PUT /api/v1/devices/:deviceId accepts a target snapshot the device cannot deploy #8812

Setting targetSnapshot on a device returns 200 and stores the target in cases where the device never deploys it.

Steps to reproduce

1. Set a target on a device assigned to a hosted instance (or not assigned to anything), using a snapshot from another device in the team. The route returns 200 and stores it, but sendDeviceUpdateCommand drops any snapshot that is not from the device's own instance, so the update carries no snapshot and the device stops its flows.
2. Set a target on a device running the Lite agent. The UI blocks this, the route does not.
3. Set a target on a device in developer mode with an agent older than 3.8.0. The UI blocks this, the route does not. The agent ignores the forced update, so the target is stored but never deployed.

Expected

The route rejects these with a 400, so the UI is not the only place enforcing them.

Reference

forge/routes/api/device.js:736-765, forge/db/controllers/Device.js:112-121, frontend/src/pages/device/VersionHistory/Snapshots/index.vue:349-366. The MCP tool in #8811 checks all three before calling the route, and those checks can come out once this is fixed.