Build core domain: orgs, users, jobs, locate points, auth, live map

Replaces the device-events demo with the actual product:

- Prisma + PostGIS data layer (postgis/postgis:17-3.5). Lat/lng decimals
  are the source of truth; a generated geometry(Point,4326) column with
  a GIST index backs bbox queries. Migrations apply on container boot.
- JWT auth (bcryptjs + httpOnly cookie) with public registration that
  creates an org; per-org roles (ORG_ADMIN/MEMBER/VIEWER) enforced by
  guards on all /orgs/:orgId routes.
- Scoped API keys (X-API-Key, sha256-hashed, shown once) for
  programmatic access, manageable by org admins.
- REST API: jobs/tickets CRUD with filters, points query (time range,
  recordedAt cursor, bbox), members, devices, api-keys.
- MQTT ingest: devices publish to devices/{username}/points and /jobs;
  unknown tickets auto-create stub jobs (source=DEVICE); every message
  is raw-logged to device_events; acks on devices/{username}/jobs/ack.
  Broker gets a dedicated backend user; testuser is now a plain device.
- Realtime: plain-WS gateway at /api/ws (socket.io removed) with
  cookie auth and per-job channels feeding the map live.
- Next.js frontend: login/register, jobs list with filters, job detail
  with live Google map (APWA utility colors, polylines per run) behind
  a provider-neutral JobMap abstraction for a future Esri swap, and
  settings pages for members/devices/api-keys.
- Seed: Umagul org, admin user, testuser device, demo job with RTK
  points. Sample publisher updated to the new topic contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/prisma/seed.ts

@@ -0,0 +1,88 @@
+import { PrismaClient, GpsFixType, JobStatus, UtilityType } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+
+const prisma = new PrismaClient();
+
+const SEED_ADMIN_EMAIL = 'brent.perteet@gmail.com';
+const SEED_ADMIN_PASSWORD = 'changeme123';
+
+async function main() {
+  const org = await prisma.organization.upsert({
+    where: { slug: 'umagul' },
+    update: {},
+    create: { name: 'Umagul', slug: 'umagul' },
+  });
+
+  const admin = await prisma.user.upsert({
+    where: { email: SEED_ADMIN_EMAIL },
+    update: {},
+    create: {
+      email: SEED_ADMIN_EMAIL,
+      name: 'Brent Perteet',
+      passwordHash: await bcrypt.hash(SEED_ADMIN_PASSWORD, 12),
+    },
+  });
+
+  await prisma.orgMembership.upsert({
+    where: { orgId_userId: { orgId: org.id, userId: admin.id } },
+    update: { role: 'ORG_ADMIN' },
+    create: { orgId: org.id, userId: admin.id, role: 'ORG_ADMIN' },
+  });
+
+  const device = await prisma.device.upsert({
+    where: { mqttUsername: 'testuser' },
+    update: {},
+    create: {
+      orgId: org.id,
+      name: 'Demo locator',
+      mqttUsername: 'testuser',
+      serialNumber: 'DEMO-0001',
+    },
+  });
+
+  const job = await prisma.job.upsert({
+    where: { orgId_ticketNumber: { orgId: org.id, ticketNumber: 'TKT-2026-0001' } },
+    update: {},
+    create: {
+      orgId: org.id,
+      ticketNumber: 'TKT-2026-0001',
+      title: 'Gas line locate - Main St demo',
+      description: 'Seeded demo job with sample RTK points along a gas line.',
+      address: '100 Main St',
+      status: JobStatus.IN_PROGRESS,
+      createdById: admin.id,
+      assignedToId: admin.id,
+    },
+  });
+
+  const existing = await prisma.locatePoint.count({ where: { jobId: job.id } });
+  if (existing === 0) {
+    // A short run of points along a line (roughly northeast, ~1.5m spacing)
+    const startLat = 33.15012345;
+    const startLng = -96.83512345;
+    const points = Array.from({ length: 12 }, (_, i) => ({
+      jobId: job.id,
+      deviceId: device.id,
+      lat: startLat + i * 0.0000135,
+      lng: startLng + i * 0.0000042,
+      altitude: 187.4 + i * 0.02,
+      fixType: GpsFixType.FIXED_RTK,
+      hAccuracy: 0.014,
+      depth: 1.2,
+      utilityType: UtilityType.GAS,
+      sequence: i + 1,
+      recordedAt: new Date(Date.now() - (12 - i) * 5000),
+    }));
+    await prisma.locatePoint.createMany({ data: points });
+  }
+
+  console.log(`Seeded org=${org.slug} admin=${admin.email} device=${device.mqttUsername} job=${job.ticketNumber}`);
+  console.log(`Admin password: ${SEED_ADMIN_PASSWORD}`);
+}
+
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(() => prisma.$disconnect());