Records the device's own uninstall

Body-less by construction (identity is the certificate).

Always 200 on a verified identity, carrying the outcome in the body rather than in the

status code. The device is mid-uninstall and is about to delete its own credentials: there is nothing
it can usefully do with a 404, and treating "no row" as an error would make the scanner's best-effort
call log a failure on a path that in fact reached the right end state. A caller whose certificate does
not verify never gets here — the A1 boundary answers 403 first.