fix: A26 + A33 + A34 + A35 + A36 + A43 — bande S/XS du P2 (v7.3.9)

- A26 — champ `standalone` mort supprimé (0 lecteur) ; `sqlite:////data/…` ne
  produit plus de chemin UNC sous Windows ; `.env.example` ne promet plus
  PostgreSQL ; raise au boot si `APP_SECRET_KEY` vaut la valeur par défaut
- A33 — rate limit : préfixes manquants (`/scim/v2/`, `/workspace/`, `/db/` +
  non-GET sur `/s/` et `/f/`), limite lue dans `settings.rate_limit_requests`
  (60 annoncés / 100 codés en dur), clé `X-Forwarded-For` seulement derrière un
  proxy local (anti-spoof), `_store` épuré (mémoire bornée) + test dédié
- A34 — `_spawn()` : les 10 schedulers loggent leur exception et redémarrent
  après 10 s au lieu de mourir en silence ; 2 `logger.debug` de scheduler → warning
- A35 — OpenAPI régénéré 439 → 511 chemins (`info.version 7.3.9`), README
  (était v6.7.0), compteur API_GUIDE, titre dupliqué retiré du ROADMAP ;
  le drift Python 3.12/3.13 reste noté (rebuild d'image à valider)
- A36 — 4 dépendances mortes purgées de requirements.txt (aiosqlite, slowapi,
  loguru, packaging = 0 import) ; pyproject reste sans [project] : Docker et la
  CI installent requirements.txt, dupliquer les 22 deps créerait 2 sources
- A43 — 15 `datetime.utcnow()` → `now(UTC).replace(tzinfo=None)` (format ISO
  naïf identique, warnings de dépréciation divisés : 2374 → 926)

suite **1029/1029** · `ruff check app tests` OK · docs/ROADMAP/CHANGELOG/WORKLOAD à jour

app/routers/agent.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+from datetime import UTC
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
@@ -51,7 +52,7 @@ async def agent_scheduler(interval_seconds: int = 60):
                 triggers = conn.execute(
                     "SELECT * FROM agent_triggers WHERE trigger_type='schedule' AND is_active=1"
                 ).fetchall()
-                now = datetime.utcnow()
+                now = datetime.now(UTC).replace(tzinfo=None)
                 for trig in triggers:
                     last = trig["last_fired_at"]
                     if last:

app/routers/api.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import json
 import logging
-from datetime import datetime
+from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse
@@ -46,7 +46,7 @@ def _check_rate_limit(request: Request) -> bool:
     if not settings.rate_limit_enabled:
         return True
     ip = request.client.host if request.client else "unknown"
-    now = datetime.utcnow().timestamp()
+    now = datetime.now(UTC).replace(tzinfo=None).timestamp()
     window_start, count = _rate_limit_store.get(ip, (0, 0))
     if now - window_start > 60:
         _rate_limit_store[ip] = (now, 1)

app/routers/board.py

@@ -1732,7 +1732,7 @@ async def _store_uploaded_file(request: Request, ws_id: int) -> dict:
     ext = name.rsplit(".", 1)[-1].lower() if "." in name else "bin"
     if ext not in {"png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico", "avif"}:
         raise HTTPException(400, "Unsupported image format")
-    stamp = datetime.datetime.utcnow().strftime("%Y%m%d%H%M%S")
+    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S")
     folder = _upload_root() / f"uploads/workspace_{ws_id}"
     folder.mkdir(parents=True, exist_ok=True)
     final = f"{stamp}_{name}"
@@ -2040,7 +2040,7 @@ async def delete_page(request: Request, page_id: int):
         if not row:
             raise HTTPException(404, "Page not found")
         import datetime
-        conn.execute("UPDATE pages SET deleted_at=? WHERE id=?", (datetime.datetime.utcnow().isoformat(), page_id,))
+        conn.execute("UPDATE pages SET deleted_at=? WHERE id=?", (datetime.datetime.now(datetime.UTC).replace(tzinfo=None).isoformat(), page_id,))
         conn.commit()
     await fire_event("page.deleted", {"page_id": page_id, "title": row["title"] or ""})
     return {"status": "ok", "deleted": page_id, "title": row["title"]}

app/routers/dashboard.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import logging
+from datetime import UTC
 
 from fastapi import APIRouter, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
@@ -1485,7 +1486,7 @@ async def delete_local_workspace_item(request: Request, item_id: int):
     with get_conn() as conn:
         conn.execute(
             "UPDATE pages SET deleted_at=? WHERE id=? AND deleted_at IS NULL",
-            (datetime.utcnow().isoformat(), item_id),
+            (datetime.now(UTC).replace(tzinfo=None).isoformat(), item_id),
         )
         conn.commit()
     return {"status": "ok"}

app/routers/emoji.py

@@ -62,7 +62,7 @@ async def create_custom_emoji(request: Request):
     if ext not in _IMAGE_EXTS:
         raise HTTPException(400, "Unsupported image format")
     ws_id = _active_ws(request)
-    stamp = datetime.datetime.utcnow().strftime("%Y%m%d%H%M%S%f")
+    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S%f")
     folder = _upload_root() / f"uploads/workspace_{ws_id}"
     folder.mkdir(parents=True, exist_ok=True)
     final = f"emoji_{stamp}_{safe}"

app/routers/sharing.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import logging
 import re
 import unicodedata
-from datetime import datetime
+from datetime import UTC, datetime
 
 from fastapi import APIRouter, HTTPException, Request
 
@@ -399,7 +399,7 @@ async def track_recent(request: Request):
                DO UPDATE SET workspace=excluded.workspace,
                              source_type=excluded.source_type,
                              accessed_at=excluded.accessed_at""",
-            (user["id"], page_id, workspace, source_type, datetime.utcnow().isoformat()),
+            (user["id"], page_id, workspace, source_type, datetime.now(UTC).replace(tzinfo=None).isoformat()),
         )
         conn.commit()
 
@@ -407,5 +407,5 @@ async def track_recent(request: Request):
         "status": "tracked",
         "user_id": user["id"],
         "page_id": page_id,
-        "accessed_at": datetime.utcnow().isoformat(),
+        "accessed_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
     }