fix(tests): rendre la suite hermétique — pin oauth_redirect_uri + FLOWDECK_DATA_DIR temporel

- test_get_redirect_uri_from_host_header: épingle oauth_redirect_uri à vide
  pour tester la dérivation Host de façon isolée (le .env du projet définit
  OAUTH_REDIRECT_URI, qui passe prioritaire par design)
- conftest: pose FLOWDECK_DATA_DIR vers un répertoire temporel inscriptible
  pour les tests emoji/docx/covers qui dépendaient de /data (conteneur)
- ajoute scripts/audit_functional.py: audit de bout-en-bout des processus
  (notes, DB, tâches, partage, publication, export, recherche, agents)

Suite locale: 538 passed

tests/test_app.py

@@ -1719,9 +1719,16 @@ def _oauth_request(headers: dict):
     })
 
 
-def test_get_redirect_uri_from_host_header():
-    """get_redirect_uri() derives the URI from the Host header."""
+def test_get_redirect_uri_from_host_header(monkeypatch):
+    """get_redirect_uri() derives the URI from the Host header when used directly.
+
+    NOTE: an explicit ``OAUTH_REDIRECT_URI`` env override (as present in the
+    project ``.env``) takes priority by design. This test pins that override to
+    empty so it exercises the Host-header derivation path in isolation.
+    """
+    from app.config import settings
     from app.routers.auth import get_redirect_uri
+    monkeypatch.setattr(settings, "oauth_redirect_uri", "")
     uri = get_redirect_uri(_oauth_request({"host": "192.168.30.101:8080"}))
     assert uri == "http://192.168.30.101:8080/auth/callback"