fix: A21 phase 2c — 190 routes hors loop, 86 % total (v7.26.0)

4 passes (283 → 93 routes async sur 667 = 86 % hors loop, avant 61 %) :

A. RACINE AUTH — `get_current_user` (auth/session.py) était `async def`
   SANS aucun await (cookie decode = synchrone) ; idem ses clones :
   `agent._current_user_id/_workspace_id/_current_admin` (34 sites) et
   `sso._require_admin` (corps 0 await, 6 sites) → `def` +
   47 `await` supprimés. Piège : 3 call sites passaient par l'alias `gcu`
   (grep littéral aveugle) — 8 tests en échec → corrigés.

B. Re-scan : 19 routes devenues SANS await → `def` (agent 8, sso 5,
   web_clipper 3, projects 2, auth 1…).

C/D. 155 routes dont les seuls awaits = `request.json()` / événements :
   - try/except `body = {}` → `Body(default={})` (même tolérance)
   - try/except `raise HTTPException(400)` → `Body(...)` REQUIS
     (422 FastAPI — aucun test ne couvrait le 400)
   - forme conditionnelle `request.json() if content-type else {}`
     (54 sites) → défaut `{}` (sans corps = `{}` dans les 2 cas)
   - `await fire_*` → `run_event_sync(...)` ; imports `Body` /
     `run_event_sync` ajoutés aux routers convertis

Reste async (93, justifié) : form/upload/file (22), réseau gitea/llm/oidc,
`_json_body` (9), 2 JSON inline en argument, 1 fallback logique
(capture_frontend_error), 1 lecture conditionnelle (web_clipper), mixtes.

suite **1089/1089** · ruff OK · docs à jour

app/routers/agent.py

@@ -9,7 +9,7 @@ import json
 import logging
 from datetime import UTC
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Body, HTTPException, Request
 from fastapi.responses import StreamingResponse
 
 from app.auth.session import get_current_user
@@ -93,16 +93,16 @@ async def agent_scheduler(interval_seconds: int = 60):
             logger.exception("Agent scheduler tick failed")
 
 
-async def _current_user_id(request: Request) -> int:
+def _current_user_id(request: Request) -> int:
     """A14 : plus de fallback sur la row `admin` — 401 sans session."""
-    user = await get_current_user(request)
+    user = get_current_user(request)
     if not user or not user.get("id"):
         raise HTTPException(status_code=401, detail="Authentication required")
     return user["id"]
 
 
-async def _workspace_id(request: Request) -> int | None:
-    user = await get_current_user(request)
+def _workspace_id(request: Request) -> int | None:
+    user = get_current_user(request)
     if user and user.get("workspace_id"):
         return user["workspace_id"]
     try:
@@ -112,11 +112,11 @@ async def _workspace_id(request: Request) -> int | None:
         return None
 
 
-async def _current_admin(request: Request) -> dict:
+def _current_admin(request: Request) -> dict:
     """A14 : session obligatoire, puis admin. L'ancien fallback « row admin »
     laissait un anonymous diriger `PATCH /api/agent/providers` (et donc le
     `ping()` vers un `api_base` de son choix = SSRF)."""
-    user = await get_current_user(request)
+    user = get_current_user(request)
     if not user:
         raise HTTPException(status_code=401, detail="Authentication required")
     if not user.get("is_admin"):
@@ -146,9 +146,9 @@ def _default_agent(conn, user_id: int) -> dict:
 
 
 @router.get("")
-async def list_agents(request: Request):
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
+def list_agents(request: Request):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     with get_conn() as conn:
         _default_agent(conn, user_id)
         rows = conn.execute("SELECT * FROM agents WHERE workspace_id IS ? OR workspace_id=? ORDER BY agent_type, name", (ws, ws)).fetchall()
@@ -156,10 +156,9 @@ async def list_agents(request: Request):
 
 
 @router.post("")
-async def create_agent(request: Request):
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+def create_agent(request: Request, body: dict = Body(default={})):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     name = (body.get("name") or "").strip() or "Custom Agent"
     with get_conn() as conn:
         try:
@@ -184,8 +183,8 @@ async def create_agent(request: Request):
 
 
 @router.get("/conversations")
-async def list_conversations(request: Request):
-    user_id = await _current_user_id(request)
+def list_conversations(request: Request):
+    user_id = _current_user_id(request)
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT * FROM agent_conversations WHERE user_id=? ORDER BY updated_at DESC",
@@ -195,10 +194,9 @@ async def list_conversations(request: Request):
 
 
 @router.post("/conversations")
-async def create_conversation(request: Request):
-    user_id = await _current_user_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
-    ws = await _workspace_id(request)
+def create_conversation(request: Request, body: dict = Body(default={})):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     with get_conn() as conn:
         agent = _default_agent(conn, user_id)
         cur = conn.execute(
@@ -236,10 +234,9 @@ def delete_conversation(request: Request, conversation_id: int):
 
