Requires a Better Auth session cookie or an x-api-key header. The caller's organization role must grant alarm:read and the organization must be entitled to the {location} in the path (super admins bypass both checks).Latest alarm per signal for the requested devices.