Build core domain: orgs, users, jobs, locate points, auth, live map

Replaces the device-events demo with the actual product:

- Prisma + PostGIS data layer (postgis/postgis:17-3.5). Lat/lng decimals
  are the source of truth; a generated geometry(Point,4326) column with
  a GIST index backs bbox queries. Migrations apply on container boot.
- JWT auth (bcryptjs + httpOnly cookie) with public registration that
  creates an org; per-org roles (ORG_ADMIN/MEMBER/VIEWER) enforced by
  guards on all /orgs/:orgId routes.
- Scoped API keys (X-API-Key, sha256-hashed, shown once) for
  programmatic access, manageable by org admins.
- REST API: jobs/tickets CRUD with filters, points query (time range,
  recordedAt cursor, bbox), members, devices, api-keys.
- MQTT ingest: devices publish to devices/{username}/points and /jobs;
  unknown tickets auto-create stub jobs (source=DEVICE); every message
  is raw-logged to device_events; acks on devices/{username}/jobs/ack.
  Broker gets a dedicated backend user; testuser is now a plain device.
- Realtime: plain-WS gateway at /api/ws (socket.io removed) with
  cookie auth and per-job channels feeding the map live.
- Next.js frontend: login/register, jobs list with filters, job detail
  with live Google map (APWA utility colors, polylines per run) behind
  a provider-neutral JobMap abstraction for a future Esri swap, and
  settings pages for members/devices/api-keys.
- Seed: Umagul org, admin user, testuser device, demo job with RTK
  points. Sample publisher updated to the new topic contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/publish_sample.py

@@ -1,7 +1,17 @@
+"""Publish sample locate points to the UlHub backend via MQTT.
+
+The backend subscribes to devices/# and expects points at
+devices/{mqttUsername}/points with a JSON body:
+
+    {"ticket": "TKT-...", "points": [{"lat": .., "lng": .., "ts": "ISO8601", ...}]}
+
+Points for an unknown ticket auto-create a stub job (source=DEVICE).
+"""
+
 import json
 import os
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 
 import paho.mqtt.client as mqtt
 
@@ -9,27 +19,45 @@ BROKER_HOST = os.getenv("MQTT_HOST", "127.0.0.1")
 BROKER_PORT = int(os.getenv("MQTT_PORT", "1883"))
 USERNAME = os.getenv("MQTT_USERNAME", "testuser")
 PASSWORD = os.getenv("MQTT_PASSWORD", "testpass")
-TOPIC = os.getenv("MQTT_TOPIC", "devices/demo")
+TICKET = os.getenv("TICKET", "TKT-2026-0001")
 INTERVAL = float(os.getenv("MQTT_INTERVAL", "2"))
 
-client = mqtt.Client()
-if USERNAME:
-    client.username_pw_set(USERNAME, PASSWORD)
+# Walk northeast from this location, one point per interval
+START_LAT = float(os.getenv("START_LAT", "33.15012345"))
+START_LNG = float(os.getenv("START_LNG", "-96.83512345"))
 
+TOPIC = f"devices/{USERNAME}/points"
+
+client = mqtt.Client()
+client.username_pw_set(USERNAME, PASSWORD)
 client.connect(BROKER_HOST, BROKER_PORT, 60)
+client.loop_start()
 
 try:
-    counter = 0
+    seq = 0
     while True:
         payload = {
-            "message": f"hello from host {counter}",
-            "timestamp": datetime.utcnow().isoformat() + "Z",
+            "ticket": TICKET,
+            "points": [
+                {
+                    "lat": START_LAT + seq * 0.0000135,
+                    "lng": START_LNG + seq * 0.0000042,
+                    "alt": 187.4 + seq * 0.02,
+                    "fix": "FIXED_RTK",
+                    "hAcc": 0.014,
+                    "depth": 1.2,
+                    "utility": "GAS",
+                    "seq": seq + 1,
+                    "ts": datetime.now(timezone.utc).isoformat(),
+                }
+            ],
         }
-        client.publish(TOPIC, json.dumps(payload), qos=0)
-        print(f"published to {TOPIC}: {payload}")
-        counter += 1
+        client.publish(TOPIC, json.dumps(payload), qos=1)
+        print(f"published point {seq + 1} to {TOPIC} (ticket {TICKET})")
+        seq += 1
         time.sleep(INTERVAL)
 except KeyboardInterrupt:
     print("stopped")
 finally:
+    client.loop_stop()
     client.disconnect()