feat(mqtt): MqttDriverForm + MqttDeviceForm — the driver/device config forms P1 omitted

The P1 live gate had to insert MQTT driver config directly via SQL: DriverConfigModal and
DeviceModal both fell through to "No typed config form for driver type Mqtt" with no raw-JSON
fallback, so broker host/port/TLS/credentials were unauthorable from the AdminUI. Task 12 built
the *tag* editor; these are the driver + device surfaces.

MqttDriverForm authors the whole MqttDriverOptions connection surface (host/port/clientId,
TLS + CA pin, credentials, protocol version/clean-session/keep-alive, connect timeout, reconnect
backoffs, mode, maxPayloadBytes, and the Plain sub-object). The Sparkplug sub-object stays P2 —
a marked placeholder mirroring MqttTagConfigEditor's stub, with any existing sparkplug keys
preserved untouched.

The connection is authored on the DRIVER, not the device — unlike Modbus/S7/OpcUaClient and
contrary to what docs/drivers/Mqtt.md said. DriverDeviceConfigMerger merges a device's keys up
only when the driver has exactly ONE device, so a device-authored broker connection vanishes
silently the moment a second device is added. MqttDeviceForm is therefore informational (the
GalaxyDeviceForm shape) and round-trips DeviceConfig verbatim; it flags legacy connection keys
left on a device by a pre-form deployment, because those still win via merge-up.

Serialization goes through the ONE shared MqttJson.Options instance (Task 9's decision), never a
fifth per-form copy — pinned by an assertion that an ordinal-only reader CANNOT bind the emitted
blob, and by extending the fleet-wide DriverPageJsonConverterTests guard to resolve a form's
serializer from an explicit external-instance registry when it has no _jsonOpts field. Dropping
the converter from MqttJson.Options reddens 3 tests and leaves the symmetric round-trip green —
the Task 9 lesson, reproduced.

RawTags is stripped from the emitted blob (the deploy artifact owns it) and unknown top-level
keys survive a load->save. Validation mirrors the driver's own [Range] bounds inline, and
ToOptions() additionally clamps, so an ignored error still cannot persist a
connectTimeoutSeconds:0 driver-brick. A non-blank clientId raises the P1 live-gate warning
inline (fixed ids make redundant pair nodes evict each other while both report Healthy).

AdminUI 761/761 green (was 730), TWAE-clean; Driver.Mqtt 266/266 green.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/drivers/Mqtt.md

@@ -48,24 +48,50 @@ Driver-type string: **`Mqtt`** (`DriverTypeNames.Mqtt`).
 ## Configuration
 
 Bound through `MqttJson.Options` — **case-insensitive**, enums by **name**, unknown members skipped.
-Author the connection on the **device** (`DeviceConfig`) and the mode on the **driver**
-(`DriverConfig`); `DriverDeviceConfigMerger` merges them, and injects `rawTags`.
+
+**The whole connection is authored on the DRIVER** (`DriverConfig`), via `MqttDriverForm` in the `/raw`
+driver-config modal. Unlike Modbus / S7 / OPC UA Client, MQTT does **not** use the v3
+endpoint→`DeviceConfig` split: an MQTT driver instance holds exactly one broker session, so
+`MqttDeviceForm` is informational (the same shape as `GalaxyDeviceForm`) and devices under an MQTT
+driver are pure organisational grouping in the RawPath.
+
+> **Why not the device.** `DriverDeviceConfigMerger` merges a device's keys up to the top level *only
+> when the driver has exactly one device*. A device-authored broker connection therefore disappears
+> from the merged blob the moment a second device is added — a silent outage with nothing to see at
+> deploy time. Driver-level authoring is correct for 0, 1 or N devices. A pre-form deployment that put
+> the connection on a sole device still works (merge-up wins over the driver's keys) and
+> `MqttDeviceForm` flags those keys so the mismatch is visible; move them to the driver.
+
+`DriverDeviceConfigMerger` still merges driver + device and injects `rawTags`.
 
 ```jsonc
-// DriverConfig
-{ "Mode": "Plain", "Plain": { "TopicPrefix": "", "DefaultQos": 1 } }
-
-// DeviceConfig
+// DriverConfig — authored by MqttDriverForm. PascalCase keys, enums as names.
 {
   "Host": "10.100.0.35",
   "Port": 8883,
   "UseTls": true,
+  "AllowUntrustedServerCertificate": false,
+  "CaCertificatePath": null,      // pins the chain; null = OS trust store
   "Username": "otopcua",
-  "Password": "",                 // supply via ${secret:} / env — never commit
-  "CaCertificatePath": null       // pins the chain; null = OS trust store
+  "Password": "",                 // never commit
+  "ProtocolVersion": "V500",
+  "CleanSession": true,
+  "KeepAliveSeconds": 30,
+  "ConnectTimeoutSeconds": 15,
+  "ReconnectMinBackoffSeconds": 1,
+  "ReconnectMaxBackoffSeconds": 30,
+  "MaxPayloadBytes": 1048576,
+  "Mode": "Plain",
+  "Plain": { "TopicPrefix": "", "DefaultQos": 1 }
 }
+
+// DeviceConfig — empty; MQTT has no per-device endpoint.
+{}
 ```
 
+The form never writes `RawTags` (the deploy artifact owns it) and never touches `Sparkplug` (P2) — an
+existing `Sparkplug` object, and any key a newer driver adds, survive a load→save untouched.
+
 Every key has a default, so nothing is strictly required by the binder. Notable ones:
 `port` **8883**, `useTls` **true**, `protocolVersion` **V500**, `cleanSession` **true**,
 `keepAliveSeconds` **30**, `connectTimeoutSeconds` **15**,
@@ -77,7 +103,13 @@ Every key has a default, so nothing is strictly required by the binder. Notable
 > other forever — the broker logs `Client <id> already connected, closing old connection` and both
 > nodes reconnect every few seconds while still reporting `Healthy`. Unset (the default) lets MQTTnet
 > generate a unique id per connection, which is correct. This was observed live during the P1 gate.
-> (The probe and browser already self-uniquify with `-probe-` / `-browse-` suffixes.)
+> (The probe and browser already self-uniquify with `-probe-` / `-browse-` suffixes.) `MqttDriverForm`
+> defaults the field blank and raises this warning inline the moment a value is typed.
+
+The form validates every knob against the driver's own `[Range]` bounds (port 1–65535, keep-alive /
+connect-timeout / backoffs ≥ 1 s, max-backoff ≥ min-backoff, `maxPayloadBytes` ≥ 1, QoS 0–2) and
+additionally **clamps** on serialize, so an operator who ignores the inline error still cannot persist
+a `connectTimeoutSeconds: 0` driver-brick.
 
 ## Tag Configuration