Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/media.php

@@ -84,9 +84,12 @@ return [
     |
     | POST /api/v1/media, which the MCP server uses to put an image on a page.
     |
-    | Raster formats only. The panel's own upload accepts SVG from the people
-    | who run it; this endpoint also fetches from arbitrary URLs, and an SVG is
-    | a document that can carry script, served from this application's domain.
+    | SVG is accepted because it is what a logo is, but never as sent: an SVG
+    | is a document that can carry script, served from this application's
+    | domain, and this endpoint also fetches from arbitrary URLs. It goes
+    | through enshrined/svg-sanitize first — scripts, event handlers and
+    | remote references removed — and Caddy serves stored SVGs under a
+    | Content-Security-Policy that would stop a script anyway.
     |
     | The size ceiling sits under php.ini's `upload_max_filesize` (24M) so the
     | answer is a readable 422 rather than PHP silently dropping the file.
@@ -94,9 +97,15 @@ return [
     */
 
     'upload' => [
-        'mimes' => ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif'],
+        'mimes' => ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif', 'image/svg+xml'],
         'max_kb' => (int) env('MEDIA_UPLOAD_MAX_KB', 20 * 1024),
-        'directory' => 'pages',
+
+        // What the image is for, and so where it lands — the same directories
+        // the panel's own upload fields use — and whose permission it takes.
+        'for' => [
+            'pages' => 'pages',
+            'technologies' => 'technologies',
+        ],
 
         // Fetching from a URL: how long to wait, in seconds. The request that
         // triggered it is waiting too.