Read a KYC check’s captured document image

Requires an API client bearer token.

The case's captured document image, narrowed to the custody `review` purpose — the same human-adjudication slice `getCheckApplicant` reads from, extended (S9) to include the retained image. Every read is reported to pii-vault's audit pipeline (`access_recorded: true`) on a best-effort basis — an audit-publish failure never fails the read itself, so this is not an unconditional guarantee — attributed to the identity-kyc service principal, not to the individual console user who made the request.