Get Observability External Verify

First call newer than since, or {pending: true} if none.

since is REQUIRED - without it the query would match any historical call from this PK+client and immediately mark verify as successful for a returning user reconnecting. The FE sets since to the timestamp at which the user clicked into the verify step.