feat: take aedes 1.1.1 (D-021 obligation (1), D-031)

[nzneit]

Summary

Discharges the last of D-021's three deferred range changes: aedes ^0.51.3 → ^1.1.1, landed exactly under D-026's condition (own branch/PR/decision entry + an R-033 rehearsal re-run) and along D-024's de-risked path.

Migration — precisely the delta D-024's ten-check Bun probe recorded:

• import { Aedes } (the 1.x default export is a function whose body throws a migration error)
• await aedes.listen() at the top of start() before either port listener opens — persistence setup became async and moved out of the constructor, so this.persistence exists only post-listen (getState was already a post-start surface; the AedesWithPersistence narrowing stays, since 1.x still types persistence only on the options)
• D-024's bare node:net tcp listener and the hand-built ws listener: no change

Defaults: taken unchanged. The measured diff vs 0.51.3 is exactly two options:

• drainTimeout: 60000 — arms only on socket backpressure (unref'd timer) and disconnects a client whose socket stays undrained 60s; no clean path gains latency, aedes.close() unaffected
• maxTopicLevels: 100 — not a new limit: a 101-level publish on 0.51.3 threw qlobber's synchronous too many words (the bundled matcher already capped at 100); 1.1.1 fails the same input cleanly via the publish callback (topic has too many levels), so broker.emit rejects legibly at the same ceiling

maxClientsIdLength/keepaliveLimit unchanged, so the connect surface D-026 measured does not move. Lockfile slims: eight utility deps dropped; aedes-persistence 10.3.1 + mqemitter 7.1.0 in; persistence backends are optional peers, not installed.

Verification

• Full gate set exits 0: check-docs, lint, typecheck, demo-app:build, bun test 568 pass / 0 fail — including src/broker/connect-profile.test.ts, the D-026 closure pin (MQTT 3.1.1 over ws, non-root path, no auth, retained receipt on subscribe, persistent session at keepalive 30, QoS 0/1 both ways)
• R-033 rehearsal re-run: green — the demo-app.md §9 walk on the bumped broker in Chromium and Firefox both: checklist all-green, command chain reacts, both break buttons caught, zero sent-vs-seen discrepancies (manual by design)

Docs

• DECISIONS.md: D-031 (measurements, the defaults analysis, the rehearsal record)
• AGENTS.md: status updated — all three D-021 deferred range changes now discharged