v0.1.29 — Geraete-Offboarding (v1)

Neu:
- Geraete-Offboarding: Geraete ueber Intune, Autopilot und Entra ID
  entfernen. Suche + ID-Aufloesung (via $batch), Recovery-Keys
  (BitLocker/FileVault/LAPS) vor dem Loeschen, Bestaetigungs-Dialog mit
  Dienst-Auswahl + 403/Multi-Admin-Approval-Handling, im Read-Only gesperrt.
  Neues Modul src/Offboard.ps1, Endpoints /api/offboard/{search,keys,execute}.
  Portiert aus Device Offboarding Manager (Ugur Koc, MIT).
- Offboarding-Berechtigungen dokumentiert; Setup-Skript -IncludeOffboarding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Api.ps1

@@ -60,6 +60,10 @@ function Invoke-ApiHandler {
         "POST /api/policies/assign"       { return Invoke-PolicyAssignEndpoint -Body $Body }
         "POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
         "POST /api/pickfolder"            { return Invoke-FolderPickerEndpoint -Body $Body }
+
+        "GET /api/offboard/search"        { return Search-OffboardDevicesEndpoint -Query $Query }
+        "POST /api/offboard/keys"         { return Get-OffboardKeysEndpoint -Body $Body }
+        "POST /api/offboard/execute"      { return Invoke-OffboardExecuteEndpoint -Body $Body }
     }
 
     # 2-segment fallbacks (z.B. /api/groups/<id>/members)