Milestone 03: Media, OpenAPI and API Lab

Implemented in this milestone

Removed legacy sha256$ password verification and updated local admin seeds to PBKDF2-HMAC-SHA256.
Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower than plain SHA-256 and available through the existing OpenSSL dependency.
Added report media uploads at POST /api/v1/reports/{id}/media.
Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
Removed the old /photos upload path; report attachments now use /media.
Added generated OpenAPI JSON from Drogon controller route macros.
Exposed /api/v1/openapi.json and /api/v1/docs.
Added a small Streamlit API lab for visual endpoint testing.

Add richer OpenAPI schema metadata for request and response bodies.
Consider extracting tools/drogon-openapi-gen into an open-source standalone project once the conventions stabilize.
Add minimal media upload integration tests after endpoint contracts settle.
Keep API and docs on media terminology only.
Keep the Streamlit lab small and replace it with the real frontend later.