merge: main → develop (sync)

2026-07-20 11:02:42 -04:00
436 changed files with 9879 additions and 120731 deletions
@@ -14,10 +14,3 @@ build/
 node_modules/
 Dockerfile
 .dockerignore
-
-# A9 — jamais de DB ni de fichiers de test dans l'image
-*.db
-*.db-*
-test-commit.md
-upload_test.txt
-e2e/
@@ -9,13 +9,6 @@ GITEA_WEBHOOK_SECRET=
 GITHUB_OAUTH_CLIENT_ID=
 GITHUB_OAUTH_CLIENT_SECRET=

-# ── OAuth2 ──
-# Laisser VIDE = redirect URI dynamique (dérivée du Host/X-Forwarded-* de la requête).
-# Ne définir QUE si on veut forcer une URI exacte — elle DOIT être enregistrée
-# dans l'application OAuth2 côté Gitea/GitHub (Settings → Applications).
-# Exemple : OAUTH_REDIRECT_URI=https://flowdeck.dracodev.net/auth/callback
-OAUTH_REDIRECT_URI=
-
 # ── App ──
 APP_SECRET_KEY=change-me-to-random
 APP_HOST=0.0.0.0
@@ -24,61 +17,10 @@ LOG_LEVEL=INFO
 DEFAULT_LANG=fr

 # ── Database ──
-# SQLite UNIQUEMENT (le code ne lit que le préfixe sqlite:///, tout autre
-# schéma retombe silencieusement sur /data/flowdeck.db).
+# SQLite (default): sqlite:////data/flowdeck.db
+# PostgreSQL (optional): postgresql://user:pass@host:5432/flowdeck
 DATABASE_URL=sqlite:////data/flowdeck.db

 # ── Sync ──
 SYNC_INTERVAL=60
 GITEA_CACHE_TTL=30
-
-# ── Backups (v5.2.0) ──
-# Sauvegarde automatique quotidienne du fichier SQLite (fichiers datés).
-BACKUP_ENABLED=true
-BACKUP_DIR=/data/backups
-BACKUP_INTERVAL_HOURS=24
-BACKUP_KEEP=30
-
-# ── Forge projects sync (v5.2.0) ──
-# Rafraîchissement périodique de la table `projects` depuis les forges connectées.
-PROJECT_SYNC_ENABLED=true
-PROJECT_SYNC_INTERVAL_HOURS=1
-
-# ── Public API v2 (v6.3.0) ──
-# PUBLIC_API_INSECURE_OK=true autorise le token de dev fd-public-key (jamais en prod).
-PUBLIC_API_INSECURE_OK=false
-API_V2_RATE_LIMIT_PER_TOKEN=300
-
-# ── Email notifications (v4.9.0) ──
-# Laisser SMTP_HOST vide = pas d'envoi d'email (seulement les notifications in-app).
-SMTP_HOST=
-SMTP_PORT=587
-SMTP_USER=
-SMTP_PASSWORD=
-SMTP_FROM=FlowDeck <[email protected]>
-SMTP_USE_TLS=true
-APP_BASE_URL=http://localhost:8080
-
-# ── SSO / Enterprise (v6.7.0) ──
-# Fallback de démarrage uniquement : dès qu'un admin enregistre une configuration
-# dans Settings → Admin → SSO / Enterprise, la table `sso_config` prime sur le .env.
-# Le bouton SSO n'apparaît sur la page de connexion que si une config est active.
-# SSO_PROVIDER=saml           # saml | oidc  (vide = SSO désactivé)
-# SSO_NAME=Company SSO        # libellé du bouton
-# SSO_ONLY=false              # true = refuser le login local (les admins gardent le leur)
-# SSO_AUTO_PROVISION=true     # créer le compte au premier login SSO
-# SAML :
-# SSO_ENTITY_ID=https://idp.example.com/saml/metadata
-# SSO_SSO_URL=https://idp.example.com/saml/sso
-# SSO_SLO_URL=https://idp.example.com/saml/slo
-# SSO_X509_CERTIFICATE=-----BEGIN CERTIFICATE-----
-# SSO_SIGN_REQUESTS=false     # signer les AuthnRequests / LogoutRequest
-# OIDC :
-# SSO_ISSUER_URL=https://auth.example.com/realms/flowdeck
-# SSO_CLIENT_ID=
-# SSO_CLIENT_SECRET=
-# SSO_SCOPE=openid profile email
-# Mapping (JSON) :
-# SSO_ATTRIBUTE_MAPPING={"email":"email","full_name":"name","groups":"groups"}
-# SSO_GROUPS_MAPPING=[{"sso_group":"FlowDeck Admins","workspace_role":"admin","workspace_id":1}]
-# SSO_DEFAULT_WORKSPACE_ID=0
@@ -1,57 +1,28 @@
 name: FlowDeck CI

 on:
-  # Run on every pushed branch so feature branches are validated before the PR.
  push:
+    branches: [main]
  pull_request:
-    branches: [main, develop]
+    branches: [main]

 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - name: Install lint tools
-        run: pip install -r requirements-dev.txt
-      - name: Ruff (Python)
-        run: ruff check app tests
-      - name: ESLint (JavaScript)
-        run: npx --yes eslint static/js
-
  test:
    runs-on: ubuntu-latest
-    # NOTE: no `container:` here. A `python:*-slim` image ships no Node.js, so the
-    # JavaScript `actions/checkout` action could not run and every job failed at
-    # the first step. The runner's default image already provides Node; we install
-    # the Python toolchain explicitly with actions/setup-python.
+    container: python:3.12-slim
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - name: Install system dependencies (WeasyPrint / emoji fonts)
-        run: |-
-          SUDO=""
-          if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends \
-            libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libffi-dev \
-            libjpeg-dev libopenjp2-7 libcairo2 fonts-noto-color-emoji
-      - name: Install Python dependencies
-        run: pip install -r requirements-dev.txt pytest-cov
-      - name: Run tests (parallel) with coverage
+      - name: Install dependencies
+        run: pip install -r requirements.txt pytest pytest-cov
+      - name: Run tests with coverage
        env:
          GITEA_URL: https://git.dracodev.net
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          APP_SECRET_KEY: ci-test-key
-        # `-n auto` needs pytest-xdist, provided by requirements-dev.txt.
-        run: python -m pytest tests/ -v --tb=short -n auto --cov=app --cov-report=term
+        run: python -m pytest tests/ -v --tb=short --cov=app --cov-report=term
      - name: Coverage summary
-        if: always()
-        run: coverage report -m || true
+        run: |
+          python -m pytest tests/ --cov=app --cov-report=term 2>&1 | tail -20

  docker:
    runs-on: ubuntu-latest
@@ -4,7 +4,6 @@ __pycache__/
 /data/
 .venv/
 venv/
-.venv*/
 *.egg-info/
 dist/
 .pytest_cache/
@@ -16,13 +15,3 @@ dist/
 .ua/tmp/
 .ua/.trash-*/
 .ua/.understandignore
-uv.lock
-
-# A9 — jamais de DB ni de fichiers de test dans git
-*.db
-*.db-*
-test-commit.md
-upload_test.txt
-e2e/node_modules/
-e2e/shots/
-e2e/test-results/
@@ -1,8 +1,7 @@
-# Architecture FlowDeck — Document Complet v4.0
+# Architecture FlowDeck — Document Complet v3.0

-> **Version:** 4.0 · **Date:** 2026-07-20 · **Auteur:** Hermes-Deepin
+> **Version:** 3.0 · **Date:** 2026-07-14 · **Auteur:** Hermes-Deepin
 > **Cible:** Clone Notion intégré à Gitea/GitHub — multi-comptes, multi-intégrations
-> **Version déployée:** v4.0.x (production : https://flowdeck.dracodev.net)

 ---

@@ -48,31 +47,34 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  Templates Jinja2 (SSR)                                   │    │
-│  │  ├─ base.html            — Layout Notion commun (sidebar)  │    │
-│  │  ├─ _header.html         — Topbar + breadcrumbs            │    │
-│  │  ├─ _workspace_tree_macro.html — Macro arbre sidebar       │    │
-│  │  ├─ landing.html         — Landing page non-auth           │    │
-│  │  ├─ workspaces.html      — Page Workspaces (locale/Gitea)  │    │
-│  │  ├─ library.html         — Bibliothèque multi-onglets      │    │
-│  │  ├─ local_workspace.html — Workspace local (explorer)      │    │
-│  │  ├─ page_editor.html     — Éditeur de blocs                │    │
-│  │  ├─ trash.html           — Corbeille (local only)          │    │
-│  │  ├─ settings.html        — Settings / My Account / Admin    │    │
-│  │  ├─ accounts.html        — Gestion comptes admin           │    │
-│  │  ├─ board.html           — Kanban (wrapper)                │    │
-│  │  ├─ board_fragment.html  — Cartes Kanban                   │    │
-│  │  ├─ table_view.html      — Vue table                       │    │
-│  │  ├─ login.html           — Login/Register (local + OAuth)   │    │
-│  │  ├─ public_page.html     — Page publiée (/p/slug)          │    │
-│  │  └─ (legacy: dashboard, detailed_board, card_detail, etc.) │    │
+│  │  ├─ dashboard.html     — Projets + sidebar                │    │
+│  │  ├─ board.html         — Kanban (wrapper)                 │    │
+│  │  ├─ board_fragment.html— Cartes Kanban                    │    │
+│  │  ├─ table_view.html    — Vue table                        │    │
+│  │  ├─ calendar_view.html — Vue calendrier (v1.6)            │    │
+│  │  ├─ timeline_view.html — Vue Gantt (v1.6)                 │    │
+│  │  ├─ gallery_view.html  — Vue galerie (v1.6)               │    │
+│  │  ├─ list_view.html     — Vue liste (v1.6)                 │    │
+│  │  ├─ status_overview.html — Donut SVG                      │    │
+│  │  ├─ team_load.html     — Barres stacked                   │    │
+│  │  ├─ detailed_board.html— Board détaillé                   │    │
+│  │  ├─ card_detail.html   — Modale détail carte              │    │
+│  │  ├─ card.html          — Carte individuelle               │    │
+│  │  ├─ page_editor.html   — Éditeur de blocs                 │    │
+│  │  ├─ my_tasks.html      — Dashboard unifié (v1.9)          │    │
+│  │  ├─ library.html       — Bibliothèque de pages            │    │
+│  │  ├─ trash.html         — Corbeille                        │    │
+│  │  ├─ accounts.html      — Gestion comptes                  │    │
+│  │  ├─ notes.html         — Notes Markdown                   │    │
+│  │  └─ base.html          — Layout commun                    │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
-│  │  JavaScript (servi localement, pas de CDN externe)        │    │
+│  │  JavaScript (CDN, pas de build step)                      │    │
+│  │  ├─ HTMX 1.9          — AJAX sans JS                      │    │
 │  │  ├─ Alpine.js 3.14    — Interactivité légère              │    │
-│  │  ├─ HTMX 1.9          — AJAX sans JS (legacy)             │    │
 │  │  ├─ SortableJS 1.15   — Drag & drop                       │    │
-│  │  └─ Prism.js          — Syntax highlighting               │    │
+│  │  └─ highlight.js      — Syntax highlighting (v2.0)        │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -93,30 +95,17 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  ROUTERS                                                  │    │
-│  │  ├─ main.py           — FastAPI app, lifespan, CORS, 404   │    │
-│  │  ├─ dashboard.py      — /, /workspaces, /library, /help    │    │
-│  │  │                    — /trash, /settings, /accounts        │    │
-│  │  │                    — /p/{slug} (pages publiques)         │    │
-│  │  │                    — _sidebar_data() — données sidebar   │    │
-│  │  ├─ board.py          — /board/{o}/{r}       Board + vues   │    │
-│  │  │                    — /board/api/pages     CRUD pages     │    │
-│  │  │                    — /board/api/trash     Trash          │    │
-│  │  ├─ api.py            — /api/...             CRUD + sync    │    │
-│  │  ├─ auth.py           — /auth/...            OAuth2 + local │    │
-│  │  ├─ local_workspace.py— /api/local-workspace CRUD + upload  │    │
-│  │  ├─ my_tasks.py       — /my-tasks            Dashboard      │    │
-│  │  ├─ library.py        — /api/library/*       API bibliothèque│    │
-│  │  ├─ pages.py          — /pages/...           Pages CRUD     │    │
-│  │  ├─ collections.py    — /db/...              Collections    │    │
-│  │  ├─ editor.py         — /api/editor/...      Block editor   │    │
-│  │  ├─ public_api.py     — /api/v1              Public API v1  │    │
-│  │  ├─ api_v2.py         — /api/v2              Public API v2  │    │
-│  │  │                    — Bearer + scopes, CRUD complet        │    │
-│  │  ├─ web_clipper.py    — /api/v2/web-clipper  Web Clipper     │    │
-│  │  ├─ permissions.py    — /api/v2 (ACL)        Permissions     │    │
-│  │  ├─ workspace.py      — Workspaces API + Gitea projets     │    │
-│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks    │    │
-│  │  └─ admin.py          — /api/admin/*         Admin users    │    │
+│  │  ├─ dashboard.py      — /                    Dashboard   │    │
+│  │  ├─ board.py          — /board/{o}/{r}       Board + vues │    │
+│  │  │                    — /board/api/...       APIs board   │    │
+│  │  ├─ api.py            — /api/...             CRUD + sync  │    │
+│  │  ├─ notes.py          — /notes/{o}/{r}       Notes        │    │
+│  │  ├─ auth.py           — /auth/...            OAuth2       │    │
+│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks  │    │
+│  │  ├─ my_tasks.py       — /my-tasks            (v1.9)       │    │
+│  │  ├─ pages.py          — /pages/...           Pages CRUD   │    │
+│  │  ├─ collections.py    — /db/...              Collections  │    │
+│  │  └─ editor.py         — /api/editor/...      Block editor │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -149,11 +138,6 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │  │  │  ├─ property_values    (legacy → collection_pages)      │
 │  │  │  ├─ ai_keywords                                 │    │    │
 │  │  │  ├─ pages                                       │    │    │
-│  │  │  ├─ page_shares          (v4.0)                  │    │    │
-│  │  │  ├─ recents              (v4.0)                  │    │    │
-│  │  │  ├─ tags                 (v4.0)                  │    │    │
-│  │  │  ├─ page_tags            (v4.0)                  │    │    │
-│  │  │  ├─ gitea_private_pages  (v4.0)                  │    │    │
 │  │  │  ├─ users                                       │    │    │
 │  │  │  ├─ user_tokens                                 │    │    │
 │  │  │  ├─ workspaces            (v2.0)                │    │    │
@@ -701,146 +685,42 @@ POST   /favorites                                   → Ajouter favori
 DELETE /favorites/{id}                              → Retirer favori
 ```

-### 4.6 Routes Sidebar & Library (v4.0)
-
-```
-GET    /library                                     → Bibliothèque dynamique
-GET    /api/library/recents                         → Pages récentes
-GET    /api/library/favorites                       → Favoris
-GET    /api/library/shared                          → Pages partagées
-GET    /api/library/published                       → Pages publiées
-GET    /api/library/private                         → Pages privées
-GET    /api/library/workspace                       → Pages du workspace
-
-GET    /api/local-workspace/items                   → Arborescence workspace
-POST   /api/local-workspace/items                   → Créer page/dossier
-PUT    /api/local-workspace/items/{id}              → Renommer
-DELETE /api/local-workspace/items/{id}              → Soft delete
-POST   /api/local-workspace/upload                  → Upload fichier
-GET    /api/files/{ws_id}/{filename}                → Servir fichier uploadé
-
-GET    /help                                        → Page d'aide complète
-GET    /api/public/pages/{slug}                     → Page publique
-```
-
-### 4.7 Routes Share & Publish (v4.0)
-
-```
-POST   /api/pages/{id}/share                        → Partager une page
-DELETE /api/pages/{id}/share/{share_id}             → Retirer partage
-GET    /api/pages/{id}/shares                       → Liste partages
-POST   /api/pages/{id}/publish                      → Publier page
-DELETE /api/pages/{id}/publish                      → Dépublier
-```
-
 ---

-## 5. Système d'authentification (v4.0)
-
-FlowDeck supporte **3 méthodes d'authentification** et la **connexion d'intégrations multiples** à un même compte local.
-
-### 5.1 Types de comptes
-
-| Type | Auth | Workspaces | Intégrations |
-|------|------|------------|--------------|
-| **Local pur** | email + password | Locaux uniquement | Aucune |
-| **Local + intégrations** | email + password | Locaux + distants | Gitea et/ou GitHub |
-| **OAuth pur** | Gitea ou GitHub | Distants uniquement | Non-déconnectable |
-
-### 5.2 Comportement du sidebar selon le type de compte
-
-```
-LOCAL PUR:
-  ├─ 📁 [nom workspace local]
-  ├─ 📅 Meetings
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 🤖 Agents
-  ├─ 👥 Shared        ← visible si pages partagées
-  ├─ 🌐 Published     ← visible si pages publiées
-  ├─ (Private caché)
-  └─ 📚 Library / ✅ My Tasks / 🗑️ Trash / ❓ Help
-
-LOCAL + GITEA/GITHUB:
-  ├─ 🔗 [owner/repo]  ← workspace distant actif
-  ├─ 📅 Meetings
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 🤖 Agents
-  ├─ 👥 Shared
-  ├─ 🌐 Published
-  ├─ 🔒 Private        ← visible (fichiers locaux liés au projet distant)
-  └─ 📚 / ✅ / 🗑️ / ❓
-
-OAUTH PUR (GITEA/GITHUB):
-  ├─ 🔗 [owner/repo]  ← identité = compte Gitea/GitHub
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 👥 Shared
-  ├─ 🌐 Published
-  ├─ (Private caché)
-  └─ 📚 / ✅ / ❓ (Trash caché — pas de workspace local)
-```
-
-### 5.3 Règles d'affichage
-
- **Section Private** : visible UNIQUEMENT si compte local + workspace distant actif
- **Trash** : visible si `auth_method == 'local'` ou si des pages locales existent
- **Boutons New File/New Folder** : cachés si `has_active_workspace == False`
- **Message "No workspace open"** : affiché dans la section Workspace si aucun workspace actif
- **Header sidebar** : toujours le compte local si auth_method=local, même avec intégrations
-
-### 5.4 cookie `flowdeck_workspace`
-
- `""` → aucun workspace actif
- `"42"` → workspace local ID 42
- `"gitea:owner:repo"` → workspace distant Gitea
- Nettoyage automatique si cookie invalide (workspace supprimé ou autre user)
-
---
-
-## 6. Frontend
+## 5. Frontend

 ### 5.1 Layout

-```ascii
+```
 ┌──────────────────────────────────────────────────────────────┐
-│ TOPBAR (unified-header)                                      │
-│ ┌──────┬───────────────────────────────────────┬───────────┐ │
-│ │ «»   │ Breadcrumbs: 🏠 Workspaces           │ Share ⚙    │ │
-│ └──────┴───────────────────────────────────────┴───────────┘ │
+│ TOPBAR (44px, sticky)                                        │
+│ ┌──────────┬──────────────────────────────────┬────────────┐ │
+│ │ Logo     │ Breadcrumbs: WS > Collection     │ Share...   │ │
+│ │ FlowDeck │ (ou WS > Collection > Page)     │ Settings   │ │
+│ └──────────┴──────────────────────────────────┴────────────┘ │
 ├────────────┬─────────────────────────────────────────────────┤
 │ SIDEBAR    │ CONTENU PRINCIPAL                               │
 │ (240px)    │                                                 │
-│            │  ┌─ Help Page ────────────────────────────────┐│
-│ ┌────────┐ │  │ ┌──────────────┐ ┌──────────────┐          ││
-│ │ Header │ │  │ │ 🚀 Getting   │ │ 📝 Pages     │  (...)   ││
-│ │ [D]    │ │  │ │   Started    │ │   & Editor   │          ││
-│ │ Draco  │ │  │ └──────────────┘ └──────────────┘          ││
-│ └────────┘ │  └─────────────────────────────────────────────┘│
-│            │                                                 │
-│ 🏠 💬 📨 🔍│  ┌─ Library ─────────────────────────────────┐│
-│            │  │ [Recents|Favorites|Shared|Published|...]    ││
-│ 📁 Worksp. │  │ ┌──────┬──────────┬──────────┬───────────┐ ││
-│  📄 New Pg │  │ │Name  │Created by│Source    │Last edited│ ││
-│  📁 New Fl │  │ ├──────┼──────────┼──────────┼───────────┤ ││
-│  📄 page 1 │  │ │doc A │Draco     │Local     │10 min ago │ ││
-│  📄 page 2 │  │ │doc B │bruno     │Gitea     │2 hours ago│ ││
-│            │  │ └──────┴──────────┴──────────┴───────────┘ ││
-│ 📅 Meeting │  └─────────────────────────────────────────────┘│
-│ 🕒 Recents │                                                 │
-│ ⭐ Favoris │  ┌─ Workspaces ───────────────────────────────┐│
-│ 🤖 Agents  │  │ ┌──────────┐ ┌──────────┐ ┌───┐ ┌───┐     ││
-│ 👥 Shared  │  │ │Project A │ │Project B │ │ + │ │ + │     ││
-│ 🌐 Publ.   │  │ │3 pages   │ │12 pages  │ │   │ │   │     ││
-│            │  │ └──────────┘ └──────────┘ └───┘ └───┘     ││
-│ ══════════ │  └─────────────────────────────────────────────┘│
-│ 📚 Library │                                                 │
-│ ✅ My Task │  ┌─ Settings ─────────────────────────────────┐│
-│ 🗑️ Trash  │  │ My Account | Admin | Integrations            ││
-│ ❓ Help    │  │ [Upload photo] [Full Name] [Email] [...]    ││
+│            │  ┌─────────────────────────────────────────────┐│
+│ Workspace  │  │  DATABASE VIEW                               ││
+│ header     │  │  ┌──────┬──────┬──────┬──────┬──────────┐   ││
+│            │  │  │Title │Statut│Priori│Assign│Due Date  │   ││
+│ 🔍 Search  │  │  ├──────┼──────┼──────┼──────┼──────────┤   ││
+│            │  │  │Tâche1│Todo  │ P1   │Bruno │15 juil   │   ││
+│ ▼ Recents  │  │  │Tâche2│Doing │ P2   │ —    │20 juil   │   ││
+│  · Proj A  │  │  │Tâche3│Done  │ P3   │Marie │10 juil   │   ││
+│  · Proj B  │  │  └──────┴──────┴──────┴──────┴──────────┘   ││
+│            │  │  [+ New]  [Filter]  [Sort]  [Search]  [...]  ││
+│ ▼ Private  │  └─────────────────────────────────────────────┘│
+│  · Notes   │                                                 │
+│            │  ┌─ Barre d'outils ────────────────────────────┐│
+│ ▼ Shared   │  │  [Table▼] [Kanban] [Calendar] [Gallery] ... ││
+│  · ...     │  │  [Group▼] [Filter▼] [Sort▼] [Properties▼]  ││
 │            │  └─────────────────────────────────────────────┘│
-│ 💬 [+📄]   │                                                 │
+│ ────────── │                                                 │
+│ [+New page]│  ┌─ Contenu de la vue ─────────────────────────┐│
+│ (sticky    │  │  (table / board / calendar / gallery / ...)  ││
+│  footer)   │  └─────────────────────────────────────────────┘│
 └────────────┴─────────────────────────────────────────────────┘
 ```

