Fleet API: GET /v1/robots/<id> with retained presence, pose, capabilities and last mission status

[MJohnson459]

The fleet API can now answer is this robot online and what is it doing over
HTTP alone. M3's split — reads over MQTT, writes over HTTP — is right for the
dashboard, which wants a live stream, and wrong for a client that asks once and
acts: an MCP front door or a script otherwise has to track the topic tree,
retention semantics and (after #624) a broker credential, three contracts where
one would do.

What changed

mote_fleet/server/fleet_server.py gains a subscription of its own.
BrokerFeed connects to mote/v2/+/{presence,health,pose,capabilities, mission/status} and fills RobotState, an in-memory map of the last retained
payload per robot per leaf.

• GET /v1/robots/<id> — the registry row, broker_connected, and
  presence / health / pose / capabilities / mission_status, each the
  publisher's own document or null. Operator token, like GET /v1/audit
  (#623 has not landed, so the handler checks it the way audit does).
• GET /v1/robots — each row now carries its presence payload, so picking an
  online robot costs one request rather than N.

Five decisions are load-bearing:

• Forwarded, never rebuilt. No field added, renamed or reinterpreted — the
  rule the agent follows, so there is one definition of this wire.
• Absent state is null per field. A robot the server has never heard from
  is 200 with every field null; 404 stays reserved for one that is not
  enrolled. broker_connected sits beside them because with the feed down every
  field is null however healthy the fleet is, and null alone cannot say which.
• Nothing is persisted. Every topic read is retained, so a restarted server
  is repopulated by the broker within a second; a stored copy could only be the
  staler answer. A cleared retained topic (zero-length payload) clears the
  field, or the server would assert state the broker has stopped serving.
• mission_status is the last status, not a history — one transition is all
  that is retained. watch and dispatch keep the broker for the rest.
• The token is checked before the robot is looked up, so an anonymous caller
  cannot enumerate ids by reading 401 against 404.

serve() takes publisher and feed as a pair: injecting a publisher is how a
test stands the broker down, and a live subscription beside a stubbed publisher
would have the server dialling a broker the test does not have. server_close()
now closes both, which also fixes a paho client leaked per server in the tests.

fleetctl reads this route rather than the broker: robots gains a
PRESENCE column with three states (online / offline / unknown — a robot
nobody has heard from is not offline), and fleetctl robots <id> prints health,
pose, capabilities and the last mission. Both say so when the fleet server is
not connected to the broker.

Docs: docs/fleet/fleet-api.md specifies both routes as contract (auth
table, status codes, the field table, and what the route deliberately is not);
control-plane.md and docs/fleet/README.md §8 point at it; CLAUDE.md gains
a section. The deploy Dockerfile's note on why paho is installed now covers both
halves of the broker hop.

Verification

• mote_fleet/test — 279 passed, run against the dev environment's Python
  (pixi run inside a worktree would provision a duplicate multi-GB env).
• test_fleet_server.py over the real socket: unknown robot 404; enrolled robot
  with no traffic → all-null; retained presence/pose/status published through
  the test broker come back verbatim; the newest payload on a topic wins; a
  cleared retention clears the field; 401 without a token, and 401 rather than
  404 for an unknown id; the roster's presence column; what the state refuses to
  hold (a registry announcement, a command, a non-object payload).
• test_e2e_fleet.py::test_a_mission_can_be_followed_over_http_alone — a real
  mosquitto, the fleet server with its own subscription, the agent and the real
  mote_tasks tree: discover the robot, read its capability set, dispatch, and
  follow the mission to succeeded and then a typed unresolved_zone refusal,
  with no MQTT client in the test.
• pre-commit run --all-files clean.

fleetctl's two read commands were also driven against a live server; the
transcript in docs/fleet/README.md §8 is that run's actual output.

[claude]

server_close() reads self.feed/self.publisher, but FleetServer.__init__ assigns them (L1254-1255) only after calling super().__init__(address, FleetHandler) (L1239). socketserver.TCPServer.__init__ calls self.server_close() itself, in an except block, if server_bind()/server_activate() fails (e.g. the operator's classic "it's already running" OSError: Address already in use) — at that point self.feed doesn't exist yet, so this override raises AttributeError instead of letting the real bind error propagate, and self.publisher (a live BrokerLink with its own paho thread) never gets closed on that path.

Suggested change

	super().server_close()
	if self.feed is not None:
	self.feed.close()
	self.publisher.close()
	super().server_close()
	if getattr(self, "feed", None) is not None:
	self.feed.close()
	publisher = getattr(self, "publisher", None)
	if publisher is not None:
	publisher.close()

[claude]

This ignores paho's CONNACK reason code — on_connect fires on a refused connection too (bad client id, not-authorized, server unavailable), and this handler unconditionally subscribes and sets state.connected = True regardless. That reproduces exactly the ambiguity broker_connected exists to remove (per RobotState's own docstring: "a client cannot tell a robot that has said nothing from a server that cannot hear") — a refused connection would report broker_connected: true with every field null. The test harness's own fake_robots.py already guards this case via reason_code.is_failure; this new production code doesn't.

Suggested change

	def _on_connect(self, client, _userdata, *_args):
	for leaf in STATE_LEAVES:
	client.subscribe(protocol.any_robot(leaf), qos=protocol.QOS)
	self.state.connected = True
	def _on_connect(self, client, _userdata, _flags, reason_code, *_args):
	if getattr(reason_code, "is_failure", False):
	return
	for leaf in STATE_LEAVES:
	client.subscribe(protocol.any_robot(leaf), qos=protocol.QOS)
	self.state.connected = True

[claude]

This docstring's anti-enumeration claim ("an unauthenticated caller cannot enumerate ids by reading 401 against 404") doesn't hold at the fleet level: _roster() (GET /v1/robots, L623-642) has no auth check at all and already returns robot_id/name/site/fingerprint/enrolled_at for every enrolled robot — plus, as of this PR, each robot's presence payload. An anonymous caller enumerates the whole fleet (and now who's online) with one request to /v1/robots, so the careful 401-before-404 ordering here doesn't actually buy id secrecy. The same sentence is repeated in docs/fleet/fleet-api.md and CLAUDE.md. Worth either scoping the claim to what it actually buys (protecting the state data, not the id itself) or noting the roster still enumerates ids until a credential is added.