Split employee devices from DeviceConnection

viewer.enrolledDevices shared DeviceConnection with the admin
org list, so totalCount had to authorize with both
employee-device:list and device:list. Mirror
EmployeeDocumentConnection: a dedicated EmployeeDeviceConnection
without totalCount, and keep DeviceConnection.totalCount for
the org fleet only. Cover assumed-session device:get IDOR in e2e.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/console/v1/graphql/device.graphql

@@ -119,6 +119,22 @@ type DeviceEdge {
     node: Device!
 }
 
+type EmployeeDeviceConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.EmployeeDeviceConnection"
+    ) {
+    edges: [EmployeeDeviceEdge!]!
+    pageInfo: PageInfo!
+}
+
+type EmployeeDeviceEdge
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.EmployeeDeviceEdge"
+    ) {
+    cursor: CursorKey!
+    node: Device!
+}
+
 type CreateDevicePayload {
     device: Device!
     # enrollmentToken is shown ONCE; exchange via agent REST /enroll.

pkg/server/api/console/v1/graphql/viewer.graphql

@@ -30,7 +30,7 @@ type Viewer {
         last: Int
         before: CursorKey
         orderBy: DeviceOrder
-    ): DeviceConnection! @goField(forceResolver: true)
+    ): EmployeeDeviceConnection! @goField(forceResolver: true)
 
     # Own-device read for self-enrollment status polling before org assumption.
     enrolledDevice(id: ID!): Device @goField(forceResolver: true)