Command genopenapi writes the OpenAPI spec to api/openapi.yaml. It is the
`make openapi` target. The committed snapshot is what PRs diff against and
what external tooling consumes; the drift test in internal/api keeps it equal
to the spec the running service generates.