feat: vault DIR — exclusions par vault et lecture seule déclarable (vault Spark)

backend/services/files.py

@@ -7,13 +7,30 @@ from typing import Any
 
 from backend.services.errors import ServiceError
 from backend.services.paths import resolve_safe_path
-from backend.services.vaults import get_vault_root
+from backend.services.vaults import chemin_exclu, get_vault_root
 
 logger = logging.getLogger("obsigate.services.files")
 
 
+def _ensure_not_excluded(vault_name: str, path: str) -> None:
+    """Raise ``not_found`` (404) when *path* is excluded in this vault.
+
+    Un chemin exclu (DIR_N_IGNORED_DIRS / DIR_N_IGNORED_PATHS) est
+    indiscernable d'un chemin inexistant : même erreur, aucun détail
+    sur la règle qui l'a caché.
+    """
+    if chemin_exclu(vault_name, path):
+        raise ServiceError(
+            f"File not found: {path}",
+            code="not_found",
+            status=404,
+            details={"vault": vault_name, "path": path},
+        )
+
+
 def read_raw_file(vault_name: str, path: str) -> dict[str, Any]:
     """Return the raw text content of a vault file (no redaction)."""
+    _ensure_not_excluded(vault_name, path)
     root = get_vault_root(vault_name)
     file_path = resolve_safe_path(root, path)
 
@@ -56,6 +73,7 @@ def read_file_text(
         ServiceError: ``not_found`` (404), ``file_too_large`` (413) or a read
             error (500).
     """
+    _ensure_not_excluded(vault_name, path)
     root = get_vault_root(vault_name)
     target = resolve_safe_path(root, path)