Document milestone 03

docs/LLM_CONTEXT.md

@@ -17,5 +17,5 @@ Important conventions:
 - Use Drogon references from `/home/gabdevele/Projects/snitchitaly/backend/drogon`
   and `https://drogonframework.github.io/drogon-docs/`.
 - `AGENTS.md` is the durable agent instruction entrypoint.
-- `docs/MILESTONE_01.md` and later milestone files describe what has been
-  implemented and what comes next.
+- `docs/MILESTONE_01.md`, `docs/MILESTONE_02.md` and `docs/MILESTONE_03.md`
+  describe what has been implemented and what comes next.

docs/MILESTONE_03.md

@@ -0,0 +1,21 @@
+# Milestone 03: Media, OpenAPI and API Lab
+
+## Implemented in this milestone
+- Removed legacy `sha256$` password verification and updated local admin seeds to
+  PBKDF2-HMAC-SHA256.
+- Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower
+  than plain SHA-256 and available through the existing OpenSSL dependency.
+- Added report media uploads at `POST /api/v1/reports/{id}/media`.
+- Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
+- Kept `POST /api/v1/reports/{id}/photos` as a temporary compatibility alias.
+- Added generated OpenAPI JSON from Drogon controller route macros.
+- Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
+- Added a small Streamlit API lab for visual endpoint testing.
+
+## To do next
+- Add richer OpenAPI schema metadata for request and response bodies.
+- Consider extracting `tools/drogon-openapi-gen` into an open-source standalone
+  project once the conventions stabilize.
+- Add minimal media upload integration tests after endpoint contracts settle.
+- Replace the compatibility `/photos` alias once external scripts use `/media`.
+- Keep the Streamlit lab small and replace it with the real frontend later.