linked device, device tasks and certs in database

server/internal/models/cert.go

@@ -13,6 +13,7 @@ type DeviceCertificate struct {
 	NotAfter   time.Time
 	PemCert    string `gorm:"type:text"` // PEM of leaf cert
 	CreatedAt  time.Time
+	Device     Device `gorm:"constraint:OnDelete:CASCADE;foreignKey:DeviceGUID;references:GUID"`
 }
 
 // “Instant kill” list checked by the mTLS guard before allowing access.