Get device flags and scan schedule

Returns the flag map plus the per-device scan schedule for the verified device: 200
{ featureFlags: { fleetKillSwitch, ... }, scanSchedule: { version, slotLocal, windowStartLocal,
windowEndLocal } } (T89 additive sibling — always present on a 200); 503 { status: "degraded" }
when the backend could not evaluate the flags (Unleash unreachable / context query failed) —
fail-closed like /ingest, so the scanner applies its own safe defaults. The schedule service
fails OPEN to the default window (DEC-2) and is resolved only on the 200 path, so it never

causes a 503; the 503 body is unchanged and carries no scanSchedule.