🚧 Update certificate management

README.md

@@ -102,7 +102,8 @@ covered by the test suite / running stack.
 - [x] Management RBAC (super_admin / broker_admin / operator / auditor)
 - [x] Dynamic Security integration (backend as the dynsec admin client)
 - [x] MQTT clients: create / disable / enable / delete, password reset,
-      random passwords (returned exactly once)
+      random passwords (returned exactly once), expected client-ID
+      binding (anti-credential-sharing, spec section 11)
 - [x] Groups: create / delete, member + role assignment with priorities
 - [x] Roles: create / delete, ACL editor (all six ACL types, `%u`/`%c`
       substitution, priorities, draft-then-save)
@@ -137,21 +138,33 @@ Hardening done beyond the plan:
       private keys encrypted at rest (AES-256-GCM)
 - [x] Server certificate generation (CN, DNS/IP SANs, serverAuth EKU,
       signed by a platform CA; PEM download)
+- [x] Client certificates (CN = MQTT username, clientAuth EKU,
+      one-time bundle with cert + key + CA chain as file downloads;
+      identity binding to the client metadata)
+- [x] mTLS listeners end-to-end: TLS section in the listener form
+      (certificate picker, min TLS version, require_certificate,
+      use_identity_as_username) — verified live with a client-cert
+      publish through an mTLS listener (spec section 24)
 - [x] Certificate inventory (serial, fingerprint, SANs, status, expiry)
 - [x] TLS config generation: listeners with a bound certificate emit
       certfile/keyfile/cafile; cert files are published to a shared
-      certs volume before the config is validated/activated
+      certs volume (uid 1883, key mode 0640) before validation/deploy
+- [x] Unpublished-port warning: listeners on ports not mapped by
+      compose.yaml warn in the preview/deploy (reachable only inside
+      the Docker network; keep PUBLISHED_PORTS in sync with compose)
 - [ ] Configuration diff view (revision N-1 → N)
 - [ ] Configuration rollback (creates a new revision, §62)
-- [ ] Reload-vs-restart classification (§28) — only a restart warning on
-      listener port/bind edits so far, no general classification
+- [ ] Reload-vs-restart classification (§28) — the deploy health check
+      passes on reload, but a NEW listener still needs an explicit
+      broker restart (docker compose restart mosquitto); surfacing
+      that in the UI is pending
 - [ ] CA import (existing external CA)
 - [ ] Root-key export + removal workflow (§18)
-- [ ] Client certificates (managed-key mode, one-time download)
-- [ ] CSR signing
+- [ ] CSR signing (client-side key generation)
 - [ ] Certificate revocation + CRL generation/publishing
-- [ ] mTLS listeners (model fields + config generation exist; binding a
-      certificate in the UI is the remaining step)
+- [ ] Client-cert disable: revoking access for a connected device
+      (needs CRL or dynsec disable + kick; the interim path — disabling
+      the client — already refuses reconnects even with a valid cert)
 
 ### Release 3 — Operations, safety, and visibility (§68.3) — PARTIAL