Per-device consent policy for remote access

Consent prompts are currently all-or-nothing at the tenant level. We need it scoped per device or device group — require end-user consent before remote sessions on standard user endpoints, but bypass consent for unattended devices like digital signage and conference room systems, which have no one present to approve the prompt. Today we either weaken consent for every device or lose remote access to unattended hardware.