feat(mqtt-connector): TLS, auth, and SNTP time source for the Embassy client

Implements design 044: mqtts:// broker support behind a new embassy-tls
feature.

- embedded-tls 1.3 session over the Embassy TCP socket; rustpki (pure
  Rust, rsa+p384) certificate verification against an app-embedded root
  CA; SNI + hostname verification from the broker URL (IP-literal mqtts
  URLs are rejected at build()).
- Entropy injected via TlsOptions (&'static mut dyn CryptoRngCore) — the
  app owns the TRNG; buffers are app-provided statics (D3, D10).
- Connector-internal SNTPv4 task (UDP + DNS) backs the TlsClock; the
  first handshake waits for time sync so validity is always checked (D4,
  D5). The wire codec is feature-independent and host-tested.
- The TLS manager loop is a connector-local port of
  mountain-mqtt-embassy's run() (which hard-codes a plain TcpSocket);
  the session speaks a custom Connection impl tracking decrypted
  plaintext + socket readiness, and re-subscribes inbound routes per
  session. The plain path is untouched (D6).
- with_credentials() feeds MQTT CONNECT on both transports; the fork
  submodule gains upstream 0.4's ConnectionSettings::with_auth/
  authenticated (aimdb-dev/mountain-mqtt@89a7129) (D8).
- make check gains the embassy-runtime,embassy-tls,defmt clippy leg.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lxsaah

Cargo.lock

@@ -252,6 +252,8 @@ clippy:
 	cargo clippy --package aimdb-knx-connector --target thumbv7em-none-eabihf --no-default-features --features "embassy-runtime" -- -D warnings
 	@printf "$(YELLOW)  → Clippy on MQTT connector (embassy + defmt)$(NC)\n"
 	cargo clippy --package aimdb-mqtt-connector --target thumbv7em-none-eabihf --no-default-features --features "embassy-runtime,defmt" -- -D warnings
+	@printf "$(YELLOW)  → Clippy on MQTT connector (embassy + TLS + defmt)$(NC)\n"
+	cargo clippy --package aimdb-mqtt-connector --target thumbv7em-none-eabihf --no-default-features --features "embassy-runtime,embassy-tls,defmt" -- -D warnings
 	@printf "$(YELLOW)  → Clippy on KNX connector (embassy + defmt)$(NC)\n"
 	cargo clippy --package aimdb-knx-connector --target thumbv7em-none-eabihf --no-default-features --features "embassy-runtime,defmt" -- -D warnings
 	@printf "$(YELLOW)  → Clippy on WS protocol$(NC)\n"

Makefile

@@ -38,6 +38,18 @@ embassy-runtime = [
     "heapless",
     "static_cell",
 ]
+# TLS (`mqtts://`) for the Embassy client — design 044. embedded-tls 1.3
+# session over the Embassy TCP socket, pure-Rust certificate verification
+# (`rustpki`; `rsa`/`p384` so public CA chains verify out of the box), broker
+# hostname resolution (embassy-net DNS), and the SNTP time source (UDP).
+embassy-tls = [
+    "embassy-runtime",
+    "dep:embedded-tls",
+    "dep:embedded-io-async",
+    "dep:rand_core",
+    "embassy-net/dns",
+    "embassy-net/udp",
+]
 tracing = ["dep:tracing", "aimdb-core/tracing"]
 defmt = ["dep:defmt", "aimdb-core/defmt"]
 
@@ -84,6 +96,15 @@ mountain-mqtt = { version = "0.2.0", default-features = false, optional = true,
 ] }
 mountain-mqtt-embassy = { version = "0.2.0", optional = true }
 
+# TLS for the Embassy client (no_std TLS 1.3; design 044)
+embedded-tls = { version = "0.19", default-features = false, optional = true, features = [
+    "rustpki",
+    "rsa",
+    "p384",
+] }
+embedded-io-async = { workspace = true, optional = true }
+rand_core = { version = "0.6", default-features = false, optional = true }
+
 # Embedded utilities
 heapless = { workspace = true, optional = true }
 static_cell = { version = "2.0", optional = true }