Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -30,6 +30,7 @@ services:
     volumes:
       - ./backend:/usr/src/app:delegated
       - /usr/src/app/node_modules
+      - ./mosquitto/certs:/mosquitto-certs
     environment:
       DATABASE_URL: postgresql://ulhub:development@postgres:5432/ulhub
       JWT_SECRET: ${JWT_SECRET:-dev-only-insecure-secret}
@@ -37,6 +38,12 @@ services:
       MQTT_PORT: 1883
       MQTT_USERNAME: ${MQTT_BACKEND_USERNAME:-backend}
       MQTT_PASSWORD: ${MQTT_BACKEND_PASSWORD:-backendpass}
+      MQTT_CERTS_DIR: /mosquitto-certs
+      MQTT_TLS_PORT: 8883
+      # Must match the CN the broker's server cert was provisioned for
+      # (Settings → MQTT Certs), not this container's docker-network hostname —
+      # used by the simulator's MQTTS transport to verify the broker's identity.
+      MQTT_TLS_SERVERNAME: ${MQTT_TLS_SERVERNAME:-localhost}
       NODE_ENV: development
     command: sh -c "npx prisma migrate deploy && npm run start:dev"