fix: A21 phase 1 — 352 routes async sans await → threadpool (v7.8.0)

- Conversion `async def` → `def` de TOUTES les routes dont le corps ne contient
  ni `await`, ni `async with`, ni `async for`, ni `asyncio` (scan automatique
  corps par corps sur app/ : 352 converties, 0 dangereuses, vérifié
  `asyncio`/`run_coroutine`/`.result()` absents). FastAPI exécute ces handlers
  dans son threadpool → tout leur SQLite (`get_conn()` + `conn.execute`) quitte
  l'event loop, sans changer une ligne de logique.
- Répartition : api_v2 60, dashboard 40, collections 25, board 23,
  workspace 19, wiki 17, permissions 14, api 14, main.py 6, + 35 fichiers.
- Les 4 routers prioritaires de l'audit sont couverts par ce lot :
  api_v2 60 + dashboard 40 + collections 25 + board 23 = 148 conversions
  (le reste de leurs routes attend la phase 2 : elles ont de vrais `await`).
- Reste (phase 2) : les 311 routes avec de vrais `await` → enrouler les blocs
  DB dans `await anyio.to_thread.run_sync(...)` ; pas de wrapper partagé livré
  (rien ne l'appellerait — YAGNI jusqu'au premier usage).

suite **1037/1037** (233 s) · `ruff check app tests` OK · docs à jour

app/routers/public_api.py

@@ -55,7 +55,7 @@ def verify_token(authorization: str | None = Header(None)):
 
 
 @router.post("/token")
-async def generate_token(request: Request):
+def generate_token(request: Request):
     """Generate a public API access token (A4 : session obligatoire — plus de
     « legacy shared token » `user_id=0` créable par un anonymous)."""
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
@@ -72,14 +72,14 @@ async def generate_token(request: Request):
 
 
 @router.get("/collections", dependencies=[Depends(verify_token)])
-async def public_list_collections(request: Request):
+def public_list_collections(request: Request):
     with get_conn() as conn:
         rows = conn.execute("SELECT id, name, description, icon, created_at FROM collections ORDER BY name").fetchall()
     return {"collections": [dict(r) for r in rows]}
 
 
 @router.get("/collections/{collection_id}", dependencies=[Depends(verify_token)])
-async def public_get_collection(request: Request, collection_id: int):
+def public_get_collection(request: Request, collection_id: int):
     with get_conn() as conn:
         coll = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
         if not coll:
@@ -92,7 +92,7 @@ async def public_get_collection(request: Request, collection_id: int):
 
 
 @router.get("/collections/{collection_id}/pages", dependencies=[Depends(verify_token)])
-async def public_list_pages(request: Request, collection_id: int):
+def public_list_pages(request: Request, collection_id: int):
     with get_conn() as conn:
         pages = conn.execute(
             "SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? AND parent_id IS NULL ORDER BY position",
@@ -102,7 +102,7 @@ async def public_list_pages(request: Request, collection_id: int):
 
 
 @router.get("/pages/{page_id}", dependencies=[Depends(verify_token)])
-async def public_get_page(request: Request, page_id: int):
+def public_get_page(request: Request, page_id: int):
     with get_conn() as conn:
         p = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
         if not p:
@@ -111,7 +111,7 @@ async def public_get_page(request: Request, page_id: int):
 
 
 @router.get("/my-tasks", dependencies=[Depends(verify_token)])
-async def public_my_tasks(request: Request):
+def public_my_tasks(request: Request):
     """Public API: list tasks (requires valid token)."""
     with get_conn() as conn:
         pages = conn.execute(