Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/sim/dto/sim.dto.ts

@@ -1,12 +1,27 @@
-import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsIn, IsNotEmpty, IsOptional, IsString, MaxLength } from 'class-validator';
 import { MqttLogMessageDto } from '../../ingest/dto/mqtt-messages.dto';
 
+export type SimTransport = 'relay' | 'mqtts';
+
 // What the simulator UI sends the backend: a devices/<serial>/log payload
 // (type: "log" persists a point, "status" is a live-only position update)
 // plus "serial", which lives in the topic rather than the wire payload.
 export class SimPublishPointDto extends MqttLogMessageDto {
+  @ApiProperty({ description: 'Locator serial number; identifies the device via devices/<serial>/log' })
   @IsString()
   @IsNotEmpty()
   @MaxLength(64)
   serial: string;
+
+  @ApiPropertyOptional({
+    description:
+      '"relay" (default) publishes via the backend\'s own privileged broker connection. ' +
+      '"mqtts" instead connects to port 8883 and authenticates as this serial\'s own issued ' +
+      'client certificate, exercising the real device-auth + ACL path.',
+    enum: ['relay', 'mqtts'],
+  })
+  @IsOptional()
+  @IsIn(['relay', 'mqtts'])
+  transport?: SimTransport;
 }