Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/prisma/migrations/20260716152545_device_last_position/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "devices" ADD COLUMN     "lastPosition" JSONB,
+ADD COLUMN     "lastPositionAt" TIMESTAMPTZ(6);