# Milestone 03: Media, OpenAPI and API Lab

## Implemented in this milestone
- Removed legacy `sha256$` password verification and updated local admin seeds to
  PBKDF2-HMAC-SHA256.
- Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower
  than plain SHA-256 and available through the existing OpenSSL dependency.
- Added report media uploads at `POST /api/v1/reports/{id}/media`.
- Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
- Report attachments now use the `/media` upload path.
- Added generated OpenAPI JSON through `scripts/swagger-drogon/`, combining
  Drogon route macros, adjacent metadata blocks, C++ inference and the Visione
  schema registry.
- Exposed `/api/v1/openapi.json` and `/api/v1/docs`.
- Added a small Streamlit API lab for visual endpoint testing.

## To do next
- Expand OpenAPI schema coverage as endpoints evolve.
- Consider extracting `scripts/generate_openapi.py` into an open-source standalone
  project once the conventions stabilize.
- Add minimal media upload integration tests after endpoint contracts settle.
- Keep API and docs on `media` terminology only.
- Keep the Streamlit lab small and replace it with the real frontend later.