Read one ATM's configuration and state

Verified ATM operations staff with cards:atm:read on reads and cards:atm:write plus authentication within five minutes on writes; an independent reviewer holding cards:atm:approve decides configurations, exception resolutions and network settlements. Device messages require svc_atmdevice with cards:atm:device; network messages require svc_atmnetwork with cards:atm:network; replenishment updates admit the carrier's cards:atm:replenishment identity. The general cards:read and cards:write scopes do not open the switch. CADP1 is a bank-defined NDC-style cycle, not NCR NDC. The network link is a bank-defined ISO 8583:1987 subset, not a certified Pulse or STAR interface. Software PIN work is refused in production. Surcharges on cards other banks issued are disclosed on screen (12 CFR 1005.16). Cash posts to the terminal's ATM custody unit on GL 1020. See services/cards/atm/README.md.