# Milestone 03: Media, OpenAPI and API Lab

## Implemented in this milestone
- Removed legacy `sha256$` password verification and updated local admin seeds to
  PBKDF2-HMAC-SHA256.
- Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower
  than plain SHA-256 and available through the existing OpenSSL dependency.
- Added report media uploads at `POST /api/v1/reports/{id}/media`.
- Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
- Report attachments now use the `/media` upload path.
- Added generated OpenAPI JSON from Drogon controller route macros and adjacent
  metadata blocks.
- Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
- Added a small Streamlit API lab for visual endpoint testing.

## To do next
- Add richer OpenAPI schema metadata for request and response bodies.
- Consider extracting `scripts/generate_openapi.py` into an open-source standalone
  project once the conventions stabilize.
- Add minimal media upload integration tests after endpoint contracts settle.
- Keep API and docs on `media` terminology only.
- Keep the Streamlit lab small and replace it with the real frontend later.