Pins the wire shape: honest constants, deviceCount aggregation, the {"users":[...]} envelope, ignored type/role filters, and 404 on unknown/non-numeric/pseudo-user ids.