security(iot): MQTT ACL isolation via EMQX HTTP authorization

Each IoT device can only pub/sub to its own topics: {namespace}/{deviceId}/#
Any attempt to access foreign topics → EMQX denies and disconnects.

Changes:
- internal/api/handler: add MQTTAcl handler (POST /internal/mqtt/acl)
- internal/api/router: register /internal/mqtt/acl route
- deployments/k8s/emqx.yaml: add HTTP authorization backend, no_match=deny
- Operator v0.1.52 deployed

Tested: own topic ALLOWED, foreign topic → authorization_permission_denied + disconnect

deployments/k8s/emqx.yaml

@@ -64,16 +64,37 @@ data:
       }
     ]
 
-    ## ACL по умолчанию — разрешаем всё аутентифицированным клиентам
-    ## Тонкая ACL настраивается через HTTP auth response (поле acl)
+    ## Authorization (ACL) — HTTP backend для изоляции топиков по устройству.
+    ## no_match = deny: если HTTP backend недоступен или не ответил — запрещаем.
+    ## Endpoint /internal/mqtt/acl возвращает allow только для топиков {ns}/{deviceId}/#
     authorization {
-      no_match = allow
+      no_match = deny
       deny_action = disconnect
       cache {
         enable = true
         max_size = 32
         ttl = 1m
       }
+      sources = [
+        {
+          type = http
+          enable = true
+          method = post
+          url = "http://sless-operator.sless.svc:9090/internal/mqtt/acl"
+          body {
+            username = "${username}"
+            clientid = "${clientid}"
+            action = "${action}"
+            topic = "${topic}"
+          }
+          headers {
+            "content-type" = "application/json"
+          }
+          connect_timeout = 5s
+          request_timeout = 5s
+          pool_size = 8
+        }
+      ]
     }
 
     ## MQTT настройки