fix: 修复 packages 接口访问不存在字段导致的运行时错误

- 移除 router 中对 result.region、result.currency、pkg.price 的访问
- 修正 pkg.type.value 为 pkg.type (type 是 Literal 不是 Enum)
- 更新协议文档以反映实际实现
- 新增 Apple IAP 协议文档
- 标记未使用的错误码为 RESERVED

docs/protocols/auth/session-auth-protocol.md

@@ -73,10 +73,18 @@ Request:
 { "email": "user@example.com", "token": "123456" }
 ```
 
+Optional fields:
+
+```json
+{ "email": "user@example.com", "token": "123456", "language": "zh-CN", "timezone": "Asia/Shanghai" }
+```
+
 Validation (backend):
 
 - `email` must match `SUPABASE_EMAIL_PATTERN`
 - `token` must be exactly 6 chars
+- `language` (optional): max 20 chars, updates profile settings.preferences.language if provided
+- `timezone` (optional): max 50 chars, updates profile settings.preferences.timezone if provided
 
 Response: