Returns the persisted verification record for (appUserId, cardToken). Returns data: null when the card has never been verified (the global response interceptor wraps the service-level null). The appUserId query param is the customer's app_user.uuid; the controller resolves it to the internal BIGINT before lookup.

Access: Auth methods: JWT bearer. Requires permissions: purchase:admin.