Mosquitto subchart leaves plaintext 1883 open when TLS is enabled

[fbeneventi]

Context

When operators enable MQTT TLS via mosquitto.tls.enabled=true, the
rendered mosquitto.conf adds port 8883 as an additional listener
rather than replacing the plaintext 1883 listener.

See deploy/helm/examon/subcharts/mosquitto/templates/configmap.yaml:
the conditional {{- if .Values.tls.enabled }} block adds an 8883
listener but does not gate the unconditional 1883 listener earlier in
the file.

Impact

Operators who believe enabling TLS hardens the broker still expose an
unauthenticated plaintext port to anything that can reach the
LoadBalancer IP.

Current workaround (documented)

docs/administrators/deploy/harden-for-production.md § Known gaps in
v0.5.0 instructs operators to restrict port 1883 at the LoadBalancer
service or NetworkPolicy layer.

Desired behaviour

Introduce a new value mosquitto.tls.allowPlaintext (default false
when tls.enabled=true). When TLS is enabled and allowPlaintext is
false, the rendered config should bind only 8883.

Files to touch

• deploy/helm/examon/subcharts/mosquitto/templates/configmap.yaml
• deploy/helm/examon/subcharts/mosquitto/values.yaml
• deploy/helm/examon/values-production.yaml

Doc cleanup when closed

• Remove the dual-listener caveat from
  docs/administrators/deploy/harden-for-production.md § MQTT TLS.
• Remove the corresponding paragraph from § Known gaps in v0.5.0.
• Update verification step to test only port 8883.