Implement an authenticated read-only console for verified fleet state

[ShalomMaman]

Parent epic: #41

Dependencies: #24, #44, #45 and the architecture decision in #43.

Goal

Deliver the first remote-management surface as a privacy-minimized, read-only console before any remote policy editor is enabled.

Scope

Provide a responsive web console suitable for mobile use that shows only authorized devices and verified operational state:

• account owner/device custodian and delegated-role summary;
• device display name or privacy-safe identifier;
• Device Guard and Android version;
• last safe check-in and management-connectivity health;
• requested and last verified policy revision;
• reconciliation, update and kiosk state where applicable;
• pending, failed, rejected and superseded status without claiming unverified success;
• actionable, privacy-safe error codes.

The console must use the role and recent-authentication rules from #45, enforce tenant isolation on every request, and expose no raw package/system inventory or device detail before authentication.

Privacy and security requirements

• Reuse the minimized fleet model from Design privacy-preserving fleet health and staged rollout visibility #24 rather than introducing a second telemetry contract.
• Do not collect or render browsing history, kiosk URL paths/queries, message/contact content, location, screenshots, local app content, PINs or recovery codes.
• Support owner-visible session/device management and clear identification of who currently has delegated access.
• Treat stale or missing reports as unknown/unreachable, not as proof that policy is active.

Acceptance criteria

• The console is read-only end to end; no write endpoint or hidden mutation is reachable.
• Tenant and device authorization is enforced server-side and covered by negative tests.
• Requested state is visually distinct from device-verified state.
• Unreachable, stale, failed and rejected devices are accurately represented.
• No unauthenticated response exposes raw package, policy or system details.
• Mobile and RTL accessibility flows are tested.
• Privacy fields and retention match Design privacy-preserving fleet health and staged rollout visibility #24 and the approved data-flow model.

Non-goals

• Editing policy, kiosk, ADB, network or recovery settings.
• Treating a recent server request as an applied device result.

Hebrew summary

השלב הראשון יהיה לוח ניהול לצפייה בלבד: רואים מצב מכשיר ומדיניות מאומתת, בלי אפשרות לשנות דבר. כך מוכיחים הרשאות, פרטיות והפרדה בין לקוחות לפני פתיחת שליטה מרחוק.