Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/sim/sim.module.ts

@@ -1,11 +1,13 @@
 import { Module } from '@nestjs/common';
+import { CertificatesModule } from '../certificates/certificates.module';
 import { IngestModule } from '../ingest/ingest.module';
+import { SimMqttsService } from './sim-mqtts.service';
 import { SimController } from './sim.controller';
 import { SimService } from './sim.service';
 
 @Module({
-  imports: [IngestModule],
+  imports: [IngestModule, CertificatesModule],
   controllers: [SimController],
-  providers: [SimService],
+  providers: [SimService, SimMqttsService],
 })
 export class SimModule {}