Add WebSocket, multi API key, geocoding proxy, beacon map picker, and comprehensive bug fixes

- Multi API Key + permission system (read/write/admin) with SHA-256 hash
- WebSocket real-time push (location, alarm, device_status, attendance, bluetooth)
- Geocoding proxy endpoints for Amap POI search and reverse geocode
- Beacon modal map-based location picker with search and click-to-select
- GCJ-02 ↔ WGS-84 bidirectional coordinate conversion
- Data cleanup scheduler (configurable retention days)
- Fix GPS longitude sign inversion (course_status bit 11: 0=East, 1=West)
- Fix 2G CellID 2→3 bytes across all protocols (0x28, 0x2C, parser.py)
- Fix parser loop guards, alarm_source field length, CommandLog.sent_at
- Fix geocoding IMEI parameterization, require_admin import
- Improve API error messages for 422 validation errors
- Remove beacon floor/area fields (consolidated into name)

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <noreply@hapi.run>

app/routers/locations.py

@@ -6,7 +6,7 @@ API endpoints for querying location records and device tracks.
 import math
 from datetime import datetime
 
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Body, Depends, HTTPException, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -85,6 +85,27 @@ async def latest_location(device_id: int, db: AsyncSession = Depends(get_db)):
     return APIResponse(data=LocationRecordResponse.model_validate(record))
 
 
+@router.post(
+    "/batch-latest",
+    response_model=APIResponse[list[LocationRecordResponse | None]],
+    summary="批量获取设备最新位置 / Batch get latest locations",
+)
+async def batch_latest_locations(
+    device_ids: list[int] = Body(..., min_length=1, max_length=100, embed=True),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    传入 device_ids 列表，返回每台设备的最新位置（按输入顺序）。
+    Pass device_ids list, returns latest location per device in input order.
+    """
+    records = await location_service.get_batch_latest_locations(db, device_ids)
+    result_map = {r.device_id: r for r in records}
+    return APIResponse(data=[
+        LocationRecordResponse.model_validate(result_map[did]) if did in result_map else None
+        for did in device_ids
+    ])
+
+
 @router.get(
     "/track/{device_id}",
     response_model=APIResponse[list[LocationRecordResponse]],