Forge level exploration for Expert credentials

## Context

Parent: #6897 — FE MQTT Migration

Exploration task to understand how the Forge BE provisions MQTT credentials and how the FE Expert and AI Agent authenticate with EMQX.

## Scope

- Understand Forge BE credential provisioning for MQTT connections
- Map the auth flow: FE Expert requests credentials → Forge BE issues scoped MQTT credentials → FE connects to EMQX
- Define topic ACL structure — ensure clients can only subscribe to their own chat-session-id topics
- Investigate how instance logs already handle this auth pattern (remote & hosted)
- Coordinate with Steve (AI Agent side) and Ben (auth bits)

## Estimate

4h (+ 1h guidance needed from Steve/Ben)

## Acceptance Criteria

- [ ] Credential provisioning flow documented
- [ ] Topic ACL rules defined for Expert sessions
- [ ] Auth pattern aligned with existing instance logs implementation
- [ ] Security considerations addressed (topic isolation, session ownership)