Whether tablet push is on for the clinic (and its VAPID public key), and whether the browser's current endpoint — sent in the body, never the URL, so it stays out of access logs — is this tablet's.

POST /devices/me/push/status: the browser's current endpoint, if it has one.

`POST /devices/me/push/status`. string DevicePushStatusDto.EndpointState is about the exact endpoint the
browser sent, and tells the tablet what to do with that subscription:
* active — it is this tablet's, live: register it again (refreshes keys and last-seen);

• lapsed — it is this tablet's, but the push service reported it gone: register it again;
• none — it is not this tablet's (never registered, re-paired, another tablet's or a staff member's), or no endpoint was sent: never register it on load; unsubscribe it.