lint clean.
• 13 new ACL tests against a real mosquitto 2.0.20 (test_broker_acl.py) covering the milestone's criterion directly: anonymous refused, robot A cannot read robot B's commands or forge its health, operator cannot publish or read commands, server can dispatch to any robot.
• test_e2e_fleet.py now runs against an authenticated, ACL-enforcing broker started with empty credential files, so the enroll → issue → SIGHUP → agent connects → dispatch → status chain only completes if every link works.
• The dashboard driven in a real browser, including a live revocation that dropped the operator's MQTT session (disconnected: not authorised) and 401'd its next HTTP call — one act closing both paths.
• Our $7$ hash verified against a hash written by the real mosquitto_passwd, so the reimplementation cannot drift from the broker.

Key gotcha, recorded because it shapes every ACL test: mosquitto denies silently. A forbidden publish is accepted at the socket and dropped; a forbidden subscribe is granted at SUBACK and never delivers. Denial is therefore asserted on delivery — a suite checking return codes would pass with no ACL file loaded at all.

Breaking change for a deployed fleet, by design: a robot enrolled before M7 has no credential and the broker will refuse it. pixi run enroll is the fix and the agent's log says so.

Deliberately not done, each with reasons in docs/fleet/security.md: mTLS (username/password inside WireGuard is proportionate, and the seam is unchanged), expiring operator sessions (Q7's OIDC answer replaces the minting, not the checking), package signing (nothing to sign until M5), Foxglove tokens (M2 does not exist yet — but the tailnet rule already scopes port 8765).

Left open, filed as task #264: the tailnet policy is committed but not yet applied in the admin console; no robot has been re-enrolled against an M7 server; and pixi run fleet-broker-ws itself was not exercised (a container broker was verified, but started by hand on non-default ports because the workstation already had one on 1883/9001).

Docs: docs/fleet/security.md (the fleet's third versioned contract, alongside M1's MQTT one and M3's HTTP one) and docs/fleet/m7-verification.md, with control-plane.md, fleet-api.md, README.md, CLAUDE.md and the design doc's M7 milestone updated.

Committed as 8b2e03b on branch fleet-m7-security (worktree). Not pushed and no PR opened — remote operations are yours.