/openapi.json: the service's public API as OpenAPI 3.1 (SEO-3) (#169)

ddiff --git a/server/app.js b/server/app.js
iindex ab4d0c2..2b5845d 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -66,6 +66,25 @@ function createApp(opts = {}) {
      const release = require('openvibe-shared/release').createRelease({ service: 'run', root: path.join(__dirname, '..') });
  
      const app = express();
++    // GET /openapi.json (SEO-3): this service's public API as OpenAPI 3.1, generated from the contracts
++    // (openvibe-contracts); the operations they mark internal-only are left out.
++    app.get('/openapi.json', (_req, res) => {
++        const doc = require('openvibe-contracts').openapi.document('run');
++        if (!doc) return res.status(404).type('text/plain').send('No API document.');
++        const METHODS = new Set(['get', 'put', 'post', 'delete', 'patch', 'head', 'options']);
++        const paths = {};
++        for (const [p, item] of Object.entries(doc.paths || {})) {
++            const kept = {};
++            for (const [k, op] of Object.entries(item || {})) {
++                if (!METHODS.has(k)) { kept[k] = op; continue; }
++                const vis = [].concat((op && op['x-openvibe-visibility']) || []);
++                if (vis.length && vis.every((v) => v === 'internal')) continue;
++                kept[k] = op;
++            }
++            if (Object.keys(kept).some((k) => METHODS.has(k))) paths[p] = kept;
++        }
++        res.set('Cache-Control', 'public, max-age=3600').set('Access-Control-Allow-Origin', '*').json({ ...doc, paths });
++    });
      app.disable('x-powered-by');
      app.set('trust proxy', config.trustProxy);
      // Run answers JSON and server-sent events only: no page, no form, no script — so helmet's defaults
ddiff --git a/test/openapi-json.test.js b/test/openapi-json.test.js
nnew file mode 100644
iindex 0000000..e1f33c0
---- /dev/null
++++ b/test/openapi-json.test.js
@@@ -0,0 +1,13 @@
++'use strict';
++// SEO-3: /openapi.json answered 404 here (11-03). It is the contracts' OpenAPI 3.1 document for this service
++// (openvibe-contracts), without the operations they mark internal-only.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++const doc = require('openvibe-contracts').openapi.document('run');
++assert.ok(doc && doc.openapi && /^3\.1/.test(doc.openapi), 'the contracts carry an OpenAPI 3.1 document for run');
++const src = fs.readFileSync(path.join(__dirname, '..', 'server/app.js'), 'utf8');
++assert.match(src, /app\.get\('\/openapi\.json'/, 'the route is mounted');
++assert.match(src, /openapi\.document\('run'\)/);
++assert.match(src, /vis\.every\(\(v\) => v === 'internal'\)\) continue;/, 'internal-only operations are left out');
++console.log('openapi.json: ok');