Get a usage upload URL

Called by the MineOS device agent when usage metrics or remediation is enabled for the device, to upload its encrypted
usage report; you do not call this endpoint yourself. The agent authenticates with its device certificate, declares the batch id,
and receives a short-lived URL to upload the batch to.

Responses:

• 200 — { "uploadUrl", "expiresAt" }: upload the batch with an HTTP PUT (Content-Type:
  application/json) to uploadUrl before expiresAt
• 400 — { "error": "invalid_request", "details": [ ... ] }: the request is malformed or contains unknown fields
• 403 — { "reason": "enrollment_not_active" | "not_enabled" }: the device is not an approved device, or
  neither usage metrics nor remediation is enabled for it
• 429 — { "reason": "quota_exceeded" | "rate_limited", "retryAfter" } and a Retry-After header: the
  device's daily upload quota or your organization's rate limit is reached
• 503 — { "status": "degraded" }: the upload cannot be accepted right now; the agent retries