Add BLE challenge-response for short-lived MQTT session certs

BLE-only locators can't hold the MQTT/TLS connection themselves — a phone
relays their data — so handing the phone a device's permanent client-cert
key would export its identity to every phone it pairs with. Instead the
device signs a server-issued nonce with its permanent key over BLE; once
verified, the backend mints a short-lived session certificate for the
phone's actual MQTT connection, keeping the permanent key on-device always.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -44,6 +44,11 @@ services:
       # (Settings → MQTT Certs), not this container's docker-network hostname —
       # used by the simulator's MQTTS transport to verify the broker's identity.
       MQTT_TLS_SERVERNAME: ${MQTT_TLS_SERVERNAME:-localhost}
+      # BLE challenge-response session certs (backend/src/device-mqtt-auth):
+      # how long a nonce is redeemable for, and how long the short-lived
+      # session cert it produces is valid before a phone must re-challenge.
+      MQTT_CHALLENGE_TTL_SECONDS: ${MQTT_CHALLENGE_TTL_SECONDS:-120}
+      MQTT_SESSION_CERT_HOURS: ${MQTT_SESSION_CERT_HOURS:-24}
       NODE_ENV: development
     command: sh -c "npx prisma migrate deploy && npm run start:dev"