Milestone 03: Media, OpenAPI and API Lab

Implemented in this milestone

Removed legacy sha256$ password verification and updated local admin seeds to PBKDF2-HMAC-SHA256.
Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower than plain SHA-256 and available through the existing OpenSSL dependency.
Added report media uploads at POST /api/v1/reports/{id}/media.
Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
Report attachments now use the /media upload path.
Added generated OpenAPI JSON through scripts/swagger-drogon/, combining Drogon route macros, adjacent metadata blocks, C++ inference and the Visione schema registry.
Exposed /api/v1/openapi.json and /api/v1/docs.
Added a small Streamlit API lab for visual endpoint testing.

Expand OpenAPI schema coverage as endpoints evolve.
Consider extracting scripts/generate_openapi.py into an open-source standalone project once the conventions stabilize.
Add minimal media upload integration tests after endpoint contracts settle.
Keep API and docs on media terminology only.
Keep the Streamlit lab small and replace it with the real frontend later.