Return the available BizzyFlex protection plans for a train fare. Call this before booking to show the traveler their options.

fareId is the Mercury UUID returned by POST /v1/trains/fares/build; Mercury reverse-maps it to the upstream provider identifier server-side.

An empty protectionPlans list means no plans are available for this fare — this is a valid response (the dominant case in production since only specific non-refundable economy carrier/fare combinations are eligible), not an error.

A guest-session caller may list plans for its own locked fare, mirroring GET /v1/flights/fares/{fareId}/protection-plans.