docs(asm): document X-RateLimit-Limit/Remaining response headers on all endpoints

[dmchaledev]

Problem

The info.description in asm/openapi.yaml explicitly tells API consumers:

The current limit and remaining quota are returned in X-RateLimit-Limit and X-RateLimit-Remaining response headers.

But no endpoint actually declared these headers in its response objects. That means:

• SDK generators (openapi-generator, fern, etc.) produce response models with no trace of these headers
• Redoc's interactive docs show nothing about them
• Developers relying on the spec to implement rate-limit-aware retry logic have no machine-readable contract to work from

Fix

• Adds a components/headers section with reusable X-RateLimit-Limit and X-RateLimit-Remaining header definitions (type, description, example value)
• Wires both headers into every 2xx response across all 12 endpoints (GET/PATCH list and detail routes for Assets, Scans, Vulnerabilities, and Tags)

Changes

• asm/openapi.yaml — +72 lines, no breaking changes

Test plan

• spectral lint asm/openapi.yaml --ruleset spectral:oas passes (CI will verify)
• Render with Redoc locally and confirm headers appear in each endpoint's response section

🤖 Generated with Claude Code

https://claude.ai/code/session_01D8aK5iFD2dh7B5Z4vtf5m5

---

Generated by Claude Code