/public/*Public catalog reads
Catalog reads use x-organization-slug to identify the tenant without privileged credentials. Other public routes have their own context: signup intake is organization-agnostic, while checkout/action routes use their documented tokens and guards.