Function served_openapi 

pub fn served_openapi() -> OpenApi

The canonical served OpenAPI shape (RFC-011 cluster-only): the static ApiDoc with every protected path nested under /graphs/{graph_id}/… and cluster_-prefixed operation ids. /healthz and /graphs stay flat. This is the single source of nesting — both the runtime server_openapi handler and the committed openapi.json derive from it, so the published spec can never describe routes the server does not serve. The handler additionally strips security in open mode; the committed spec retains it.