@@ -1673,43 +1553,7 @@ docker compose restart flowdeck
 - [Notion Help — Databases](https://www.notion.com/help/intro-to-databases)
 - [Notion Help — Tasks & Dependencies](https://www.notion.com/help/tasks-and-dependencies)
 - [Notion Help — Relations & Rollups](https://www.notion.com/help/relations-and-rollups)
+- [Notion Data Sources (2025)](https://www.notionapps.com/blog/notion-data-sources-update-2025/)
+- [react-notion-x](https://github.com/NotionX/react-notion-x)
 - [FlowDeck — NOTION_DATABASE_TASKS_GUIDE.md](docs/NOTION_DATABASE_TASKS_GUIDE.md)
 - [FlowDeck — ROADMAP.md](ROADMAP.md)
-
---
-
-## 16. Versions à venir
-
-### v4.1.0 — Content Blocks enrichis (priorité standard)
-
- **Callout boxes** — Blocs d'alerte (info, warning, tip, danger)
- **Table of Contents** — Auto-généré depuis les headings
- **LaTeX / KaTeX** — Formules mathématiques
- **Toggle lists** — Listes pliables/dépliables
- **Multi-columns** — Mise en page 2-3 colonnes
-
-### v4.2.0 — Export (priorité standard)
-
- Export **Markdown** avec images
- Export **PDF** (via WeasyPrint ou headless Chrome)
- Export **HTML** standalone (page auto-suffisante)
-
-### v4.3.0 — Collaboration (priorité basse)
-
- **Commentaires inline** sur les pages
- **@mentions** pour notifier des utilisateurs
- **Notifications email** (changements, mentions)
- **Permissions par workspace** (viewer, editor, admin)
-
-### v5.0.0 — Plateforme avancée (futur)
-
- **AI Assistants** — Génération de contenu, résumés, suggestions
- **Embeds** — Vidéos, PDF, Figma, Google Docs
- **Automatisations** — Règles déclenchées sur événements (Notion-style)
- **Base de données avancée** — Relations inter-collections, rollups
- **Kanban flexible** — Colonnes custom, WIP limits
- **API publique REST v2** — `/api/v2` (v6.3.0) : Bearer + scopes `read/write/admin`, CRUD complet, pagination, RFC 7807, idempotence, audit, OpenAPI (`/docs`, `docs/openapi-v2.json`) ; `/api/v1` lecture seule (compat)
- **API agent publique** — `/api/v2/agents/*` + `/api/v2/skills/*` (v6.6.0, agent phase 5) : wrappers Bearer sur `AgentEngine` (run synchrone JSON, journal + rollback, trigger externe) et marketplace de skills (export/import portable, galerie de presets) — `app/routers/api_v2_agent.py`, `app/services/skill_gallery.py`
- **SSO / SAML + OIDC entreprise** — v6.7.0 (Enterprise Auth, dernière feature v6.0.0) : SP SAML (`python3-saml`) + OIDC PKCE (`authlib`), auto-provisioning + mapping groupes IdP → rôles workspace, mode « SSO only », onglet admin « SSO / Enterprise », migration 23 (`sso_config`, `sso_login_history`, `sso_requests`), `/help` section SSO — `app/routers/sso.py`, `app/services/sso_provisioning.py`, `app/auth/providers/{saml,oidc}_provider.py`
- **Volume Docker persistant** — `/data` monté pour survie des données
- **PostgreSQL** — Migration optionnelle pour scaling
@@ -1,44 +1,19 @@
-# ═══════════════════════════════════════════════════════════
-# FlowDeck — multi-stage Docker build (v5.2.0)
-# Stage 1 "builder": build Python wheels once.
-# Stage 2 "runtime": minimal image with WeasyPrint system libs.
-# ═══════════════════════════════════════════════════════════
-FROM python:3.12-slim AS builder
+FROM python:3.12-slim

 WORKDIR /app

+RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+
 COPY requirements.txt .
-RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
-
-# ── runtime stage ───────────────────────────────────────────
-FROM python:3.12-slim AS runtime
-
-WORKDIR /app
-
-# WeasyPrint PDF: text layout (pango/harfbuzz), image decoding, fonts,
-# colour emoji support. curl = healthcheck.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    libpango-1.0-0 \
-    libpangoft2-1.0-0 \
-    libharfbuzz0b \
-    libffi-dev \
-    libgdk-pixbuf-2.0-0 \
-    shared-mime-info \
-    fonts-dejavu-core \
-    fonts-noto-color-emoji \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /wheels /wheels
-RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
+RUN pip install --no-cache-dir -r requirements.txt

 COPY . .

-RUN mkdir -p /data /data/backups
+RUN mkdir -p /data

 EXPOSE 8080

 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/api/health || exit 1

-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
@@ -2,7 +2,7 @@

 Clone complet de **Notion** intégré nativement à **Gitea** — Databases, Pages, Kanban, Calendar, Gallery, Timeline, List, Multi-Users.

-> **7.3.9** — audit sécurité P0→P2 (A1–A26, A33–A36, A43 : auth 401 partout, CSRF sans exemption cookie-auth, SSRF, autoescape, logs d'exceptions) · avant : v6.7.x SSO/SAML + OIDC, v6.6.x agent API, v6.5.x synced blocks, v6.4.0 realtime, PWA offline
+> **v2.1.0** — API publique, Webhooks sortants, PWA

 ## Quick Start

@@ -49,14 +49,10 @@ docker compose up -d
 - **CSV Import/Export**
 - **Public Sharing**: lien de partage lecture seule

-### API & Intégrations (v6.3–v6.6)
- **API publique REST v2**: `/api/v2` — CRUD complet, Bearer + scopes `read/write/admin`, pagination, filtres, erreurs RFC 7807, idempotence, audit — [guide](docs/API_GUIDE_V6.md) · OpenAPI `/docs`
- **API agent publique (v6.6)**: `/api/v2/agents/*` — agents, conversations, **run synchrone JSON**, journal d'actions + rollback, `trigger` externe
- **Marketplace de skills (v6.6)**: export/import portable + galerie de 6 presets installables (`/api/v2/skills/*`), section « Galerie » dans la palette `/` de l'agent
- **API publique v1**: `/api/v1` (lecture seule, compat)
- **Webhooks sortants**: gestion + dispatcher d'événements (CRUD v2)
- **Web Clipper**: extension navigateur Manifest V3 (article/sélection/bookmark/screenshot)
- **PWA**: manifest.json + service worker, offline support
+### API & Intégrations (v2.1)
+- **API publique REST**: `/api/v1` avec token auth
+- **Webhooks sortants**: gestion + dispatcher d'événements
+- **PWA**: manifest.json, prêt pour installation mobile

 ### UI Notion-Style (v1.1–v1.2)
 - Sidebar gauche avec sections hiérarchiques
@@ -89,7 +85,7 @@ DATABASE_URL=sqlite:////data/flowdeck.db
 ## Tests

 ```bash
-python3 -m pytest tests/ -v   # 764/764 passent (0 skip)
+python3 -m pytest tests/ -v   # 73/73 passent
 ```

 ## Roadmap
@@ -1 +0,0 @@
-7.30.0
@@ -1,7 +1,7 @@
 # WORKLOAD — FlowDeck Notion Clone

-> **Début**: 2026-07-08 | **Version**: v7.30.0 (audit — A28 lot 2 : dashboard.py 2 735 L → package 10 fichiers) | **Statut**: EN COURS 🔄
-> **Cible**: parité Notion + intégration forge · **Follow-ups v7.3 livrés**: sidebar teamspaces, notif `page.updated`, charts `number` + dashboards multi-DB, unfurl forge, UI Settings → Audit — voir `ROADMAP.md § v7.3.0`
+> **Début**: 2026-07-08 | **Version**: v2.2.0 | **Statut**: EN COURS 🔄
+> **Cible v3.0**: Multi-User, Multi-Forge (Gitea/GitHub), Standalone

 ## Avancement Global

@@ -21,22 +21,7 @@
 | v2.0 | Multi-User + Editor Complete | ✅ | 67/67 |
 | v2.1 | Public API, Webhooks, PWA | ✅ | 73/73 |
 | v2.2 | Share/Publish, Favorites, Library | ✅ | 73/73 |
-| v3.0 | Auth locale, Multi-Forge, Standalone | ✅ | — |
-| v4.x–v5.x | MVP → Agent IA, palette, automations, import, calendrier, wiki-links, synced blocks | ✅ | 523+ |
-| v6.0–v6.3 | PWA offline, permissions granulaires, web clipper, API publique v2 | ✅ | 668+ |
-| **v6.4.0** | **Realtime production (merge 3-voix, broadcast non bloquant)** | ✅ | **749+** |
-| **v6.5.0–v6.5.1** | **Synced blocks production (databases/vues) + webhooks v2 complets** | ✅ | **749** |
-| **v6.6.0** | **Agent phase 5 — API publique agent & skill marketplace** | ✅ | **764+** |
-| **v6.7.0** | **SSO / SAML + OIDC entreprise (Enterprise Auth)** | ✅ | **802** |
-| v6.8.0 | Sites multi-pages + Forms publics ([doc](docs/V68_Sites_Forms.md)) | ✅ | 20 |
-| v6.9.0 | Recherche hybride + Ask AI RAG ([doc](docs/V69_Search_Ask_AI.md)) | ✅ | 24 |
-| v7.0.0 | Automations multi-étapes + Workers lite ([doc](docs/V70_Automations_Workers.md)) | ✅ | 31 |
-| v7.1.0 | Calendar sync + Meeting Notes ([doc](docs/V71_Calendar_Meetings.md)) | ✅ | 15 |
-| v7.2.0 | SCIM + 2FA + Audit UI + gouvernance agents ([doc](docs/V72_Enterprise_SCIM_2FA.md)) | ✅ | 52 |
-| v7.3.0 | Teamspaces + Verified + Polish + follow-ups ([doc](docs/V73_Wiki_Teamspaces_Polish.md)) | ✅ | 72 |
-
-> **Suites de régression** : `test_v72_enterprise.py` (52) + `test_v73_wiki_polish.py` (72) = **124 verts** · suite complète `-n auto` = **1016 passed**.
-> **Follow-ups v7.3 livrés** (voir § v7.3.0 du `ROADMAP.md`): sidebar par teamspace, charts `number`/multi-DB, notif `page.updated` aux followers, unfurl `gitea:`/`github:`, page Settings → Audit — + 21 casses SSO corrigées (install `python3-saml`/`authlib`).
+| v3.0 | **Auth locale, Multi-Forge, Standalone** | 🔲 | — |

 ## Blocs Complétés

@@ -73,5 +58,5 @@ CRUD collections/pages, 5 vues HTML, relations/rollups/formulas, sub-items/depen
 - **BDD**: SQLite WAL mode, 21 tables, foreign keys ON
 - **Auth**: OAuth2 Gitea + sessions signed (itsdangerous) + token API
 - **Déploiement**: Docker (python:3.12-slim), docker-compose, port 8080
- **Tests**: pytest, 764+ tests, TestClient avec SQLite temporaire
+- **Tests**: pytest, 73 tests, TestClient avec SQLite temporaire
 - **CI/CD**: Gitea Actions (.gitea/workflows/ci.yml)
@@ -1,5 +1,3 @@
 """FlowDeck — Auth module: session, OAuth2, dependencies."""
 from app.auth.oauth import GiteaOAuth
 from app.auth.session import SessionManager, get_current_user
-
-__all__ = ["GiteaOAuth", "SessionManager", "get_current_user"]
@@ -4,8 +4,9 @@ from __future__ import annotations
 import logging
 from urllib.parse import urlencode

