feat: #152 viewer XLSX — affichage multi-feuilles, édition des cellules et téléchargement des .xlsx

- backend/xlsx_reader.py : rend openpyxl en tableaux HTML (plafond 500x40 par feuille)
- PUT /api/file/{vault}/xlsx/save : service edit_xlsx_cells (backup avant écriture, refs A1 validées)
- frontend : renderXlsxViewer (onglets, contenteditable, sauvegarde par feuille)
- docs : CHANGELOG [Unreleased], Roadmap index #152, archive, README FR/EN, exemple OpenAPI

backend/services/mutations.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import logging
 import os
+import re
 import shutil
 from collections.abc import Callable
 from pathlib import Path
@@ -223,6 +224,102 @@ def edit_file(
     return {"success": True, "vault": vault_name, "path": rel_path, "size": len(content)}
 
 
+# Cell reference like "A1" / "AB42" (Excel A1 notation, up to 3 letters / 8 digits).
+_XLSX_CELL_RE = re.compile(r"^[A-Z]{1,3}[1-9][0-9]{0,7}$")
+# ponytail: bare int/float coercion mirrors what Excel does when you type a
+# number; dates/booleans stay text (upgrade path: parse locale dates too).
+_XLSX_INT_RE = re.compile(r"^[+-]?\d+$")
+_XLSX_FLOAT_RE = re.compile(r"^[+-]?(?:\d+\.\d*|\.\d+)$")
+
+
+def _coerce_xlsx_value(value: Any) -> Any:
+    """Turn the string sent by the cell editor back into a scalar."""
+    if not isinstance(value, str):
+        return value
+    text = value.strip()
+    if text == "":
+        return None
+    if _XLSX_INT_RE.match(text):
+        return int(text)
+    if _XLSX_FLOAT_RE.match(text):
+        return float(text)
+    return value
+
+
+def edit_xlsx_cells(
+    vault_name: str,
+    path: str,
+    sheet: str,
+    cells: dict[str, Any],
+    *,
+    backup: bool = True,
+) -> dict[str, Any]:
+    """Apply a batch of cell edits to an ``.xlsx`` workbook.
+
+    Raises:
+        ServiceError: ``not_found`` (404), ``read_only`` (403) or
+        ``invalid`` (400) for a bad sheet, cell reference or value.
+
+    ponytail: openpyxl round-trips values/formulas/styles but drops charts,
+    images and pivot tables; use the SheetJS path if a workbook needs those.
+    """
+    root = get_vault_root(vault_name)
+    _ensure_writable(root)
+    file_path = resolve_safe_path(root, path)
+
+    if not file_path.exists() or not file_path.is_file():
+        raise ServiceError(
+            f"File not found: {path}",
+            code="not_found",
+            status=404,
+            details={"vault": vault_name, "path": path},
+        )
+    if file_path.suffix.lower() != ".xlsx":
+        raise ServiceError(
+            f"Not an .xlsx file: {path}", code="invalid", status=400
+        )
+    if not cells:
+        raise ServiceError("No cells to update", code="invalid", status=400)
+    for ref in cells:
+        if not isinstance(ref, str) or not _XLSX_CELL_RE.match(ref):
+            raise ServiceError(
+                f"Invalid cell reference: {ref!r}", code="invalid", status=400
+            )
+
+    from openpyxl import load_workbook
+
+    try:
+        wb = load_workbook(file_path)
+    except Exception as exc:
+        raise ServiceError(
+            f"Cannot open workbook: {exc}", code="invalid", status=400
+        ) from exc
+    if sheet not in wb.sheetnames:
+        raise ServiceError(
+            f"Unknown sheet: {sheet}",
+            code="invalid",
+            status=400,
+            details={"sheets": wb.sheetnames},
+        )
+
+    rel_path = _rel(root, file_path)
+    if backup:
+        create_backup(file_path, vault_name, rel_path)
+
+    ws = wb[sheet]
+    for ref, value in cells.items():
+        ws[ref].value = _coerce_xlsx_value(value)
+    wb.save(file_path)
+
+    logger.info(f"XLSX cells saved: {vault_name}/{rel_path} [{sheet}] +{len(cells)}")
+    return {
+        "success": True,
+        "vault": vault_name,
+        "path": rel_path,
+        "size": len(cells),
+    }
+
+
 def append_to_file(
     vault_name: str,
     path: str,