- Add `verified` middleware to billing route group so only
email-verified users can access billing endpoints
- Separate read-only GET routes from state-changing POST routes
- Add `throttle:6,1` rate limiting to state-changing endpoints
(cancel, resume, upgrade/preview, upgrade) — 6 requests per minute
- Reorganise route group with clear section comments
Fixes#13
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