+import httpx
+
 from app.config import settings
-from app.services.http_client import shared_client

 logger = logging.getLogger(__name__)

@@ -38,7 +39,7 @@ class GiteaOAuth:
    async def exchange_code(self, code: str) -> dict | None:
        """Exchange authorization code for access token."""
        try:
-            async with shared_client(timeout=15) as client:
+            async with httpx.AsyncClient(timeout=15) as client:
                resp = await client.post(
                    self.TOKEN_URL,
                    data={
@@ -60,7 +61,7 @@ class GiteaOAuth:
    async def get_user(self, access_token: str) -> dict | None:
        """Get user info from Gitea API."""
        try:
-            async with shared_client(timeout=10) as client:
+            async with httpx.AsyncClient(timeout=10) as client:
                resp = await client.get(
                    self.USER_URL,
                    headers={"Authorization": f"token {access_token}"},
@@ -7,7 +7,7 @@ import time
 from abc import ABC, abstractmethod
 from urllib.parse import urlencode

-from app.services.http_client import shared_client
+import httpx

 logger = logging.getLogger(__name__)

@@ -76,7 +76,7 @@ class GiteaProvider(OAuthProvider):
            "grant_type": "authorization_code",
            "redirect_uri": redirect_uri or self.redirect_uri,
        }
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.post(url, json=data, headers={"Accept": "application/json"})
            if r.status_code != 200:
                logger.error("Gitea token exchange failed: %s", r.text)
@@ -85,7 +85,7 @@ class GiteaProvider(OAuthProvider):

    async def get_user(self, access_token: str) -> dict | None:
        url = f"{self.base}/api/v1/user"
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.get(url, headers={"Authorization": f"token {access_token}"})
            if r.status_code != 200:
                return None
@@ -100,7 +100,7 @@ class GiteaProvider(OAuthProvider):

    async def list_repositories(self, access_token: str) -> list[dict]:
        repos = []
-        async with shared_client(timeout=30) as client:
+        async with httpx.AsyncClient(timeout=30) as client:
            for page in range(1, 6):
                r = await client.get(
                    f"{self.base}/api/v1/user/repos",
@@ -158,14 +158,14 @@ class GitHubProvider(OAuthProvider):
        )

    async def exchange_code(self, code: str, redirect_uri: str | None = None) -> dict | None:
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.post(
                self.token_url,
                data={
                    "client_id": self.client_id,
                    "client_secret": self.client_secret,
                    "code": code,
-                    "redirect_uri": redirect_uri or self.redirect_uri,
+                    "redirect_uri": self.redirect_uri,
                },
                headers={"Accept": "application/json"},
            )
@@ -179,7 +179,7 @@ class GitHubProvider(OAuthProvider):

    async def get_user(self, access_token: str) -> dict | None:
        url = f"{self.api_url}/user"
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.get(
                url,
                headers={"Authorization": f"Bearer {access_token}", "Accept": "application/vnd.github.v3+json"},
@@ -197,7 +197,7 @@ class GitHubProvider(OAuthProvider):

    async def list_repositories(self, access_token: str) -> list[dict]:
        repos = []
-        async with shared_client(timeout=30) as client:
+        async with httpx.AsyncClient(timeout=30) as client:
            for page in range(1, 6):
                r = await client.get(
                    f"{self.api_url}/user/repos",
@@ -1,217 +0,0 @@
-"""OIDC provider — authorization code flow with PKCE (v6.7.0).
-
-Discovery (``.well-known/openid-configuration``) is cached for an hour, the
-ID token signature is verified against the issuer JWKS via authlib's JOSE
-implementation, and ``iss`` / ``aud`` / ``exp`` / ``nonce`` are checked here
-explicitly so the rules are visible and unit-testable.
-"""
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-import logging
-import secrets
-import time
-import warnings
-
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-
-#: Default attribute mapping (design doc §3.2) — OIDC claim names.
-DEFAULT_OIDC_MAPPING: dict[str, str] = {
-    "login": "sub",
-    "email": "email",
-    "full_name": "name",
-    "avatar_url": "picture",
-    "groups": "groups",
-}
-
-_DISCOVERY_TTL = 3600.0
-_discovery_cache: dict[str, tuple[float, dict]] = {}
-
-
-class OIDCError(Exception):
-    """OIDC processing failure — ``message`` is user-facing."""
-
-
-def pkce_pair() -> tuple[str, str]:
-    """Return ``(code_verifier, code_challenge)`` for the S256 method."""
-    verifier = secrets.token_urlsafe(64)
-    digest = hashlib.sha256(verifier.encode("ascii")).digest()
-    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
-    return verifier, challenge
-
-
-
-
-def _b64url_decode(data: str) -> bytes:
-    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
-
-
-async def discover(issuer_url: str) -> dict:
-    """Fetch (and cache) the issuer's OIDC discovery document."""
-    issuer = issuer_url.rstrip("/")
-    url = f"{issuer}/.well-known/openid-configuration"
-    now = time.time()
-    hit = _discovery_cache.get(issuer)
-    if hit and now - hit[0] < _DISCOVERY_TTL:
-        return hit[1]
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.get(url)
-            r.raise_for_status()
-            doc = r.json()
-    except Exception as err:
-        raise OIDCError(f"OIDC discovery failed ({url}): {err}") from err
-    if not doc.get("authorization_endpoint") or not doc.get("token_endpoint"):
-        raise OIDCError("OIDC discovery document is missing authorization/token endpoints")
-    _discovery_cache[issuer] = (now, doc)
-    return doc
-
-
-def build_authorize_url(
-    doc: dict,
-    *,
-    client_id: str,
-    redirect_uri: str,
-    scope: str,
-    state: str,
-    nonce: str,
-    code_challenge: str,
-) -> str:
-    from urllib.parse import urlencode
-
-    params = {
-        "client_id": client_id,
-        "redirect_uri": redirect_uri,
-        "response_type": "code",
-        "scope": scope or "openid profile email",
-        "state": state,
-        "nonce": nonce,
-        "code_challenge": code_challenge,
-        "code_challenge_method": "S256",
-    }
-    sep = "&" if "?" in doc["authorization_endpoint"] else "?"
-    return doc["authorization_endpoint"] + sep + urlencode(params)
-
-
-async def exchange_code(
-    doc: dict, *, client_id: str, client_secret: str, code: str, redirect_uri: str, code_verifier: str
-) -> dict:
-    """Exchange the authorization code for tokens (PKCE, confidential client)."""
-    data = {
-        "grant_type": "authorization_code",
-        "code": code,
-        "redirect_uri": redirect_uri,
-        "client_id": client_id,
-        "code_verifier": code_verifier,
-    }
-    auth = None
-    if client_secret:
-        auth = (client_id, client_secret)
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.post(doc["token_endpoint"], data=data, auth=auth)
-    except Exception as err:
-        raise OIDCError(f"OIDC token request failed: {err}") from err
-    if r.status_code != 200:
-        raise OIDCError(f"OIDC token endpoint returned {r.status_code}: {r.text[:300]}")
-    try:
-        tokens = r.json()
-    except Exception as err:
-        raise OIDCError(f"OIDC token endpoint returned a non-JSON body: {err}") from err
-    if "error" in tokens:
-        raise OIDCError(f"OIDC error: {tokens.get('error')} {tokens.get('error_description', '')}".strip())
-    return tokens
-
-
-async def fetch_userinfo(doc: dict, access_token: str) -> dict:
-    """Best-effort userinfo fetch (groups often only live there)."""
-    endpoint = doc.get("userinfo_endpoint")
-    if not endpoint or not access_token:
-        return {}
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.get(endpoint, headers={"Authorization": f"Bearer {access_token}"})
-        if r.status_code != 200:
-            return {}
-        data = r.json()
-        return data if isinstance(data, dict) else {}
-    except Exception as err:  # userinfo is optional enrichment
-        logger.debug("userinfo fetch failed: %s", err)
-        return {}
-
-
-def validate_id_token(
-    id_token: str, *, issuer: str, client_id: str, nonce: str, jwks: dict
-) -> dict:
-    """Verify the ID token signature and claims. Returns the claims dict."""
-    with warnings.catch_warnings():
-        warnings.simplefilter("ignore", DeprecationWarning)
-        from authlib.jose import JsonWebKey
-        from authlib.jose import jwt as jose_jwt
-
-    if isinstance(id_token, bytes):
-        # authlib's jose.jwt.encode() returns bytes; IdP token endpoints send
-        # str — accept both instead of crashing on ``bytes.count(".")``.
-        id_token = id_token.decode()
-    if not id_token or id_token.count(".") != 2:
-        raise OIDCError("Missing or malformed ID token")
-
-    try:
-        keyset = JsonWebKey.import_key_set(jwks)
-    except Exception as err:
-        raise OIDCError(f"Invalid issuer JWKS: {err}") from err
-
-    try:
-        # Pick the key matching the token header (kid) when several are offered.
-        header = json.loads(_b64url_decode(id_token.split(".")[0]))
-        kid = header.get("kid")
-        key = keyset.get_by_kid(kid) if kid and hasattr(keyset, "get_by_kid") else None
-        token_obj = jose_jwt.decode(id_token, key or keyset)
-    except Exception as err:
-        raise OIDCError(f"ID token signature verification failed: {err}") from err
-
-    claims = dict(token_obj)  # authlib's JWTClaims is a dict subclass
-    now = int(time.time())
-
-    if claims.get("iss") != issuer.rstrip("/") and claims.get("iss") != issuer:
-        raise OIDCError(f"ID token issuer mismatch: {claims.get('iss')!r}")
-    aud = claims.get("aud")
-    aud_list = aud if isinstance(aud, list) else [aud]
-    if client_id not in aud_list:
-        raise OIDCError("ID token audience does not include this client")
-    exp = claims.get("exp")
-    if not isinstance(exp, int) or exp < now:
-        raise OIDCError("ID token expired")
-    iat = claims.get("iat")
-    if isinstance(iat, int) and iat > now + 300:
-        raise OIDCError("ID token issued in the future")
-    if nonce and claims.get("nonce") != nonce:
-        raise OIDCError("ID token nonce mismatch")
-    if not claims.get("sub"):
-        raise OIDCError("ID token has no subject")
-    return claims
-
-
-def claims_to_identity(claims: dict, mapping: dict | None = None) -> dict:
-    """Map OIDC claims onto the shared ``{login, email, full_name, avatar_url, groups}`` shape."""
-    mapping = mapping or DEFAULT_OIDC_MAPPING
-    identity: dict = {"_raw": claims}
-    for field in ("login", "email", "full_name", "avatar_url"):
-        source = mapping.get(field) or field
-        value = claims.get(source, "")
-        if isinstance(value, list):
-            value = value[0] if value else ""
-        identity[field] = str(value or "").strip()
-    groups = claims.get(mapping.get("groups", "groups"), [])
-    if isinstance(groups, str):
-        groups = [groups]
-    identity["groups"] = [str(g) for g in groups if g]
-    if not identity["email"]:
-        identity["email"] = claims.get("email", "") or ""
-    if not identity["full_name"]:
-        identity["full_name"] = claims.get("name", "") or identity["email"]
-    return identity
@@ -1,279 +0,0 @@
-"""SAML 2.0 Service Provider — wrapper around python3-saml (OneLogin toolkit).
-
-v6.7.0. Adapts FastAPI's ``Request`` to the toolkit's flat ``request_data``
-dict and builds the SP settings from the ``sso_config`` row.
-
-What the toolkit validates in strict mode (all covered by tests):
-XML schema, signature of the assertion and/or the message against the IdP
-certificate, ``Conditions`` timestamps, ``Audience``, ``Destination``,
-``Issuer``, ``Status``, "exactly one assertion", and ``InResponseTo``
-against the AuthnRequest id we pass to ``process_response()`` — combined
-with the single-use ``sso_requests`` store that makes replay impossible.
-"""
-from __future__ import annotations
-
-import logging
-from dataclasses import dataclass, field
-
-from fastapi import Request
-
-logger = logging.getLogger(__name__)
-
-BINDING_HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-BINDING_HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-NAMEID_FORMAT_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
-
-#: Default attribute mapping (design doc §3.2). ``nameid`` = the assertion's
-#: NameID; every other value is matched against attribute Name / FriendlyName
-#: / URI local part (so ``email`` finds both ``email`` and
-#: ``http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress``).
-DEFAULT_SAML_MAPPING: dict[str, str] = {
-    "login": "nameid",
-    "email": "nameid",
-    "full_name": "displayName",
-    "avatar_url": "avatar",
-    "groups": "groups",
-}
-
-
-class SAMLError(Exception):
-    """SAML processing failure — ``message`` is user-facing, ``reason`` is logged."""
-
-
-@dataclass
-class SAMLIdentity:
-    """What a validated assertion tells us about the user."""
-
-    name_id: str
-    name_id_format: str = ""
-    session_index: str = ""
-    attributes: dict[str, list[str]] = field(default_factory=dict)
-    friendly_attributes: dict[str, list[str]] = field(default_factory=dict)
-
-    def resolve(self, source: str) -> str:
-        """Resolve one mapped source (``nameid`` or an attribute name) → first value."""
-        if not source or source == "nameid":
-            return self.name_id or ""
-        if source in self.attributes and self.attributes[source]:
-            return (self.attributes[source][0] or "").strip()
-        # FriendlyName match (case-insensitive)
-        lower = {k.lower(): v for k, v in self.friendly_attributes.items()}
-        if source.lower() in lower and lower[source.lower()]:
-            return (lower[source.lower()][0] or "").strip()
-        # URI local part match: ".../claims/emailaddress" ~ "emailaddress", and
-        # a mapping of "email" must still find ".../claims/emailaddress".
-        want = source.lower().lstrip("./")
-        for name, values in self.attributes.items():
-            if not values:
-                continue
-            local = name.rsplit("/", 1)[-1].rsplit("}", 1)[-1].lower()
-            if local == want or local.endswith(want) or want.endswith(local):
-                return (values[0] or "").strip()
-        return ""
-
-
-def external_base_url(request: Request) -> str:
-    """Scheme://host the user actually used (proxy-aware, like OAuth redirects)."""
-    proto = request.headers.get("x-forwarded-proto", "")
-    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
-    fwd_host = request.headers.get("x-forwarded-host", "")
-    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
-    return f"{scheme}://{host}"
-
-
-def saml_endpoints(request: Request) -> dict[str, str]:
-    """SP entity id + ACS/SLO/metadata URLs derived from the incoming request."""
-    base = external_base_url(request)
-    return {
-        "entity_id": f"{base}/auth/saml/metadata",
-        "acs": f"{base}/auth/saml/callback",
-        "slo": f"{base}/auth/saml/logout",
-        "metadata": f"{base}/auth/saml/metadata",
-    }
-
-
-def build_settings(cfg: dict, endpoints: dict[str, str]) -> dict:
-    """python3-saml settings dict built from a ``sso_config`` row."""
-    sign_requests = bool(cfg.get("sign_requests"))
-    sp: dict = {
-        "entityId": endpoints["entity_id"],
-        "assertionConsumerService": {
-            "url": endpoints["acs"],
-            "binding": BINDING_HTTP_POST,
-        },
-        "singleLogoutService": {
-            "url": endpoints["slo"],
-            "binding": BINDING_HTTP_REDIRECT,
-        },
-        "NameIDFormat": NAMEID_FORMAT_EMAIL,
-    }
-    if cfg.get("sp_private_key") and cfg.get("sp_certificate"):
-        sp["privateKey"] = cfg["sp_private_key"]
-        sp["x509cert"] = cfg["sp_certificate"]
-
-    idp: dict = {
-        "entityId": cfg.get("entity_id") or "",
-        "singleSignOnService": {
-            "url": cfg.get("sso_url") or "",
-            "binding": BINDING_HTTP_REDIRECT,
-        },
-        "x509cert": cfg.get("x509_certificate") or "",
-    }
-    if cfg.get("slo_url"):
-        idp["singleLogoutService"] = {"url": cfg["slo_url"], "binding": BINDING_HTTP_REDIRECT}
-
-    return {
-        "strict": True,
-        "debug": False,
-        "sp": sp,
-        "idp": idp,
-        "security": {
-            "authnRequestsSigned": sign_requests,
-            "logoutRequestSigned": sign_requests,
-            "logoutResponseSigned": False,
-            "wantMessagesSigned": False,
-            "wantAssertionsSigned": True,
-            "wantNameIdEncrypted": False,
-            "wantAssertionsEncrypted": False,
-            "wantXmlValidation": True,
-            "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
-            "digestAlgorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
-            "rejectDeprecatedAlgorithm": True,
-            # FlowDeck is self-hosted: LAN/homelab deploys commonly reach the
-            # SP through single-label hosts (http://flowdeck/, docker service
-            # names). python3-saml rejects those URLs unless this is on.
-            "allowSingleLabelDomains": True,
-        },
-    }
-
-
-def _request_data(request: Request, script_name: str, post_data: dict | None = None) -> dict:
-    """Flat request dict expected by ``OneLogin_Saml2_Auth``."""
-    https = "on" if external_base_url(request).startswith("https") else "off"
-    return {
-        "https": https,
-        "http_host": request.headers.get("host", "localhost:8080"),
-        "script_name": script_name,
-        "request_uri": request.url.path,
-        "query_string": str(request.url.query or ""),
-        "get_data": dict(request.query_params),
-        "post_data": post_data or {},
-    }
-
-
-def _auth(request: Request, cfg: dict, script_name: str, post_data: dict | None = None):
-    from onelogin.saml2.auth import OneLogin_Saml2_Auth
-
-    settings = build_settings(cfg, saml_endpoints(request))
-    try:
-        return OneLogin_Saml2_Auth(
-            _request_data(request, script_name, post_data=post_data), old_settings=settings
-        )
-    except Exception as err:  # malformed IdP/SP config (bad cert, missing URL…)
-        raise SAMLError(f"Invalid SAML configuration: {err}") from err
-
-
-def create_login(request: Request, cfg: dict, relay_state: str) -> tuple[str, str]:
-    """Build the AuthnRequest. Returns ``(redirect_url, authn_request_id)``."""
-    auth = _auth(request, cfg, "/auth/saml/login")
-    try:
-        url = auth.login(return_to=relay_state)
-    except Exception as err:
-        raise SAMLError(f"Could not build the SAML AuthnRequest: {err}") from err
-    request_id = auth.get_last_request_id() or ""
-    if not request_id:
-        raise SAMLError("AuthnRequest was built without an id")
-    return url, request_id
-
-
-def process_response(request: Request, cfg: dict, post_data: dict, request_id: str) -> SAMLIdentity:
-    """Validate the IdP's SAMLResponse and extract the identity.
-
-    ``request_id`` is the id of the AuthnRequest we issued (from the
-    single-use ``sso_requests`` row): the toolkit rejects any response whose
-    ``InResponseTo`` does not match it.
-    """
-    auth = _auth(request, cfg, "/auth/saml/callback", post_data=post_data)
-    try:
-        auth.process_response(request_id=request_id or None)
-    except Exception as err:
-        raise SAMLError(f"SAML response could not be processed: {err}") from err
-
-    errors = auth.get_errors()
-    if errors:
-        raise SAMLError(auth.get_last_error_reason() or f"SAML errors: {', '.join(errors)}")
-    if not auth.is_authenticated():
-        raise SAMLError("SAML response did not authenticate the user")
-
-    name_id = auth.get_nameid() or ""
-    if not name_id:
-        raise SAMLError("SAML assertion carries no NameID")
-    return SAMLIdentity(
-        name_id=name_id,
-        name_id_format=auth.get_nameid_format() or "",
-        session_index=auth.get_session_index() or "",
-        attributes=auth.get_attributes() or {},
-        friendly_attributes=auth.get_friendlyname_attributes() or {},
-    )
-
-
-def metadata_xml(request: Request, cfg: dict) -> str:
-    """SP metadata XML (for the IdP configuration screen)."""
-    from onelogin.saml2.settings import OneLogin_Saml2_Settings
-
-    settings = OneLogin_Saml2_Settings(
-        build_settings(cfg, saml_endpoints(request)), custom_base_path=None
-    )
-    try:
-        xml = settings.get_sp_metadata()
-    except Exception as err:
-        raise SAMLError(f"Could not build the SP metadata: {err}") from err
-    if isinstance(xml, bytes):
-        xml = xml.decode("utf-8")
-    return xml
-
-
-def build_logout_url(request: Request, cfg: dict, return_to: str, name_id: str, session_index: str) -> str:
-    """SP-initiated Single Logout (HTTP-Redirect LogoutRequest to the IdP)."""
-    auth = _auth(request, cfg, "/auth/saml/logout")
-    if not cfg.get("slo_url"):
-        raise SAMLError("The IdP has no Single Logout URL configured")
-    try:
-        return auth.logout(
-            return_to=return_to,
-            name_id=name_id or None,
-            session_index=session_index or None,
-        )
-    except Exception as err:
-        raise SAMLError(f"Could not build the SAML LogoutRequest: {err}") from err
-
-
-def process_slo_form(request: Request, cfg: dict, form: dict, query: dict) -> tuple[str | None, list[str]]:
-    """Process a LogoutRequest / LogoutResponse received from the IdP.
-
-    ``form`` holds the POSTed fields, ``query`` the GET parameters (the
-    HTTP-Redirect binding delivers LogoutRequest/LogoutResponse there).
-    Returns ``(redirect_url, errors)``.
-    """
-    from onelogin.saml2.auth import OneLogin_Saml2_Auth
-
-    settings = build_settings(cfg, saml_endpoints(request))
-    https = "on" if external_base_url(request).startswith("https") else "off"
-    post_data = {k: v for k, v in form.items() if k in ("SAMLRequest", "SAMLResponse", "RelayState")}
-    if not post_data:
-        post_data = {"SAMLResponse": query["SAMLResponse"]} if "SAMLResponse" in query else {}
-    req_data = {
-        "https": https,
-        "http_host": request.headers.get("host", "localhost:8080"),
-        "script_name": "/auth/saml/logout",
-        "request_uri": request.url.path,
-        "query_string": str(request.url.query or ""),
-        "get_data": dict(query),
-        "post_data": post_data,
-    }
-    auth = OneLogin_Saml2_Auth(req_data, old_settings=settings)
-    try:
-        url = auth.process_slo(keep_local_session=True)
-    except Exception as err:
-        raise SAMLError(f"SAML logout could not be processed: {err}") from err
-    return url, auth.get_errors()
@@ -1,43 +1,26 @@
 """FlowDeck — Session management with signed cookies."""
 from __future__ import annotations

