OpenAPI 3.0 spec for the de-id transforms with concrete request/response
schemas, both /tokenize and /restore, an x-api-key securityScheme for
backend-direct calls, and both servers (backend custom domain + Fusion listener,
which injects the key).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
