Secure Mode status

True when Secure Mode is enabled. This public endpoint intentionally exposes only this flag; provisioning state, reset policy, and configured roles are not disclosed to unauthenticated clients.