MQTT per-thread UDS mirror throws an unhandled rejection on non-MQTT input

## Summary

Sending plain HTTP (or any non-MQTT bytes) to the secure MQTT listener's per-thread UDS mirror (`sockets/-.sock`, created by `server.socket()` in `server/threads/threadServer.js` when `tls.unixDomainSockets` is on) produces an unhandled rejection in the worker instead of a clean connection close:

```
unhandledRejection in worker thread 3: TypeError: Cannot read properties of undefined (reading 'includes')
at authorizeLocal (server/mqtt.ts:38)
at server.socket.port handler (server/mqtt.ts:185)
at proxyProtocol.ts:341 / Socket.onReadable (proxyProtocol.ts:316)
```

`authorizeLocal` reads `socket.remoteAddress` (undefined on a Unix domain socket) and calls `.includes` on it. The connection is left open; the client hangs.

## Reproduction

TLS + `tls.unixDomainSockets: true`, then `curl --unix-socket sockets/0-8883.sock http://x/` against the MQTT secure-port mirror. Found while writing the isolated-application integration test (HarperFast/harper#2524), whose first version picked the MQTT mirror by accident.

## Fix direction

Treat a missing `remoteAddress` as a local connection in `authorizeLocal` (the mirror is only ever reached through the local proxy), and reject or close a connection whose first bytes are not an MQTT CONNECT rather than letting the parser throw.

🤖 Filed by Claude on behalf of Kris

Start in server/mqtt.ts at authorizeLocal and the server.socket.port handler, then inspect server/threads/threadServer.js and proxyProtocol.ts for the per-thread UDS path. Reproduce with curl --unix-socket against the secure MQTT mirror. Done means missing remoteAddress is handled and non-MQTT input closes cleanly without an unhandled rejection or a hanging client.

Written by the indexing model from the issue text.