Findable by agent catalogs, not just reachable

Our paid endpoints were correct and invisible at the same time. A GET on a paid resource answered "405, wrong method". Catalog crawlers probe with GET to read payment terms before anyone pays, so every one of them bounced off, and the conformance check that follows was never even reached. The discovery metadata was also published under a key we had picked ourselves rather than the one catalogs read. Both fixed. A GET now answers "402, here is how to pay", which is what the standard expects. Our paid endpoints went from failing the fourth of twenty-five conformance checks to passing all twenty-five. An MCP client's GET is deliberately treated differently: it still gets a clean 405, because telling a connected client its session needs paying for would break it.