TLS for the MQTT connection (iteration 2, step 5)

ca_file or the system's CAs (MOSQ_OPT_TLS_USE_OS_CERTS), client
certificate, broker certificate and host name verified, settings errors
reported before connecting. The client thread blocks SIGPIPE: with TLS,
a write to a connection the broker closed killed the process. The
reason of a failed handshake (libmosquitto's log) is appended to the
error. tst_mqtt covers TLS with test certificates in tests/data (D44).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PROGRESS.md

@@ -25,7 +25,7 @@ CLAUDE.md ("Working rules").
 - **Implementation** follows the order in DESIGN.md (steps 1–7). Steps 1 (libmosquitto in
   CMake and the containers), 2 (`MqttClient`, `MosquittoClient`, `tst_mqtt`) 3
   (`HaEntity`, `HaSensor`, `HaDevice`, unit tests) and 4 (app wiring, `--desktop-novr`,
-  UI-1) done; next: step 5 (TLS).
+  UI-1) and 5 (TLS) done; next: step 6 (app commands, `--ha-remove`, `uninstall.sh`).
 
 ## Next steps
 
@@ -164,6 +164,20 @@ Known limitation: the bundled-Qt package does not support WebEngine in this iter
     `libmosquitto.so.1`, at most `GLIBC_2.34`, private Qt symbols only `QVulkan*`.
   - Not checked yet: the graceful exit through `aboutToQuit` in the app (only in
     `tst_mqtt`); it needs a real window close or "Quit app" in SteamVR (manual test).
+- Step 5: TLS in `MosquittoClient` (`ca_file` or the system's CAs, client certificate,
+  checks before connecting); test certificates in `tests/data/` (D44); 9 TLS cases in
+  `tst_mqtt`. Findings:
+  - **SIGPIPE crash:** with TLS, a write to a connection the broker closed killed the
+    process (OpenSSL uses `write()`). Fixed by blocking SIGPIPE in the client thread.
+  - libmosquitto's `tls_set()` needs a CA file or directory, so with system CAs only
+    `MOSQ_OPT_TLS_USE_OS_CERTS` is set, and a client certificate needs `ca_file`
+    (documented, reported as a settings error).
+  - A failed handshake returns only "TLS error"/"Protocol error"; the reason is in
+    libmosquitto's log, which is now appended.
+  - Checked: host 3 × 21/21; `container-test.sh` 12/12 (libmosquitto 2.0.21), no Vulkan
+    validation messages.
+  - Still open: which CA store the Frame's OpenSSL uses by default (for `ca_file` empty);
+    check on the device.
 
 ### 2026-10-05: requirements approved