fix: A21 phase 1 — 352 routes async sans await → threadpool (v7.8.0)

- Conversion `async def` → `def` de TOUTES les routes dont le corps ne contient
  ni `await`, ni `async with`, ni `async for`, ni `asyncio` (scan automatique
  corps par corps sur app/ : 352 converties, 0 dangereuses, vérifié
  `asyncio`/`run_coroutine`/`.result()` absents). FastAPI exécute ces handlers
  dans son threadpool → tout leur SQLite (`get_conn()` + `conn.execute`) quitte
  l'event loop, sans changer une ligne de logique.
- Répartition : api_v2 60, dashboard 40, collections 25, board 23,
  workspace 19, wiki 17, permissions 14, api 14, main.py 6, + 35 fichiers.
- Les 4 routers prioritaires de l'audit sont couverts par ce lot :
  api_v2 60 + dashboard 40 + collections 25 + board 23 = 148 conversions
  (le reste de leurs routes attend la phase 2 : elles ont de vrais `await`).
- Reste (phase 2) : les 311 routes avec de vrais `await` → enrouler les blocs
  DB dans `await anyio.to_thread.run_sync(...)` ; pas de wrapper partagé livré
  (rien ne l'appellerait — YAGNI jusqu'au premier usage).

suite **1037/1037** (233 s) · `ruff check app tests` OK · docs à jour

app/routers/permissions.py

@@ -158,7 +158,7 @@ def _set_permission_type(request: Request, pm: PermissionManager, resource_type:
 
 
 @router.get("/pages/{page_id}/permissions")
-async def list_page_permissions(page_id: int, request: Request):
+def list_page_permissions(page_id: int, request: Request):
     """List explicit page grants + the caller's effective role."""
     pm = _pm(request)
     if not pm.can_view_page(page_id):
@@ -174,7 +174,7 @@ async def list_page_permissions(page_id: int, request: Request):
 
 
 @router.get("/pages/{page_id}/permissions/mine")
-async def my_page_permission(page_id: int, request: Request):
+def my_page_permission(page_id: int, request: Request):
     """Effective role of the current user on a page (UI gating)."""
     pm = _pm(request)
     if not pm.can_view_page(page_id):
@@ -224,7 +224,7 @@ async def batch_page_permissions(page_id: int, request: Request):
 
 
 @router.delete("/pages/{page_id}/permissions/{perm_id}")
-async def revoke_page_permission(page_id: int, perm_id: int, request: Request):
+def revoke_page_permission(page_id: int, perm_id: int, request: Request):
     pm = _pm(request)
     if not pm.can_manage_page_permissions(page_id):
         raise HTTPException(403, "Only a page owner can manage its permissions")
@@ -243,7 +243,7 @@ async def set_page_permission_type(page_id: int, request: Request):
 
 
 @router.get("/collections/{collection_id}/permissions")
-async def list_collection_permissions(collection_id: int, request: Request):
+def list_collection_permissions(collection_id: int, request: Request):
     pm = _pm(request)
     if not pm.can_view_collection(collection_id):
         raise HTTPException(404, "Collection not found")
@@ -276,7 +276,7 @@ async def grant_collection_permission(collection_id: int, request: Request):
 
 
 @router.delete("/collections/{collection_id}/permissions/{perm_id}")
-async def revoke_collection_permission(collection_id: int, perm_id: int, request: Request):
+def revoke_collection_permission(collection_id: int, perm_id: int, request: Request):
     pm = _pm(request)
     if not pm.can_manage_collection_permissions(collection_id):
         raise HTTPException(403, "Only a collection owner can manage its permissions")
@@ -294,7 +294,7 @@ async def set_collection_permission_type(collection_id: int, request: Request):
 
 
 @router.get("/collections/{collection_id}/properties/visible")
-async def visible_properties(collection_id: int, request: Request):
+def visible_properties(collection_id: int, request: Request):
     """Split property ids into visible / hidden for the current user."""
     pm = _pm(request)
     if not pm.can_view_collection(collection_id):
@@ -316,7 +316,7 @@ async def visible_properties(collection_id: int, request: Request):
 
 
 @router.get("/collections/{collection_id}/properties/{property_id}/permissions")
-async def list_property_permissions(collection_id: int, property_id: int, request: Request):
+def list_property_permissions(collection_id: int, property_id: int, request: Request):
     pm = _pm(request)
     if not pm.can_view_collection(collection_id):
         raise HTTPException(404, "Collection not found")
@@ -349,7 +349,7 @@ async def grant_property_permission(collection_id: int, property_id: int, reques
 
 
 @router.delete("/collections/{collection_id}/properties/{property_id}/permissions/{perm_id}")
-async def revoke_property_permission(collection_id: int, property_id: int,
+def revoke_property_permission(collection_id: int, property_id: int,
                                      perm_id: int, request: Request):
     pm = _pm(request)
     if not pm.can_manage_collection_permissions(collection_id):
@@ -362,7 +362,7 @@ async def revoke_property_permission(collection_id: int, property_id: int,
 
 
 @router.get("/groups")
-async def list_groups(request: Request, workspace_id: int | None = None):
+def list_groups(request: Request, workspace_id: int | None = None):
     user = _require_user(request)
     pm = PermissionManager(user["id"])
     return {"groups": pm.get_groups_for_workspace(workspace_id)}
@@ -405,7 +405,7 @@ async def update_group(group_id: int, request: Request):
 
 
 @router.delete("/groups/{group_id}")
-async def delete_group(group_id: int, request: Request):
+def delete_group(group_id: int, request: Request):
     pm = _pm(request)
     with get_conn() as conn:
         row = conn.execute(
@@ -422,7 +422,7 @@ async def delete_group(group_id: int, request: Request):
 
 
 @router.get("/groups/{group_id}/members")
-async def list_group_members(group_id: int, request: Request):
+def list_group_members(group_id: int, request: Request):
     user = _require_user(request)
     return {"members": PermissionManager(user["id"]).get_group_members(group_id)}
 
@@ -451,7 +451,7 @@ async def add_group_member(group_id: int, request: Request):
 
 
 @router.delete("/groups/{group_id}/members/{user_id}")
-async def remove_group_member(group_id: int, user_id: int, request: Request):
+def remove_group_member(group_id: int, user_id: int, request: Request):
     pm = _pm(request)
     with get_conn() as conn:
         row = conn.execute(
@@ -473,7 +473,7 @@ async def remove_group_member(group_id: int, user_id: int, request: Request):
 
 
 @router.get("/users")
-async def list_users(request: Request, workspace_id: int | None = None, q: str = ""):
+def list_users(request: Request, workspace_id: int | None = None, q: str = ""):
     """Workspace members (+ admins) for the grant pickers."""
     _require_user(request)
     q = (q or "").strip().lower()
@@ -503,7 +503,7 @@ async def list_users(request: Request, workspace_id: int | None = None, q: str =
 
 
 @router.get("/audit/permissions")
-async def permission_audit(request: Request, limit: int = 100):
+def permission_audit(request: Request, limit: int = 100):
     """Full permission change history — workspace owner/admin only."""
     user = _require_user(request)
     uid = user["id"]