ops(runtime): harden bundled MQTT and opt-in pprof defaults #372

Problem

The repository defaults on dborup/CoreScope master 1f423e0627976c961fb7a40f45016e817e582cc3 still set DISABLE_MOSQUITTO=false and publish ${PROD_MQTT_PORT:-1883}:1883 in docker-compose.yml. That can expose the bundled plaintext broker if an operator uses this Compose path without overriding it. Server and ingestor pprof are already opt-in here, but when enabled their listeners use ":"+port, binding to all interfaces; the default ports differ (6060/6061).

Reference: nashmesh/CoreScope PR 21 (reference only). Our production and staging broker topologies include existing Mosquitto and MQTT device-auth sources; confirm their actual configuration before any default or deployment change. This issue does not assert which Compose path the live hosts currently run.

Requested change

• Make bundled Mosquitto an explicit opt-in. In external-broker mode, validate that a usable external MQTT source is present before starting or replacing the service. Keep credentials out of diagnostics.
• When bundled mode is explicitly selected, bind any host port to loopback unless a separately reviewed exposure is required.
• Keep pprof opt-in and bind enabled listeners to loopback by default, preserving distinct server/ingestor ports.
• Review setup, update, restore, staging and documentation paths together so environment/config precedence cannot silently select the wrong broker.

Acceptance

• Tests cover both broker modes, malformed/localhost-only external configuration, missing source, environment precedence and all relevant Compose variants.
• Tests confirm pprof is absent by default, local-only when enabled and uses distinct ports.
• A staging-like rollout verifies live MQTT ingestion and restart/rollback behavior before any production change. Existing observers and the device-auth source must continue receiving data.

Opening this issue authorizes no host or deployment changes.