Add BLE challenge-response for short-lived MQTT session certs

BLE-only locators can't hold the MQTT/TLS connection themselves — a phone
relays their data — so handing the phone a device's permanent client-cert
key would export its identity to every phone it pairs with. Instead the
device signs a server-issued nonce with its permanent key over BLE; once
verified, the backend mints a short-lived session certificate for the
phone's actual MQTT connection, keeping the permanent key on-device always.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/package-lock.json

@@ -16,6 +16,7 @@
         "@nestjs/platform-express": "^10.0.0",
         "@nestjs/platform-ws": "^10.0.0",
         "@nestjs/swagger": "^7.4.2",
+        "@nestjs/throttler": "^5.1.2",
         "@nestjs/websockets": "^10.0.0",
         "@prisma/client": "^6.10.0",
         "bcryptjs": "^2.4.3",
@@ -802,6 +803,17 @@
         }
       }
     },
+    "node_modules/@nestjs/throttler": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@nestjs/throttler/-/throttler-5.2.0.tgz",
+      "integrity": "sha512-G/G/MV3xf6sy1DwmnJsgeL+d2tQ/xGRNa9ZhZjm9Kyxp+3+ylGzwJtcnhWlN82PMEp3TiDQpTt+9waOIg/bpPg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
+        "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
+        "reflect-metadata": "^0.1.13 || ^0.2.0"
+      }
+    },
     "node_modules/@nestjs/websockets": {
       "version": "10.4.22",
       "resolved": "https://registry.npmjs.org/@nestjs/websockets/-/websockets-10.4.22.tgz",