Enroll a device

Called by the MineOS device agent when it first runs on a device (and when it re-enrolls); you do not call this
endpoint yourself. The agent presents your organization's enrollment token — the one embedded in the MDM package —
together with a certificate signing request, and receives the device certificate it uses for all later calls.

Responses:

• 201 — { "certificate", "caChain", "deviceId", "expiresAt" }: the device certificate (PEM), the issuing chain, the
  device's id and the certificate expiry
• 202 — { "status": "pending", "retryAfter" }: enrollment is held for approval; the agent retries after
  retryAfter seconds
• 400 — { "error" }: the request or the certificate signing request could not be processed
• 401 — { "error" }: the enrollment token is invalid, expired or revoked (one answer for every token failure)
• 403 — { "reason": "rejected" }: this device has been rejected by an administrator
• 429 — { "reason": "fleet_cap_reached" | "waiting_room_full", "retryAfter" }: your organization's device limit is
  reached
• 503 — { "status": "degraded" }: certificate issuance is temporarily unavailable; the agent retries