Check the proof for a pending ownership claim

Signed-in only, and the claim must belong to the caller (404 otherwise — no existence oracle). Checks the well-known token file and the DNS TXT record; either passes. Fails closed on any ambiguous response. 200 whether or not it verifies.