Age verification server

Running. Veratad AgeMatch is the only verification provider - nothing here can mark a checkout verified without a PASS from them.

• POST /proxy/agematch - runs the check for one buyer
• GET /proxy/account/status - account page, signed-in customer
• POST /proxy/account/agematch - AgeMatch for that customer
• POST /proxy/account/document - poll their document check
• GET /api/sessions/:token - what Veratad said, and attempts used
• DELETE /api/sessions/:token - reset a checkout, for re-testing
• GET /auth?shop=x.myshopify.com - connect a store outside the app's organisation

Public URL: https://veratad-dev.twowombats.com
AgeMatch: live as WS@twowombats.com
Attempts allowed per checkout: 2