Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/prisma/migrations/20260716210738_device_certificates/migration.sql

@@ -0,0 +1,20 @@
+-- CreateTable
+CREATE TABLE "device_certificates" (
+    "id" TEXT NOT NULL,
+    "deviceId" TEXT NOT NULL,
+    "serialNumber" TEXT NOT NULL,
+    "commonName" TEXT NOT NULL,
+    "certificatePem" TEXT NOT NULL,
+    "privateKeyPem" TEXT NOT NULL,
+    "fingerprint" TEXT NOT NULL,
+    "issuedAt" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expiresAt" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "device_certificates_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "device_certificates_deviceId_key" ON "device_certificates"("deviceId");
+
+-- AddForeignKey
+ALTER TABLE "device_certificates" ADD CONSTRAINT "device_certificates_deviceId_fkey" FOREIGN KEY ("deviceId") REFERENCES "devices"("id") ON DELETE CASCADE ON UPDATE CASCADE;