Add device-certificate mTLS auth, live position tracking, and API docs

Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/lib/format.ts

@@ -0,0 +1,24 @@
+const UNITS: Array<[string, number]> = [
+  ['year', 365 * 24 * 60 * 60],
+  ['day', 24 * 60 * 60],
+  ['hr', 60 * 60],
+  ['min', 60],
+];
+
+// "just now", "1 min ago", "10 min ago", "3 days ago", …
+export function formatRelativeTime(iso: string | null, now: number = Date.now()): string {
+  if (!iso) {
+    return 'never';
+  }
+  const seconds = Math.floor((now - new Date(iso).getTime()) / 1000);
+  if (seconds < 45) {
+    return 'just now';
+  }
+  for (const [label, secondsPerUnit] of UNITS) {
+    const value = Math.floor(seconds / secondsPerUnit);
+    if (value >= 1) {
+      return `${value} ${label}${value === 1 ? '' : 's'} ago`;
+    }
+  }
+  return 'just now';
+}