Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/Dockerfile

@@ -1,5 +1,8 @@
 FROM node:20-alpine
 
+# Needed by certificates/pki.service.ts to shell out for CA/device cert generation.
+RUN apk add --no-cache openssl
+
 WORKDIR /usr/src/app
 
 COPY package.json package-lock.json* ./