Get Available Rules

Global catalog of rule building blocks. No team/app scoping -- matches Flask's bare login_required (no permission_required at all). The three plain select(...) calls below are already filtered to active=True by fastapp's global session-level soft-delete listener (src/database/mixins.py) with no explicit .where() needed -- matching Flask's Model.query.all(), which goes through the same kind of default-active filter on its own model-level query_class.