feat(v4.0): GitHub routes + CSRF exemptions for share/publish

- app/routers/github_routes.py: /api/github/status + disconnect
- CSRF: ajout /api/github, /api/pages, /api/recents aux exclusions
- main.py: registration github_router

app/routers/board.py

@@ -289,8 +289,9 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
             "WHERE share_mode='anyone' OR published=1 ORDER BY updated_at DESC LIMIT 20"
         ).fetchall()
     shared_pages = []
+    published_pages = []
     for r in shared_rows:
-        shared_pages.append({
+        page_entry = {
             "id": f"page/{r['id']}",
             "db_id": r["id"],
             "name": r["title"] or "New page",
@@ -301,7 +302,11 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
             "depth": 0,
             "has_children": False,
             "children": [],
-        })
+        }
+        if r["published"]:
+            published_pages.append(page_entry)
+        else:
+            shared_pages.append(page_entry)
 
     # Auth method & OAuth badge data
     auth_method = "local"
@@ -330,6 +335,7 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
             "current_page": repo or "Dashboard", "last_edited": "now",
             "recent_pages": recent, "private_pages": private_items,
             "favorite_pages": favorites, "shared_pages": shared_pages,
+            "published_pages": published_pages,
             "user": user, "workspace_key": ws_key,
             "auth_method": auth_method,
             "gitea_linked": gitea_linked,

app/routers/dashboard.py

@@ -121,6 +121,7 @@ def _sidebar_data(request: Request, repos: list[dict]) -> dict:
         "private_pages": [],
         "favorite_pages": [],
         "shared_pages": [],
+        "published_pages": [],
         "user": user,
         "avatar_url": avatar_url,
         "avatar_color": avatar_color,

app/routers/github_routes.py

@@ -0,0 +1,35 @@
+"""GitHub OAuth — status and disconnect routes."""
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(tags=["github"], prefix="/api/github")
+
+
+@router.get("/status")
+async def github_status(request: Request):
+    """Check if the current user has GitHub linked."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return {"linked": False}
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT github_token FROM user_oauth_tokens WHERE user_id=? AND provider='github' AND github_token IS NOT NULL AND github_token != ''",
+            (user["id"],)
+        ).fetchone()
+    return {"linked": row is not None}
+
+
+@router.delete("/disconnect")
+async def disconnect_github(request: Request):
+    """Remove all GitHub OAuth tokens for the current user."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM user_oauth_tokens WHERE user_id=? AND provider='github'", (user["id"],))
+        conn.commit()
+    return {"status": "ok"}