-import logging
-from datetime import UTC, datetime
-from uuid import uuid4
+import json
+from datetime import datetime, timedelta

-from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+from itsdangerous import URLSafeTimedSerializer, BadSignature, SignatureExpired

 from app.config import settings

-logger = logging.getLogger(__name__)
-
 _serializer = URLSafeTimedSerializer(settings.app_secret_key)


 class SessionManager:
-    """Manages user sessions via signed cookies (v5.2.0: revocable).
-
-    Each cookie embeds a ``sid`` referencing a row in ``user_sessions``.
-    Revoking that row instantly invalidates the cookie (checked in
-    ``decode_session``). Legacy cookies without a ``sid`` stay valid.
-    """
+    """Manages user sessions via signed cookies."""

    @staticmethod
-    def create_session(user_data: dict, request=None) -> str:
-        """Create a signed session cookie value.
-
-        ``request`` is optional — when provided the session is recorded in the
-        ``user_sessions`` table (ip + user agent) and becomes revocable.
-        """
+    def create_session(user_data: dict) -> str:
+        """Create a signed session cookie value."""
        payload = {
            "user": user_data,
-            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
+            "created_at": datetime.utcnow().isoformat(),
        }
-        user_id = user_data.get("id")
-        if user_id:
-            sid = str(uuid4())
-            payload["sid"] = sid
-            _record_session(sid, user_id, request)
        return _serializer.dumps(payload)

    @staticmethod
@@ -45,65 +28,10 @@ class SessionManager:
        """Decode and validate a session cookie. Returns user data or None."""
        try:
            payload = _serializer.loads(cookie, max_age=86400 * 7)  # 7 days
+            return payload.get("user")
        except (BadSignature, SignatureExpired):
            return None

-        sid = payload.get("sid") or ""
-        if sid and not _session_active(sid):
-            # Revoked or deleted session → treat as logged out.
-            return None
-        if sid:
-            _touch_session(sid)
-        return payload.get("user")
-
-    @staticmethod
-    def session_id(cookie: str) -> str | None:
-        """Return the session id embedded in a cookie (or None)."""
-        try:
-            payload = _serializer.loads(cookie, max_age=86400 * 7)
-            return payload.get("sid")
-        except (BadSignature, SignatureExpired):
-            return None
-
-    @staticmethod
-    def list_sessions(user_id: int) -> list[dict]:
-        """All recorded sessions for a user (for the Settings UI)."""
-        from app.db import get_conn
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, ip_address, user_agent, created_at, last_seen_at, revoked "
-                "FROM user_sessions WHERE user_id=? ORDER BY last_seen_at DESC",
-                (user_id,),
-            ).fetchall()
-        return [dict(r) for r in rows]
-
-    @staticmethod
-    def revoke_session(sid: str) -> bool:
-        """Revoke a session row. Returns True if a row was updated."""
-        from app.db import get_conn
-        with get_conn() as conn:
-            cur = conn.execute(
-                "UPDATE user_sessions SET revoked=1 WHERE id=? AND revoked=0", (sid,)
-            )
-            conn.commit()
-            return cur.rowcount > 0
-
-    @staticmethod
-    def refresh_session(cookie: str, user_data: dict, request=None) -> str:
-        """Re-sign a cookie keeping its session id (used after profile edits)."""
-        sid = SessionManager.session_id(cookie) if cookie else None
-        payload = {
-            "user": user_data,
-            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
-        }
-        user_id = user_data.get("id")
-        if user_id:
-            if sid is None:
-                sid = str(uuid4())
-                _record_session(sid, user_id, request)
-            payload["sid"] = sid
-        return _serializer.dumps(payload)
-
    @staticmethod
    def store_token(user_id: int, gitea_token: str) -> None:
        """Store a user's Gitea OAuth token in SQLite."""
@@ -130,53 +58,10 @@ class SessionManager:
        return row["gitea_token"] if row else None


-def _record_session(sid: str, user_id: int, request) -> None:
-    ip = ""
-    ua = ""
-    if request is not None:
-        ip = request.client.host if getattr(request, "client", None) else ""
-        ua = (request.headers.get("user-agent", "") or "")[:500]
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            conn.execute(
-                "INSERT INTO user_sessions (id, user_id, ip_address, user_agent) VALUES (?, ?, ?, ?)",
-                (sid, user_id, ip, ua),
-            )
-            conn.commit()
-    except Exception as exc:  # table may not exist in very old installs
-        logger.debug("session record skipped: %s", exc)
-
-
-def _session_active(sid: str) -> bool:
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT revoked FROM user_sessions WHERE id=?", (sid,)
-            ).fetchone()
-        return bool(row and not row["revoked"])
-    except Exception:
-        # No table / DB unavailable → keep the cookie valid (fail-open-safe).
-        return True
-
-
-def _touch_session(sid: str) -> None:
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            conn.execute(
-                "UPDATE user_sessions SET last_seen_at=CURRENT_TIMESTAMP WHERE id=? AND revoked=0",
-                (sid,),
-            )
-            conn.commit()
-    except Exception:
-        logger.exception("_touch_session")
-
-
 # FastAPI dependency
-def get_current_user(request) -> dict | None:
+async def get_current_user(request) -> dict | None:
    """FastAPI dependency: extract current user from session cookie."""
+    from fastapi import Request
    session = request.cookies.get("flowdeck_session")
    if session:
        return SessionManager.decode_session(session)
@@ -1,22 +1,11 @@
 """FlowDeck — Configuration via pydantic-settings."""
 from __future__ import annotations

-import os
 from pathlib import Path
-
 from pydantic_settings import BaseSettings, SettingsConfigDict


 class Settings(BaseSettings):
-    @property
-    def data_dir(self) -> str:
-        """Racine des fichiers (avatars, uploads…).
-
-        Pas un champ : la lecture est faite à chaque accès parce que les tests
-        monkeypatchent `FLOWDECK_DATA_DIR` en cours de vie (A42 — les 9 copies
-        de `Path(os.environ.get("FLOWDECK_DATA_DIR", "/data"))` vont ici).
-        """
-        return os.environ.get("FLOWDECK_DATA_DIR", "/data")
    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )
@@ -32,9 +21,11 @@ class Settings(BaseSettings):
    github_oauth_client_id: str = ""
    github_oauth_client_secret: str = ""

-    # OAuth2 — empty = dynamic per-request redirect URI (Host + X-Forwarded-*),
-    # set this ONLY to pin an exact URI (must be registered in Gitea/GitHub)
-    oauth_redirect_uri: str = ""
+    # Standalone mode
+    standalone: bool = False  # FLOWDECK_STANDALONE=true in .env
+
+    # OAuth2
+    oauth_redirect_uri: str = "http://localhost:8080/auth/callback"

    # Webhook
    webhook_base_url: str = "http://localhost:8080"
@@ -50,10 +41,6 @@ class Settings(BaseSettings):
    rate_limit_enabled: bool = True
    rate_limit_requests: int = 60  # per minute

-    # Public API v2 (v6.3.0)
-    public_api_insecure_ok: bool = False  # if True, fd-public-key is accepted (dev only)
-    api_v2_rate_limit_per_token: int = 300  # req/min per token for /api/v2
-
    # Database
    database_url: str = "sqlite:////data/flowdeck.db"

@@ -61,71 +48,6 @@ class Settings(BaseSettings):
    sync_interval: int = 60
    gitea_cache_ttl: int = 30

-    # Backup (v5.2.0) — scheduled daily snapshot of the SQLite file
-    backup_enabled: bool = True
-    backup_dir: str = "/data/backups"
-    backup_interval_hours: int = 24
-    backup_keep: int = 30
-
-    # Forge projects sync (v5.2.0) — periodic refresh of `projects` table
-    project_sync_enabled: bool = True
-    project_sync_interval_hours: int = 1
-
-    # Reminders (v5.8.0) — background scan for due date reminders
-    reminders_enabled: bool = True
-    reminder_scan_interval_seconds: int = 60
-
-    # Webhooks outbound (v6.4.0) — retry of failed deliveries
-    webhook_retry_enabled: bool = True
-    webhook_retry_interval_seconds: int = 60
-
-    # Email / SMTP notifications (v4.9.0) — optional. If smtp_host is empty,
-    # email notifications are skipped (only in-app notifications are delivered).
-    smtp_host: str = ""
-    smtp_port: int = 587
-    smtp_user: str = ""
-    smtp_password: str = ""
-    smtp_from: str = "FlowDeck <[email protected]>"
-    smtp_use_tls: bool = True
-    app_base_url: str = "http://localhost:8080"
-
-    # SSO / SAML + OIDC (v6.7.0) — bootstrap fallback ONLY: as soon as an admin
-    # saves a configuration in Settings → Admin → SSO / Enterprise, the
-    # `sso_config` table wins (see app/services/sso_provisioning.py).
-    sso_provider: str = ""               # 'saml' | 'oidc' | '' (disabled)
-    sso_name: str = "Company SSO"         # button label on the login page
-    sso_entity_id: str = ""               # SAML: IdP entity id
-    sso_sso_url: str = ""                 # SAML: IdP SSO URL (HTTP-Redirect)
-    sso_slo_url: str = ""                 # SAML: IdP Single Logout URL
-    sso_x509_certificate: str = ""        # SAML: IdP signing certificate (PEM)
-    sso_issuer_url: str = ""              # OIDC: issuer identifier
-    sso_client_id: str = ""               # OIDC: client id
-    sso_client_secret: str = ""           # OIDC: client secret (env only)
-    sso_scope: str = "openid profile email"
-    sso_attribute_mapping: str = ""       # JSON, defaults per provider
-    sso_groups_mapping: str = "[]"        # JSON [{sso_group, workspace_role, workspace_id}]
-    sso_auto_provision: bool = True
-    sso_only: bool = False                # refuse local login when true
-    sso_sign_requests: bool = False       # sign AuthnRequest / LogoutRequest
-    sso_default_workspace_id: int = 0
-
-    # FlowDeck Agent (v4.10.0) — multi-LLM. Empty keys → offline/mock mode
-    # (deterministic rule-based planner so the agent works without any API key).
-    agent_enabled: bool = True
-    llm_provider: str = "offline"      # any id from llm_client.PROVIDERS
-                                       # (openai, anthropic, mistral, cohere,
-                                       #  google, groq, deepseek, openrouter,
-                                       #  nvidia, together, perplexity, xai,
-                                       #  qwencloud, minimax, morph, fireworks,
-                                       #  cerebras, sambanova, chutes, xiaomi,
-                                       #  sealion, sensenova, ollama, offline)
-    llm_model: str = "gpt-4o"
-    llm_api_key: str = ""
-    llm_api_base: str = ""             # custom base URL (Ollama, OpenRouter, ...)
-    agent_max_iterations: int = 12
-    agent_max_tokens_budget: int = 500000
-    agent_run_timeout_seconds: int = 300
-
    @property
    def db_path(self) -> Path:
        if self.database_url == "sqlite:///:memory:":
@@ -136,9 +58,7 @@ class Settings(BaseSettings):
            import re
            if re.match(r'^[a-zA-Z]:', p):
                return Path(p)
-            # A26 : `sqlite:////data/flowdeck.db` donne p='/data/…' — un simple
-            # concat '/'+'/' → '//data/…' = chemin UNC sous Windows. On normalise.
-            return Path("/" + p.lstrip("/"))
+            return Path("/" + p)
        return Path("/data/flowdeck.db")


@@ -192,7 +192,7 @@ def init_db():
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
                title TEXT NOT NULL DEFAULT '',
-                icon TEXT DEFAULT 'file',
+                icon TEXT DEFAULT '📄',
                position INTEGER NOT NULL DEFAULT 0,
                parent_id INTEGER REFERENCES collection_pages(id),
                gitea_issue_id INTEGER,
@@ -442,18 +442,12 @@ def init_db():
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                page_id INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
                shared_with_user_id INTEGER REFERENCES users(id),
-                shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE,
                shared_with_email TEXT DEFAULT '',
                permission TEXT NOT NULL DEFAULT 'view',
                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                created_by INTEGER REFERENCES users(id)
            )
        """)
-        # v5.x: migration — partage par groupes (colonne manquante sur DB existantes)
-        try:
-            conn.execute("ALTER TABLE page_shares ADD COLUMN shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE")
-        except sqlite3.OperationalError:
-            pass
        # 4) recents table
        conn.execute("""
            CREATE TABLE IF NOT EXISTS recents (
@@ -468,366 +462,6 @@ def init_db():
        """)
        conn.commit()

