Add WebSocket, multi API key, geocoding proxy, beacon map picker, and comprehensive bug fixes

- Multi API Key + permission system (read/write/admin) with SHA-256 hash
- WebSocket real-time push (location, alarm, device_status, attendance, bluetooth)
- Geocoding proxy endpoints for Amap POI search and reverse geocode
- Beacon modal map-based location picker with search and click-to-select
- GCJ-02 ↔ WGS-84 bidirectional coordinate conversion
- Data cleanup scheduler (configurable retention days)
- Fix GPS longitude sign inversion (course_status bit 11: 0=East, 1=West)
- Fix 2G CellID 2→3 bytes across all protocols (0x28, 0x2C, parser.py)
- Fix parser loop guards, alarm_source field length, CommandLog.sent_at
- Fix geocoding IMEI parameterization, require_admin import
- Improve API error messages for 422 validation errors
- Remove beacon floor/area fields (consolidated into name)

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <noreply@hapi.run>

app/services/location_service.py

@@ -101,6 +101,49 @@ async def get_latest_location(
     return result.scalar_one_or_none()
 
 
+async def get_batch_latest_locations(
+    db: AsyncSession, device_ids: list[int]
+) -> list[LocationRecord]:
+    """
+    批量获取多设备最新位置 / Get the most recent location for each device in the list.
+
+    Uses a subquery with MAX(id) GROUP BY device_id for efficiency.
+    """
+    if not device_ids:
+        return []
+
+    # Subquery: max id per device_id
+    subq = (
+        select(func.max(LocationRecord.id).label("max_id"))
+        .where(LocationRecord.device_id.in_(device_ids))
+        .group_by(LocationRecord.device_id)
+        .subquery()
+    )
+    result = await db.execute(
+        select(LocationRecord).where(LocationRecord.id.in_(select(subq.c.max_id)))
+    )
+    return list(result.scalars().all())
+
+
+async def get_all_online_latest_locations(
+    db: AsyncSession,
+) -> list[LocationRecord]:
+    """
+    获取所有在线设备的最新位置 / Get latest location for all online devices.
+    """
+    from app.models import Device
+
+    # Get online device IDs
+    online_result = await db.execute(
+        select(Device.id).where(Device.status == "online")
+    )
+    online_ids = [row[0] for row in online_result.all()]
+    if not online_ids:
+        return []
+
+    return await get_batch_latest_locations(db, online_ids)
+
+
 async def get_device_track(
     db: AsyncSession,
     device_id: int,