go generate (gen/api/v1) runs ogen against openapi/v1/headscale.yaml; ogen added as a tool dependency. CI freshness check covers openapi/.