contracts

openapi.json is the generated API contract.

It is not hand-written. The Axum router (utoipa-axum + #[utoipa::path]) is the source of truth.

just generate-api

That dumps the spec here and rewrites apps/web/src/api/generated.ts.