feat(api,ai): #72 OpenAPI 3.1 enrichie + fiabilisation de l'outil AI UI

API (#72):
- backend/openapi_docs.py: 18 tags documentes, assignation auto par prefixe,
  securite bearerAuth/cookieAuth, erreurs 401/403/404/422/500, exemples,
  page /api autonome (liens /docs, /redoc, /openapi.json)
- backend/schemas.py: response_model Pydantic pour ~35 endpoints sans modele
- main.py: FastAPI enrichi + override app.openapi; routes /api et /api/
- ai_routes/bookslm_routes: response_model + doc SSE
- frontend: entree 'API' du menu (i18n FR/EN)
- tests/test_openapi.py (58 tests)

AI UI:
- BooksLM: requetes authentifiees (AuthManager), parsing SSE {token}/error,
  message utilisateur correct (plus le placeholder vide), barre de contexte
- AI Editor: Ctrl/Cmd+J lie une seule fois, libelles i18n, modale de
  reecriture accessible a la place de window.prompt()
- tests/frontend/ai.test.mjs (7 tests) + CI

frontend/js/bookslm.js

@@ -2,6 +2,7 @@
 import { t } from './i18n.js';
 import { buildAIPickerUI } from './ai.js';
 import { safeCreateIcons } from './utils.js';
+import { api, AuthManager } from './auth.js';
 
 class BooksLM {
   constructor() {
@@ -58,15 +59,14 @@ class BooksLM {
     });
     this._isOpen = true;
 
-    // Load context
+    // Load context (authenticated — `api` injects the bearer token and
+    // transparently refreshes it once on 401).
     try {
-      const resp = await fetch('/api/ai/bookslm/context', {
+      const data = await api('/api/ai/bookslm/context', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ vault, directory })
+        body: JSON.stringify({ vault, directory }),
       });
-      if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
-      const data = await resp.json();
       this._contextFiles = data.files || [];
       this._updateStatus(data);
       this._showSuggestions();
@@ -241,10 +241,11 @@ class BooksLM {
     if (data && data.files) {
       const count = data.files.length;
       const chars = data.total_chars || 0;
-      const pct = Math.min(100, Math.round((chars / 100000) * 100));
+      const maxChars = data.max_total_chars || 200000;
+      const pct = Math.min(100, Math.round((chars / maxChars) * 100));
       status.innerHTML = `
         <span>${t('bookslm.files_indexed', { count })}, ${t('bookslm.chars_loaded', { chars: Math.round(chars / 1000) + 'K' })}</span>
-        <div class="bookslm-context-bar"><div class="bookslm-context-fill" style="width:${pct}%"></div></div>
+        <div class="bookslm-context-bar" role="progressbar" aria-valuenow="${pct}" aria-valuemin="0" aria-valuemax="100"><div class="bookslm-context-fill" style="width:${pct}%"></div></div>
       `;
     } else if (this._isLoading) {
       status.textContent = '⏳ ...';
@@ -330,6 +331,12 @@ class BooksLM {
     const sugEl = this._panel.querySelector('.bookslm-suggestions');
     if (sugEl) sugEl.innerHTML = '';
 
+    // Snapshot the prior turns BEFORE appending the new user message so the
+    // backend receives the correct `message` + `conversation_history` split.
+    const history = this._messages
+      .filter((m) => m.content && m.content.trim())
+      .map((m) => ({ role: m.role, content: m.content }));
+
     // Add user message
     this._messages.push({ role: 'user', content: text });
     this._renderMessages();
@@ -356,33 +363,70 @@ class BooksLM {
         model = picker.model || null;
       } catch { /* */ }
 
-      const resp = await fetch('/api/ai/bookslm/chat', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          vault: this._vault,
-          directory: this._directory,
-          // The backend expects `message` + `conversation_history`,
-          // not a generic `messages` array. Convert before sending.
-          message: this._messages.length
-            ? this._messages[this._messages.length - 1].content
-            : '',
-          conversation_history: this._messages
-            .slice(0, -1)
-            .filter((m) => m.content && m.content.trim())
-            .map((m) => ({ role: m.role, content: m.content })),
-          context_files: this._contextFiles.map((f) => f.path || f),
-          provider,
-          model,
-        }),
-        signal: this._abortCtrl.signal
-      });
+      const payload = {
+        vault: this._vault,
+        directory: this._directory,
+        message: text,
+        conversation_history: history,
+        context_files: this._contextFiles.map((f) => f.path || f),
+        provider,
+        model,
+      };
 
-      if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+      // Authenticated streaming request (raw fetch so we can read the SSE
+      // body; `api()` would consume the JSON response instead).
+      const doFetch = () => {
+        const headers = { 'Content-Type': 'application/json', ...(AuthManager.getAuthHeaders() || {}) };
+        return fetch('/api/ai/bookslm/chat', {
+          method: 'POST',
+          headers,
+          credentials: 'include',
+          body: JSON.stringify(payload),
+          signal: this._abortCtrl.signal,
+        });
+      };
+      let resp = await doFetch();
+      if (resp.status === 401 && AuthManager._authEnabled) {
+        await AuthManager.refreshAccessToken();
+        resp = await doFetch();
+      }
+      if (!resp.ok) {
+        let detail = `HTTP ${resp.status}`;
+        try { detail = (await resp.json()).detail || detail; } catch { /* */ }
+        throw new Error(detail);
+      }
 
       const reader = resp.body.getReader();
       const decoder = new TextDecoder();
       let buffer = '';
+      let currentEvent = 'message';
+
+      const handleLine = (line) => {
+        if (line.startsWith('event:')) {
+          currentEvent = line.slice(6).trim();
+          return;
+        }
+        if (!line.startsWith('data:')) return;
+        const raw = line.slice(5).trim();
+        if (!raw || raw === '[DONE]') return;
+        let data;
+        try {
+          data = JSON.parse(raw);
+        } catch {
+          assistantMsg.content += raw;
+          return;
+        }
+        if (currentEvent === 'error' || data.error) {
+          const msg = data.error || t('bookslm.error');
+          assistantMsg.content += (assistantMsg.content ? '\n\n' : '') + '⚠ ' + msg;
+          return;
+        }
+        // The backend streams `{token: "..."}`; accept `content` too for
+        // forward compatibility.
+        const chunk = data.token || data.content || '';
+        if (chunk) assistantMsg.content += chunk;
+        if (data.sources) assistantMsg.sources = data.sources;
+      };
 
       while (true) {
         const { done, value } = await reader.read();
@@ -392,25 +436,10 @@ class BooksLM {
         const lines = buffer.split('\n');
         buffer = lines.pop() || '';
 
-        for (const line of lines) {
-          if (!line.startsWith('data: ')) continue;
-          const payload = line.slice(6);
-          if (payload === '[DONE]') continue;
-          try {
-            const data = JSON.parse(payload);
-            if (data.content) {
-              assistantMsg.content += data.content;
-            }
-            if (data.sources) {
-              assistantMsg.sources = data.sources;
-            }
-          } catch {
-            // Raw text token
-            assistantMsg.content += payload;
-          }
-          this._renderMessages();
-        }
+        for (const line of lines) handleLine(line);
+        this._renderMessages();
       }
+      if (buffer) handleLine(buffer);
 
       // Extract sources from context files if mentioned
       if (!assistantMsg.sources.length) {