backend/docs/MILESTONE_03.md

Milestone 03: Media, OpenAPI and API Lab

Implemented in this milestone

• Removed legacy sha256$ password verification and updated local admin seeds to PBKDF2-HMAC-SHA256.
• Documented why PBKDF2-HMAC-SHA256 is used now: salted, intentionally slower than plain SHA-256 and available through the existing OpenSSL dependency.
• Added report media uploads at POST /api/v1/reports/{id}/media.
• Supported JPEG, PNG, WebP, MP4, WebM and QuickTime uploads.
• Report attachments now use the /media upload path.
• Added generated OpenAPI JSON from Drogon route macros plus the manual docs/openapi/visione.openapi.yaml contract.
• Exposed /api/v1/openapi.json and /api/v1/docs.
• Added a small Streamlit API lab for visual endpoint testing.

To do next

• Expand the manual OpenAPI contract as endpoints evolve.
• Add minimal media upload integration tests after endpoint contracts settle.
• Keep API and docs on media terminology only.
• Keep the Streamlit lab small and replace it with the real frontend later.