add opt-in presence feed for client connect and disconnect in agent mode

[fabracht]

Summary

Agent-mode presence feed for hold reclaim, off by default.

• --presence / MQDB_PRESENCE publishes retained QoS 0 JSON {client_id, user_id, event, unexpected, ts} to $DB/_presence/{client_id} on connect and disconnect
• fires on clean and unexpected disconnects; internal mqdb- clients are skipped
• $DB/_presence/# is ReadOnly, so clients (admins included) cannot forge presence and a non-admin janitor can subscribe
• the agent's own $DB/# handler ignores presence topics
• cluster mode is a follow-up: the cluster trie drops $-prefixed topics from wildcard routing, so it will broadcast presence to all nodes instead

Test plan

• cargo make format-check clean
• cargo make clippy passes with zero warnings
• cargo make test: 24 suites, 1190 passed, 0 failed
• presence_test: connect and clean disconnect delivered, retained state reaches a late subscriber, forged publish is not delivered, silent when disabled
• CI green