Submits the code the user read off the verification message. On
success the response carries verified: true and a verifiedAt, and
the phone counts as verified by Verified Inc's one-time code.

A code that is wrong, expired, or out of attempts comes back as a 422
rather than a success with verified: false — check the status, not
the body, to tell the two apart. Verifications expire quickly, so a
uuid Verified no longer holds is a 404; start a new verification
rather than retrying this one.