feat: vault DIR — exclusions par vault et lecture seule déclarable (vault Spark)

backend/routers/files_read.py

@@ -44,7 +44,7 @@ from backend.schemas import (
 from backend.services.files import read_raw_file
 from backend.services.mutations import file_revision
 from backend.services.paths import resolve_safe_path
-from backend.services.vaults import browse_directory, get_vault_root
+from backend.services.vaults import browse_directory, chemin_exclu, get_vault_root
 from backend.share import list_shares
 
 logger = logging.getLogger("obsigate")
@@ -171,6 +171,9 @@ async def api_file_download(vault_name: str, path: str = Query(..., description=
     if not vault_data:
         raise HTTPException(status_code=404, detail=f"Vault '{vault_name}' not found")
 
+    if chemin_exclu(vault_name, path):
+        raise HTTPException(status_code=404, detail=f"File not found: {path}")
+
     vault_root = Path(vault_data["path"])
     file_path = resolve_safe_path(vault_root, path)
 
@@ -366,6 +369,9 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
     if not vault_data:
         raise HTTPException(status_code=404, detail=f"Vault '{vault_name}' not found")
 
+    if chemin_exclu(vault_name, path):
+        raise HTTPException(status_code=404, detail=f"File not found: {path}")
+
     vault_root = Path(vault_data["path"])
     file_path = resolve_safe_path(vault_root, path)