-        # v4.1.0: Data Sources & Linked Databases
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS collection_data_sources (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                source_collection_id INTEGER NOT NULL REFERENCES collections(id),
-                source_name TEXT DEFAULT '',
-                is_linked BOOLEAN NOT NULL DEFAULT 0,
-                position INTEGER NOT NULL DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(collection_id, source_collection_id)
-            )
-        """)
-        # Add workspace_id to collections if missing (v4.1.0 migration)
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN workspace_id INTEGER REFERENCES workspaces(id)")
-        except sqlite3.OperationalError:
-            pass
-        # Add created_by to collections if missing
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN created_by INTEGER REFERENCES users(id)")
-        except sqlite3.OperationalError:
-            pass
-        conn.commit()
-
-        # v4.6.0: Add collection_id to pages (page ↔ collection link for full-page DBs)
-        try:
-            conn.execute("ALTER TABLE pages ADD COLUMN collection_id INTEGER REFERENCES collections(id)")
-        except sqlite3.OperationalError:
-            pass
-
-        # v4.2.0: Collection Templates (enhanced) + Dashboards
-        # Add description, is_recurring, recurrence_rule to page_templates
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN description TEXT DEFAULT ''")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN is_recurring BOOLEAN NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN recurrence_rule TEXT DEFAULT ''")
-        except sqlite3.OperationalError:
-            pass
-
-        # Dashboard: combinaison de vues/widgets sur une page
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS collection_dashboards (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                name TEXT NOT NULL DEFAULT 'Dashboard',
-                layout_json TEXT NOT NULL DEFAULT '{"columns":1,"widgets":[]}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.commit()
-
-        # v4.4.0: Tasks & Dependencies
-        # Add is_task flag to collections
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN is_task BOOLEAN NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-
-        # Dependencies table: bloque/bloqué par with auto-shift config
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS page_dependencies (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                dependency_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                dependency_type TEXT NOT NULL DEFAULT 'blocks',
-                auto_shift TEXT DEFAULT 'overlap',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(page_id, dependency_id, dependency_type)
-            )
-        """)
-        conn.commit()
-
-        # v4.5.0: Sprints
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS sprints (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                name TEXT NOT NULL,
-                start_date TEXT NOT NULL,
-                end_date TEXT NOT NULL,
-                goal TEXT DEFAULT '',
-                status TEXT NOT NULL DEFAULT 'planning',
-                auto_complete BOOLEAN NOT NULL DEFAULT 1,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS sprint_pages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                sprint_id INTEGER NOT NULL REFERENCES sprints(id) ON DELETE CASCADE,
-                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                status_at_start TEXT DEFAULT '',
-                velocity_points INTEGER DEFAULT 1,
-                UNIQUE(sprint_id, page_id)
-            )
-        """)
-        conn.commit()
-
-        # v4.6.0: Sidebar customization config per user
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN sidebar_config TEXT DEFAULT '{}'")
-        except sqlite3.OperationalError:
-            pass
-        conn.commit()
-
-        # ═══════════ v4.9.0: Collaboration — notifications, inline comments, prefs ═══════════
-        # Notifications table (mentions, comments, page changes)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS notifications (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-                actor_id INTEGER REFERENCES users(id),
-                ntype TEXT NOT NULL DEFAULT 'mention',   -- 'mention' | 'comment' | 'page'
-                title TEXT NOT NULL DEFAULT '',
-                message TEXT NOT NULL DEFAULT '',
-                resource_type TEXT NOT NULL DEFAULT 'page',
-                resource_id INTEGER NOT NULL DEFAULT 0,
-                url TEXT NOT NULL DEFAULT '',
-                is_read INTEGER NOT NULL DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute(
-            "CREATE INDEX IF NOT EXISTS idx_notif_user_read ON notifications(user_id, is_read)"
-        )
-
-        # Notification email preferences (JSON: {"comments": true, "mentions": true})
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN notification_prefs TEXT DEFAULT '{}'")
-        except sqlite3.OperationalError:
-            pass
-
-        # Inline comments on pages: the v2.0.0 `comments` table had a NOT NULL FK to
-        # collection_pages, which prevents using page-editor (pages) ids. Rebuild it so
-        # it can hold page comments with optional inline anchors, while preserving data.
-        # target_type='collection_page' (legacy) or 'page' (editor); target_id = resource id.
-        # anchor_block_id = block id; anchor_start/anchor_end = text selection offsets.
-        _cols = [r[1] for r in conn.execute("PRAGMA table_info(comments)").fetchall()]
-        if "target_type" not in _cols:
-            try:
-                conn.execute("""
-                    CREATE TABLE comments_new (
-                        id INTEGER PRIMARY KEY AUTOINCREMENT,
-                        page_id INTEGER,
-                        user_id INTEGER NOT NULL REFERENCES users(id),
-                        body TEXT NOT NULL DEFAULT '',
-                        parent_id INTEGER,
-                        resolved BOOLEAN NOT NULL DEFAULT 0,
-                        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                        target_type TEXT NOT NULL DEFAULT 'page',
-                        target_id INTEGER NOT NULL DEFAULT 0,
-                        anchor_block_id TEXT,
-                        anchor_start INTEGER,
-                        anchor_end INTEGER
-                    )
-                """)
-                conn.execute(
-                    """INSERT INTO comments_new
-                       (id, page_id, user_id, body, parent_id, resolved, created_at, updated_at, target_type, target_id)
-                       SELECT id, page_id, user_id, body, parent_id, resolved, created_at, updated_at,
-                              'collection_page', COALESCE(page_id, 0)
-                       FROM comments"""
-                )
-                conn.execute("DROP TABLE comments")
-                conn.execute("ALTER TABLE comments_new RENAME TO comments")
-            except sqlite3.OperationalError:
-                pass
-        conn.commit()
-
-        # ═══════════ v4.10.0: FlowDeck Agent — agents, conversations, audit ═══════════
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agents (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                workspace_id INTEGER REFERENCES workspaces(id),
-                name TEXT NOT NULL DEFAULT 'FlowDeck Agent',
-                icon TEXT DEFAULT '🤖',
-                agent_type TEXT NOT NULL DEFAULT 'personal',
-                description TEXT DEFAULT '',
-                system_instructions TEXT DEFAULT '',
-                model TEXT DEFAULT 'gpt-4o',
-                scope_json TEXT NOT NULL DEFAULT '{}',
-                trigger_json TEXT NOT NULL DEFAULT '{}',
-                approval_mode TEXT NOT NULL DEFAULT 'auto',
-                is_active BOOLEAN NOT NULL DEFAULT 1,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                created_by INTEGER REFERENCES users(id),
-                UNIQUE(workspace_id, name)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_conversations (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
-                user_id INTEGER NOT NULL REFERENCES users(id),
-                title TEXT DEFAULT 'New conversation',
-                status TEXT NOT NULL DEFAULT 'idle',
-                context_json TEXT NOT NULL DEFAULT '{}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_messages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
-                role TEXT NOT NULL,
-                content TEXT NOT NULL DEFAULT '',
-                tool_calls_json TEXT DEFAULT '[]',
-                model TEXT,
-                tokens_used INTEGER DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_actions (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
-                tool_name TEXT NOT NULL,
-                target_type TEXT,
-                target_id TEXT,
-                payload_json TEXT NOT NULL DEFAULT '{}',
-                result_json TEXT NOT NULL DEFAULT '{}',
-                status TEXT NOT NULL DEFAULT 'success',
-                undo_snapshot_json TEXT DEFAULT '{}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                executed_by INTEGER REFERENCES users(id)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_skills (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                workspace_id INTEGER REFERENCES workspaces(id),
-                name TEXT NOT NULL,
-                description TEXT DEFAULT '',
-                prompt_template TEXT NOT NULL,
-                allowed_tools_json TEXT NOT NULL DEFAULT '[]',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                created_by INTEGER REFERENCES users(id),
-                UNIQUE(workspace_id, name)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_triggers (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
-                trigger_type TEXT NOT NULL DEFAULT 'manual',
-                config_json TEXT NOT NULL DEFAULT '{}',
-                is_active BOOLEAN NOT NULL DEFAULT 1,
-                last_fired_at TIMESTAMP,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        # ─── v4.15.0: feedback des réponses de l'agent (👍 / 👎) ───────────────
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_feedback (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER REFERENCES agent_conversations(id) ON DELETE SET NULL,
-                message_id INTEGER REFERENCES agent_messages(id) ON DELETE SET NULL,
-                user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
-                rating TEXT NOT NULL CHECK (rating IN ('up', 'down')),
-                snippet TEXT DEFAULT '',
-                comment TEXT DEFAULT '',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_conv ON agent_feedback(conversation_id)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_user ON agent_feedback(user_id)")
-
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_user ON agent_conversations(user_id, updated_at)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_msg_conv ON agent_messages(conversation_id, created_at)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_action_conv ON agent_actions(conversation_id)")
-
-        # ─── v4.10.1: LLM runtime config (single row id=1) ─────────────────────
-        # Created lazily (no seed) so .env stays the default until an admin saves
-        # the LLM settings from the UI. Precedence: DB row > settings.llm_*.
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS llm_config (
-                id INTEGER PRIMARY KEY CHECK (id = 1),
-                provider TEXT NOT NULL DEFAULT 'offline',
-                model TEXT DEFAULT '',
-                api_key TEXT DEFAULT '',
-                api_base TEXT DEFAULT '',
-                verified INTEGER NOT NULL DEFAULT 0,
-                verified_model TEXT DEFAULT '',
-                verified_at TIMESTAMP,
-                last_error TEXT DEFAULT '',
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        # ─── v4.10.2: per-user provider API keys ──────────────────────────────
-        # Each user can save several providers with their own key/base + the
-        # live model list fetched from the provider (models_json cache).
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS user_llm_keys (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-                provider TEXT NOT NULL,
-                api_key TEXT NOT NULL DEFAULT '',
-                api_base TEXT NOT NULL DEFAULT '',
-                default_model TEXT DEFAULT '',
-                models_json TEXT NOT NULL DEFAULT '[]',
-                verified INTEGER NOT NULL DEFAULT 0,
-                verified_model TEXT DEFAULT '',
-                verified_at TIMESTAMP,
-                last_error TEXT DEFAULT '',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(user_id, provider)
-            )
-        """)
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_user_llm_keys_user ON user_llm_keys(user_id)")
-        # v4.12: provider activation/verification — a provider is only offered in
-        # the Agent UI once it is configured AND its connection test succeeded.
-        for col, ddl in (
-            ("verified", "INTEGER NOT NULL DEFAULT 0"),
-            ("verified_model", "TEXT DEFAULT ''"),
-            ("verified_at", "TIMESTAMP"),
-            ("last_error", "TEXT DEFAULT ''"),
-        ):
-            try:
-                conn.execute(f"ALTER TABLE user_llm_keys ADD COLUMN {col} {ddl}")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        for col, ddl in (
-            ("verified", "INTEGER NOT NULL DEFAULT 0"),
-            ("verified_model", "TEXT DEFAULT ''"),
-            ("verified_at", "TIMESTAMP"),
-            ("last_error", "TEXT DEFAULT ''"),
-        ):
-            try:
-                conn.execute(f"ALTER TABLE llm_config ADD COLUMN {col} {ddl}")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        # Migration: per-conversation provider/model override columns
-        for col in ("provider", "model"):
-            try:
-                conn.execute(f"ALTER TABLE agent_conversations ADD COLUMN {col} TEXT DEFAULT ''")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_llm ON agent_conversations(provider, model)")
-        conn.commit()
-
-        # ── v5.2.0: apply any pending VERSIONED migrations (schema_version) ──
-        from app.migrations import apply_migrations
-        apply_migrations(conn)
-
-    # Webhook subscriptions (v2.1.0) — created here (idempotent) so the full
-    # schema exists without depending on the FastAPI lifespan startup.
-    from app.services.webhook_outbound import init_webhook_tables
-    init_webhook_tables()
-

@contextmanager
 def get_conn():
@@ -837,11 +471,6 @@ def get_conn():
    conn.row_factory = sqlite3.Row
    conn.execute("PRAGMA journal_mode=WAL")
    conn.execute("PRAGMA foreign_keys=ON")
-    # A21 (partiel) : un seul writer par DB — sans timeout la requête concurrente
-    # échoue immédiatement avec « database is locked » (tests xdist, schedulers).
-    # ponytail: le reste d'A21 (wrapper async + 510 call sites synchrones sur
-    # l'event loop) reste à migrer module par module.
-    conn.execute("PRAGMA busy_timeout=5000")
    try:
        yield conn
    finally:
@@ -1,67 +1,22 @@
 """FlowDeck — Kanban léger intégré à Gitea."""
 from __future__ import annotations

-import asyncio
 import logging
 from contextlib import asynccontextmanager

 from fastapi import FastAPI, Request
-from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
-from starlette.exceptions import HTTPException as _StarHTTPException
+from fastapi.middleware.cors import CORSMiddleware
 from starlette.middleware.sessions import SessionMiddleware

 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
 from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
-from app.routers import (
-    admin,
-    agent,
-    api,
-    auth,
-    board,
-    collections,
-    dashboard,
-    export,
-    library,
-    my_tasks,
-    notes,
-    onboarding,
-    projects,
-    public_api,
-    search,
-    security,
-    sharing,
-    sidebar_config,
-    sync,
-    webhooks,
-    workspace,
-)
-from app.routers.api_v2 import router as api_v2_router
-from app.routers.api_v2_agent import router as api_v2_agent_router
-from app.routers.audit import router as audit_router
-from app.routers.automations import router as automations_router
-from app.routers.collaboration import router as collaboration_router
-from app.routers.emoji import router as emoji_router
+from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace, library, public_api, admin, sharing
 from app.routers.gitea import router as gitea_router
 from app.routers.github_routes import router as github_router
-from app.routers.governance import router as governance_router
-from app.routers.imports import page_router as import_page_router
-from app.routers.imports import router as imports_router
-from app.routers.meetings import router as meetings_router
-from app.routers.notifications import router as notifications_router
-from app.routers.permissions import router as permissions_router
-from app.routers.realtime import router as realtime_router
-from app.routers.scim import router as scim_router
-from app.routers.search_ai import router as search_ai_router
-from app.routers.sites import router as sites_router
-from app.routers.sso import router as sso_router
-from app.routers.web_clipper import api_router as web_clipper_api_router
-from app.routers.web_clipper import router as web_clipper_router
-from app.routers.webauthn import router as webauthn_router
-from app.routers.wiki import router as wiki_router
-from app.routers.workers import router as workers_router
+from app.services.gitea_client import gitea
 from app.services.webhook_outbound import init_webhook_tables

 logging.basicConfig(
@@ -71,123 +26,28 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)


