The signed-in member's own certification records

Returns the Tier 0 registrations, dual-gate attempts, and issued registry records (score reports, plus any legacy certificate) that belong to the account behind the supplied Firebase ID token. This is a member endpoint, not part of the agent surface: it is same-origin (no CORS headers are sent), never cached (Cache-Control: no-store), and requires an ID token from an aioq.org account whose email address is verified. Agent keys are not accepted. Records are attached to the account two ways, and every entry says which: account means an ID token was verified when the record was submitted and the account uid was stamped on it; email means the record carries this verified email address but identity was not verified at submission time. The email address is taken only from the verified token — there is no parameter that selects a different one. Gate B item ids, the draw seed, and the served item lists are never returned: they describe the private rotating pool.