CS-219 Hide devices of platform admin users on People/Devices tab

[github-actions]

This is an automated pull request to merge chas/hide-platform-admin-devices into dev.
It was created by the [Auto Pull Request] action.

[cursor]

PR Summary

Low Risk
Low risk: only tightens query filters to exclude User.role='admin' records; main risk is unintentionally hiding devices if roles are misassigned.

Overview
Updates the People → Devices data loaders to exclude devices belonging to platform admin users.

Both the device-agent DB query (getEmployeeDevicesFromDB) and the Fleet legacy path (getFleetHosts member lookup) now apply a NOT user.role='admin' filter so platform-admin devices no longer appear in org device lists.

^{Written by Cursor Bugbot for commit 760fa00. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Apr 3, 2026 1:40am
comp-framework-editor	Ready	Preview, Comment	Apr 3, 2026 1:40am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		Apr 3, 2026 1:40am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[linear]

CS-219 Device agent shows "ESET On" when not installed