feat: A20 phase 3 LOT 1 — shell + library migres, harnais csp_preview vert (v7.38.0)

Ajout :
- e2e/csp_preview.spec.js — apercu CSP strict SANS deployer : le build
  officiel @alpinejs/csp (e2e/fixtures/alpine.csp.js, 0 eval) est servi a
  la place de alpine.min.js par interception Playwright ; toute expression
  que le parseur maison ne digere pas = pageerror (filet). Premiere
  surface VERTE : library (composant lie, icones SVG via Alpine.effect,
  recherche ouverte + focalisee, 0 erreur).

Changed :
- 16 composants x-data="fn()" enregistres via Alpine.data (registre =
  seule resolution du build CSP, probe « Undefined variable » ;
  scripts classiques executes pendant le parsing => alpine:init toujours
  joint) : appState, libraryPage, workspacesPage, editorState, board x4,
  settings/import/table_view/team_load/trash/workspace/welcome/accounts/
  card_detail.
- base.html (shell) migre : x-effect document.* -> syncSidebarClass(),
  $nextTick(arrow) -> initSidebarSort(), window.FlowDeck.* ->
  fdCreatePage/fdCreateFolder/fdGwRefresh, Object.keys/Math.min/
  window.innerWidth dans x-for et :style -> sidebarSections()/
  sectionMenuPos() — tout = simple appel de methode.
- x-html restants du shell -> x-init + Alpine.effect : icone agent,
  carte projet, library x3 ; recherche library -> toggleSearch()
  (Alpine.nextTick) ; openMoveSelected() pour Object.keys en expression.
- eslint : 70 warnings -> 0/0 (globals getCsrf depuis A38 ph1,
  /* exported openCardDetail */ + /* global owner, repo */, 3 ;; residuels).

suite **1093/1093** · ruff OK · eslint 0/0 · E2E 3/3 (csp_preview + smoke x2)
· docs a jour (ROADMAP ph3 LOT 1, CHANGELOG, WORKLOAD, VERSION)

e2e/_csp_probe3.js

@@ -0,0 +1,40 @@
+// CSP build : x-data="foo()" — globale window vs Alpine.data, lequel résout ?
+const { chromium } = require('playwright-core');
+const path = require('path');
+const fs = require('fs');
+
+function findChromium() {
+  const root = path.join(process.env.LOCALAPPDATA, 'ms-playwright');
+  const dirs = fs.readdirSync(root).filter((d) => d.startsWith('chromium-') && !d.includes('headless'));
+  dirs.sort();
+  return path.join(root, dirs[dirs.length - 1], 'chrome-win64', 'chrome.exe');
+}
+const ALPINE = fs.readFileSync(
+  'C:/Users/bruno/AppData/Local/hermes/cache/scratch/alpine_csp.js',
+  'utf-8'
+);
+const html = `<!DOCTYPE html><html><body>
+<div id="a" x-data="composantGlobal()" x-init="init()"><span id="s1" x-text="v"></span></div>
+<div id="b" x-data="composantAlpineData()" x-init="init()"><span id="s2" x-text="v"></span></div>
+<script>${ALPINE.replace(/<\/script>/g, '<\\/script>')}</script>
+<script>
+function composantGlobal() { return { v: '?', init() { this.v = 'glok'; } }; }
+document.addEventListener('alpine:init', () => {
+  Alpine.data('composantAlpineData', () => ({ v: '?', init() { this.v = 'adok'; } }));
+});
+</script></body></html>`;
+
+(async () => {
+  const browser = await chromium.launch({ headless: true, executablePath: findChromium() });
+  const page = await browser.newPage();
+  const errs = [];
+  page.on('pageerror', (e) => errs.push(e.message.slice(0, 120)));
+  await page.setContent(html, { waitUntil: 'domcontentloaded' });
+  await page.waitForTimeout(500);
+  const res = await page.evaluate(() => ({
+    global: document.querySelector('#s1').textContent,
+    alpineData: document.querySelector('#s2').textContent,
+  }));
+  console.log('RESULTATS:', JSON.stringify(res), 'ERREURS:', errs.length ? errs : 'aucune');
+  await browser.close();
+})();