Returns the rules engine OpenAPI specification. No bearer token is required: this route carries no authorizer, by decision, so that the specification can be read before a caller has credentials. It exposes the shape of the API only -- no rule, organization or user data passes through it.