feat(lnurl): access-control verify endpoint

GET /api/v1/verify/{external_id}?p=&c= — side-effect-light SUN check for
access control (doors via the aiolabs  extension): confirms a genuine,
non-replayed tap and returns the card identity (external_id, card_name),
WITHOUT /scan's spend semantics (no withdrawRequest, no daily-limit, no hit).
It still advances the SUN counter, so a captured p/c can't be replayed.

Named 'verify' because /auth is already the card-programming OTP endpoint.
config.json → 1.1.1-aio.2.

config.json

@@ -2,7 +2,7 @@
   "name": "Bolt Cards",
   "short_description": "Self custody Bolt Cards with one time LNURLw",
   "tile": "/boltcards/static/image/boltcard.png",
-  "version": "1.1.1-aio.1",
+  "version": "1.1.1-aio.2",
   "min_lnbits_version": "1.3.0",
   "contributors": [
     {