Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/TechnologyController.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Enums\TechnologyCategory;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\TechnologyRequest;
+use App\Http\Resources\TechnologyResource;
+use App\Models\Technology;
+use App\Support\TranslatablePayload;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+
+/**
+ * The technologies the collective uses, and their place on the radar.
+ *
+ * Same rules as the panel: TechnologyPolicy refuses to delete one a project,
+ * member or call still points at.
+ */
+class TechnologyController extends Controller
+{
+    /**
+     * Filters: category, radar_ring (`none` for those off the radar), search.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('viewAny', Technology::class);
+
+        $technologies = Technology::query()
+            ->with('logoMedia')
+            ->withCount('projects')
+            ->when($request->filled('category'), fn ($q) => $q->where('category', $request->string('category')))
+            ->when($request->filled('radar_ring'), fn ($q) => $request->string('radar_ring')->toString() === 'none'
+                ? $q->whereNull('radar_ring')
+                : $q->where('radar_ring', $request->string('radar_ring')))
+            ->when($request->filled('search'), fn ($q) => $q->where('name', 'like', '%'.$request->string('search').'%'))
+            ->orderBy('position')
+            ->orderBy('name')
+            ->paginate(perPage: min($request->integer('per_page', 25), 100))
+            ->withQueryString();
+
+        return TechnologyResource::collection($technologies);
+    }
+
+    public function store(TechnologyRequest $request): JsonResponse
+    {
+        $this->authorize('create', Technology::class);
+
+        $technology = new Technology;
+        $technology->fill(TranslatablePayload::merge($technology, $request->validated(), $technology->translatable));
+        // The column's default, and the panel's, stated here so the model
+        // knows it too: otherwise the answer to a create without a category
+        // would be missing the one the row was given.
+        $technology->category ??= TechnologyCategory::Tool;
+        $technology->save();
+
+        return TechnologyResource::make($this->loaded($technology))->response()->setStatusCode(201);
+    }
+
+    public function show(Technology $technology): TechnologyResource
+    {
+        $this->authorize('view', $technology);
+
+        return TechnologyResource::make($this->loaded($technology));
+    }
+
+    public function update(TechnologyRequest $request, Technology $technology): TechnologyResource
+    {
+        $this->authorize('update', $technology);
+
+        $technology->fill(TranslatablePayload::merge($technology, $request->validated(), $technology->translatable));
+        $technology->save();
+
+        return TechnologyResource::make($this->loaded($technology));
+    }
+
+    public function destroy(Technology $technology): JsonResponse
+    {
+        $this->authorize('delete', $technology);
+
+        $technology->delete();
+
+        return response()->json(status: 204);
+    }
+
+    protected function loaded(Technology $technology): Technology
+    {
+        return $technology->load('logoMedia')->loadCount('projects');
+    }
+}