Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Policies/MediaPolicy.php

@@ -24,14 +24,15 @@ class MediaPolicy extends ResourcePolicy
     /**
      * Uploading through the API, which has no form to attach a file to.
      *
-     * Still true to the rule above in spirit: through the API the one record
-     * that holds an image is a page, so whoever may write pages may upload the
-     * image for one — and nobody else, whatever their `media.*` permissions,
-     * which only ever described looking after files that already exist.
+     * Still true to the rule above in spirit: an upload says which kind of
+     * record it is for — a page, a technology — and whoever may write that kind
+     * of record may upload its image. Nobody else, whatever their `media.*`
+     * permissions, which only ever described looking after files that already
+     * exist.
      */
-    public function upload(User $user): bool
+    public function upload(User $user, string $for = 'pages'): bool
     {
-        return $user->can('pages.create') || $user->can('pages.update');
+        return $user->can("{$for}.create") || $user->can("{$for}.update");
     }
 
     /**