smqtt

Enforce client_id=device_id; invalidate tokens on kick to close JWT replay gap

Fix MQTT auth, suppress warnings, smoke test passes end-to-end