- get_snapshot queries snapshot by id/device/tenant, decrypts via Transit - get_snapshot_diff queries diff by new_snapshot_id with device/tenant filter - Both return None for missing data (404-safe) - 4 new tests with mocked Transit and DB sessions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>