Add pre-assume enrolled device status query

The /enroll wait UI polled device state via node(), which
requires an assumed org session, so confirmation never
succeeded for unassumed viewers. Expose viewer.enrolledDevice
behind itam:employee-device:get (own-device, skip assumption)
and point the poller at it.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/console/v1/device_resolvers.go

@@ -101,6 +101,8 @@ func (r *deviceConnectionResolver) TotalCount(ctx context.Context, obj *types.De
 }
 
 // EnrollDevice is the resolver for the enrollDevice field.
+// SkipAssumptionCheck: self-enrollment from /enroll runs before the viewer
+// assumes the target organization.
 func (r *mutationResolver) EnrollDevice(ctx context.Context, input types.EnrollDeviceInput) (*types.CreateDevicePayload, error) {
 	identity := authn.IdentityFromContext(ctx)