fix: corriger 33 erreurs mypy (CI bloquant) + lien README (BUG-003, BUG-004)

BUG-003: annotations de types, gardes None sur get_user(), PdfReader: Any et import PROVIDERS manquant (bug latent main.py:4523). Etape mypy du CI rendue bloquante (etait advisory).

BUG-004: lien README.md -> docs/CONTRIBUTING.md corrige (+ DELIVERY_WORKFLOW.md), arbre projet mis a jour, parite README.fr.md.

Verifie: mypy 0 erreur, ruff OK, pytest 728 passed / 5 skipped, frontend OK, liens md OK.

backend/auth/router.py

@@ -379,6 +379,8 @@ async def mfa_totp_enable(
     from .user_store import get_user, update_user
 
     user = get_user(current_user["username"])
+    if user is None:
+        raise HTTPException(404, "Utilisateur introuvable")
     secret = user.get("mfa_secret_pending")
     if not secret:
         raise HTTPException(400, "Aucune configuration MFA en cours. Commencez par /mfa/totp/setup")
@@ -415,6 +417,8 @@ async def mfa_totp_disable(
     from .user_store import get_user, update_user
 
     user = get_user(current_user["username"])
+    if user is None:
+        raise HTTPException(404, "Utilisateur introuvable")
     if not user.get("mfa_enabled"):
         raise HTTPException(400, "MFA non activé")
 
@@ -485,6 +489,8 @@ async def mfa_webauthn_register(
     from .webauthn_mfa import complete_registration
 
     user = get_user(current_user["username"])
+    if user is None:
+        raise HTTPException(404, "Utilisateur introuvable")
     try:
         record = complete_registration(current_user["username"], req.credential,
                                        label=req.label)
@@ -529,6 +535,8 @@ def user_credentials_response(creds: list[dict]) -> list[dict]:
 async def mfa_webauthn_list(current_user=Depends(require_auth)):
     from .user_store import get_user
     user = get_user(current_user["username"])
+    if user is None:
+        raise HTTPException(404, "Utilisateur introuvable")
     return {"credentials": user_credentials_response(user.get("webauthn_credentials", []))}
 
 
@@ -542,6 +550,8 @@ async def mfa_webauthn_remove(
     from .webauthn_mfa import clear_pending
 
     user = get_user(current_user["username"])
+    if user is None:
+        raise HTTPException(404, "Utilisateur introuvable")
     if not verify_password(req.password, user["password_hash"]):
         raise HTTPException(400, "Mot de passe incorrect")