Remove photo alias

docs/API_SPEC.md

@@ -33,8 +33,7 @@ Authorization: Bearer <token>
 - `POST /reports/{id}/assignments`: assign a team.
 - `POST /reports/{id}/feedback`: add citizen feedback.
 - `POST /reports/{id}/media`: upload up to five multipart media files. Supported
-  types are JPEG, PNG, WebP, MP4, WebM and QuickTime. The legacy
-  `/reports/{id}/photos` path is kept as a compatibility alias.
+  types are JPEG, PNG, WebP, MP4, WebM and QuickTime.
 
 ## Admin Reference Data
 - `GET|POST /admin/categories`

docs/MILESTONE_03.md

@@ -7,7 +7,7 @@
   than plain SHA-256 and available through the existing OpenSSL dependency.
 - Added report media uploads at `POST /api/v1/reports/{id}/media`.
 - Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
-- Kept `POST /api/v1/reports/{id}/photos` as a temporary compatibility alias.
+- Removed the old `/photos` upload path; report attachments now use `/media`.
 - Added generated OpenAPI JSON from Drogon controller route macros.
 - Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
 - Added a small Streamlit API lab for visual endpoint testing.
@@ -17,5 +17,5 @@
 - Consider extracting `tools/drogon-openapi-gen` into an open-source standalone
   project once the conventions stabilize.
 - Add minimal media upload integration tests after endpoint contracts settle.
-- Replace the compatibility `/photos` alias once external scripts use `/media`.
+- Keep API and docs on `media` terminology only.
 - Keep the Streamlit lab small and replace it with the real frontend later.