One page of the devices enrolled for the authenticated tenant, filtered, searched and sorted per the
query, each with its check-in fields, scan-scheduler slots, derived reporting and tamper statuses, and
connected agents/vendors counts.

reportingStatus and tamperStatus are derived at read time rather than stored, so a
device that has gone silent or reported a tampered scan is visible without waiting for a writer; the list
can be filtered and sorted on them as if they were columns.
total is the FILTERED count. An oversized pageSize is clamped rather than rejected;
an unknown enum-filter token is a 400; a tenant with no matching devices gets
{ "total": 0, "items": [] } rather than a 404.