Get a single user device by ID.

Operator scoping:
Operator-scoped tokens can only read devices currently associated with a user
belonging to the token's operator. Devices outside this scope — including
orphaned devices — return 404 (the existence of the device is not leaked).
Devices whose associated user has been soft-deleted ARE returned to operator-scoped
tokens when the soft-deleted user belonged to the token's operator.