Add pre-assume enrolled device status query

The /enroll wait UI polled device state via node(), which
requires an assumed org session, so confirmation never
succeeded for unassumed viewers. Expose viewer.enrolledDevice
behind itam:employee-device:get (own-device, skip assumption)
and point the poller at it.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/gqlutils/errors.go

@@ -120,6 +120,22 @@ func Forbiddenf(ctx context.Context, format string, a ...any) *gqlerror.Error {
 	return Forbidden(ctx, fmt.Errorf(format, a...))
 }
 
+// IsForbidden reports whether err is a GraphQL error with code FORBIDDEN.
+func IsForbidden(err error) bool {
+	return hasCode(err, "FORBIDDEN")
+}
+
+func hasCode(err error, code string) bool {
+	gqlErr, ok := errors.AsType[*gqlerror.Error](err)
+	if !ok {
+		return false
+	}
+
+	got, _ := gqlErr.Extensions["code"].(string)
+
+	return got == code
+}
+
 func NotFound(ctx context.Context, err error) *gqlerror.Error {
 	return &gqlerror.Error{
 		Message: err.Error(),