update openapi spec

[slashburygin]

Summary by Sourcery

Refine and extend the OpenAPI user specification to model concrete driver, IAM, networking, repository, certificate, secret, and IAM domain resources, replacing generic maps with structured oneOf schemas, introducing new fields and operations, and aligning query parameters and paths with the updated API surface.

New Features:

• Introduce concrete driver_spec variants for machine pools (libvirt, exordos_local_hyper, dummy) and make driver_spec required across MachinePool schemas.
• Add registration_auto_provision and registration_client controls to IAM client and user flows, plus new IAM IdP, organization, project, role, role binding, permission binding, and client action endpoints (login, logout, introspect, jwks, userinfo, password reset).
• Define Border networking resources as a first-class API alongside existing load balancers, including SNAT rules and forwarding configuration, and wire corresponding paths and parameters.
• Add repository and repository element APIs for managing manifests, inventory, repositories, and lifecycle actions like install, uninstall, upgrade, refresh, and upload.
• Introduce UniversalAgent creation and key issuance endpoints, and expand secret management resources for certificates, passwords, RSA keys, SSH keys, and rules.

Enhancements:

• Replace numerous additionalProperties-based generic objects with strongly-typed oneOf schemas and enriched field constraints across IAM, networking, repository, and secret components.
• Rename and reorganize several schemas and routes (e.g., Organization vs OrganizationMember, LB vs Border) to better reflect domain concepts and support nested subresources.
• Align and extend query parameters (e.g., manifest, version, node, registration flags) to be consistent and more expressive across the updated API.

[sourcery-ai]

Sorry @slashburygin, your pull request is larger than the review limit of 150000 diff characters

[sourcery-ai]

Reviewer's Guide

Refines the OpenAPI user spec by making driver specifications and repository-related structures more explicit and typed, introduces border networking resources, restructures IAM/organization/permission models, and adds several new endpoints and parameters across IAM, network, repo, and UA domains.

File-Level Changes

Change	Details	Files
Replace generic driver_spec maps with discriminated union objects and require driver_spec in machine pool models.	For MachinePool_Get, MachinePool_Create, MachinePool_Update, and MachinePool_Filter, replaced driver_spec.additionalProperties loose typing with a oneOf over explicit driver kinds: libvirt, exordos_local_hyper, and dummy. Defined concrete properties for each driver kind (connection_uri, network, storage_pool, machine_prefix, network_type, iface_rom_file, iface_mtu, iface_source, node, etc.) with validation constraints, examples, and defaults. Marked driver_spec as a required property in MachinePool_* schemas.	docs/openapi/openapi_user.yaml
Extend IAM client and user registration models with auto-provisioning and registration metadata.	Added registration_auto_provision boolean field (default true) to multiple IAM client-related schemas and query parameters. Introduced registration_client and related UUID fields to user and/or registration flows to track client responsible for registration. Extended parameter components and path operations to accept and propagate the new registration-related fields.	docs/openapi/openapi_user.yaml
Restructure organization, member, permission binding, and project IAM models and endpoints.	Renamed and redefined OrganizationMember_* and Organization_* schemas and operations, moving Organization_Get earlier and reintroducing OrganizationMember_* types with organization/user/role fields. Reworked PermissionBinding_* schemas to focus on project_id, role, and permission, and shifted Permission_* schemas further down while keeping their structure. Added/updated IAM endpoints for organizations, organization members, permission bindings, permissions, projects, role bindings, roles, and users to align with the new schema layout and operationIds.	docs/openapi/openapi_user.yaml
Introduce Border networking resource and adjust LB/BackendPool/Vhost/Route models and paths.	Renamed existing LB_* schema section temporarily to Border_* (Border_Get/Create/Update/Filter) with specific fields like node, type (core_agent/core), ipsv4, snat_rules, forwards, and updated their required/project_id semantics. Reintroduced LB_Get/Create/Update/Filter schemas later with clarified type oneOf (core vs core_agent) and consistent ipsv4 fields. Updated path parameters and routes to add BorderUuid and Border_* endpoints, and expanded network/lb subresources for backend_pools, vhosts, and routes with more hierarchical URLs and tags.	docs/openapi/openapi_user.yaml
Add repository and repo element domain (RepoElement_, Repository_) along with supporting parameters and endpoints.	Introduced RepoElement_Get/Filter schemas representing elements within repositories, including repository, version, manifest/specification/inventory maps, installation_state, and element reference. Defined Repository_Get/Create/Update/Filter schemas with status, priority, refresh_rate, sync_mode, and driver_spec oneOf over nginx/bootstrap/dummy_migration/database, plus required name/project_id/driver_spec. Added query parameters for repository-related filters (repository, version, manifest, specification, inventory, priority, refresh_rate, sync_mode, next_refresh) and created /v1/repo/... endpoints for repositories and repo elements with actions like edit, install, uninstall, upgrade, refresh, and upload.	docs/openapi/openapi_user.yaml
Refine certificate, password, RSAKey, SSHKey, and rule-related schemas to be more strongly typed and better organized.	Moved Certificate_* schemas down and restored their method oneOf (dns_core) while cleaning up constructor/method duplication from repository-related blocks. Reintroduced Password_, RSAKey_, SSHKey_* schemas with clearer separation between constructors, methods, and payload fields (e.g., value vs private_key/public_key) and aligned their Filter/Create/Update structures. Adjusted Rule_Get and Rule_Filter schemas for condition structures and ensured they follow consistent patterns with other resources.	docs/openapi/openapi_user.yaml
Expand IAM IdP and client action endpoints and add new well-known routes.	Added extensive Idp_* schemas (Get/Create/Update/Filter) and corresponding /v1/iam/idp/ and /v1/iam/idp/{IdpUuid} endpoints, including .well_known subroutes and actions authorize, callback, and login. Extended IamClient action endpoints with login, logout, me, jwks, introspect, send_reset_password_code, and userinfo paths and operationIds. Introduced WellKnownRoute controller endpoints under IdPs for handling .well_known paths.	docs/openapi/openapi_user.yaml
Enhance User and UniversalAgent domains with new actions and creation capabilities.	Expanded /v1/iam/users/* endpoints with numerous actions (activate_otp, change_password, confirm_email, disable_otp, enable_otp, force_confirm_email, get_my_roles, resend_email_confirmation, reset_password) and wired them to User schemas, including extra fields like otp_secret and email confirmation metadata. Added UniversalAgent_Create schema and POST /v1/ua/agents to allow UniversalAgent creation, plus an issue_key action endpoint for agents. Ensured UniversalAgent schemas track capabilities, facts, node, and status with appropriate defaults.	docs/openapi/openapi_user.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[phantomii]

Looks good.