Returns all saved cards for the authenticated user, ordered most-recent first.
authorization_code is never returned — it is stored server-side only and used
exclusively by the backend to charge the card when funding an escrow.
JWT access token obtained from /auth-verify (login context) or /auth-signup. Set the bearer_token environment variable in your API client to apply it globally.