fix: side peek des bases repasse en vanilla JS + largeur 1100px standard (v7.49.0)

- Panneau peek: les bindings Alpine (x-data absent du conteneur) rendaient
  loovverture et le redimensionnement inoperants -> cblage direct sur le document.
- Helper unique window.fdWirePeekResize (app.js): pointer capture, 300px-90vw,
  clic=fermer, largeur persiste fd_peek_width partagee entre les 4 peeks.
- database-table-container margin:0 (tableau colle a gauche, marge Library).
- .lib-container remonte dans app.css (trash etait pleine largeur), .db-index 1100px.
- ObsiGate verifie sans code: creation .xlsx OK (openpyxl, #186).

app/routers/board/synced.py

@@ -16,23 +16,41 @@ router = APIRouter(tags=["board"], prefix="/board")
 
 
 
-# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════
-# These routes MUST be registered before the catch-all /{owner}/{repo} below.
+# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════# These routes MUST be registered before the catch-all /{owner}/{repo} below.
+
+def _session_user(request: Request) -> dict:
+    """Session obligatoire — sans garde, un appel anonyme levait
+    ``AttributeError: 'NoneType' object has no attribute 'get'`` (HTTP 500)
+    au lieu d'un 401."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    return user
+
+
+def _assert_can_edit_block(request: Request, sb: dict) -> None:
+    """Seul l'auteur du bloc (ou un admin global) peut le modifier/supprimer."""
+    user = _session_user(request)
+    if sb.get("created_by") in (None, user.get("id")):
+        return
+    if user.get("is_admin"):
+        return
+    raise HTTPException(403, "Not the author of this synced block")
+
 
 @router.get("/api/synced-blocks")
 def list_synced_blocks_api(request: Request, workspace: str = Query(default="")):
     """List synced blocks for a workspace."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    user = _session_user(request)
     from app.services.synced_blocks import list_synced_blocks
     return {"synced_blocks": list_synced_blocks(workspace or user.get("login", ""))}
 
 
 
-
 @router.post("/api/synced-blocks")
 def create_synced_block_api(request: Request, body: dict = Body(...)):
     """Create a new synced block."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    user = _session_user(request)
     from app.services.synced_blocks import create_synced_block
     sid = create_synced_block(
         workspace=body.get("workspace", ""),
@@ -61,6 +79,7 @@ async def update_synced_block_api(request: Request, sid: int):
     sb = get_synced_block(sid)
     if not sb:
         raise HTTPException(404, "Synced block not found")
+    _assert_can_edit_block(request, sb)
     update_synced_block(sid, body.get("title", sb["title"]), body.get("content", []))
     # v6.5.0: rewrite every referencing page's stored content first (DB row
     # content pages included), THEN push the realtime update so open rooms
@@ -86,6 +105,7 @@ async def delete_synced_block_api(request: Request, sid: int):
     sb = get_synced_block(sid)
     if not sb:
         raise HTTPException(404, "Synced block not found")
+    _assert_can_edit_block(request, sb)
     # v6.5.0: collect referencing pages BEFORE the FK cascade wipes the
     # refs, rewrite their stored content (deleted state), then broadcast.
     pids = page_ids_for_synced(sid)
@@ -99,8 +119,9 @@ async def delete_synced_block_api(request: Request, sid: int):
 
 
 @router.get("/api/synced-blocks/{sid}")
-def get_synced_block_api(sid: int):
+def get_synced_block_api(request: Request, sid: int):
     """Get a synced block by id."""
+    _session_user(request)
     from app.services.synced_blocks import get_synced_block
     sb = get_synced_block(sid)
     if not sb: