TOC inside the docs

docs/OPEN_API.md

@@ -2,6 +2,26 @@
 
 Triage **real device crashes** vs **synthetic / bulk test traffic** when exposing upload or query APIs beyond the Android app. Builds on RBAC ([`examples/crash_reporter/backend/README.md`](../examples/crash_reporter/backend/README.md)).
 
+---
+
+## Table of contents
+
+<!-- toc -->
+- [Problems](#problems)
+- [Payload extension (ingest)](#payload-extension-ingest)
+- [Upload API (POST …/api/upload.php)](#upload-api-post-apiuploadphp)
+- [Console / query API (read)](#console-query-api-read)
+- [Classifying synthetic traffic (heuristics)](#classifying-synthetic-traffic-heuristics)
+- [Security](#security)
+- [Android](#android)
+- [Triage tags (implemented v1)](#triage-tags-implemented-v1)
+- [Implementation order](#implementation-order)
+<!-- /toc -->
+
+**Documentation index:** [README.md](README.md)
+
+---
+
 ## Problems
 
 - Load tests and CI may POST many similar JSON blobs → drown signal in the reports list.