Admin-or-support, dry-run-first deactivation by epd DeviceId. Missing app records produce warnings and do not block IoT deactivation. An optional previousDeviceObjectId from the admin search allows orphaned paper assignments to be detached; without a known app id, papers remain unchanged. A dry run is the default and returns the papers currently attached plus a confirmationToken. Papers and their cross-paper references are preserved. To execute, repeat with dryRun=false and that token. After a confirmed IoT reset, cleanup can be retried with the same token without resetting the device again; a completed request returns its saved result. Cleanup only affects the original database device and detaches its remaining paper references. Change counts describe the successful cleanup attempt. Middlewares: `authMiddleware`, `validateAdminOrSupport`