fix: A3–A8 — bloc « fallback admin » de l'audit sécurité (401 sans session, ACL, CSRF)

- A3 : helper `_require_user_id()` (401 sans session) sur profile/password/token/forge ; `PUT /api/user/password` exige `current_password` vérifié ; `/api/user` sorti de la liste CSRF exemptée
- A4 : `POST /api/v1/token` → 401 sans session, chemin legacy `user_id=0` supprimé
- A5 : CRUD membres d'espace (POST/PUT/DELETE) : session + rôle admin de l'espace (ou admin global), placeholder user créé en `is_admin=0`, GET membres sans session → 401
- A6 : `_require_view` → 404 et `_require_edit` → 401 quand il n'y a pas de session (fin du legacy single-user sur les collections)
- A7 : création ET lecture de page → 401 sans session (PermissionManager conservé) ; `/board/api/pages` sorti de `EXCLUDED_PATHS` ; header CSRF manquant ajouté sur setItemIcon (local_workspace)
- A8 : seed admin sans mot de passe codé en dur — aléatoire au premier boot loggé une fois, ou `FLOWDECK_ADMIN_PASSWORD` ; re-seed seulement si absent
- tests : client connecté par défaut via `_TestSessionAuth` (session + CSRF injectés à la volée, jamais dans le cookie jar → plus de CookieConflict), helper `anon()` sur les 40 tests d'anonymat ; 1016/1016 verts, `ruff check app tests` OK

app/routers/workspace.py

@@ -25,6 +25,24 @@ def _current_user(request: Request) -> dict:
     return SessionManager.decode_session(s) or {"login": "admin", "id": 1}
 
 
+def _require_ws_admin(request: Request, ws_id: int) -> None:
+    """A5 — CRUD des membres : session obligatoire + rôle admin de l'espace
+    (ou admin global). Un anonymous ne peut plus s'ajouter lui-même ni se
+    promouvoir admin."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    with get_conn() as conn:
+        if conn.execute("SELECT 1 FROM users WHERE id=? AND is_admin=1", (user["id"],)).fetchone():
+            return
+        row = conn.execute(
+            "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+            (ws_id, user["id"]),
+        ).fetchone()
+    if not row or row["role"] != "admin":
+        raise HTTPException(403, "Workspace admin role required")
+
+
 # ── Workspaces ──
 
 @router.get("")
@@ -58,6 +76,8 @@ async def create_workspace(request: Request):
 
 @router.get("/{ws_id}/members")
 async def list_members(request: Request, ws_id: int):
+    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        raise HTTPException(401, "Authentication required")
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT wm.*, u.login, u.full_name, u.avatar_url FROM workspace_members wm JOIN users u ON wm.user_id=u.id WHERE wm.workspace_id=?",
@@ -68,13 +88,14 @@ async def list_members(request: Request, ws_id: int):
 
 @router.post("/{ws_id}/members")
 async def add_member(request: Request, ws_id: int):
+    _require_ws_admin(request, ws_id)
     body = await request.json() if request.headers.get("content-type") else {}
     user_id = body.get("user_id")
     role = body.get("role", "editor")
     if role not in ROLES:
         raise HTTPException(400, f"Invalid role: {role}")
     with get_conn() as conn:
-        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
+        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,0)",
                      (user_id, f"user_{user_id}", f"User {user_id}"))
         conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?,?,?)",
                      (ws_id, user_id, role))
@@ -84,6 +105,7 @@ async def add_member(request: Request, ws_id: int):
 
 @router.put("/{ws_id}/members/{user_id}")
 async def update_member_role(request: Request, ws_id: int, user_id: int):
+    _require_ws_admin(request, ws_id)
     body = await request.json() if request.headers.get("content-type") else {}
     role = body.get("role", "editor")
     if role not in ROLES:
@@ -97,6 +119,7 @@ async def update_member_role(request: Request, ws_id: int, user_id: int):
 
 @router.delete("/{ws_id}/members/{user_id}")
 async def remove_member(request: Request, ws_id: int, user_id: int):
+    _require_ws_admin(request, ws_id)
     with get_conn() as conn:
         conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (ws_id, user_id))
         conn.commit()