Add BLE challenge-response for short-lived MQTT session certs

BLE-only locators can't hold the MQTT/TLS connection themselves — a phone
relays their data — so handing the phone a device's permanent client-cert
key would export its identity to every phone it pairs with. Instead the
device signs a server-issued nonce with its permanent key over BLE; once
verified, the backend mints a short-lived session certificate for the
phone's actual MQTT connection, keeping the permanent key on-device always.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/app.module.ts

@@ -14,6 +14,7 @@ import { ApiKeysModule } from './api-keys/api-keys.module';
 import { SimModule } from './sim/sim.module';
 import { DeviceStatusModule } from './device-status/device-status.module';
 import { CertificatesModule } from './certificates/certificates.module';
+import { DeviceMqttAuthModule } from './device-mqtt-auth/device-mqtt-auth.module';
 
 @Module({
   imports: [
@@ -29,6 +30,7 @@ import { CertificatesModule } from './certificates/certificates.module';
     SimModule,
     DeviceStatusModule,
     CertificatesModule,
+    DeviceMqttAuthModule,
   ],
   controllers: [AppController, StatusController],
   providers: [AppService],