Build core domain: orgs, users, jobs, locate points, auth, live map

Replaces the device-events demo with the actual product:

- Prisma + PostGIS data layer (postgis/postgis:17-3.5). Lat/lng decimals
  are the source of truth; a generated geometry(Point,4326) column with
  a GIST index backs bbox queries. Migrations apply on container boot.
- JWT auth (bcryptjs + httpOnly cookie) with public registration that
  creates an org; per-org roles (ORG_ADMIN/MEMBER/VIEWER) enforced by
  guards on all /orgs/:orgId routes.
- Scoped API keys (X-API-Key, sha256-hashed, shown once) for
  programmatic access, manageable by org admins.
- REST API: jobs/tickets CRUD with filters, points query (time range,
  recordedAt cursor, bbox), members, devices, api-keys.
- MQTT ingest: devices publish to devices/{username}/points and /jobs;
  unknown tickets auto-create stub jobs (source=DEVICE); every message
  is raw-logged to device_events; acks on devices/{username}/jobs/ack.
  Broker gets a dedicated backend user; testuser is now a plain device.
- Realtime: plain-WS gateway at /api/ws (socket.io removed) with
  cookie auth and per-job channels feeding the map live.
- Next.js frontend: login/register, jobs list with filters, job detail
  with live Google map (APWA utility colors, polylines per run) behind
  a provider-neutral JobMap abstraction for a future Esri swap, and
  settings pages for members/devices/api-keys.
- Seed: Umagul org, admin user, testuser device, demo job with RTK
  points. Sample publisher updated to the new topic contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/ingest/mqtt-client.service.ts

@@ -0,0 +1,59 @@
+import { Injectable, Logger, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { connect, MqttClient } from 'mqtt';
+
+export type MqttMessageListener = (topic: string, payload: Buffer) => void;
+
+@Injectable()
+export class MqttClientService implements OnModuleInit, OnModuleDestroy {
+  private readonly logger = new Logger(MqttClientService.name);
+  private readonly listeners = new Set<MqttMessageListener>();
+  private client: MqttClient | null = null;
+
+  onModuleInit() {
+    const host = process.env.MQTT_HOST || 'mosquitto';
+    const port = Number(process.env.MQTT_PORT || 1883);
+    this.client = connect(`mqtt://${host}:${port}`, {
+      username: process.env.MQTT_USERNAME || 'backend',
+      password: process.env.MQTT_PASSWORD || 'backendpass',
+      clientId: `ulhub-backend-${Math.random().toString(16).slice(2)}`,
+    });
+
+    this.client.on('connect', () => {
+      this.logger.log(`Connected to MQTT broker at ${host}:${port}`);
+      this.client!.subscribe('devices/#', (err) => {
+        if (err) {
+          this.logger.error('Failed to subscribe to devices/#', err);
+        } else {
+          this.logger.log('Subscribed to devices/#');
+        }
+      });
+    });
+
+    this.client.on('message', (topic, payload) => {
+      for (const listener of this.listeners) {
+        listener(topic, payload);
+      }
+    });
+
+    this.client.on('error', (error) => {
+      this.logger.error(`MQTT client error: ${error.message}`);
+    });
+  }
+
+  async onModuleDestroy() {
+    await this.client?.endAsync();
+  }
+
+  onMessage(listener: MqttMessageListener): () => void {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+
+  publish(topic: string, payload: object) {
+    this.client?.publish(topic, JSON.stringify(payload), { qos: 1 }, (err) => {
+      if (err) {
+        this.logger.error(`Failed to publish to ${topic}: ${err.message}`);
+      }
+    });
+  }
+}