The plan catalog (prices in cents + monthly credit allotments).

<br/>Deliberately ANONYMOUS: this is the price list. /packages is a public<br/>route in the SPA, so gating it behind @login_required bounced a visitor<br/>who had not signed in yet to /?reason=session-expired instead of<br/>showing them the plans (mobile QA fix round 1). The payload carries the<br/>same numbers the marketing pricing page publishes and nothing about any<br/>user; every other billing route stays gated. Also allowlisted by endpoint<br/>name in app/__init__.py so the app-wide auth gate lets it through.