 
 @router.patch("/conversations/{conversation_id}")
-async def patch_conversation(request: Request, conversation_id: int):
+def patch_conversation(request: Request, conversation_id: int, body: dict = Body(default={})):
     """Update a conversation's title / provider / model (slash-command support)."""
-    user_id = await _current_user_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+    user_id = _current_user_id(request)
     with get_conn() as conn:
         conv = conn.execute(
             "SELECT id FROM agent_conversations WHERE id=? AND user_id=?",
@@ -262,10 +259,9 @@ async def patch_conversation(request: Request, conversation_id: int):
 
 
 @router.post("/conversations/{conversation_id}/run")
-async def run_conversation(request: Request, conversation_id: int):
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+async def run_conversation(request: Request, conversation_id: int, body: dict = Body(default={})):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     objective = (body.get("message") or "").strip()
     if not objective:
         raise HTTPException(status_code=400, detail="message est requis")
@@ -323,7 +319,7 @@ async def agent_generate(request: Request):
     Because no tool schema is offered, the model answers with plain text based on
     the provided document context instead of issuing search_workspace / tools.
     """
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     body = await request.json() if request.headers.get("content-type") else {}
     prompt = (body.get("prompt") or "").strip()
     if not prompt:
@@ -383,7 +379,7 @@ async def agent_writing(request: Request):
     """
     from app.services.ai_writing import WRITING_ACTIONS, AIWritingService
 
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     body = await request.json() if request.headers.get("content-type") else {}
     action = (body.get("action") or "").strip().lower()
     if not action:
@@ -422,7 +418,7 @@ async def agent_writing_properties(request: Request):
     """
     from app.services.ai_writing import AIWritingService
 
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     body = await request.json() if request.headers.get("content-type") else {}
     properties = body.get("properties") or []
     if not isinstance(properties, list) or not properties:
@@ -474,18 +470,17 @@ def undo(request: Request, action_id: int):
 
 
 @router.get("/skills")
-async def list_skills(request: Request):
-    ws = await _workspace_id(request)
+def list_skills(request: Request):
+    ws = _workspace_id(request)
     with get_conn() as conn:
         rows = conn.execute("SELECT * FROM agent_skills WHERE workspace_id IS ? OR workspace_id=? ORDER BY name", (ws, ws)).fetchall()
     return {"skills": [dict(r) for r in rows]}
 
 
 @router.post("/skills")
-async def create_skill(request: Request):
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+def create_skill(request: Request, body: dict = Body(default={})):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     name = (body.get("name") or "").strip()
     if not name:
         raise HTTPException(status_code=400, detail="name est requis")
@@ -504,10 +499,10 @@ async def create_skill(request: Request):
 
 
 @router.post("/skills/{skill_id}/apply")
-async def apply_skill(request: Request, skill_id: int):
+def apply_skill(request: Request, skill_id: int):
     """Create a conversation pre-loaded with a skill, ready to run."""
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     with get_conn() as conn:
         skill = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
         if not skill:
@@ -535,13 +530,12 @@ def skills_gallery(request: Request):
 
 
 @router.post("/skills/gallery/{slug}/install")
-async def install_gallery_skill(request: Request, slug: str):
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
+def install_gallery_skill(request: Request, slug: str, body: dict = Body(default={})):
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     preset = skill_gallery.get_gallery(slug)
     if not preset:
         raise HTTPException(status_code=404, detail=f"Skill inconnue dans la galerie: {slug}")
-    body = await request.json() if request.headers.get("content-type") else {}
     try:
         row, created = skill_gallery.upsert_skill(
             skill_gallery.parse_payload(preset),
@@ -555,11 +549,10 @@ async def install_gallery_skill(request: Request, slug: str):
 
 
 @router.post("/skills/import")
-async def import_skill(request: Request):
+def import_skill(request: Request, body: dict = Body(default={})):
     """Importe un skill portable (JSON exporté depuis une autre instance)."""
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     payload = body.get("payload") if isinstance(body.get("payload"), dict) else body
     try:
         fields = skill_gallery.parse_payload(payload)
@@ -601,7 +594,7 @@ def delete_skill(request: Request, skill_id: int):
 
 
 @router.get("/mentions")
-async def list_mentions(request: Request, q: str = ""):
+def list_mentions(request: Request, q: str = ""):
     """Éléments mentionnables dans le panneau agent (commande « @ » / bouton « + »).
 
