Document milestone 03

docs/MILESTONE_03.md

@@ -0,0 +1,21 @@
+# Milestone 03: Media, OpenAPI and API Lab
+
+## Implemented in this milestone
+- Removed legacy `sha256$` password verification and updated local admin seeds to
+  PBKDF2-HMAC-SHA256.
+- Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower
+  than plain SHA-256 and available through the existing OpenSSL dependency.
+- Added report media uploads at `POST /api/v1/reports/{id}/media`.
+- Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
+- Kept `POST /api/v1/reports/{id}/photos` as a temporary compatibility alias.
+- Added generated OpenAPI JSON from Drogon controller route macros.
+- Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
+- Added a small Streamlit API lab for visual endpoint testing.
+
+## To do next
+- Add richer OpenAPI schema metadata for request and response bodies.
+- Consider extracting `tools/drogon-openapi-gen` into an open-source standalone
+  project once the conventions stabilize.
+- Add minimal media upload integration tests after endpoint contracts settle.
+- Replace the compatibility `/photos` alias once external scripts use `/media`.
+- Keep the Streamlit lab small and replace it with the real frontend later.