RG-T127 Hardware unit tracking support

[ucswift]

Description

This PR implements comprehensive hardware GPS unit tracking support (RG-T127), enabling departments to bind physical hardware trackers or forwarding services to Units and receive live position data through authenticated HTTPS endpoints.

Key additions

Device & credential management

• New UnitTrackingDevices and UnitTrackingCredentials data models with full database migrations (SQL Server and PostgreSQL)
• Complete CRUD lifecycle for tracking bindings: create, update, disable, delete, and rebind to a different Unit
• Credential provisioning with rotation (with overlap window) and revocation, supporting four authentication modes: Bearer token, Basic auth, custom header, and capability-path (URL-embedded token)
• One-time credential display with no-store caching headers; stored secrets are never returned by APIs

Position ingestion pipeline

• Public HTTPS ingress controller (/api/v4/unit-trackers/{id}/positions and capability-path variant) accepting single or batched JSON position payloads
• Strict JSON payload parser with size, depth, duplicate-property, and content-type validation
• Ingress service that normalizes, validates (coordinate bounds, timestamp skew/retention window, device-identifier matching), deduplicates via idempotent event IDs, and publishes to a new RabbitMQ v2 queue with retry and dead-letter support
• Per-device and per-credential rate limiting, plus optional CIDR-based source IP allow-listing

Location resolution and status

• UnitLocationSourceResolver that selects the freshest, highest-priority location across hardware and mobile-app sources, with configurable staleness thresholds and mobile fallback behavior
• UnitTrackingStatusService computing effective device status (Online, Stale, Error, Disabled, NeverSeen)
• Extended UnitsLocation and UnitLocationEvent documents with source metadata and rich telemetry (satellites, HDOP, battery, ignition, alarm codes, etc.)

Web UI and API

• Full MVC area (User/UnitTracking) with views for listing, creating, editing, and managing tracker bindings, credentials, and a JSON preview tool (non-production only)
• REST API controller (UnitTrackingDevicesController) for programmatic lifecycle management with authorization scoped to Unit view/update permissions
• Localization resources for all tracking UI strings

Security and observability

• Capability-path redaction middleware and Sentry filter to prevent credential tokens from appearing in request paths, logs, or error traces
• Audit logging for all device and credential operations with masked device identifiers
• Department-level settings for stale threshold, mobile fallback, and location retention period

Infrastructure improvements

• Async event aggregator support for reliable realtime publish of unit location updates with publisher confirmations
• Refactored department settings cache invalidation into a centralized, type-driven approach
• Idempotent document-store writes returning Inserted/Duplicate status to suppress duplicate realtime events
• Hardened unit-location queue consumer with manual acknowledgements and retry/dead-letter routing

Summary by CodeRabbit

• New Features
  • Added full hardware unit tracking: catalog profiles, device bindings, credential lifecycle, status monitoring, and unit location ingestion APIs.
  • Introduced v4 unit-tracking ingress (device positions + capability tokens) with JSON/Traccar-compatible parsing.
  • Added admin v4 endpoints and user-area UI for managing tracking devices and credentials.
• Bug Fixes
  • Improved unit-location delivery reliability with publisher confirmations, retry/dead-letter handling, and stricter enqueue/validation behavior.
• Security / Privacy
  • Redacted capability tokens in request paths and Sentry events.
  • Protected internal reports with a shared token.
  • Added stronger authorization checks and call-image access tokens.