feat: chat — suivi du document, chat général en onglet sidebar, onglets au-dessus du filtre #190

- **A — Suivi du document** : l'en-tête du panneau chat affiche le document
  ciblé (titre + chemin) et `followFileChat()` appelé par `renderFile()`
  re-cible le panneau ouvert à chaque changement de document.
- **B — Chat général** : onglet « Chat » (dernier) dans la sidebar,
  conversation centrale stockée dans le store #169 via les sentinelles
  `__global__/general` (`GET/POST /api/chat`) ; pastille de messages non
  lus sur l'onglet ; pièces jointes image/vidéo (`POST /api/chat/upload` :
  allow-list d'extensions, 25 MB, nom UUID ; `GET /api/chat/attachment/{name}`
  résolu contre l'allow-list) ; URL cliquables au rendu ; date/heure d'envoi.
- **C — Ordre des onglets** : la barre de filtre passe sous les onglets et
  sert de recherche dans le chat (texte + auteur) quand l'onglet Chat est
  actif (`switchSidebarTab` + `routeFilter`).
- Transport : broadcast SSE `chat_message` réutilisé (`vault __global__`
  route vers la sidebar, sinon le panneau fichier) — pas de 2ᵉ WebSocket.
- i18n FR/EN (6 clés), CSS bloc #190, `initSidebarChat()` dans l'orchestrateur.
- Tests : pytest 27 chat (12 nouveaux) ; JSDOM `filechat.test.mjs` 11 (5
  nouveaux) ; suite 1655 passed, ruff/mypy 0, validate-imports 42 modules.
- Docs : CHANGELOG [Unreleased], ROADMAP #190 → index, fiche
  `file-chat-169.md` §#190, guide « Chat général », journal des interventions.

backend/file_chat.py

@@ -1,10 +1,15 @@
-# backend/file_chat.py — historique de discussion par fichier (#169)
-"""Per-file chat history persisted under ``data/chats/``.
+# backend/file_chat.py — historique de discussion (#169, #190)
+"""Chat history persisted under ``data/chats/``.
 
 One JSON document per ``(vault, path)`` pair, keyed by a SHA-256 of both so
 the filename never carries user-controlled path separators. Writes are
 atomic (tmp + move) and the message list is capped at
 :data:`MAX_MESSAGES` to bound growth.
+
+#190 adds the **general chat**: the same store addressed with the reserved
+sentinels (:data:`GLOBAL_VAULT` / :data:`GLOBAL_PATH`), so no second
+implementation. Messages may carry an ``attachment`` (image/video/url)
+uploaded under ``data/chat_uploads/``.
 """
 
 from __future__ import annotations
@@ -24,6 +29,18 @@ CHAT_DIR = Path("data/chats")
 MAX_MESSAGES = 500  # retention ceiling per file (oldest dropped first)
 MAX_TEXT = 4000  # characters per message
 
+# #190 — general (non file-bound) conversation, stored like any other one.
+GLOBAL_VAULT = "__global__"
+GLOBAL_PATH = "general"
+
+# #190 — attachments (image/video) live outside the vaults.
+UPLOAD_DIR = Path("data/chat_uploads")
+MAX_UPLOAD_BYTES = 25 * 1024 * 1024  # 25 MB per attachment
+ALLOWED_ATTACH_EXT = {
+    ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg",
+    ".mp4", ".webm", ".ogg", ".mov", ".m4v",
+}
+
 
 def _chat_file(vault: str, path: str) -> Path:
     """Return the chat file for *(vault, path)* (hashed, traversal-proof)."""
@@ -62,19 +79,38 @@ def get_messages(vault: str, path: str) -> list[dict[str, Any]]:
     return list(_read(vault, path).get("messages", []))
 
 
-def add_message(vault: str, path: str, user: str, text: str) -> dict[str, Any]:
+def add_message(
+    vault: str,
+    path: str,
+    user: str,
+    text: str,
+    attachment: dict[str, Any] | None = None,
+) -> dict[str, Any]:
     """Append a message and persist it. Returns the stored message.
 
