One enrolled device by its device id — the same identifier the agents surface reports as
endpoint, so the two collections can be joined.

Returns exactly the same fields as an entry in the list, so a client need not handle two shapes for
one device. Responds 404 when the device is not this tenant's: absent and belonging-to-another-tenant are
the same answer, so device ids cannot be probed across tenants.