Answer an unpaid GET with the same 402 challenge the POST route issues.

This route used to 405. Directory crawlers and x402 explorers probe a paid resource with a plain GET to read its terms, and a 405 carries no price, no network and no pay-to address, so the resource looks broken rather than priced. The challenge is metadata about the resource, not about the search operation, so serving it on GET is both more discoverable and more correct. Actually running a search still requires POST with a query.