Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/MediaRequest.php

@@ -40,6 +40,7 @@ class MediaRequest extends FormRequest
                 'mimetypes:'.implode(',', (array) config('media.upload.mimes')),
             ],
             'url' => ['required_without:file', 'string', 'url:https', 'max:2048'],
+            'for' => ['sometimes', 'string', 'in:'.implode(',', array_keys((array) config('media.upload.for')))],
         ];
     }
 }

app/Http/Requests/Api/V1/TechnologyRequest.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Enums\RadarRing;
+use App\Enums\TechnologyCategory;
+use App\Models\Technology;
+use App\Rules\Translatable;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * The panel's technology form, as rules. On update every field is optional
+ * (PATCH semantics) but keeps the same shape.
+ *
+ * `name` and `slug` are plain strings: a technology's name is a proper noun,
+ * the same in every language. Only the prose about it is translatable.
+ */
+class TechnologyRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $technology = $this->route('technology');
+        $creating = ! $technology instanceof Technology;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'name' => [$sometimes, 'string', 'max:120'],
+            'slug' => [
+                $sometimes,
+                'string',
+                'max:120',
+                'alpha_dash:ascii',
+                Rule::unique('technologies', 'slug')->ignore($technology?->id),
+            ],
+            'description' => ['sometimes', 'nullable', new Translatable(max: 1000)],
+            'radar_note' => ['sometimes', 'nullable', new Translatable(max: 1000)],
+
+            'category' => ['sometimes', Rule::enum(TechnologyCategory::class)],
+            // Null keeps it off the radar while projects can still be tagged with it.
+            'radar_ring' => ['sometimes', 'nullable', Rule::enum(RadarRing::class)],
+            'color' => ['sometimes', 'nullable', 'string', 'regex:/^#[0-9a-fA-F]{6}$/'],
+            'logo' => ['sometimes', 'nullable', 'string', 'max:255'],
+            // 255, not the panel's 2048: that is the column's width.
+            'website' => ['sometimes', 'nullable', 'url', 'max:255'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+        ];
+    }
+}