Backend GET /api/devices/protected returns:
{ success, data: { devices, plan, max, isLegend } }
apiFetch already unwraps `data`, leaving us with the object
{ devices, plan, max, isLegend } — not an array.
Old code did `Array.isArray(res) ? res : []` on that object, which
silently fell through to an empty list. Effect: enrolled protected
devices (Mac/Windows) never appeared in the Geräte screen even though
the DB row existed and the API responded correctly.
Fix: read res.devices instead of assuming the response is the array.
8851f36f65