Return the available protection plans for a flight fare. Call this before booking to show the traveler their options.

fareId is the Mercury UUID returned by POST /v1/flights/fares/build; Mercury reverse-maps it to the upstream provider identifier server-side.

An empty protectionPlans list means no plans are available for this fare — this is a valid response, not an error.

A guest-session caller may list plans for its own locked fare. A fare locked by another principal does not resolve, so it returns the same 410 an expired fare does.