Post apivizplan

POST /viz/plan — return the execution plan for a spec.

Same auth / visibility / readiness / no-leak rules as SafeVizSpecValidateView and VizCostEstimateView — all three share _resolve_visible_ready_version so the no-leak contract can’t drift across viz endpoints. On failure: the common {is_valid: false, errors: [{path, error}]} envelope.