feat(auth): v2.1.0 - MFA TOTP avec QR code, recovery codes

- backend/auth/mfa.py: TOTP (pyotp), recovery codes SHA-256
- Login flow: mfa_required → totp/verify → token (ou recovery)
- 6 nouveaux endpoints /api/auth/mfa/*
- Frontend: QR code setup, 6-digit auto-submit, recovery codes
- Settings: section Sécurité avec enable/disable MFA
- CSS: mfa-challenge, setup-card, recovery-list, badges
- i18n: 36 nouvelles clés EN/FR
- pyotp ajouté aux dépendances
- 30 tests (TOTP, recovery, API endpoints, login flow)
- 439 tests passent au total

backend/main.py

@@ -686,11 +686,14 @@ from backend.secret_redactor import redact_file_content
 # Lazy import: WeasyPrint PDF export (requires GTK, may not be available everywhere)
 try:
     from backend.pdf_export import build_pdf_html, generate_pdf
-except OSError:
+except Exception:  # pragma: no cover - WeasyPrint/GTK missing
     generate_pdf = None  # type: ignore[assignment]
     build_pdf_html = None  # type: ignore[assignment]
-    import logging
+
     logging.getLogger("obsigate").warning("PDF export unavailable (WeasyPrint/GTK not found)")
+
+# Multi-format export (HTML / MD bundle / ePub) — pure Python, no heavy deps.
+from backend.export import export_epub, export_html, export_md_bundle, ExportError  # noqa: E402
 from backend.ai_routes import router as ai_router
 from backend.saved_searches import delete_saved, get_saved, save_search
 from backend.share import (
@@ -1445,6 +1448,93 @@ async def api_file_pdf(vault_name: str, path: str = Query(..., description="Rela
     return Response(content=pdf_bytes, media_type="application/pdf", headers={"Content-Disposition": f'attachment; filename="{safe_name}.pdf"'})
 
 
+# ---------------------------------------------------------------------------
+# Multi-format export endpoints (HTML / Markdown bundle / ePub)
+# ---------------------------------------------------------------------------
+
+def _resolve_export_target(vault_name: str, path: str, current_user: dict) -> tuple[Path, Path]:
+    """Resolve a vault + relative path into (vault_root, absolute file path).
+
+    Enforces auth (vault access) and path traversal protection.
+    """
+    if not check_vault_access(vault_name, current_user):
+        raise HTTPException(status_code=403, detail=f"Accès refusé à la vault '{vault_name}'")
+    vault_data = get_vault_data(vault_name)
+    if not vault_data:
+        raise HTTPException(status_code=404, detail=f"Vault '{vault_name}' not found")
+    vault_root = Path(vault_data["path"])
+    target = _resolve_safe_path(vault_root, path)
+    return vault_root, target
+
+
+@app.get("/api/export/html")
+async def api_export_html(
+    vault: str = Query(..., description="Vault name"),
+    path: str = Query(..., description="Relative path to file"),
+    current_user=Depends(require_auth),
+):
+    """Export a markdown note as a standalone HTML file."""
+    try:
+        vault_root, target = _resolve_export_target(vault, path, current_user)
+        html_bytes = export_html(vault_root, target)
+    except ExportError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    record_open(current_user.get("username"), vault, path)
+    safe_name = _safe_export_name(target.stem)
+    return Response(
+        content=html_bytes,
+        media_type="text/html; charset=utf-8",
+        headers={"Content-Disposition": f'attachment; filename="{safe_name}.html"'},
+    )
+
+
+@app.get("/api/export/md-bundle")
+async def api_export_md_bundle(
+    vault: str = Query(..., description="Vault name"),
+    path: str = Query(..., description="Relative path to directory or file"),
+    current_user=Depends(require_auth),
+):
+    """Export a directory (or single file) of markdown as a ZIP bundle."""
+    try:
+        vault_root, target = _resolve_export_target(vault, path, current_user)
+        zip_bytes = export_md_bundle(vault_root, target)
+    except ExportError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    safe_name = _safe_export_name(target.name)
+    return Response(
+        content=zip_bytes,
+        media_type="application/zip",
+        headers={"Content-Disposition": f'attachment; filename="{safe_name}.zip"'},
+    )
+
+
+@app.get("/api/export/epub")
+async def api_export_epub(
+    vault: str = Query(..., description="Vault name"),
+    path: str = Query(..., description="Relative path to file"),
+    current_user=Depends(require_auth),
+):
+    """Export a markdown note as an ePub document."""
+    try:
+        vault_root, target = _resolve_export_target(vault, path, current_user)
+        epub_bytes = export_epub(vault_root, target)
+    except ExportError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    record_open(current_user.get("username"), vault, path)
+    safe_name = _safe_export_name(target.stem)
+    return Response(
+        content=epub_bytes,
+        media_type="application/epub+zip",
+        headers={"Content-Disposition": f'attachment; filename="{safe_name}.epub"'},
+    )
+
+
+def _safe_export_name(name: str) -> str:
+    """ASCII-safe, filename-safe download name (falls back to 'document')."""
+    cleaned = "".join(c for c in name if c.isascii() and (c.isalnum() or c in " _-.")).strip()
+    return cleaned or "document"
+
+
 @app.put("/api/file/{vault_name}/save", response_model=FileSaveResponse)
 async def api_file_save(
     vault_name: str,