Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mcp/src/tools.mjs

@@ -145,7 +145,17 @@ function buildTool(spec, paths, path, method, item, op, localFiles) {
     // it has no reason to touch.
     if (method === 'patch') delete body.required;
 
-    properties.body = { ...body, description: 'JSON request body.' };
+    // Beside a file, the body carries the upload's other fields (`for`, say)
+    // rather than the JSON alternative, whose own requirements — a `url` —
+    // would then be wrong.
+    if (files.length > 0) delete body.required;
+
+    properties.body = {
+      ...body,
+      description: files.length > 0
+        ? 'JSON request body; with a file, its other fields go here too.'
+        : 'JSON request body.',
+    };
 
     // With a file to send instead, the JSON body is the other way in rather
     // than a requirement; the API says which one it missed if neither comes.

mcp/test/tools.test.mjs

@@ -23,6 +23,10 @@ test('names follow the Laravel routes', () => {
     admin_pages_destroy: 'DELETE /v1/pages/{page}',
     admin_pages_restore: 'POST /v1/pages/{page}/restore',
     admin_roles_catalogue: 'GET /v1/roles/catalogue',
+    admin_technologies_index: 'GET /v1/technologies',
+    admin_technologies_store: 'POST /v1/technologies',
+    admin_technologies_update: 'PATCH /v1/technologies/{technology}',
+    admin_media_store: 'POST /v1/media',
   };
 
   for (const [name, route] of Object.entries(expected)) {
@@ -86,7 +90,10 @@ test('over stdio an upload takes a local path, and the JSON body becomes optiona
   assert.deepEqual(local.operation.files, ['file']);
   assert.equal(local.inputSchema.properties.file_path.type, 'string');
   assert.ok(local.inputSchema.properties.body.properties.url);
+  assert.ok(local.inputSchema.properties.body.properties.for);
   assert.equal(local.inputSchema.required, undefined);
+  // `url` is the JSON alternative; beside a file it must not be demanded.
+  assert.equal(local.inputSchema.properties.body.required, undefined);
 });
 
 test('over HTTP there is no local path to offer: only the URL', () => {