fix: A29 + A42(partiel) — publish partagé, fuite password_hash, data_dir (v7.5.0)

- A29 — `app/services/publish.py` : slugify titré unique (fallback aléatoire),
  404 si la page n'existe pas, événements centralisés. Les 3 paires
  publish/unpublish déléguent (sharing = front, board, v2) :
  · board : mise à jour aveugle → 404 + contrôle de session ajouté
  · board : perd `share_mode='anyone'` en bonus, v2 : perd `is_shared=1` —
    le share dialog reste l'unique propriétaire de ces drapeaux
  · v2 : slug fourni conservé, slug vidé aussi à la dépublication (avant : laissé)
  · `/users/me` ×2 et listings collections ×3 = contrats versionnés distincts,
    décision documentée (on garde)
- Byproduct sécurité — `GET /api/users/me` (v1) et le contexte de `/accounts`
  faisaient `SELECT *` sur users → password_hash / login_attempts / locked_until
  exposés → colonnes whitelistées (liste v2)
- A42 (partiel) — 9 copies de `Path(os.environ.get("FLOWDECK_DATA_DIR", "/data"))`
  → `settings.data_dir` (property : lecture à chaque accès, les tests
  monkeypatchent l'env) ; cache Gitea : évacuation des entrées expirées à chaque
  écriture. Reste : client httpx partagé (52 créations, cache par event loop)

tests : test_publish_service_shared_and_safe, test_users_me_no_secret_columns,
test_gitea_cache_evicts_expired

suite **1034/1034** · `ruff check app tests` OK · OpenAPI 511 chemins / 7.5.0
docs (ROADMAP/CHANGELOG/WORKLOAD/VERSION) à jour

app/routers/board.py

@@ -10,12 +10,14 @@ from fastapi import APIRouter, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse, JSONResponse
 
 from app.auth.session import SessionManager
+from app.config import settings
 from app.db import get_conn
 from app.routers.dashboard import _get_app_version
 from app.routers.sidebar_config import get_sidebar_config_sync
 from app.services.automations import fire_event
 from app.services.gitea_client import gitea
 from app.services.permission_manager import PermissionManager
+from app.services.publish import fire_published, fire_unpublished, publish, unpublish
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["board"], prefix="/board")
@@ -1011,35 +1013,20 @@ async def update_share(request: Request, page_id: int):
 @router.post("/api/pages/{page_id:int}/publish")
 async def publish_page(request: Request, page_id: int):
     """Publish a page to the web (generates publish_slug)."""
-    import secrets
-    slug = "p-" + secrets.token_urlsafe(8)
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET is_published=1, publish_slug=?, share_mode='anyone' WHERE id=?",
-            (slug, page_id),
-        )
-        conn.commit()
-        row = conn.execute("SELECT title FROM pages WHERE id=?", (page_id,)).fetchone()
-    try:
-        await fire_event("page.published", {"page_id": page_id, "slug": slug})
-    except Exception:
-        logger.exception("publish_page")
-    return {"is_published": True, "publish_slug": slug, "title": row["title"] if row else ""}
+    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        raise HTTPException(401, "Authentication required")
+    slug, title = publish(page_id)
+    await fire_published(page_id, slug)
+    return {"is_published": True, "publish_slug": slug, "title": title}
 
 
 @router.delete("/api/pages/{page_id:int}/publish")
 async def unpublish_page(request: Request, page_id: int):
     """Unpublish a page from the web."""
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET is_published=0, publish_slug='' WHERE id=?",
-            (page_id,),
-        )
-        conn.commit()
-    try:
-        await fire_event("page.unpublished", {"page_id": page_id})
-    except Exception:
-        logger.exception("unpublish_page")
+    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        raise HTTPException(401, "Authentication required")
+    unpublish(page_id)
+    await fire_unpublished(page_id)
     return {"is_published": False}
 
 
@@ -1686,8 +1673,7 @@ async def duplicate_page(request: Request, page_id: int):
 
 
 def _upload_root() -> Path:
-    import os
-    return Path(os.environ.get("FLOWDECK_DATA_DIR", "/data"))
+    return Path(settings.data_dir)
 
 
 def _ws_id_for(request: Request, page_id: int) -> int: