Returns one page of the tenant's agents — one row per (agent, device) pair — filtered, sorted and
paged entirely in SQL. Supports free-text search, combined-risk-band filtering and sorting.

An empty result is { "total": 0, "items": [] } and never a 404: an empty fleet, a fleet that
has not been analysed yet, and an over-restrictive filter all legitimately mean "no rows". Note that in a
datacenter where the v2 analysis pipeline has not yet run, every tenant legitimately reads as empty.
Unrecognized values for the enum-shaped parameters (sortBy, sortDirection,
riskLevels) are rejected with 400 and a body naming both a stable error code and the accepted
values — they are never silently ignored, because substituting a default would return plausibly-wrong
data in the right shape.