One page of the devices enrolled for the authenticated tenant, newest-enrolled first, each with its
check-in fields, scan-scheduler slots, and derived reporting and tamper statuses.

reportingStatus and tamperStatus are derived at read time rather than stored, so a
device that has gone silent or reported a tampered scan is visible without waiting for a writer.
Ordering is by enrollment date — note that this is not scan or check-in recency. An oversized
pageSize is clamped rather than rejected, and a tenant with no devices gets
{ "total": 0, "items": [] } rather than a 404.