v0.3.0: OAuth2, CSRF, rate limiting, issue CRUD, webhooks, card detail, checklists

- OAuth2 Gitea (login/callback/logout) with fallback admin mode
- Session management with signed cookies (itsdangerous, 7 days)
- CSRF protection middleware on all POST/PUT/PATCH/DELETE
- Rate limiting in-memory (60 req/min per IP)
- Issue creation from FlowDeck (POST /api/issues/{owner}/{repo})
- Inline issue editing (PATCH /api/issues/{owner}/{repo}/{issue_id})
- Card detail modal (double-click): description, labels, comments
- Checklists with toggleable items (CRUD endpoints + UI)
- Priority + due date editable on cards
- Webhook receiver (POST /api/webhook) with HMAC-SHA256
- Auto-register/status webhooks for repos
- GiteaClient: create_issue, update_issue, get_comments, webhooks, collaborators
- New DB tables: users, user_tokens, checklists, checklist_items
- CSS: modal, forms, checklists, comments, PR section

app/templates/base.html

@@ -18,12 +18,27 @@
       </a>
     </div>
     <div class="header-right">
+      <span id="user-info" hx-get="/auth/user" hx-trigger="load" hx-swap="innerHTML">
+        <a href="/auth/login" class="btn btn-sm">🔑 Login</a>
+      </span>
       <button class="theme-toggle" onclick="toggleTheme()" title="Thème clair/sombre">🌓</button>
     </div>
   </header>
   <main class="main-content">
     {% block content %}{% endblock %}
   </main>
+
+  <!-- Card Detail Modal (global) -->
+  <div id="card-modal" class="modal-overlay" style="display:none" hx-target="#card-modal-content">
+    <div class="modal-container">
+      <div class="modal-header">
+        <h3 id="card-modal-title">Détail</h3>
+        <button onclick="closeModal()" class="modal-close">&times;</button>
+      </div>
+      <div id="card-modal-content" class="modal-body"></div>
+    </div>
+  </div>
+
   <script src="/static/js/app.js" defer></script>
 </body>
 </html>