ops: make the bundled Mosquitto opt-in, normalise DISABLE_MOSQUITTO, pprof loopback by default (#431 owner decisions) #441

Owner decisions (2026-10-14) on the "Left for the owner" items in #431 (#372, merged):

1. The bundled Mosquitto becomes opt-in. The default in docker-compose.yml (and every other compose variant or script default) changes to DISABLE_MOSQUITTO=true. Operators who rely on the bundled broker must set DISABLE_MOSQUITTO=false explicitly. Ship this with a clear release note.
2. Normalise DISABLE_MOSQUITTO parsing. The entrypoint, Go code and manage.sh must treat true/1/yes/on (case-insensitive, trimmed) identically, and likewise false/0/no/off. broker-check stops reporting a mismatch once parsing is consistent; it should still report the effective mode.
3. pprof binds to loopback by default when enabled. When ENABLE_PPROF is on, the server and ingestor listeners default to 127.0.0.1. The existing PPROF_BIND setting restores remote access (e.g. PPROF_BIND=0.0.0.0). Keep distinct server/ingestor ports. Document the SSH-tunnel alternative.
4. MQTT_SOURCE_STRICT stays off by default. No change.

Acceptance:

• Tests for each parsing value (including unset/empty and junk), the compose default, and the pprof bind default and override.
• Release note text covering what changes on upgrade and how to keep the old behaviour (DISABLE_MOSQUITTO=false, PPROF_BIND=0.0.0.0).
• Verified with local Docker that an install with DISABLE_MOSQUITTO=true (as all our deployments have) behaves identically before and after.