Get a report upload URL

Called by the MineOS device agent after each scan to upload its report; you do not call this endpoint yourself. The agent
authenticates with its device certificate, declares the report id, and receives a short-lived URL to upload the report to.
The same call carries the device's health check-in (last run outcome, scheduled slot, agent version), which is what the
device status endpoints show.

Responses:

• 200 — { "uploadUrl", "expiresAt", "requiredContentType" }: upload the report with an HTTP PUT to uploadUrl
  before expiresAt
• 400 — { "error": "invalid_request", "details": [ ... ] }: the request is malformed or contains unknown fields
• 403 — { "reason": "enrollment_not_active" }: the device is not (or no longer) an approved device
• 429 — { "reason": "quota_exceeded" | "rate_limited", "retryAfter" }: the device's daily report quota or your
  organization's rate limit is reached
• 503 — { "status": "degraded" }: report storage is temporarily unavailable; the agent retries