List cards for a specific user

Returns the Ecentric card list for the given Ecentric user ID. When appUserId is supplied (as app_user.uuid), every card in the response is annotated with a verification object describing the persisted 3DS verification state for that token (status / verifiedAt / lastFailureReason). Cards with no verify_cards row receive a verification object whose fields are all null so the front-end has a stable shape to render.

Access: Auth methods: JWT bearer. Requires permissions: purchase:admin.