List Assessments

The whole catalogue, session-authed: every startable package with THIS candidate's state per package.

The magic-link twin is GET /api/bench-profile/{token}/assessments. Both call self_serve_service.catalog and serialize_catalog and do nothing else, so a passed package is un-retakeable, a failed one inside the 90-day cooldown carries its retry date, and the one-at-a-time lock reads the same, whichever door the candidate came through. There is deliberately no second query and no second opinion about eligibility here: test_e2e_candidate_catalogue.py asserts the two payloads are equal for the same candidate, and that equivalence is the whole point of the endpoint existing rather than the home payload growing a 44-item array that four other pages would carry for nothing.

Rate limit is the token twin's (60/hour), keyed by session rather than by token: browsing a catalogue is cheap and a candidate comparing packages should not hit a wall.