fix: A21 phase 2c — 190 routes hors loop, 86 % total (v7.26.0)

4 passes (283 → 93 routes async sur 667 = 86 % hors loop, avant 61 %) :

A. RACINE AUTH — `get_current_user` (auth/session.py) était `async def`
   SANS aucun await (cookie decode = synchrone) ; idem ses clones :
   `agent._current_user_id/_workspace_id/_current_admin` (34 sites) et
   `sso._require_admin` (corps 0 await, 6 sites) → `def` +
   47 `await` supprimés. Piège : 3 call sites passaient par l'alias `gcu`
   (grep littéral aveugle) — 8 tests en échec → corrigés.

B. Re-scan : 19 routes devenues SANS await → `def` (agent 8, sso 5,
   web_clipper 3, projects 2, auth 1…).

C/D. 155 routes dont les seuls awaits = `request.json()` / événements :
   - try/except `body = {}` → `Body(default={})` (même tolérance)
   - try/except `raise HTTPException(400)` → `Body(...)` REQUIS
     (422 FastAPI — aucun test ne couvrait le 400)
   - forme conditionnelle `request.json() if content-type else {}`
     (54 sites) → défaut `{}` (sans corps = `{}` dans les 2 cas)
   - `await fire_*` → `run_event_sync(...)` ; imports `Body` /
     `run_event_sync` ajoutés aux routers convertis

Reste async (93, justifié) : form/upload/file (22), réseau gitea/llm/oidc,
`_json_body` (9), 2 JSON inline en argument, 1 fallback logique
(capture_frontend_error), 1 lecture conditionnelle (web_clipper), mixtes.

suite **1089/1089** · ruff OK · docs à jour

app/routers/wiki.py

@@ -7,7 +7,7 @@ from __future__ import annotations
 
 import html
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Body, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse
 
 from app.auth.session import SessionManager
@@ -172,12 +172,8 @@ def teamspace_page(teamspace_id: int, request: Request):
 
 
 @router.post("/api/v2/wiki/teamspaces")
-async def create_teamspace(request: Request):
+def create_teamspace(request: Request, body: dict = Body(default={})):
     user = _user(request)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     name = (body.get("name") or "").strip()
     if not name or len(name) > 120:
         raise HTTPException(400, "name required (max 120 chars)")
@@ -225,15 +221,11 @@ def list_members(teamspace_id: int, request: Request):
 
 
 @router.put("/api/v2/wiki/teamspaces/{teamspace_id}/members/{member_id}")
-async def set_member(teamspace_id: int, member_id: int, request: Request):
+def set_member(teamspace_id: int, member_id: int, request: Request, body: dict = Body(default={})):
     user = _user(request)
     _teamspace_or_404(teamspace_id, user["id"])
     if not wiki.can_write_teamspace(user["id"], teamspace_id):
         raise HTTPException(403, "Editor role required")
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     role = body.get("role")
     if role not in wiki.TEAMSPACE_ROLES:
         raise HTTPException(400, f"role must be one of {', '.join(wiki.TEAMSPACE_ROLES)}")
@@ -275,15 +267,11 @@ def get_verification(page_id: int, request: Request):
 
 
 @router.post("/api/v2/wiki/pages/{page_id}/verify")
-async def verify_page(page_id: int, request: Request):
+def verify_page(page_id: int, request: Request, body: dict = Body(default={})):
     user = _user(request)
     page = _page_or_404(page_id)
     if not _can_verify(user, page):
         raise HTTPException(403, "Editor role required to verify a page")
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     out = wiki.verify_page(page_id, user["id"],
                            days=body.get("days") or wiki.VERIFICATION_DAYS_DEFAULT,
                            note=body.get("note") or "")
@@ -355,12 +343,8 @@ def list_followers(page_id: int, request: Request):
 # ── comment reactions ──────────────────────────────────────────────────────
 
 @router.post("/api/v2/wiki/comments/{comment_id}/reactions")
-async def react(comment_id: int, request: Request):
+def react(comment_id: int, request: Request, body: dict = Body(default={})):
     user = _user(request)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     emoji = (body.get("emoji") or "").strip()
     if not emoji:
         raise HTTPException(400, "emoji required")
@@ -380,15 +364,11 @@ def list_reactions(comment_id: int, request: Request):
 # ── guest shares ───────────────────────────────────────────────────────────
 
 @router.post("/api/v2/wiki/pages/{page_id}/guests")
-async def create_guest(page_id: int, request: Request):
+def create_guest(page_id: int, request: Request, body: dict = Body(default={})):
     user = _user(request)
     page = _page_or_404(page_id)
     if page.get("teamspace_id") and not wiki.can_write_teamspace(user["id"], page["teamspace_id"]):
         raise HTTPException(403, "Editor role required to share")
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     try:
         share = wiki.create_guest_share(page_id, body.get("email") or "",
                                         body.get("role") or "viewer",
@@ -519,13 +499,9 @@ def sweep_expiry(request: Request):
 # ── blocks (mermaid / equation_inline / progress) ───────────────────────────
 
 @router.post("/api/v2/wiki/blocks/preview")
-async def preview_blocks(request: Request):
+def preview_blocks(request: Request, body: dict = Body(default={})):
     """Render v7.3 blocks to HTML (same renderer used by the export pipeline)."""
     _user(request)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
     blocks = body.get("blocks")
     if not isinstance(blocks, list):
         raise HTTPException(400, "blocks must be a list")