     Retourne des sections d'objets FlowDeck que l'utilisateur peut épingler au
@@ -624,7 +617,7 @@ async def list_mentions(request: Request, q: str = ""):
     except (TypeError, ValueError):
         ws = None
     if not ws:
-        ws = await _workspace_id(request)
+        ws = _workspace_id(request)
 
     def dedupe(items: list[dict]) -> list[dict]:
         seen: set = set()
@@ -729,10 +722,9 @@ async def list_mentions(request: Request, q: str = ""):
 
 
 @router.post("/feedback")
-async def add_feedback(request: Request):
+def add_feedback(request: Request, body: dict = Body(default={})):
     """Enregistre le retour (👍 / 👎) porté sur une réponse de l'agent."""
-    user_id = await _current_user_id(request)
-    body = await request.json() if request.headers.get("content-type") else {}
+    user_id = _current_user_id(request)
     rating = (body.get("rating") or "").strip().lower()
     if rating not in ("up", "down"):
         raise HTTPException(status_code=400, detail="rating doit être 'up' ou 'down'")
@@ -766,8 +758,8 @@ async def add_feedback(request: Request):
 async def trigger_agent(request: Request, agent_id: int):
     """Manually fire a custom agent: create a conversation and run it with the
     agent's instructions as the objective (falls back to a generic prompt)."""
-    user_id = await _current_user_id(request)
-    ws = await _workspace_id(request)
+    user_id = _current_user_id(request)
+    ws = _workspace_id(request)
     with get_conn() as conn:
         agent = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
         if not agent:
@@ -814,7 +806,7 @@ async def list_providers(request: Request):
       - ``verified``   : the last connection test / model fetch succeeded.
       - ``functional`` : the provider is ready to chat (verified, or `offline`).
     """
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     llm = LLMClient()
     cfg = get_llm_config()
     keys = list_user_llm_keys(user_id)
@@ -869,20 +861,19 @@ async def list_providers(request: Request):
 
 
 @router.get("/keys")
-async def list_llm_keys(request: Request):
+def list_llm_keys(request: Request):
     """The user's saved provider keys + API keys (masked)."""
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     return {"keys": list_user_llm_keys(user_id)}
 
 
 @router.put("/keys/{llm_provider}")
-async def save_llm_key(request: Request, llm_provider: str):
+def save_llm_key(request: Request, llm_provider: str, body: dict = Body(default={})):
     """Upsert a provider key for the current user (masked in responses)."""
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     provider = llm_provider.lower()
     if provider not in PROVIDERS:
         raise HTTPException(status_code=400, detail=f"Provider inconnu: {provider}")
-    body = await request.json() if request.headers.get("content-type") else {}
     api_base_raw = body.get("api_base")
     raw = upsert_user_llm_key(
         user_id,
@@ -898,9 +889,9 @@ async def save_llm_key(request: Request, llm_provider: str):
 
 
 @router.delete("/keys/{llm_provider}")
-async def delete_llm_key(request: Request, llm_provider: str):
+def delete_llm_key(request: Request, llm_provider: str):
     """Remove a saved provider key for the current user."""
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     provider = llm_provider.lower()
     if provider not in PROVIDERS:
         raise HTTPException(status_code=400, detail=f"Provider inconnu: {provider}")
@@ -915,7 +906,7 @@ async def test_user_llm_key(request: Request, llm_provider: str):
     On success the provider is flagged ``verified`` so it can be offered in the
     Agent panel; on failure the stored error is kept for display in Settings.
     """
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     provider = llm_provider.lower()
     if provider not in PROVIDERS:
         raise HTTPException(status_code=400, detail=f"Provider inconnu: {provider}")
@@ -970,7 +961,7 @@ async def fetch_llm_models(request: Request, llm_provider: str):
     A successful fetch proves connectivity, so when it used the *stored* key the
     provider is flagged ``verified`` (functional) for the Agent panel.
     """
-    user_id = await _current_user_id(request)
+    user_id = _current_user_id(request)
     provider = llm_provider.lower()
     if provider not in PROVIDERS:
         raise HTTPException(status_code=400, detail=f"Provider inconnu: {provider}")
@@ -1019,7 +1010,7 @@ def _check_api_base(value: str) -> str:
 
 @router.patch("/providers")
 async def update_provider_config(request: Request):
-    await _current_admin(request)
+    _current_admin(request)
     body = await request.json() if request.headers.get("content-type") else {}
     provider = (body.get("provider") or "").strip().lower()
     if provider and provider not in PROVIDERS:
@@ -1049,7 +1040,7 @@ async def test_provider_config(request: Request):
     A successful test flags the workspace default provider as ``verified`` so it
     becomes available (functional) for every user in the Agent panel.
     """
-    await _current_admin(request)
+    _current_admin(request)
     body = await request.json() if request.headers.get("content-type") else {}
     provider = (body.get("provider") or "").strip().lower() or None
     if provider and provider not in PROVIDERS:
@@ -1090,8 +1081,7 @@ def get_agent(request: Request, agent_id: int):
 
 
 @router.put("/{agent_id}")
-async def update_agent(request: Request, agent_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def update_agent(request: Request, agent_id: int, body: dict = Body(default={})):
     with get_conn() as conn:
         existing = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
         if not existing: