Build core domain: orgs, users, jobs, locate points, auth, live map

Replaces the device-events demo with the actual product:

- Prisma + PostGIS data layer (postgis/postgis:17-3.5). Lat/lng decimals
  are the source of truth; a generated geometry(Point,4326) column with
  a GIST index backs bbox queries. Migrations apply on container boot.
- JWT auth (bcryptjs + httpOnly cookie) with public registration that
  creates an org; per-org roles (ORG_ADMIN/MEMBER/VIEWER) enforced by
  guards on all /orgs/:orgId routes.
- Scoped API keys (X-API-Key, sha256-hashed, shown once) for
  programmatic access, manageable by org admins.
- REST API: jobs/tickets CRUD with filters, points query (time range,
  recordedAt cursor, bbox), members, devices, api-keys.
- MQTT ingest: devices publish to devices/{username}/points and /jobs;
  unknown tickets auto-create stub jobs (source=DEVICE); every message
  is raw-logged to device_events; acks on devices/{username}/jobs/ack.
  Broker gets a dedicated backend user; testuser is now a plain device.
- Realtime: plain-WS gateway at /api/ws (socket.io removed) with
  cookie auth and per-job channels feeding the map live.
- Next.js frontend: login/register, jobs list with filters, job detail
  with live Google map (APWA utility colors, polylines per run) behind
  a provider-neutral JobMap abstraction for a future Esri swap, and
  settings pages for members/devices/api-keys.
- Seed: Umagul org, admin user, testuser device, demo job with RTK
  points. Sample publisher updated to the new topic contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/devices/devices.service.ts

@@ -0,0 +1,55 @@
+import { ConflictException, Injectable, NotFoundException } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+import { CreateDeviceDto, UpdateDeviceDto } from './dto/devices.dto';
+
+@Injectable()
+export class DevicesService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  list(orgId: string) {
+    return this.prisma.device.findMany({
+      where: { orgId },
+      orderBy: { createdAt: 'asc' },
+    });
+  }
+
+  async create(orgId: string, dto: CreateDeviceDto) {
+    const existing = await this.prisma.device.findUnique({
+      where: { mqttUsername: dto.mqttUsername },
+    });
+    if (existing) {
+      throw new ConflictException('A device with this MQTT username already exists');
+    }
+    const device = await this.prisma.device.create({
+      data: { orgId, name: dto.name, mqttUsername: dto.mqttUsername, serialNumber: dto.serialNumber },
+    });
+    return {
+      ...device,
+      provisioning: {
+        mqttUsername: device.mqttUsername,
+        pointsTopic: `devices/${device.mqttUsername}/points`,
+        jobsTopic: `devices/${device.mqttUsername}/jobs`,
+        note: 'Broker credentials must be created separately (mosquitto_passwd) until dynamic broker auth lands.',
+      },
+    };
+  }
+
+  async update(orgId: string, deviceId: string, dto: UpdateDeviceDto) {
+    await this.get(orgId, deviceId);
+    return this.prisma.device.update({ where: { id: deviceId }, data: dto });
+  }
+
+  async remove(orgId: string, deviceId: string) {
+    await this.get(orgId, deviceId);
+    await this.prisma.device.delete({ where: { id: deviceId } });
+    return { ok: true };
+  }
+
+  private async get(orgId: string, deviceId: string) {
+    const device = await this.prisma.device.findFirst({ where: { id: deviceId, orgId } });
+    if (!device) {
+      throw new NotFoundException('Device not found');
+    }
+    return device;
+  }
+}