Read a KYC check’s captured document image

Requires an API client bearer token.

The case's captured document image, narrowed to the custody `review` purpose — the same human-adjudication slice `getCheckApplicant` reads from, extended (S9) to include the retained image. Every read is reported to pii-vault's audit pipeline (`access_recorded: true`) on a best-effort basis — an audit-publish failure never fails the read itself, so this is not an unconditional guarantee — attributed to the identity-kyc service principal, not to the individual console user who made the request. `document_mrz_provenance` (RIGID-766), when present, states how the case's most recent document MRZ was read: client-side widget OCR (`client_extracted`), Azure Document Intelligence (`di_extracted`), a DI-miss tesseract fallback (`di_fallback_tess`), vision's own server-side tesseract (`server_extracted`), no automated read on the latest capture attempt (`manual`), or a direct API submission that never touched OCR (`api_submitted`). Absent means no provenance is known (a legacy case, or one with an image but no document_mrz ever submitted).