Return the tradeable symbol catalog the engine backtests against.

UNAUTHENTICATED by design — this is the same public list the engine walks (DataService.list_universe — the LIVING catalog: the original curated core plus every dynamically onboarded symbol), not user data. The cockpit fetches it once to render the universe picker honestly: the "whole market · N stocks" count is derived from this exact list, never a hardcoded guess. Best-effort: a data-layer hiccup yields an empty list (the UI then falls back to its static catalog) rather than a 500.