     The list is capped at :data:`MAX_MESSAGES` (oldest dropped first).
+    *attachment* (#190) is ``{name, url, mime, kind}`` for image/video/url.
     """
     text = (text or "").strip()[:MAX_TEXT]
-    msg = {
+    msg: dict[str, Any] = {
         "id": uuid.uuid4().hex[:12],
         "user": user or "anonyme",
         "text": text,
         "ts": time.time(),
     }
+    if attachment:
+        msg["attachment"] = attachment
     doc = _read(vault, path)
+    return _append(vault, path, doc, msg)
+
+
+def _append(
+    vault: str,
+    path: str,
+    doc: dict[str, Any],
+    msg: dict[str, Any],
+) -> dict[str, Any]:
+    """Cap, persist and return *msg* (shared by file and global chats)."""
     messages = list(doc.get("messages", []))
     messages.append(msg)
     if len(messages) > MAX_MESSAGES:
@@ -82,3 +118,74 @@ def add_message(vault: str, path: str, user: str, text: str) -> dict[str, Any]:
     doc["messages"] = messages
     _write(_chat_file(vault, path), doc)
     return msg
+
+
+# --- #190 : chat général (conversation centrale, hors fichier) -------------
+
+def get_global_messages() -> list[dict[str, Any]]:
+    """Return the general-chat history (chronological)."""
+    return get_messages(GLOBAL_VAULT, GLOBAL_PATH)
+
+
+def add_global_message(
+    user: str,
+    text: str,
+    attachment: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Append a message to the general chat. Returns the stored message."""
+    return add_message(GLOBAL_VAULT, GLOBAL_PATH, user, text, attachment)
+
+
+def save_attachment(filename: str, data: bytes) -> dict[str, Any]:
+    """Persist an uploaded attachment under :data:`UPLOAD_DIR`.
+
+    Returns ``{name, url, mime, kind}``. The stored name is a fresh UUID
+    (never the client name), the extension must be in
+    :data:`ALLOWED_ATTACH_EXT` and the size is capped at
+    :data:`MAX_UPLOAD_BYTES`.
+
+    Raises:
+        ValueError: extension refused, empty file or size exceeded.
+    """
+    ext = Path(filename or "").suffix.lower()
+    if ext not in ALLOWED_ATTACH_EXT:
+        raise ValueError(f"extension refusée : {ext or '(aucune)'}")
+    if not data:
+        raise ValueError("fichier vide")
+    if len(data) > MAX_UPLOAD_BYTES:
+        raise ValueError(f"fichier trop lourd (max {MAX_UPLOAD_BYTES // (1024 * 1024)} MB)")
+    UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
+    name = f"{uuid.uuid4().hex}{ext}"
+    (UPLOAD_DIR / name).write_bytes(data)
+    kind = "video" if ext in {".mp4", ".webm", ".ogg", ".mov", ".m4v"} else "image"
+    return {
+        "name": name,
+        "url": f"/api/chat/attachment/{name}",
+        "mime": _MIME_BY_EXT.get(ext, "application/octet-stream"),
+        "kind": kind,
+    }
+
+
+def attachment_path(name: str) -> Path | None:
+    """Resolve an attachment by its stored name (UUID+ext only, no traversal)."""
+    p = Path(name)
+    if p.name != name or p.suffix.lower() not in ALLOWED_ATTACH_EXT:
+        return None
+    file = UPLOAD_DIR / p.name
+    return file if file.exists() else None
+
+
+# Extension → MIME (literals only; ``mimetypes`` guesses poorly for a few).
+_MIME_BY_EXT = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".ogg": "video/ogg",
+    ".mov": "video/quicktime",
+    ".m4v": "video/x-m4v",
+}

backend/routers/file_chat.py

@@ -1,11 +1,15 @@
-# backend/routers/file_chat.py — chat par fichier (#169)
-"""Per-file chat endpoints: history read + message post with SSE fan-out.
+# backend/routers/file_chat.py — chat (#169, #190)
+"""Chat endpoints: history read + message post with SSE fan-out.
 
-GET/POST ``/api/file/{vault_name}/chat`` — auth + vault access + path
-traversal check (``resolve_safe_path`` raises ``ServiceError`` mapped by
-the app-level handler). A posted message is broadcast on the existing
-SSE channel (``chat_message``) so every connected client updates live
-without a second WebSocket.
+- ``GET/POST /api/file/{vault_name}/chat`` — per-file chat: auth + vault
+  access + path traversal check (``resolve_safe_path`` raises
+  ``ServiceError`` mapped by the app-level handler).
+- ``GET/POST /api/chat`` — the **general chat** (#190), not bound to a file.
+- ``POST /api/chat/upload`` / ``GET /api/chat/attachment/{name}`` (#190):
+  image/video attachments (extension allow-list, size cap, UUID name).
+
+Every post is broadcast on the existing SSE channel (``chat_message``) so
+all connected clients update live without a second WebSocket.
 """
 