-def _spawn(name: str, factory):
-    """A34 : une tâche scheduler meurt en silence (aucun done_callback).
-
-    Loggue l'exception puis recrée la coroutine 10 s plus tard.
-    ponytail: pas de backoff exponentiel — un scheduler qui replante à chaque
-    tick reste visible (1 cycle / 10 s) dans les logs ; ajouter un backoff si
-    le bruit devient un problème.
-    """
-
-    async def _guard():
-        while True:
-            try:
-                await factory()
-            except asyncio.CancelledError:
-                raise
-            except Exception:
-                logger.exception("scheduler %s plante - redemarrage dans 10 s", name)
-                await asyncio.sleep(10)
-            else:
-                logger.warning("scheduler %s termine - redemarrage dans 10 s", name)
-                await asyncio.sleep(10)
-
-    return asyncio.create_task(_guard())
-
-
@asynccontextmanager
 async def lifespan(_app: FastAPI):
    init_db()
    init_webhook_tables()
-    import os
-    import secrets
-
    from app.db import get_conn
    from app.password_utils import hash_password
-
-    # A26 : secret de session par défaut refusé (il signe `flowdeck_session`).
-    if settings.app_secret_key == "change-me-to-random":
-        raise RuntimeError(
-            "APP_SECRET_KEY non défini — générer une valeur : "
-            'python -c "import secrets;print(secrets.token_hex(32))" puis la mettre dans .env'
-        )
-
-    # A8 : plus de mot de passe admin codé en dur — mot de passe aléatoire au
-    # premier boot (affiché une fois) ou FLOWDECK_ADMIN_PASSWORD ; re-seed si absent.
+    admin_hash = hash_password("FlowDeck2026!")
    with get_conn() as conn:
-        if not conn.execute("SELECT 1 FROM users WHERE login='admin'").fetchone():
-            admin_pw = os.environ.get("FLOWDECK_ADMIN_PASSWORD") or secrets.token_urlsafe(12)
-            conn.execute(
-                "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES ('admin', 'Admin', '', ?, 1)",
-                (hash_password(admin_pw),),
-            )
-            conn.commit()
-            logger.warning(
-                "Premier démarrage : compte admin créé, mot de passe = %s "
-                "(définir FLOWDECK_ADMIN_PASSWORD pour le fixer)",
-                admin_pw,
-            )
-
-    # ── FlowDeck Agent (v4.10.0): scheduled custom-agent triggers ──
-    from app.routers.agent import agent_scheduler
-    scheduler_task = _spawn("agent_scheduler", agent_scheduler)
-
-    # ── Automations (v5.1.0): cron trigger scheduler ──
-    from app.services.automations import automation_scheduler
-    automation_task = _spawn("automation_scheduler", automation_scheduler)
-
-    # ── Backups (v5.2.0): automatic daily SQLite snapshot ──
-    from app.services.backup import backup_scheduler
-    backup_task = _spawn("backup_scheduler", backup_scheduler)
-
-    # ── Forge projects sync (v5.2.0): hourly refresh of `projects` ──
-    from app.services.projects import project_sync_scheduler
-    projects_task = _spawn("project_sync_scheduler", project_sync_scheduler)
-
-    # ── Global trash purge (v5.4.0): daily cleanup of 30-day-old pages ──
-    from app.services.trash import trash_purge_scheduler
-    trash_task = _spawn("trash_purge_scheduler", trash_purge_scheduler)
-
-    # ── Reminders (v5.8.0): due-reminder scan for database rows ──
-    from app.services.reminders import reminder_scheduler
-    reminder_task = _spawn("reminder_scheduler", reminder_scheduler)
-
-    # ── Semantic search (v6.9.0): incremental vector indexing ──
-    from app.services.semantic_search import semantic_index_scheduler
-    semantic_task = _spawn("semantic_index_scheduler", semantic_index_scheduler)
-
-    # ── Calendar sync (v7.1.0): external calendars every 15 min ──
-    from app.services.calendar_sync import calendar_sync_scheduler
-    calendar_task = _spawn("calendar_sync_scheduler", calendar_sync_scheduler)
-
-    # ── Webhooks outbound (v6.4.0): retry failed deliveries ──
-    from app.services.webhook_outbound import webhook_retry_scheduler
-    webhook_task = None
-    if settings.webhook_retry_enabled:
-        webhook_task = _spawn("webhook_retry_scheduler", webhook_retry_scheduler)
-
-    logger.info("FlowDeck v%s started on port %d", dashboard._get_app_version(), settings.app_port)
-    try:
-        yield
-    finally:
-        _tasks = (scheduler_task, automation_task, backup_task, projects_task, trash_task, reminder_task, semantic_task, calendar_task)
-        if webhook_task is not None:
-            _tasks = _tasks + (webhook_task,)
-        for task in _tasks:
-            task.cancel()
-        for task in _tasks:
-            try:
-                await task
-            except asyncio.CancelledError:
-                pass
+        conn.execute(
+            "INSERT OR IGNORE INTO users (login, full_name, email, password_hash, is_admin) VALUES ('admin', 'Admin', '', ?, 1)",
+            (admin_hash,)
+        )
+        conn.commit()
+    logger.info("FlowDeck v4.0.0 started on port %d", settings.app_port)
+    yield


 app = FastAPI(
    title="FlowDeck",
-    version="7.30.0",
-    docs_url="/docs",
-    redoc_url="/redoc",
+    version="4.0.0",
+    docs_url="/docs" if settings.log_level == "DEBUG" else None,
+    redoc_url=None,
    lifespan=lifespan,
 )

@@ -195,30 +55,12 @@ app.add_middleware(SessionMiddleware, secret_key=settings.app_secret_key, max_ag
 app.add_middleware(CSRFMiddleware)
 app.add_middleware(ContentSecurityPolicyMiddleware)
 app.add_middleware(RateLimitMiddleware)
-# A37 : origines explicites (l'auth est un cookie de session ; le front est
-# servi par le même hôte). `*` + credentials est la combinaison interdite par la
-# spec CORS — ici ni les deux ni l'un : liste fermée, méthodes/entêtes minutées.
-_CORS_ORIGINS = sorted(
-    {o.rstrip("/") for o in (settings.app_base_url or "").split() if o.startswith(("http://", "https://"))}
-)
-# Hors prod : dev local + origines d'extension (Web Clipper, Bearer uniquement —
-# pas de cookie → `allow_credentials` ne s'applique pas à ces origines).
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=_CORS_ORIGINS,
-    allow_origin_regex=r"https?://(localhost|127\.0\.0\.1)(:\d+)?|\w+-extension://.*",
-    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
-    allow_headers=["Authorization", "Content-Type", "X-CSRF-Token", "Idempotency-Key"],
-    allow_credentials=True,
-)
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])

 app.include_router(auth.router)
-app.include_router(sso_router)
 app.include_router(dashboard.router)
 app.include_router(board.router)
 app.include_router(notes.router)
-app.include_router(projects.router)
-app.include_router(projects.backups_router)
 app.include_router(api.router)
 app.include_router(webhooks.router)
 app.include_router(collections.router)
@@ -230,74 +72,28 @@ app.include_router(gitea_router)
 app.include_router(github_router)
 app.include_router(public_api.router)
 app.include_router(sharing.router)
-app.include_router(sidebar_config.router)
-app.include_router(export.router)
-app.include_router(notifications_router)
-app.include_router(automations_router)
-app.include_router(collaboration_router)
-app.include_router(emoji_router)
-app.include_router(realtime_router)
-app.include_router(agent.router)
-app.include_router(search.router)
-app.include_router(security.router)
-app.include_router(onboarding.router)
-app.include_router(sync.router)
-app.include_router(imports_router)
-app.include_router(import_page_router)
-app.include_router(permissions_router)
-app.include_router(web_clipper_api_router)
-app.include_router(web_clipper_router)
-app.include_router(api_v2_router)
-app.include_router(api_v2_agent_router)
-app.include_router(sites_router)
-app.include_router(search_ai_router)
-app.include_router(workers_router)
-app.include_router(meetings_router)
-# v7.2.0 — enterprise admin
-app.include_router(scim_router)
-app.include_router(webauthn_router)
-app.include_router(audit_router)
-app.include_router(governance_router)
-# v7.3.0 — teamspaces + verified wiki
-app.include_router(wiki_router)

 app.mount("/static", StaticFiles(directory="static"), name="static")


@app.get("/manifest.json")
-def pwa_manifest():
-    """Serve the static web manifest from disk (same URL as before v6.0.0)."""
-    from fastapi.responses import FileResponse
-    return FileResponse("static/manifest.json", media_type="application/manifest+json")
-
-
-@app.get("/sw.js")
-def service_worker():
-    """Serve the PWA service worker at top-level scope (/)."""
-    from fastapi.responses import FileResponse
-    return FileResponse("static/sw.js", media_type="application/javascript")
+async def pwa_manifest():
+    return {
+        "name": "FlowDeck",
+        "short_name": "FlowDeck",
+        "start_url": "/",
+        "display": "standalone",
+        "background_color": "#191919",
+        "theme_color": "#191919",
+        "icons": [{"src": "/static/icon-192.png", "sizes": "192x192", "type": "image/png"}],
+    }


 # ═══════════ API aliases (v4.0.1) ═══════════


-@app.get("/api/csrf-token")
-def csrf_token_endpoint(request: Request):
-    """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
-    import secrets
-
-    from fastapi.responses import JSONResponse
-    token = secrets.token_hex(32)
-    response = JSONResponse({"csrf_token": token})
-    response.set_cookie(
-        "csrf_token", token,
-        httponly=False, samesite="lax", max_age=86400, path="/",
-    )
-    return response
-
-
@app.get("/api/pages")
-def api_pages_alias(request: Request):
+async def api_pages_alias(request: Request):
    """Alias /api/pages → /board/api/pages for API path consistency."""
    from fastapi.responses import RedirectResponse
    qs = str(request.url.query)
@@ -306,7 +102,7 @@ def api_pages_alias(request: Request):


@app.post("/api/pages")
-def api_pages_post_alias(request: Request):
+async def api_pages_post_alias(request: Request):
    """Alias POST /api/pages → /board/api/pages for API path consistency."""
    from fastapi.responses import RedirectResponse
    return RedirectResponse(url="/board/api/pages", status_code=307)
@@ -340,41 +136,12 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 </html>"""


-@app.exception_handler(_StarHTTPException)
-def http_exception_handler(request: Request, exc: _StarHTTPException):
-    """Unified handler: RFC7807 for /api/v2, JSON for other /api, redirect for HTML.
-
-    Registered on Starlette's HTTPException (the base class) so it catches both
-    raised exceptions and route-miss 404s.
-    """
-    status = getattr(exc, "status_code", 500)
-    detail = getattr(exc, "detail", str(exc))
-    is_api_v2 = request.url.path.startswith("/api/v2")
-    # Programmatic API prefixes that must always answer JSON errors instead of
-    # being redirected to the HTML shell (SCIM 2.0 clients, WebAuthn fetch).
-    JSON_ERROR_PREFIXES = ("/api/v2", "/scim/v2", "/auth/webauthn")
-    is_json_api = request.url.path.startswith(JSON_ERROR_PREFIXES)
-    if status == 404:
-        if is_api_v2:
-            from app.services.api_v2_helpers import problem_response
-            return problem_response(request, exc)
-        if is_json_api and request.url.path.startswith("/scim/v2"):
-            from fastapi.responses import JSONResponse
-            return JSONResponse(
-                {"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
-                 "detail": detail if isinstance(detail, str) else "Not found",
-                 "status": "404"},
-                status_code=404,
-                headers={"Content-Type": "application/scim+json"},
-            )
-        if "/api" in request.url.path or is_json_api:
-            from fastapi.responses import JSONResponse
-            return JSONResponse({"detail": detail if isinstance(detail, str) else "Not found"}, status_code=404)
-        from fastapi.responses import RedirectResponse
-        return RedirectResponse("/workspaces", status_code=302)
-    # Non-404: RFC7807 for /api/v2
-    if is_api_v2:
-        from app.services.api_v2_helpers import problem_response
-        return problem_response(request, exc)
-    from fastapi.responses import JSONResponse
-    return JSONResponse({"detail": detail if isinstance(detail, str) else str(detail)}, status_code=status)
+@app.exception_handler(404)
+async def not_found_handler(request: Request, exc):
+    """Styled 404 page matching the FlowDeck dark theme."""
+    from fastapi.responses import HTMLResponse
+    # API routes should get JSON, not HTML
+    if request.url.path.startswith("/api/") or request.url.path.startswith("/board/api/"):
+        from fastapi.responses import JSONResponse
+        return JSONResponse({"detail": "Not found"}, status_code=404)
+    return HTMLResponse(NOT_FOUND_HTML, status_code=404)
@@ -1,4 +1,2 @@
 """FlowDeck — Custom middleware."""
 from app.middleware.csrf import CSRFMiddleware
-
-__all__ = ["CSRFMiddleware"]
@@ -4,8 +4,8 @@ from __future__ import annotations
 import secrets

 from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.requests import Request
 from starlette.responses import JSONResponse
+from starlette.requests import Request


 class CSRFMiddleware(BaseHTTPMiddleware):
@@ -16,23 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
    """

    SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    # NOTE: ``/scim/v2`` is Bearer-token only (no cookie auth), so CSRF does not
-    # apply — IdP SCIM clients (Okta, Entra) cannot send an X-CSRF-Token.
-    # A19 — LISTE FINALE : plus aucun préfixe cookie-auth n'est exempté.
-    # Tous les appels non-GET du front envoient désormais `X-CSRF-Token`
-    # (46 sites équipés en v7.3.6 : agent_panel, settings, local_workspace,
-    # library, gitea_workspace, workspace, workspaces, welcome).
-    # Ne restent que du machine-to-machine / hors session :
-    #   - Bearer      : /api/webhook, /api/v1, /api/v2, /scim/v2
-    #   - callbacks    : /auth/* (login, register, SSO, 2FA, WebAuthn)
-    #   - publics      : /s/ (sites), /f/ (forms)
-    #   - infra/diag   : /api/csrf-token (le jeton lui-même), /api/frontend-error
-    EXCLUDED_PATHS = {
-        "/api/webhook", "/api/v1", "/api/v2", "/scim/v2",
-        "/auth/callback", "/auth/register", "/auth/local-login", "/auth/local-verify",
-        "/auth/2fa", "/auth/saml", "/auth/oidc", "/auth/webauthn",
-        "/s/", "/f/", "/api/csrf-token", "/api/frontend-error",
-    }
+    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea", "/api/github", "/api/pages", "/api/recents"}

    async def dispatch(self, request: Request, call_next):
        # Webhook receiver, OAuth callback, and internal API are exempt
@@ -1,9 +1,6 @@
 """FlowDeck — Security middleware: CSP headers + rate limiting."""
 from __future__ import annotations

-import ipaddress
-import re
-import secrets
 import time
 from collections import defaultdict

@@ -11,8 +8,6 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
 from starlette.responses import JSONResponse

-from app.templating import CSP_NONCE
-
 # ── Constants ────────────────────────────────────────────────

 # Allowed extensions for file uploads
@@ -67,32 +62,13 @@ class ContentSecurityPolicyMiddleware(BaseHTTPMiddleware):
    """

    CSP_HEADER = "Content-Security-Policy"
-    # A20 : `unsafe-inline` sort de script-src (remplacé par un nonce par
-    # requête — un XSS injecté dans une page ne tourne plus). Les 74 handlers
-    # inline `onclick=` restent couverts par `script-src-attr`, explicitement
-    # détaché de script-src (sinon le nonce les désactiverait aussi).
-    # `unsafe-eval` reste : Alpine (x-data en string) et htmx (hx-vars) en ont
-    # besoin → à retirer avec le build CSP d'Alpine (voir reste d'A20).
    CSP_VALUE = (
        "default-src 'self'; "
-        # A20 phase 2 : chart.js/leaflet vendorisés dans /static/js/vendor
-        # (test_csp_no_cdn_and_vendor), plus aucun hôte CDN tiers.
-        # `unsafe-eval` reste : Alpine (x-data) + htmx (hx-on/hx-vars) en
-        # ont besoin → retrait avec le build CSP d'Alpine (reste d'A20).
-        "script-src 'self' 'unsafe-eval' 'nonce-{nonce}'; "
-        "script-src-attr 'unsafe-inline'; "
-        # ponytail: aucun @font-face Google (grep négatif) → les deux
-        # hôtes fonts étaient morts, supprimés.
-        "style-src 'self' 'unsafe-inline'; "
-        # ponytail: `https:` reste ouvert — unfurls (YouTube/Vimeo/…) et
-        # tuiles OSM sont inénumérables ; plafond assumé, à resserrer si
-        # un proxy d'images local arrive.
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
        "img-src 'self' data: blob: https:; "
-        "font-src 'self' data:; "
-        # connect-src fermé : plus de `https:` (aucun fetch cross-origin
-        # côté front — grep négatif) et websockets scopés à l'hôte de la
-        # requête ({host}) → plus de canal d'exfil vers un tiers.
-        "connect-src 'self' ws://{host} wss://{host}; "
+        "font-src 'self' data: https://fonts.gstatic.com; "
+        "connect-src 'self' https: wss:; "
        "media-src 'self' blob:; "
        "frame-src 'self'; "
        "object-src 'none'; "
@@ -101,22 +77,11 @@ class ContentSecurityPolicyMiddleware(BaseHTTPMiddleware):
    )

    async def dispatch(self, request: Request, call_next):
-        nonce = secrets.token_urlsafe(16)
-        # Posé AVANT call_next : BaseHTTPMiddleware exécute le aval dans une
-        # tâche créée maintenant → le contexte (donc le nonce) y est copié,
-        # exactement ce que les templates liront via `csp_nonce()`.
-        CSP_NONCE.set(nonce)
        response = await call_next(request)
        # Only set CSP on HTML responses
        content_type = response.headers.get("content-type", "")
        if "text/html" in content_type:
-            # Host du navigateur (uvicorn rejette les Host invalides) ;
-            # on retire quand même tout caractère hors base URL par sécurité.
-            host = re.sub(r"[^0-9A-Za-z.\-:\[\]]", "",
-                          request.headers.get("host", ""))
-            response.headers[self.CSP_HEADER] = self.CSP_VALUE.format(
-                nonce=nonce, host=host
-            )
+            response.headers[self.CSP_HEADER] = self.CSP_VALUE
        return response


@@ -132,16 +97,8 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
    # Paths that should be rate-limited
    RATE_LIMITED_PREFIXES: tuple[str, ...] = (
        "/api/", "/board/api/", "/auth/",
-        # A33 : préfixes qui manquaient — SCIM (brute force de jetons/IdP),
-        # API workspace + collections (les endpoints mutants du legacy).
-        "/scim/v2/", "/workspace/", "/db/",
    )

-    # Pages publiques : seul le non-GET est plafonné (brute force de
-    # /s/<slug>/auth et spam de /f/<token>) — la lecture reste libre pour les
-    # visiteurs d'un site publié qui partagent une IP.
-    RATE_LIMITED_NON_GET_PREFIXES: tuple[str, ...] = ("/s/", "/f/")
-
    # Paths exempt from rate limiting even under an API prefix
    EXEMPT_PATHS: frozenset[str] = frozenset({
        "/api/health",
@@ -149,82 +106,36 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
        "/api/frontend-errors",
    })

-    def __init__(self, app, max_requests: int | None = None, window_seconds: int = 60):
+    def __init__(self, app, max_requests: int = 100, window_seconds: int = 60):
        super().__init__(app)
-        # A33 : None = lire `settings.rate_limit_requests` à chaque requête (la
-        # valeur de config n'était jamais lue — 100 codé en dur contre 60 annoncé).
        self.max_requests = max_requests
        self.window_seconds = window_seconds
        self._store: dict[str, tuple[float, int]] = defaultdict(lambda: (0.0, 0))
-        self._last_prune = 0.0
-        self._max_keys = 5000

    async def dispatch(self, request: Request, call_next):
        path = request.url.path

