chore(deps): drop aedes-server-factory; the tcp listener is bare node:net

[nzneit]

Removes the aedes-server-factory dependency and replaces its one call site with net.createServer((socket) => aedes.handle(socket)). Recorded as D-024. This is the follow-up D-021 pointed at: the package was already identified there as "not a maintained path to 1.x".

Why it can go

• Dead: last published 2021-06-28, nearly three years before aedes 1.0 existed.
• Heavy for one line: it hard-depends on ws@7 (the exact package whose Bun stand-in is why the ws listener is hand-built) and aedes-protocol-decoder; offbook called it once, for the tcp listener.
• Equivalent by source read, not impression: with no options its path reduces to net.createServer + aedes.handle plus a req.connDetails field. Nothing in the repo reads connDetails (repo-wide grep, exit 1). The only delta is an unread metadata field.
• The removal drops aedes-server-factory, aedes-protocol-decoder and ws@7.5.11 from the lockfile. ws@8 remains via mqtt (dev) and the Stryker runner; neither is a runtime path of broker/.

Why now, given D-021 defers aedes 1.x

This is the one aedes-adjacent change that does not move the floor under R-006/R-007: aedes stays at 0.51.x and the hand-built ws listener (the spike surface) is untouched. It clears the only structural obstacle on the 1.x path.

D-024 also records the probe results that de-risk the future bump: aedes 1.1.1 runs under Bun (10-check probe, exit 0, driven exactly the way src/broker/ drives 0.51: preConnect, handle() on a socket, the event shapes, publish(packet, cb), createRetainedStream("#") as a Readable, close(cb)). The remaining migration delta is roughly ten lines. The deferral itself stands: 1.x changes runtime defaults (drainTimeout: 60000, a maxTopicLevels clamp, keepalive limits) and the spikes measure against defaults, so they still run first.

Guards kept deliberately

The Biome noRestrictedImports entry for aedes-server-factory and the test/transport-isolation.test.ts regex both keep listing the package: they now guard against reintroduction. Negative control verified with the package uninstalled: a planted import outside src/broker/ makes lint exit 1; the clean tree exits 0. test/lint-gate.test.ts continues to assert the Biome entry, unchanged.

New coverage

The pre-existing tcp test stopped at the CONNECT handshake, which would not have caught a listener that handshakes but drops data. A new test in src/broker/fingerprint.test.ts proves the replacement listener round-trips data both ways: a QoS-1 publish reaches onInbound, and an emit reaches a tcp subscriber.

Gates

check-docs, lint, typecheck, demo-app:build and full bun test all exit 0.