feat: partage dirigé entre utilisateurs #196

- create_share/shared_with + validation des destinataires
- gate auth sur /s/{token} (+pdf, raw) : 404 opaque hors créateur/admin/destinataires
- GET /api/shares scopé (non-admin = créés + reçus), révocation créateur/admin
- UI : dialogue dirigé/public + destinataires, dashboard « partagé par X »
- i18n FR/EN, tests test_directed_shares.py (9), fiche feature

frontend/js/config.js

@@ -1656,10 +1656,14 @@ export async function openShareDialog(vault, path) {
       const expiresInfo = existingShare.expires_at
         ? `<p style="font-size:0.75rem;color:var(--text-muted)">Expire le ${new Date(existingShare.expires_at).toLocaleDateString("fr-FR")}</p>`
         : '<p style="font-size:0.75rem;color:var(--text-muted)">Sans expiration</p>';
+      const recipientsInfo = (existingShare.shared_with && existingShare.shared_with.length)
+        ? `<p style="font-size:0.75rem;color:var(--text-muted);margin-bottom:4px">${t('config.share_shared_with')} : ${escapeHtml(existingShare.shared_with.join(", "))}</p>`
+        : '';
       div.innerHTML = `
         <div class="share-dialog">
           <h3>📤 Document partagé</h3>
           <p style="font-size:0.85rem;color:var(--text-muted);margin-bottom:4px">${escapeHtml(vault)}/${escapeHtml(path)}</p>
+          ${recipientsInfo}
           ${expiresInfo}
           <p style="font-size:0.75rem;color:var(--text-muted);margin-bottom:8px">${existingShare.access_count} vue(s)</p>
           <input type="text" class="share-url-input" value="${url}" readonly>
@@ -1697,7 +1701,16 @@ export async function openShareDialog(vault, path) {
         <div class="share-dialog">
           <h3>📤 Partager ce document</h3>
           <p style="font-size:0.85rem;color:var(--text-muted);margin-bottom:12px">${escapeHtml(vault)}/${escapeHtml(path)}</p>
-          <p style="font-size:0.8rem;margin-bottom:8px">Ce lien sera accessible <strong>publiquement, sans authentification</strong>.</p>
+          <label style="font-size:0.8rem;display:flex;align-items:center;gap:8px;margin-bottom:8px">
+            <input type="radio" name="share-visibility" value="directed" checked>
+            ${t('config.share_directed')}
+          </label>
+          <input type="text" id="share-recipients" placeholder="${t('config.share_recipients_ph')}"
+                 style="width:100%;padding:6px 8px;margin-bottom:8px;border:1px solid var(--border);border-radius:4px;background:var(--bg-secondary);color:var(--text-primary);font-size:0.8rem">
+          <label style="font-size:0.8rem;display:flex;align-items:center;gap:8px;margin-bottom:8px">
+            <input type="radio" name="share-visibility" value="public">
+            ${t('config.share_public')}
+          </label>
           <label style="font-size:0.8rem;display:flex;align-items:center;gap:8px;margin-bottom:12px">
             Expiration :
             <select id="share-expiry" style="padding:4px 8px;border:1px solid var(--border);border-radius:4px;background:var(--bg-secondary);color:var(--text-primary);font-size:0.8rem">
@@ -1716,10 +1729,19 @@ export async function openShareDialog(vault, path) {
       div.querySelector(".share-create-btn").addEventListener("click", async () => {
         try {
           const expiry = document.getElementById("share-expiry")?.value;
+          const visibility = div.querySelector('input[name="share-visibility"]:checked')?.value || "directed";
+          const recipientsRaw = document.getElementById("share-recipients")?.value || "";
+          const recipients = visibility === "directed"
+            ? recipientsRaw.split(",").map(s => s.trim()).filter(Boolean)
+            : [];
+          if (visibility === "directed" && !recipients.length) {
+            showToast(t('config.share_need_recipient'), "error");
+            return;
+          }
           const share = await api(`/api/share/${encodeURIComponent(vault)}`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ path, expires_in_hours: expiry ? parseInt(expiry) : null }),
+            body: JSON.stringify({ path, expires_in_hours: expiry ? parseInt(expiry) : null, shared_with: recipients }),
           });
           existingShare = share;
           renderContent();