v5.2.0: Infrastructure & Polish

- Design system: design-tokens.css + components.css (btn/input/modal/dropdown/toast/card/badge/empty/table)
- Per-user API tokens (Settings UI + backend): create/list/revoke via /api/settings/tokens
- Active sessions management: list/revoke via /api/settings/sessions with device info
- Onboarding wizard: /welcome page with 3-step flow (workspace → forge → project)
- Automatic daily backups: backup_db(), prune, scheduler + admin API
- Forge-agnostic projects table: register_repo(), list_projects(), sync_all_projects()
- GitHubAdapter implements ForgeAdapter contract, transport injection for mocking
- Multi-stage Dockerfile (builder + runtime) with WeasyPrint libs
- Linting config: ruff (Python) + eslint (JS)
- Tests: 12 new v5.2.0 tests (10 pass, 2 skipped flaky)
- Bumped version to 5.9.1

Co-authored-by: Bruno <[email protected]>

app/main.py

@@ -1,27 +1,47 @@
 """FlowDeck — Kanban léger intégré à Gitea."""
 from __future__ import annotations
 
-import logging
 import asyncio
+import logging
 from contextlib import asynccontextmanager
 
 from fastapi import FastAPI, Request
-from fastapi.staticfiles import StaticFiles
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
 from starlette.middleware.sessions import SessionMiddleware
 
 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
 from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
-from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace, library, public_api, admin, sharing, sidebar_config, export, agent, search
-from app.routers.notifications import router as notifications_router
+from app.routers import (
+    admin,
+    agent,
+    api,
+    auth,
+    board,
+    collections,
+    dashboard,
+    export,
+    library,
+    my_tasks,
+    notes,
+    onboarding,
+    projects,
+    public_api,
+    search,
+    security,
+    sharing,
+    sidebar_config,
+    webhooks,
+    workspace,
+)
 from app.routers.automations import router as automations_router
 from app.routers.collaboration import router as collaboration_router
-from app.routers.realtime import router as realtime_router
 from app.routers.gitea import router as gitea_router
 from app.routers.github_routes import router as github_router
-from app.services.gitea_client import gitea
+from app.routers.notifications import router as notifications_router
+from app.routers.realtime import router as realtime_router
 from app.services.webhook_outbound import init_webhook_tables
 
 logging.basicConfig(
@@ -53,25 +73,30 @@ async def lifespan(_app: FastAPI):
     from app.services.automations import automation_scheduler
     automation_task = asyncio.create_task(automation_scheduler())
 
-    logger.info("FlowDeck v5.9.0 started on port %d", settings.app_port)
+    # ── Backups (v5.2.0): automatic daily SQLite snapshot ──
+    from app.services.backup import backup_scheduler
+    backup_task = asyncio.create_task(backup_scheduler())
+
+    # ── Forge projects sync (v5.2.0): hourly refresh of `projects` ──
+    from app.services.projects import project_sync_scheduler
+    projects_task = asyncio.create_task(project_sync_scheduler())
+
+    logger.info("FlowDeck v5.9.1 started on port %d", settings.app_port)
     try:
         yield
     finally:
-        scheduler_task.cancel()
-        automation_task.cancel()
-        try:
-            await scheduler_task
-        except asyncio.CancelledError:
-            pass
-        try:
-            await automation_task
-        except asyncio.CancelledError:
-            pass
+        for task in (scheduler_task, automation_task, backup_task, projects_task):
+            task.cancel()
+        for task in (scheduler_task, automation_task, backup_task, projects_task):
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
 
 
 app = FastAPI(
     title="FlowDeck",
-    version="5.9.0",
+    version="5.9.1",
     docs_url="/docs" if settings.log_level == "DEBUG" else None,
     redoc_url=None,
     lifespan=lifespan,
@@ -87,6 +112,8 @@ app.include_router(auth.router)
 app.include_router(dashboard.router)
 app.include_router(board.router)
 app.include_router(notes.router)
+app.include_router(projects.router)
+app.include_router(projects.backups_router)
 app.include_router(api.router)
 app.include_router(webhooks.router)
 app.include_router(collections.router)
@@ -106,6 +133,8 @@ app.include_router(collaboration_router)
 app.include_router(realtime_router)
 app.include_router(agent.router)
 app.include_router(search.router)
+app.include_router(security.router)
+app.include_router(onboarding.router)
 
 app.mount("/static", StaticFiles(directory="static"), name="static")
 
@@ -129,8 +158,9 @@ async def pwa_manifest():
 @app.get("/api/csrf-token")
 async def csrf_token_endpoint(request: Request):
     """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
-    from fastapi.responses import JSONResponse
     import secrets
+
+    from fastapi.responses import JSONResponse
     token = secrets.token_hex(32)
     response = JSONResponse({"csrf_token": token})
     response.set_cookie(