feat: #152 viewer XLSX — affichage multi-feuilles, édition des cellules et téléchargement des .xlsx

- backend/xlsx_reader.py : rend openpyxl en tableaux HTML (plafond 500x40 par feuille)
- PUT /api/file/{vault}/xlsx/save : service edit_xlsx_cells (backup avant écriture, refs A1 validées)
- frontend : renderXlsxViewer (onglets, contenteditable, sauvegarde par feuille)
- docs : CHANGELOG [Unreleased], Roadmap index #152, archive, README FR/EN, exemple OpenAPI

backend/main.py

@@ -125,6 +125,9 @@ from backend.services.mutations import (
 from backend.services.mutations import (
     edit_file as service_edit_file,
 )
+from backend.services.mutations import (
+    edit_xlsx_cells as service_edit_xlsx_cells,
+)
 from backend.services.mutations import (
     move_path as service_move_path,
 )
@@ -211,6 +214,10 @@ class FileContentResponse(BaseModel):
     stream_url: str | None = Field(default=None, description="Byte-range streaming URL under /api/media (audio/video)")
     media_mime: str | None = Field(default=None, description="MIME type for audio/video files")
     is_csv: bool | None = Field(default=None, description="True for CSV files")
+    is_xlsx: bool | None = Field(default=None, description="True for Excel .xlsx files")
+    xlsx_sheets: list[dict[str, Any]] | None = Field(
+        default=None, description="Rendered xlsx sheets [{name, html}]"
+    )
     is_json: bool | None = Field(default=None, description="True for JSON files")
     is_excalidraw: bool | None = Field(default=None, description="True for Excalidraw diagram files")
     excalidraw_data: dict[str, Any] | None = Field(default=None, description="Excalidraw diagram data (elements, appState, files)")
@@ -1843,6 +1850,41 @@ async def api_file_save(
     return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": result["size"]}
 
 
+@app.put("/api/file/{vault_name}/xlsx/save", response_model=FileSaveResponse)
+async def api_file_xlsx_save(
+    vault_name: str,
+    path: str = Query(..., description="Relative path to the .xlsx file"),
+    body: dict = Body(..., description='{"sheet": str, "cells": {"A1": value}}'),
+    current_user=Depends(require_auth),
+):
+    """Apply cell edits to an .xlsx workbook.
+
+    Expects a JSON body with ``sheet`` and ``cells`` (A1 references to new
+    scalar values, max 500 per request). A backup is created before the
+    workbook is rewritten.
+    """
+    if not check_vault_access(vault_name, current_user):
+        raise HTTPException(status_code=403, detail=f"Accès refusé à la vault '{vault_name}'")
+
+    sheet = body.get("sheet")
+    cells = body.get("cells")
+    if not isinstance(sheet, str) or not sheet:
+        raise HTTPException(status_code=400, detail="Feuille manquante")
+    if not isinstance(cells, dict) or not cells or len(cells) > 500:
+        raise HTTPException(status_code=400, detail="Cellules invalides (1 à 500 par requête)")
+    for ref, value in cells.items():
+        if not isinstance(ref, str) or not isinstance(value, (str, int, float, bool, type(None))):
+            raise HTTPException(status_code=400, detail=f"Cellule invalide: {ref!r}")
+
+    result = service_edit_xlsx_cells(vault_name, path, sheet, cells)
+    log_file_save(
+        current_user["username"], vault_name, path,
+        sum(len(str(v)) for v in cells.values()),
+        current_user.get("_request_ip", "unknown"),
+    )
+    return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": result["size"]}
+
+
 @app.delete("/api/file/{vault_name}", response_model=FileDeleteResponse)
 async def api_file_delete(vault_name: str, path: str = Query(..., description="Relative path to file"), current_user=Depends(require_auth)):
     """Delete a file from the vault.
@@ -2439,6 +2481,32 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
             logger.error(f"PDF read error for {path}: {e}")
             raise HTTPException(status_code=500, detail=f"Error reading PDF: {e!s}")
 
+    # === Excel .xlsx: render sheets as HTML tables (binary, before read_text) ===
+    if ext == ".xlsx":
+        try:
+            from backend.xlsx_reader import render_sheets
+
+            sheets = render_sheets(file_path)
+            size = file_path.stat().st_size
+            return {
+                "vault": vault_name,
+                "path": path,
+                "title": file_path.name,
+                "tags": [],
+                "frontmatter": {},
+                "html": sheets[0]["html"] if sheets else "",
+                "raw_length": size,
+                "extension": ext,
+                "is_markdown": False,
+                "is_xlsx": True,
+                "xlsx_sheets": sheets,
+                "unsupported": False,
+                "size_bytes": size,
+            }
+        except Exception as e:
+            logger.error(f"XLSX read error for {path}: {e}")
+            raise HTTPException(status_code=500, detail=f"Error reading XLSX: {e!s}")
+
     # === Images: return as viewable image ===
     if is_image(ext):
         size = file_path.stat().st_size