fix: A21 phase 1 — 352 routes async sans await → threadpool (v7.8.0)

- Conversion `async def` → `def` de TOUTES les routes dont le corps ne contient
  ni `await`, ni `async with`, ni `async for`, ni `asyncio` (scan automatique
  corps par corps sur app/ : 352 converties, 0 dangereuses, vérifié
  `asyncio`/`run_coroutine`/`.result()` absents). FastAPI exécute ces handlers
  dans son threadpool → tout leur SQLite (`get_conn()` + `conn.execute`) quitte
  l'event loop, sans changer une ligne de logique.
- Répartition : api_v2 60, dashboard 40, collections 25, board 23,
  workspace 19, wiki 17, permissions 14, api 14, main.py 6, + 35 fichiers.
- Les 4 routers prioritaires de l'audit sont couverts par ce lot :
  api_v2 60 + dashboard 40 + collections 25 + board 23 = 148 conversions
  (le reste de leurs routes attend la phase 2 : elles ont de vrais `await`).
- Reste (phase 2) : les 311 routes avec de vrais `await` → enrouler les blocs
  DB dans `await anyio.to_thread.run_sync(...)` ; pas de wrapper partagé livré
  (rien ne l'appellerait — YAGNI jusqu'au premier usage).

suite **1037/1037** (233 s) · `ruff check app tests` OK · docs à jour

app/main.py

@@ -185,7 +185,7 @@ async def lifespan(_app: FastAPI):
 
 app = FastAPI(
     title="FlowDeck",
-    version="7.7.0",
+    version="7.8.0",
     docs_url="/docs",
     redoc_url="/redoc",
     lifespan=lifespan,
@@ -265,14 +265,14 @@ app.mount("/static", StaticFiles(directory="static"), name="static")
 
 
 @app.get("/manifest.json")
-async def pwa_manifest():
+def pwa_manifest():
     """Serve the static web manifest from disk (same URL as before v6.0.0)."""
     from fastapi.responses import FileResponse
     return FileResponse("static/manifest.json", media_type="application/manifest+json")
 
 
 @app.get("/sw.js")
-async def service_worker():
+def service_worker():
     """Serve the PWA service worker at top-level scope (/)."""
     from fastapi.responses import FileResponse
     return FileResponse("static/sw.js", media_type="application/javascript")
@@ -282,7 +282,7 @@ async def service_worker():
 
 
 @app.get("/api/csrf-token")
-async def csrf_token_endpoint(request: Request):
+def csrf_token_endpoint(request: Request):
     """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
     import secrets
 
@@ -297,7 +297,7 @@ async def csrf_token_endpoint(request: Request):
 
 
 @app.get("/api/pages")
-async def api_pages_alias(request: Request):
+def api_pages_alias(request: Request):
     """Alias /api/pages → /board/api/pages for API path consistency."""
     from fastapi.responses import RedirectResponse
     qs = str(request.url.query)
@@ -306,7 +306,7 @@ async def api_pages_alias(request: Request):
 
 
 @app.post("/api/pages")
-async def api_pages_post_alias(request: Request):
+def api_pages_post_alias(request: Request):
     """Alias POST /api/pages → /board/api/pages for API path consistency."""
     from fastapi.responses import RedirectResponse
     return RedirectResponse(url="/board/api/pages", status_code=307)
@@ -341,7 +341,7 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 
 
 @app.exception_handler(_StarHTTPException)
-async def http_exception_handler(request: Request, exc: _StarHTTPException):
+def http_exception_handler(request: Request, exc: _StarHTTPException):
     """Unified handler: RFC7807 for /api/v2, JSON for other /api, redirect for HTML.
 
     Registered on Starlette's HTTPException (the base class) so it catches both