feat: fallback token admin GET + Private Pages persistantes

1. _require_gitea: fallback token admin pour les GET (orgs, projects, tree, file)
   _require_user_gitea: token OAuth requis pour les write (save, delete)

2. Private Pages: table gitea_private_pages (user_id, owner, repo, title, content)
   API CRUD: GET/POST/PUT/DELETE /api/gitea/projects/{o}/{r}/private-pages
   UI: liste + éditeur dans le workspace Gitea, lien 🔒 Private Pages dans sidebar
   Lié logiquement au projet (owner+repo), conservé entre sessions

app/templates/gitea_workspace.html

@@ -82,11 +82,52 @@
   </template>
 
   <!-- Empty state -->
-  <template x-if="!showFile && !showEditor">
+  <template x-if="!showFile && !showEditor && !showPrivate">
     <div class="gw-content">
       <div class="empty-state">
         <h2>📁 <span x-text="owner + '/' + repo"></span></h2>
-        <p>Select a file from the sidebar to view it.</p>
+        <p>Select a file from the sidebar to view it, or browse private pages.</p>
+      </div>
+    </div>
+  </template>
+
+  <!-- Private pages view -->
+  <template x-if="showPrivate && !editingPrivate">
+    <div class="gw-content">
+      <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:16px;">
+        <h3>🔒 Private Pages</h3>
+        <button class="btn btn-primary" @click="newPrivate()">+ New Page</button>
+      </div>
+      <template x-if="privatePages.length === 0">
+        <div class="empty-state" style="padding:40px 20px;">
+          <p>No private pages yet. Create one to store notes linked to this project.</p>
+        </div>
+      </template>
+      <template x-for="pp in privatePages" :key="pp.id">
+        <div style="background:var(--bg-secondary);border:1px solid var(--border);border-radius:8px;padding:16px;margin-bottom:8px;cursor:pointer;display:flex;align-items:center;justify-content:space-between;"
+             @click="openPrivate(pp.id)">
+          <div>
+            <div style="font-weight:500;" x-text="pp.title"></div>
+            <div style="font-size:12px;color:var(--text-dim);" x-text="pp.updated_at ? new Date(pp.updated_at+'Z').toLocaleString() : ''"></div>
+          </div>
+          <button class="btn btn-danger" style="padding:4px 8px;font-size:11px;" @click.stop="deletePrivate(pp.id)">🗑</button>
+        </div>
+      </template>
+    </div>
+  </template>
+
+  <!-- Private page editor -->
+  <template x-if="editingPrivate">
+    <div>
+      <div class="gw-file-toolbar">
+        <strong>Editing: <span x-text="editingPrivateTitle || 'Untitled'"></span></strong>
+        <span style="flex:1;"></span>
+        <button class="btn" @click="savePrivate()">💾 Save</button>
+        <button class="btn" @click="editingPrivate=null;editingPrivateTitle='';editingPrivateContent='';">Cancel</button>
+      </div>
+      <div class="gw-content">
+        <input x-model="editingPrivateTitle" placeholder="Page title" style="width:100%;padding:10px 12px;background:var(--bg-tertiary);border:1px solid var(--border);border-radius:8px;color:var(--text);font-size:16px;margin-bottom:12px;outline:none;">
+        <textarea x-model="editingPrivateContent" placeholder="Start writing…" style="min-height:60vh;"></textarea>
       </div>
     </div>
   </template>
@@ -102,6 +143,11 @@ function giteaWorkspace() {
     owner, repo,
     showFile: false,
     showEditor: false,
+    showPrivate: false,
+    privatePages: [],
+    editingPrivate: null,
+    editingPrivateTitle: '',
+    editingPrivateContent: '',
     filePath: '',
     fileContent: '',
     fileSize: 0,
@@ -137,9 +183,24 @@ function giteaWorkspace() {
           li.setAttribute('data-gitea-type', item.type === 'folder' ? 'folder' : 'file');
           li.setAttribute('data-gitea-sha', item.sha || '');
           li.style.cssText = 'padding-left:12px;cursor:pointer;';
-          li.innerHTML = '<span class=\"page-icon\">' + icon + '</span><span class=\"page-name\">' + item.name + '</span>';
+          li.innerHTML = '<span class="page-icon">' + icon + '</span><span class="page-name">' + item.name + '</span>';
           container.appendChild(li);
         });
+        // Add Private Pages link
+        var sep = document.createElement('li');
+        sep.style.cssText = 'border-top:1px solid var(--border);margin:8px 0;';
+        container.appendChild(sep);
+        var pli = document.createElement('li');
+        pli.className = 'sidebar-item';
+        pli.style.cssText = 'padding-left:12px;cursor:pointer;';
+        pli.innerHTML = '<span class="page-icon">🔒</span><span class="page-name">Private Pages</span>';
+        pli.addEventListener('click', function(e) {
+          e.preventDefault(); e.stopPropagation();
+          var gw = document.querySelector('[x-data]').__x.$data;
+          gw.showPrivate = true; gw.showFile = false; gw.showEditor = false;
+          gw.loadPrivatePages();
+        });
+        container.appendChild(pli);
       } catch(e) { console.error('Sidebar tree load failed:', e); }
     },
 
@@ -266,6 +327,68 @@ function giteaWorkspace() {
       if (bytes < 1048576) return (bytes/1024).toFixed(1) + ' KB';
       return (bytes/1048576).toFixed(1) + ' MB';
     },
+
+    // ── Private Pages ──
+
+    async loadPrivatePages() {
+      try {
+        var r = await fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/private-pages');
+        if (r.ok) { var d = await r.json(); this.privatePages = d.pages || []; }
+      } catch(e) {}
+    },
+
+    newPrivate() {
+      this.editingPrivate = 'new';
+      this.editingPrivateTitle = '';
+      this.editingPrivateContent = '';
+    },
+
+    async openPrivate(id) {
+      try {
+        var r = await fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/private-pages/' + id);
+        if (r.ok) {
+          var d = await r.json();
+          this.editingPrivate = id;
+          this.editingPrivateTitle = d.page.title;
+          this.editingPrivateContent = d.page.content;
+        }
+      } catch(e) {}
+    },
+
+    async savePrivate() {
+      var url = '/api/gitea/projects/' + this.owner + '/' + this.repo + '/private-pages';
+      var method = 'POST';
+      if (this.editingPrivate !== 'new') {
+        url += '/' + this.editingPrivate;
+        method = 'PUT';
+      }
+      try {
+        var r = await fetch(url, {
+          method, headers: {'Content-Type':'application/json','X-CSRF-Token': this.getCsrfToken ? this.getCsrfToken() : ''},
+          body: JSON.stringify({title: this.editingPrivateTitle, content: this.editingPrivateContent})
+        });
+        if (r.ok) {
+          this.editingPrivate = null;
+          this.editingPrivateTitle = '';
+          this.editingPrivateContent = '';
+          await this.loadPrivatePages();
+        }
+      } catch(e) {}
+    },
+
+    async deletePrivate(id) {
+      if (!confirm('Delete this private page?')) return;
+      try {
+        var r = await fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/private-pages/' + id, {
+          method: 'DELETE', headers: {'X-CSRF-Token': this.getCsrfToken ? this.getCsrfToken() : ''}
+        });
+        if (r.ok) await this.loadPrivatePages();
+      } catch(e) {}
+    },
+
+    getCsrfToken() {
+      return document.cookie.split('; ').find(function(c) { return c.startsWith('csrf_token='); })?.split('=')[1] || '';
+    },
   };
 }
 </script>