shappstore entitlement API. All routes are served by functions; see /healthz.