Build core domain: orgs, users, jobs, locate points, auth, live map

Replaces the device-events demo with the actual product:

- Prisma + PostGIS data layer (postgis/postgis:17-3.5). Lat/lng decimals
  are the source of truth; a generated geometry(Point,4326) column with
  a GIST index backs bbox queries. Migrations apply on container boot.
- JWT auth (bcryptjs + httpOnly cookie) with public registration that
  creates an org; per-org roles (ORG_ADMIN/MEMBER/VIEWER) enforced by
  guards on all /orgs/:orgId routes.
- Scoped API keys (X-API-Key, sha256-hashed, shown once) for
  programmatic access, manageable by org admins.
- REST API: jobs/tickets CRUD with filters, points query (time range,
  recordedAt cursor, bbox), members, devices, api-keys.
- MQTT ingest: devices publish to devices/{username}/points and /jobs;
  unknown tickets auto-create stub jobs (source=DEVICE); every message
  is raw-logged to device_events; acks on devices/{username}/jobs/ack.
  Broker gets a dedicated backend user; testuser is now a plain device.
- Realtime: plain-WS gateway at /api/ws (socket.io removed) with
  cookie auth and per-job channels feeding the map live.
- Next.js frontend: login/register, jobs list with filters, job detail
  with live Google map (APWA utility colors, polylines per run) behind
  a provider-neutral JobMap abstraction for a future Esri swap, and
  settings pages for members/devices/api-keys.
- Seed: Umagul org, admin user, testuser device, demo job with RTK
  points. Sample publisher updated to the new topic contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/pages/settings/members.tsx

@@ -0,0 +1,138 @@
+import { FormEvent, useCallback, useEffect, useState } from 'react';
+import Layout from '../../components/Layout';
+import { api } from '../../lib/api';
+import { useRequireAuth } from '../../lib/auth-context';
+
+interface MemberRow {
+  role: string;
+  createdAt: string;
+  user: { id: string; email: string; name: string };
+}
+
+const ROLES = ['ORG_ADMIN', 'MEMBER', 'VIEWER'];
+
+export default function MembersPage() {
+  const { user, activeOrg, loading } = useRequireAuth();
+  const orgId = activeOrg?.org.id ?? null;
+  const isAdmin = activeOrg?.role === 'ORG_ADMIN';
+
+  const [members, setMembers] = useState<MemberRow[]>([]);
+  const [email, setEmail] = useState('');
+  const [role, setRole] = useState('MEMBER');
+  const [error, setError] = useState<string | null>(null);
+
+  const reload = useCallback(() => {
+    if (!orgId) {
+      return;
+    }
+    api
+      .get<MemberRow[]>(`/api/orgs/${orgId}/members`)
+      .then((rows) => {
+        setMembers(rows);
+        setError(null);
+      })
+      .catch((err) => setError(err.message));
+  }, [orgId]);
+
+  useEffect(reload, [reload]);
+
+  const addMember = async (e: FormEvent) => {
+    e.preventDefault();
+    try {
+      await api.post(`/api/orgs/${orgId}/members`, { email, role });
+      setEmail('');
+      reload();
+    } catch (err: any) {
+      setError(err.message);
+    }
+  };
+
+  const changeRole = async (userId: string, newRole: string) => {
+    try {
+      await api.patch(`/api/orgs/${orgId}/members/${userId}`, { role: newRole });
+      reload();
+    } catch (err: any) {
+      setError(err.message);
+    }
+  };
+
+  const remove = async (userId: string) => {
+    try {
+      await api.delete(`/api/orgs/${orgId}/members/${userId}`);
+      reload();
+    } catch (err: any) {
+      setError(err.message);
+    }
+  };
+
+  if (loading || !user) {
+    return null;
+  }
+
+  return (
+    <Layout title="Members">
+      <h1>Members</h1>
+      {error && <p style={{ color: '#c62828' }}>{error}</p>}
+
+      {isAdmin && (
+        <form onSubmit={addMember} style={{ display: 'flex', gap: '0.5rem', marginBottom: '1.5rem' }}>
+          <input
+            type="email"
+            placeholder="registered user's email"
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+            required
+            style={{ padding: '0.4rem', width: 280 }}
+          />
+          <select value={role} onChange={(e) => setRole(e.target.value)}>
+            {ROLES.map((r) => (
+              <option key={r} value={r}>
+                {r}
+              </option>
+            ))}
+          </select>
+          <button type="submit">Add member</button>
+        </form>
+      )}
+
+      <table style={{ width: '100%', borderCollapse: 'collapse' }}>
+        <thead>
+          <tr style={{ textAlign: 'left', borderBottom: '2px solid #ddd' }}>
+            <th style={{ padding: '0.5rem' }}>Name</th>
+            <th>Email</th>
+            <th>Role</th>
+            <th>Since</th>
+            {isAdmin && <th />}
+          </tr>
+        </thead>
+        <tbody>
+          {members.map((m) => (
+            <tr key={m.user.id} style={{ borderBottom: '1px solid #eee' }}>
+              <td style={{ padding: '0.5rem' }}>{m.user.name}</td>
+              <td>{m.user.email}</td>
+              <td>
+                {isAdmin && m.user.id !== user.id ? (
+                  <select value={m.role} onChange={(e) => changeRole(m.user.id, e.target.value)}>
+                    {ROLES.map((r) => (
+                      <option key={r} value={r}>
+                        {r}
+                      </option>
+                    ))}
+                  </select>
+                ) : (
+                  m.role
+                )}
+              </td>
+              <td>{new Date(m.createdAt).toLocaleDateString()}</td>
+              {isAdmin && (
+                <td style={{ textAlign: 'right' }}>
+                  {m.user.id !== user.id && <button onClick={() => remove(m.user.id)}>Remove</button>}
+                </td>
+              )}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </Layout>
+  );
+}