-        # Respect the global rate-limit toggle (disabled in tests/local).
-        from app.config import settings
-        if not settings.rate_limit_enabled:
-            return await call_next(request)
-
-        # Only rate-limit API routes (+ non-GET sur les pages publiques)
-        method = request.method.upper()
-        limited = any(path.startswith(p) for p in self.RATE_LIMITED_PREFIXES) or (
-            method not in ("GET", "HEAD", "OPTIONS")
-            and any(path.startswith(p) for p in self.RATE_LIMITED_NON_GET_PREFIXES)
-        )
-        if not limited:
+        # Only rate-limit API routes
+        if not any(path.startswith(p) for p in self.RATE_LIMITED_PREFIXES):
            return await call_next(request)

        # Exempt health check and error capture
        if path in self.EXEMPT_PATHS:
            return await call_next(request)

-        limit = self.max_requests or settings.rate_limit_requests
-        ip = self._client_key(request)
+        ip = request.client.host if request.client else "unknown"
        now = time.time()

-        # A33 : le store n'était jamais épuré → croissance mémoire par IP.
-        if len(self._store) > self._max_keys and now - self._last_prune > self.window_seconds:
-            self._prune(now)
-
        window_start, count = self._store[ip]
        if now - window_start > self.window_seconds:
            self._store[ip] = (now, 1)
            return await call_next(request)

-        if count >= limit:
+        if count >= self.max_requests:
            return JSONResponse(
-                {"error": "Rate limit exceeded", "detail": f"Max {limit} req/min per IP"},
+                {"error": "Rate limit exceeded", "detail": f"Max {self.max_requests} req/min per IP"},
                status_code=429,
            )

        self._store[ip] = (window_start, count + 1)
        return await call_next(request)
-
-    def _client_key(self, request: Request) -> str:
-        """A33 : X-Forwarded-For uniquement derrière un proxy local.
-
-        Le test porte sur `is_private` (Python ≥ 3.13 : toutes les plages non
-        globales, pas seulement RFC1918) — un pair non-global n'est pas un
-        internaute, donc le XFF du proxy fait foi.
-        ponytail: si un jour plusieurs proxies se chaînent (ou si l'app est
-        exposée directement), prendre la dernière adresse non privée de la
-        chaîne plutôt que la première.
-        """
-        host = request.client.host if request.client else "unknown"
-        fwd = request.headers.get("x-forwarded-for", "")
-        if fwd:
-            try:
-                direct = ipaddress.ip_address(host)
-                if direct.is_private or direct.is_loopback:
-                    return fwd.split(",")[0].strip() or host
-            except ValueError:
-                pass  # hôte non-IP (testserver…) → on garde la clé d'origine
-        return host
-
-    def _prune(self, now: float) -> None:
-        expired = [k for k, (start, _) in self._store.items() if now - start > self.window_seconds]
-        for k in expired:
-            del self._store[k]
-        self._last_prune = now
@@ -1,9 +1,13 @@
 """FlowDeck — Pydantic request models for API validation."""
 from __future__ import annotations

+from typing import Optional
+
+from fastapi import UploadFile
 from pydantic import BaseModel, Field, model_validator

-from app.middleware.security import ALLOWED_EXTENSIONS, _ext
+from app.middleware.security import ALLOWED_EXTENSIONS, MAX_UPLOAD_SIZE, _ext
+

 # ── File Save ────────────────────────────────────────────────

@@ -12,7 +16,7 @@ class FileSaveRequest(BaseModel):
    path: str = Field(..., min_length=1, description="File path in the repository")
    content: str = Field(..., description="File content (UTF-8 encoded)")
    message: str = Field(default="Update via FlowDeck", description="Commit message")
-    sha: str | None = Field(default=None, description="SHA of the file being updated (required for updates)")
+    sha: Optional[str] = Field(default=None, description="SHA of the file being updated (required for updates)")

    @model_validator(mode="after")
    def validate_path_extension(self):
@@ -30,10 +34,26 @@ class UploadValidationResult(BaseModel):
    size: int
    extension: str
    valid: bool
-    error: str | None = None
+    error: Optional[str] = None


+def validate_upload_request(file: UploadFile) -> Optional[str]:
+    """Validate an uploaded file (size + extension). Returns error message or None."""
+    # Size check — we can't read the full file without a size attribute,
+    # but Starlette's UploadFile has a size property from Content-Length
+    if hasattr(file, 'size') and file.size is not None and file.size > MAX_UPLOAD_SIZE:
+        return f"File '{file.filename}' exceeds maximum size of 10 MB"

+    # Extension check
+    if file.filename:
+        ext = _ext(file.filename)
+        if ext and ext not in ALLOWED_EXTENSIONS:
+            return f"File extension '{ext}' is not allowed"
+
+    return None
+
+
+# ── Issue Create / Update ────────────────────────────────────

 class IssueCreateRequest(BaseModel):
    """Request model for creating a Gitea issue."""
@@ -46,12 +66,12 @@ class IssueCreateRequest(BaseModel):

 class IssueUpdateRequest(BaseModel):
    """Request model for updating a Gitea issue (partial update)."""
-    title: str | None = Field(default=None, max_length=500)
-    body: str | None = Field(default=None)
-    state: str | None = Field(default=None, pattern=r"^(open|closed)$")
-    labels: str | None = Field(default=None, description="Comma-separated label IDs")
-    milestone: str | None = Field(default=None)
-    assignee: str | None = Field(default=None)
+    title: Optional[str] = Field(default=None, max_length=500)
+    body: Optional[str] = Field(default=None)
+    state: Optional[str] = Field(default=None, pattern=r"^(open|closed)$")
+    labels: Optional[str] = Field(default=None, description="Comma-separated label IDs")
+    milestone: Optional[str] = Field(default=None)
+    assignee: Optional[str] = Field(default=None)


 # ── Card Move ────────────────────────────────────────────────
@@ -1,7 +1,7 @@
 """FlowDeck — Standardized response models."""
 from __future__ import annotations

-from typing import Any
+from typing import Any, Optional

 from pydantic import BaseModel

@@ -13,7 +13,7 @@ class ErrorResponse(BaseModel):
        ErrorResponse(error="Rate limit exceeded", detail="Max 100 req/min per IP")
    """
    error: str
-    detail: str | None = None
+    detail: Optional[str] = None

    model_config = {
        "json_schema_extra": {
@@ -29,7 +29,7 @@ class SuccessResponse(BaseModel):
        SuccessResponse(status="ok", data={"issue_id": 42})
    """
    status: str = "ok"
-    data: dict[str, Any] | None = None
+    data: Optional[dict[str, Any]] = None

    model_config = {
        "json_schema_extra": {
@@ -1,5 +1,5 @@
 """FlowDeck — Admin API: users, roles, stats, audit."""
-from fastapi import APIRouter, Body, Depends, HTTPException, Request
+from fastapi import APIRouter, Request, Depends, HTTPException
 from fastapi.responses import JSONResponse

 router = APIRouter(tags=["admin"], prefix="/api/admin")
@@ -8,7 +8,7 @@ router = APIRouter(tags=["admin"], prefix="/api/admin")
 # ── Dependency ──
 async def admin_required(request: Request):
    from app.auth.session import get_current_user
-    user = get_current_user(request)
+    user = await get_current_user(request)
    if not user:
        raise HTTPException(status_code=403, detail="Admin access required")
    # Also check DB directly (session cookie may be stale)
@@ -23,7 +23,7 @@ async def admin_required(request: Request):

 # ── Users ──
@router.get("/users")
-def list_users(_admin=Depends(admin_required)):
+async def list_users(_admin=Depends(admin_required)):
    """List all users with workspace/file/folder counts and storage usage."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -46,11 +46,15 @@ def list_users(_admin=Depends(admin_required)):


@router.post("/users")
-def create_user(request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+async def create_user(request: Request, _admin=Depends(admin_required)):
    """Create a new user (admin only)."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    login = body.get("login", "").strip()
    name = body.get("name", login)
    email = body.get("email", login)
@@ -74,11 +78,15 @@ def create_user(request: Request, _admin=Depends(admin_required), body: dict = B


@router.put("/users/{user_id:int}")
-def update_user(user_id: int, request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+async def update_user(user_id: int, request: Request, _admin=Depends(admin_required)):
    """Update a user: name, email, password, admin status, active status."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    with get_conn() as conn:
        user = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
        if not user:
@@ -101,7 +109,7 @@ def update_user(user_id: int, request: Request, _admin=Depends(admin_required),


@router.delete("/users/{user_id:int}")
-def delete_user(user_id: int, _admin=Depends(admin_required)):
+async def delete_user(user_id: int, _admin=Depends(admin_required)):
    """Delete a user and cascade their data."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -131,7 +139,7 @@ def delete_user(user_id: int, _admin=Depends(admin_required)):

 # ── Stats ──
@router.get("/stats")
-def user_stats(_admin=Depends(admin_required)):
+async def user_stats(_admin=Depends(admin_required)):
    """Aggregate stats: total users, workspaces, files, storage."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -151,7 +159,7 @@ def user_stats(_admin=Depends(admin_required)):

 # ── Audit ──
@router.get("/audit")
-def audit_log(limit: int = 100, _admin=Depends(admin_required)):
+async def audit_log(limit: int = 100, _admin=Depends(admin_required)):
    """Recent login history."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -3,39 +3,20 @@ from __future__ import annotations

 import json
 import logging
-from datetime import UTC, datetime
+from datetime import datetime
+from typing import Optional

-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse

-from app.auth.session import SessionManager
 from app.config import settings
 from app.db import get_conn
-from app.routers.board import STATUS_COLORS, STATUS_LABELS, _issue_column, _map_issue_to_card
+from app.routers.board import _issue_column, _map_issue_to_card, STATUS_COLORS, STATUS_LABELS
 from app.services.gitea_client import gitea
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
-
-# A17 : ce router legacy ne sert plus un anonymous. Deux exceptions assumées —
-# le probe d'infra (Docker HEALTHCHECK / CI) et la remontée d'erreur client.
-_API_PUBLIC_PATHS = {"/api/health", "/api/frontend-error"}
-
-
-async def _require_session_or_bearer(request: Request) -> None:
-    """Session de cookie **ou** Bearer d'API valide sur toutes les routes /api."""
-    if request.url.path in _API_PUBLIC_PATHS:
-        return
-    if SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        return
-    auth = request.headers.get("Authorization", "")
-    if auth.startswith("Bearer "):
-        from app.routers.public_api import verify_token
-        verify_token(auth)
-        return
-    raise HTTPException(401, "Authentication required")
-
-
-router = APIRouter(tags=["api"], prefix="/api", dependencies=[Depends(_require_session_or_bearer)])
+router = APIRouter(tags=["api"], prefix="/api")

 # ── Simple rate limiter (in-memory, per-IP) ──
 _rate_limit_store: dict[str, tuple[float, int]] = {}
@@ -46,7 +27,7 @@ def _check_rate_limit(request: Request) -> bool:
    if not settings.rate_limit_enabled:
        return True
    ip = request.client.host if request.client else "unknown"
-    now = datetime.now(UTC).replace(tzinfo=None).timestamp()
+    now = datetime.utcnow().timestamp()
    window_start, count = _rate_limit_store.get(ip, (0, 0))
    if now - window_start > 60:
        _rate_limit_store[ip] = (now, 1)
@@ -67,12 +48,12 @@ async def health(request: Request):
            conn.execute("SELECT 1")
        db_ok = True
    except Exception:
-        logger.exception("health")
+        pass
    try:
        await gitea.get_user_repos(page=1, limit=1)
        gitea_ok = True
    except Exception:
-        logger.exception("health")
+        pass

    return {
        "status": "ok" if (db_ok and gitea_ok) else "degraded",
@@ -83,7 +64,7 @@ async def health(request: Request):


@router.get("/stats")
-def stats():
+async def stats():
    """Global stats for dashboard."""
    with get_conn() as conn:
        board_count = conn.execute("SELECT COUNT(*) as c FROM boards").fetchone()["c"]
@@ -99,6 +80,22 @@ def stats():
    }


+@router.get("/projects")
+async def projects(search: str = Query(default=""), show_archived: bool = Query(default=False)):
+    """List Gitea projects (JSON)."""
+    try:
+        repos = await gitea.get_user_repos(page=1, limit=50)
+        if search:
+            q = search.lower()
+            repos = [r for r in repos if q in r.get("full_name", "").lower() or q in (r.get("description") or "").lower()]
+        if not show_archived:
+            repos = [r for r in repos if not r.get("archived", False)]
+        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
+    except Exception:
+        repos = []
+    return {"projects": repos}
+
+
@router.post("/move")
 async def move_card(
    request: Request,
@@ -153,7 +150,7 @@ async def move_card(
                issue = await gitea.get_issue(owner, repo, issue_id)
                current_labels = [lbl["name"] for lbl in issue.get("labels", [])]
                status_labels = await _get_status_labels(owner, repo, board_id)
-                filtered_names = [name for name in current_labels if name not in status_labels]
+                filtered_names = [l for l in current_labels if l not in status_labels]
                filtered_names.append(mapping["gitea_label"])

                # Resolve label names to IDs
@@ -179,7 +176,7 @@ async def _get_status_labels(owner: str, repo: str, board_id: int) -> list[str]:


@router.post("/col-mapping")
-def set_col_mapping(
+async def set_col_mapping(
    owner: str = Query(...),
    repo: str = Query(...),
    column: str = Query(...),
@@ -209,7 +206,7 @@ def set_col_mapping(


@router.delete("/col-mapping")
-def delete_col_mapping(
+async def delete_col_mapping(
    owner: str = Query(...),
    repo: str = Query(...),
    column: str = Query(...),
@@ -234,7 +231,7 @@ def delete_col_mapping(


@router.get("/board-config/{owner}/{repo}")
-def get_board_config(owner: str, repo: str):
+async def get_board_config(owner: str, repo: str):
    with get_conn() as conn:
        board = conn.execute(
            "SELECT * FROM boards WHERE project_owner=? AND project_name=?",
@@ -255,7 +252,7 @@ def get_board_config(owner: str, repo: str):


@router.post("/board-config/{owner}/{repo}")
-def update_board_config(
+async def update_board_config(
    owner: str,
    repo: str,
    columns: str = Query(default=""),
@@ -297,7 +294,7 @@ async def create_issue(
    if not _check_rate_limit(request):
        raise HTTPException(status_code=429, detail="Rate limit exceeded")

-    label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()] if labels else None
+    label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()] if labels else None
    milestone_id = int(milestone) if milestone.strip().isdigit() else None

    issue = await gitea.create_issue(
@@ -349,7 +346,7 @@ async def update_issue_api(
    if state:
        kwargs["state"] = state
    if labels:
-        label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()]
+        label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()]
    if milestone and milestone.strip().isdigit():
        kwargs["milestone"] = int(milestone)
    if assignee:
@@ -392,7 +389,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
        comments = await gitea.get_issue_comments(owner, repo, issue_id)
    except Exception as e:
        logger.warning("Failed to fetch issue %s/%s #%d: %s", owner, repo, issue_id, e)
-        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found") from e
+        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found")

    # Get checklists from local DB
    with get_conn() as conn:
@@ -444,8 +441,8 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
            "comments": comments,
            "checklists": checklists,
        }
-        from app.templating import ENV
-        env = ENV
+        from jinja2 import Environment, FileSystemLoader
+        env = Environment(loader=FileSystemLoader("app/templates"))
        template = env.get_template("card_detail.html")
        return HTMLResponse(template.render(**ctx))

@@ -460,7 +457,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
 # ── v0.5.0: Checklists ──

@router.post("/checklists/{owner}/{repo}/{issue_id}")
-def create_checklist(
+async def create_checklist(
    owner: str,
    repo: str,
    issue_id: int,
@@ -484,7 +481,7 @@ def create_checklist(


@router.post("/checklist-items/{owner}/{repo}/{issue_id}/{checklist_id}")
-def add_checklist_item(
+async def add_checklist_item(
    owner: str,
    repo: str,
    issue_id: int,
@@ -502,7 +499,7 @@ def add_checklist_item(


@router.patch("/checklist-items/{item_id}")
-def toggle_checklist_item(
+async def toggle_checklist_item(
    item_id: int,
    checked: bool = Query(default=False),
    content: str = Query(default=""),
@@ -524,7 +521,7 @@ def toggle_checklist_item(


@router.delete("/checklist-items/{item_id}")
-def delete_checklist_item(item_id: int):
+async def delete_checklist_item(item_id: int):
    """Delete a checklist item."""
    with get_conn() as conn:
        conn.execute("DELETE FROM checklist_items WHERE id=?", (item_id,))
@@ -533,7 +530,7 @@ def delete_checklist_item(item_id: int):


@router.delete("/checklists/{checklist_id}")
-def delete_checklist(checklist_id: int):
+async def delete_checklist(checklist_id: int):
    """Delete a checklist and all its items."""
    with get_conn() as conn:
        conn.execute("DELETE FROM checklist_items WHERE checklist_id=?", (checklist_id,))
@@ -545,19 +542,14 @@ def delete_checklist(checklist_id: int):
 # ── v1.0.0: User management ──

