Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Api/MediaUploadTest.php

@@ -240,8 +240,7 @@ class MediaUploadTest extends TestCase
     {
         return [
             'text renamed to .jpg' => ['photo.jpg', 'not an image at all'],
-            // Served from this domain, an SVG is a document that can run script.
-            'an SVG' => ['logo.svg', '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'],
+            'HTML renamed to .svg' => ['logo.svg', '<html><body>not a vector</body></html>'],
         ];
     }
 
@@ -260,6 +259,73 @@ class MediaUploadTest extends TestCase
         $this->assertDatabaseCount('media', 0);
     }
 
+    #[Test]
+    public function an_svg_is_stored_with_whatever_could_run_taken_out(): void
+    {
+        $this->actingWithRole('editor');
+
+        $svg = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10" onload="alert(1)">'
+            .'<script>alert(2)</script>'
+            .'<a href="javascript:alert(3)"><rect width="10" height="10" fill="#21759B"/></a>'
+            .'<image href="https://tracker.example.test/pixel.png"/>'
+            .'</svg>';
+
+        $response = $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->createWithContent('logo.svg', $svg),
+        ], ['Accept' => 'application/json'])
+            ->assertCreated()
+            ->assertJsonPath('data.mime', 'image/svg+xml')
+            ->assertJsonPath('data.width', null);
+
+        $stored = Storage::disk((string) config('media.disk'))->get($response->json('data.path'));
+
+        $this->assertStringEndsWith('.svg', $response->json('data.path'));
+        $this->assertStringContainsString('#21759B', $stored);
+
+        foreach (['<script', 'onload', 'javascript:', 'tracker.example.test'] as $removed) {
+            $this->assertStringNotContainsString($removed, $stored);
+        }
+    }
+
+    #[Test]
+    public function an_upload_for_a_technology_lands_where_the_panel_puts_their_logos(): void
+    {
+        $this->actingWithRole('editor');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => 'technologies',
+        ], ['Accept' => 'application/json'])
+            ->assertCreated()
+            ->assertJsonPath('data.path', fn (string $path) => str_starts_with($path, 'technologies/'));
+    }
+
+    #[Test]
+    public function it_takes_the_permission_of_the_record_it_is_for(): void
+    {
+        // A writer authors pages but only reads technologies.
+        $this->actingWithRole('writer');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => 'technologies',
+        ], ['Accept' => 'application/json'])
+            ->assertForbidden();
+    }
+
+    #[Test]
+    public function it_only_knows_the_records_it_is_told_about(): void
+    {
+        $this->actingWithRole('super_admin');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => '../../etc',
+        ], ['Accept' => 'application/json'])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('for');
+    }
+
     #[Test]
     public function it_wants_exactly_one_source(): void
     {