fix: A21 phase 1 — 352 routes async sans await → threadpool (v7.8.0)

- Conversion `async def` → `def` de TOUTES les routes dont le corps ne contient
  ni `await`, ni `async with`, ni `async for`, ni `asyncio` (scan automatique
  corps par corps sur app/ : 352 converties, 0 dangereuses, vérifié
  `asyncio`/`run_coroutine`/`.result()` absents). FastAPI exécute ces handlers
  dans son threadpool → tout leur SQLite (`get_conn()` + `conn.execute`) quitte
  l'event loop, sans changer une ligne de logique.
- Répartition : api_v2 60, dashboard 40, collections 25, board 23,
  workspace 19, wiki 17, permissions 14, api 14, main.py 6, + 35 fichiers.
- Les 4 routers prioritaires de l'audit sont couverts par ce lot :
  api_v2 60 + dashboard 40 + collections 25 + board 23 = 148 conversions
  (le reste de leurs routes attend la phase 2 : elles ont de vrais `await`).
- Reste (phase 2) : les 311 routes avec de vrais `await` → enrouler les blocs
  DB dans `await anyio.to_thread.run_sync(...)` ; pas de wrapper partagé livré
  (rien ne l'appellerait — YAGNI jusqu'au premier usage).

suite **1037/1037** (233 s) · `ruff check app tests` OK · docs à jour

app/routers/auth.py

@@ -156,7 +156,7 @@ async function handleLogin(e){e.preventDefault();const email=document.getElement
 
 
 @router.get("/register")
-async def register_page(request: Request):
+def register_page(request: Request):
     """Show the registration page (local login page with register tab active)."""
     return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML.replace(
         'class="tab active" onclick="switchTab(\'login\')"',
@@ -177,7 +177,7 @@ async def register_page(request: Request):
 
 
 @router.get("/login")
-async def login(request: Request, provider: str = Query("gitea")):
+def login(request: Request, provider: str = Query("gitea")):
     """Redirect to OAuth2 authorize page or show local login page."""
     # Local login page (POST handled by /auth/local-login)
     from fastapi.responses import HTMLResponse
@@ -460,7 +460,7 @@ async def callback(
 
 
 @router.get("/logout")
-async def logout(request: Request):
+def logout(request: Request):
     """Clear session and redirect to login page.
 
     SAML sessions additionally hand over to the IdP's Single Logout when one
@@ -529,7 +529,7 @@ def _session_user_or_401(request: Request) -> dict:
 
 
 @router.get("/2fa/status")
-async def twofa_status(request: Request):
+def twofa_status(request: Request):
     from app.services import two_factor as _2fa
     user = _session_user_or_401(request)
     return {"enabled": _2fa.is_enabled(user["id"]),
@@ -537,7 +537,7 @@ async def twofa_status(request: Request):
 
 
 @router.post("/2fa/setup")
-async def twofa_setup(request: Request):
+def twofa_setup(request: Request):
     from app.services import two_factor as _2fa
     user = _session_user_or_401(request)
     return _2fa.setup_secret(user["id"])
@@ -563,7 +563,7 @@ async def twofa_activate(request: Request):
 
 
 @router.post("/2fa/disable")
-async def twofa_disable(request: Request):
+def twofa_disable(request: Request):
     from app.services import two_factor as _2fa
     user = _session_user_or_401(request)
     _2fa.disable(user["id"])