 from __future__ import annotations
@@ -13,7 +17,8 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
-from fastapi import APIRouter, Body, Depends, HTTPException
+from fastapi import APIRouter, Body, Depends, File, HTTPException, UploadFile
+from fastapi.responses import FileResponse
 
 from backend import file_chat as _store
 from backend.auth.middleware import check_vault_access, require_auth
@@ -63,3 +68,71 @@ async def api_file_chat_post(
     msg = _store.add_message(vault_name, path, current_user.get("username", ""), text)
     await sse_manager.broadcast("chat_message", {"vault": vault_name, "path": path, "message": msg})
     return {"message": msg, "status": "ok"}
+
+
+# --- #190 : chat général ----------------------------------------------------
+
+def _attachment(body: dict[str, Any]) -> dict[str, Any] | None:
+    """Validate the optional ``attachment`` object sent by the client."""
+    raw = body.get("attachment")
+    if not raw or not isinstance(raw, dict):
+        return None
+    name = str(raw.get("name") or "")
+    # Only an already-uploaded file (or an http(s) URL) may travel along.
+    if not _store.attachment_path(name) and not str(raw.get("url", "")).startswith(("http://", "https://", "/api/")):
+        raise HTTPException(400, "attachment inconnu")
+    return {
+        "name": name,
+        "url": str(raw.get("url") or ""),
+        "mime": str(raw.get("mime") or ""),
+        "kind": str(raw.get("kind") or "file"),
+    }
+
+
+@router.get("/api/chat", response_model=ChatHistoryResponse)
+async def api_chat_history(current_user: dict[str, Any] = Depends(require_auth)):
+    """Return the general chat history (#190, chronological)."""
+    return {"messages": _store.get_global_messages()}
+
+
+@router.post("/api/chat", response_model=ChatMessageResponse)
+async def api_chat_post(
+    body: dict[str, Any] = Body(...),
+    current_user: dict[str, Any] = Depends(require_auth),
+):
+    """Post to the general chat and broadcast it on SSE (``chat_message``)."""
+    text = str(body.get("text") or "")
+    if not text.strip():
+        raise HTTPException(400, "text is required")
+    msg = _store.add_global_message(
+        current_user.get("username", ""), text, _attachment(body)
+    )
+    await sse_manager.broadcast(
+        "chat_message",
+        {"vault": _store.GLOBAL_VAULT, "path": _store.GLOBAL_PATH, "message": msg},
+    )
+    return {"message": msg, "status": "ok"}
+
+
+@router.post("/api/chat/upload")
+async def api_chat_upload(
+    file: UploadFile = File(...),
+    current_user: dict[str, Any] = Depends(require_auth),
+):
+    """Store an image/video attachment (#190). Returns ``{attachment}``."""
+    data = await file.read()
+    try:
+        info = _store.save_attachment(file.filename or "", data)
+    except ValueError as e:
+        raise HTTPException(400, str(e)) from e
+    return {"attachment": info}
+
+
+@router.get("/api/chat/attachment/{name}")
+async def api_chat_attachment(name: str, current_user: dict[str, Any] = Depends(require_auth)):
+    """Serve an uploaded attachment (name validated against the allow-list)."""
+    path = _store.attachment_path(name)
+    if not path:
+        raise HTTPException(404, "Attachment not found")
+    info = _store._MIME_BY_EXT.get(path.suffix.lower(), "application/octet-stream")
+    return FileResponse(str(path), media_type=info)

backend/schemas.py

@@ -152,12 +152,16 @@ class BacklinksResponse(BaseModel):
 
 
 class ChatMessageItem(BaseModel):
-    """One chat message (``GET/POST /api/file/{vault}/chat``)."""
+    """One chat message (``GET/POST /api/file/{vault}/chat`` + ``/api/chat``)."""
 
     id: str = Field(description="Message id")
     user: str = Field(description="Author username")
     text: str = Field(description="Message body")
     ts: float = Field(description="Unix timestamp")
+    attachment: dict[str, Any] | None = Field(
+        default=None,
+        description="Optional image/video/url attachment {name, url, mime, kind}",
+    )
 
 
 class ChatHistoryResponse(BaseModel):