@router.get("/users/me")
-def get_my_profile(request: Request):
+async def get_my_profile(request: Request):
    """Get current user profile."""
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return {"login": "guest", "full_name": "Guest", "email": ""}
    with get_conn() as conn:
-        # A29-byproduct : jamais `SELECT *` ici — la ligne contenait
-        # password_hash, login_attempts et locked_until.
        row = conn.execute(
-            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
-            "is_admin, is_active, last_login, created_at "
-            "FROM users WHERE login=?",
-            (user.get("login", ""),),
+            "SELECT * FROM users WHERE login=?", (user.get("login", ""),)
        ).fetchone()
        if row:
            return dict(row)
@@ -565,7 +557,7 @@ def get_my_profile(request: Request):


@router.put("/users/me")
-def update_my_profile(request: Request, full_name: str = Query(default=""),
+async def update_my_profile(request: Request, full_name: str = Query(default=""),
                             email: str = Query(default="")):
    """Update current user's local profile."""
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
@@ -584,7 +576,7 @@ def update_my_profile(request: Request, full_name: str = Query(default=""),
 # ── v0.5.0: Card priority & due date ──

@router.post("/card/{owner}/{repo}/{issue_id}")
-def update_card(
+async def update_card(
    owner: str,
    repo: str,
    issue_id: int,
@@ -673,7 +665,7 @@ async def capture_frontend_error(request: Request):


@router.get("/frontend-errors")
-def get_frontend_errors(request: Request, clear: bool = True):
+async def get_frontend_errors(request: Request, clear: bool = True):
    """Retourne les erreurs frontend récentes. Hermes appelle cette route."""
    errors = list(_frontend_errors)
    if clear:
@@ -1,42 +0,0 @@
-"""FlowDeck — Public API v2.
-
-Découpe A28 : l'ancien `api_v2.py` (2 110 lignes, 115 routes) est devenu
-ce package — un module par concern (`_common` = helpers), `router`
-agrégé ci-dessous avec le même prefix/tags qu'avant → 0 changement
-d'URL, 0 changement d'operation_id.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter
-
-from . import (
-    admin,
-    collections,
-    engagement,
-    identity,
-    planning,
-    projects,
-    properties,
-    sharing,
-    templates_io,
-    views,
-    webhooks,
-    workspaces,
-)
-
-router = APIRouter(prefix="/api/v2")
-for _mod in (
-    identity,
-    workspaces,
-    collections,
-    properties,
-    views,
-    engagement,
-    sharing,
-    planning,
-    templates_io,
-    projects,
-    admin,
-    webhooks,
-):
-    router.include_router(_mod.router)
@@ -1,36 +0,0 @@
-"""FlowDeck — API v2 : helpers partagés des modules de routes (A28)."""
-from __future__ import annotations
-
-import hashlib
-import logging
-
-from fastapi import HTTPException, Request
-
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-logger = logging.getLogger(__name__)
-
-def _hash(token: str) -> str:
-    return hashlib.sha256(token.encode()).hexdigest()
-
-def _v2_rate_check(request: Request, user: dict) -> None:
-    ip = request.client.host if request.client else "unknown"
-    th = user.get("_token_hash")
-    if not check_v2_rate_limit(th, ip):
-        raise HTTPException(status_code=429, detail="Rate limit exceeded: 300 req/min per token")
-
-# ── Tokens ────────────────────────────────────────────────────────────────
-
@@ -1,91 +0,0 @@
-"""FlowDeck — Public API v2 : admin.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.patch("/admin/users/{uid}")
-def admin_patch_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone():
-            raise HTTPException(404, "User not found")
-        sets = []
-        params: list = []
-        for k in ("is_active", "is_admin", "full_name", "email"):
-            if k in body:
-                sets.append(f"{k}=?")
-                params.append(int(body[k]) if k in ("is_active", "is_admin") else body[k])
-        if not sets:
-            raise HTTPException(400, "No fields")
-        params.append(uid)
-        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
-        conn.commit()
-    audit_log(user, "admin.user_update", "user", uid, "", request)
-    return {"id": uid, "status": "updated"}
-
-
-@router.delete("/admin/users/{uid}")
-def admin_delete_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    if uid == user["id"]:
-        raise HTTPException(400, "Cannot delete yourself")
-    with get_conn() as conn:
-        conn.execute("DELETE FROM users WHERE id=?", (uid,))
-        conn.commit()
-    audit_log(user, "admin.user_delete", "user", uid, "", request)
-    return {"id": uid, "status": "deleted"}
-
-
-@router.get("/admin/audit-logs")
-def admin_audit_logs_v2(request: Request, limit: int = 50, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    limit = max(1, min(limit, 200))
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM api_audit_log ORDER BY created_at DESC LIMIT ?", (limit,)).fetchall()
-    return {"logs": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/webhooks/events")
-def list_webhook_events_v2(request: Request, authorization: str | None = Header(default=None)):
-    """Catalogue of deliverable events (+ wildcard syntax)."""
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    from app.services.webhook_outbound import EVENTS
-    return {"events": EVENTS, "wildcards": ["*", "page.*", "collection.*"]}
@@ -1,566 +0,0 @@
-"""FlowDeck — Public API v2 : collections.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/collections")
-def list_collections_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    ws_filter = request.query_params.get("workspace_id")
-    q = (request.query_params.get("query") or "").strip()
-    with get_conn() as conn:
-        where = []
-        params: list = []
-        if ws_filter:
-            try:
-                wid = int(ws_filter)
-                where.append("c.workspace_id=?")
-                params.append(wid)
-            except ValueError:
-                pass
-        if q:
-            where.append("(c.name LIKE ? OR c.description LIKE ?)")
-            like = f"%{q}%"
-            params.extend([like, like])
-        clause = ("WHERE " + " AND ".join(where)) if where else ""
-        total = conn.execute(f"SELECT COUNT(*) FROM collections c {clause}", params).fetchone()[0]
-        rows = conn.execute(f"SELECT c.* FROM collections c {clause} ORDER BY c.name LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
-    cols = []
-    for r in rows:
-        d = row_to_dict(r)
-        # filter by visibility: skip private not visible (best-effort)
-        cols.append(d)
-    resp = {"collections": cols, "total": total, "limit": limit, "offset": offset}
-    return JSONResponse(content=resp, headers=paginate_headers(total))
-
-
-@router.post("/collections")
-def create_collection_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    description = body.get("description", "")
-    icon = body.get("icon", "📋")
-    workspace_id = body.get("workspace_id")
-    schema = body.get("schema") or body.get("schema_json") or []
-    if isinstance(schema, str):
-        try:
-            schema = json.loads(schema)
-        except Exception:
-            schema = []
-    schema_json = json.dumps(schema)
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, description, icon, schema_json, workspace_id, user["id"]))
-        cid = cur.lastrowid
-        # materialize properties if schema provided — A25 : PAS de try ici,
-        # une exception doit interrompre la transaction (sinon la collection est
-        # commitée sans son schéma et l'erreur disparaît).
-        from app.services.db_templates import materialize_properties
-        materialize_properties(conn, cid, schema)
-        # default view
-        conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json) VALUES (?,?,?,?)", (cid, "Default View", "table", json.dumps({"visible_properties": ["Title"]})))
-        conn.commit()
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (cid,)).fetchone()
-    audit_log(user, "collection.create", "collection", cid, name, request)
-    data = {"id": cid, "name": name, "status": "created", "collection": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/collections/{collection_id}")
-def get_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        pages = conn.execute("SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? ORDER BY position LIMIT 50", (collection_id,)).fetchall()
-    d = row_to_dict(row)
-    d["pages"] = [row_to_dict(p) for p in pages]
-    return d
-
-
-@router.patch("/collections/{collection_id}")
-def patch_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        name = body.get("name", row["name"])
-        description = body.get("description", row["description"])
-        icon = body.get("icon", row["icon"])
-        schema = body.get("schema") or body.get("schema_json")
-        if schema is not None:
-            sj = json.dumps(schema) if isinstance(schema, (list, dict)) else str(schema)
-        else:
-            sj = row["schema_json"]
-        conn.execute("UPDATE collections SET name=?, description=?, icon=?, schema_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, description, icon, sj, collection_id))
-        conn.commit()
-    audit_log(user, "collection.update", "collection", collection_id, "", request)
-    return {"id": collection_id, "status": "updated"}
-
-
-@router.delete("/collections/{collection_id}")
-def delete_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        conn.execute("DELETE FROM collections WHERE id=?", (collection_id,))
-        conn.commit()
-    audit_log(user, "collection.delete", "collection", collection_id, "", request)
-    return {"id": collection_id, "status": "deleted"}
-
-
-@router.post("/collections/{collection_id}/linked")
-def create_linked_db(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip() or f"Linked DB {collection_id}"
-    with get_conn() as conn:
-        src = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not src:
-            raise HTTPException(404, "Collection not found")
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, src["description"], src["icon"], src["schema_json"], src["workspace_id"] if "workspace_id" in src.keys() else None, user["id"]))
-        nid = cur.lastrowid
-        # copy data source as linked
-        try:
-            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id, is_linked) VALUES (?, ?, 1)", (nid, collection_id))
-        except Exception:
-            logger.exception("create_linked_db")
-        # copy views + properties (light)
-        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()
-        for p in rows:
-            try:
-                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, position) VALUES (?, ?, ?, ?, ?)", (nid, p["name"], p["prop_type"], p["options_json"], p["position"]))
-            except Exception:
-                logger.exception("create_linked_db")
-        vrows = conn.execute("SELECT * FROM collection_views WHERE collection_id=?", (collection_id,)).fetchall()
-        for v in vrows:
-            try:
-                conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position) VALUES (?, ?, ?, ?, ?)", (nid, v["name"], v["view_type"], v["config_json"], v["position"]))
-            except Exception:
-                logger.exception("create_linked_db")
-        conn.commit()
-    audit_log(user, "collection.linked", "collection", nid, f"src={collection_id}", request)
-    return {"id": nid, "name": name, "status": "created"}
-
-
-@router.post("/collections/{collection_id}/task")
-def toggle_task(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_task FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        cur_val = row["is_task"] if "is_task" in row.keys() else 0
-        new_val = 0 if cur_val else 1
-        conn.execute("UPDATE collections SET is_task=? WHERE id=?", (new_val, collection_id))
-        conn.commit()
-    audit_log(user, "collection.toggle_task", "collection", collection_id, str(new_val), request)
-    return {"id": collection_id, "is_task": bool(new_val)}
-
-
-@router.get("/collections/{collection_id}/sources")
-def list_sources(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        rows = conn.execute("SELECT * FROM collection_data_sources WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"sources": [dict(r) for r in rows]}
-
-
-@router.post("/collections/{collection_id}/sources")
-def add_source(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    src_id = body.get("source_collection_id") or body.get("source_id")
-    if not src_id:
-        raise HTTPException(400, "source_collection_id required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (src_id,)).fetchone():
-            raise HTTPException(404, "Source collection not found")
-        try:
-            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id) VALUES (?, ?)", (collection_id, src_id))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    audit_log(user, "collection.add_source", "collection", collection_id, str(src_id), request)
-    return {"collection_id": collection_id, "source_collection_id": src_id, "status": "added"}
-
-
-@router.delete("/collections/{collection_id}/sources/{source_id}")
-def remove_source(collection_id: int, source_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM collection_data_sources WHERE collection_id=? AND (id=? OR source_collection_id=?)", (collection_id, source_id, source_id))
-        conn.commit()
-    audit_log(user, "collection.remove_source", "collection", collection_id, str(source_id), request)
-    return {"status": "removed"}
-
-
-@router.get("/collections/{collection_id}/pages")
-def list_collection_pages_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        total = conn.execute("SELECT COUNT(*) FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        # filters: filter[status]=Done etc., sort, fields
-        # Simple: filter by property name via property_values_json LIKE (best-effort), sort by position or title
-        sort = request.query_params.get("sort") or ""
-        order = "position"
-        desc = False
-        if sort:
-            if sort.startswith("-"):
-                desc = True
-                sort = sort[1:]
-            # allow sorting by title/position/created_at
-            if sort in ("title", "position", "created_at", "updated_at"):
-                order = sort
-        direction = "DESC" if desc else "ASC"
-        rows = conn.execute(f"SELECT * FROM collection_pages WHERE collection_id=? ORDER BY {order} {direction} LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
-    # apply filter[xxx] in-memory (small)
-    filters = {k[7:-1]: v for k, v in request.query_params.items() if k.startswith("filter[") and k.endswith("]")}
-    fields = request.query_params.get("fields")
-    fields_set = set(fields.split(",")) if fields else None
-    out = []
-    for r in rows:
-        d = row_to_dict(r)
-        # property filter (AND)
-        if filters:
-            try:
-                pv = json.loads(r["property_values_json"] or "{}") if isinstance(r["property_values_json"], str) else r["property_values_json"]
-            except Exception:
-                pv = {}
-            ok = True
-            for fk, fv in filters.items():
-                # lookup by prop id or name
-                found = False
-                for kk, vv in (pv or {}).items():
-                    if str(kk) == str(fk) or str(kk).lower() == fk.lower():
-                        if str(vv) == str(fv):
-                            found = True
-                        break
-                # also check title if filter field is title
-                if fk == "title" and d.get("title") == fv:
-                    found = True
-                if not found:
-                    ok = False
-                    break
-            if not ok:
-                continue
-        if fields_set:
-            d = {k: v for k, v in d.items() if k in fields_set or k in ("id", "collection_id")}
-        out.append(d)
-    return JSONResponse(content={"pages": out, "total": total, "limit": limit, "offset": offset}, headers=paginate_headers(total))
-
-
-@router.post("/collections/{collection_id}/pages")
-def create_collection_page_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    title = (body.get("title") or body.get("name") or "Untitled").strip() or "Untitled"
-    icon = body.get("icon", "file")
-    parent_id = body.get("parent_id")
-    prop_vals = body.get("property_values") or body.get("properties") or body.get("property_values_json") or {}
-    if isinstance(prop_vals, str):
-        try:
-            prop_vals = json.loads(prop_vals)
-        except Exception:
-            prop_vals = {}
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        # validate properties if helper exists
-        try:
-            pass
-            # light validation: we rely on existing validators
-        except Exception:
-            logger.exception("create_collection_page_v2")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        # apply auto props
-        try:
-            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()]
-            from app.services.property_types import apply_auto_properties as _aap
-            _aap(props_list, prop_vals, user, is_create=True)
-        except Exception:
-            logger.exception("create_collection_page_v2")
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, icon, position, parent_id, property_values_json) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, title, icon, max_pos, parent_id, json.dumps(prop_vals)))
-        pid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (pid,)).fetchone()
-    audit_log(user, "page.create", "collection_page", pid, title, request)
-    try:
-        run_event_sync(_fire_event("collection.page.created", {"page_id": pid, "collection_id": collection_id, "title": title}))
-    except Exception:
-        logger.exception("create_collection_page_v2")
-    data = {"id": pid, "title": title, "status": "created", "page": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/pages/{page_id}")
-def get_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            # also try pages table (block pages)
-            row2 = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-            if not row2:
-                raise HTTPException(404, "Page not found")
-            d = row_to_dict(row2)
-            # v6.5.0: resolve synced blocks server-side (fresh content).
-            if (d.get("content_format") or "blocks") == "blocks" and d.get("content"):
-                from app.services.synced_blocks import resolve_content_json
-                d["content"] = resolve_content_json(d["content"], d["content_format"])
-            return d
-        d = row_to_dict(row)
-        # property_values_json already parsed by row_to_dict
-        # v6.5.0: expose the row's content page when it exists (no lazy
-        # creation on a read-only endpoint).
-        content_page_id = conn.execute(
-            "SELECT id FROM pages WHERE collection_row_id=?",
-            (page_id,),
-        ).fetchone()
-        d["content_page_id"] = content_page_id["id"] if content_page_id else None
-        return d
-
-
-@router.patch("/pages/{page_id}")
-def patch_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        title = body.get("title", row["title"])
-        icon = body.get("icon", row["icon"])
-        pos = body.get("position", row["position"])
-        parent_id = body.get("parent_id", row["parent_id"])
-        pv_raw = row["property_values_json"] or "{}"
-        try:
-            stored = json.loads(pv_raw) if isinstance(pv_raw, str) else dict(pv_raw)
-        except Exception:
-            stored = {}
-        incoming = body.get("property_values") or body.get("properties")
-        if incoming is not None:
-            if isinstance(incoming, str):
-                try:
-                    incoming = json.loads(incoming)
-                except Exception:
-                    incoming = {}
-            # merge
-            for k, v in (incoming or {}).items():
-                stored[str(k)] = v
-        # apply auto props
-        try:
-            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (row["collection_id"],)).fetchall()]
-            from app.services.property_types import apply_auto_properties as _aap
-            _aap(props_list, stored, user, is_create=False)
-        except Exception:
-            logger.exception("patch_page_v2")
-        conn.execute("UPDATE collection_pages SET title=?, icon=?, position=?, parent_id=?, property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (title, icon, pos, parent_id, json.dumps(stored), page_id))
-        conn.commit()
-    audit_log(user, "page.update", "collection_page", page_id, "", request)
-    try:
-        run_event_sync(_fire_event("collection.page.updated", {"page_id": page_id, "collection_id": row["collection_id"], "title": title}))
-    except Exception:
-        logger.exception("patch_page_v2")
-    return {"id": page_id, "status": "updated"}
-
-
-@router.delete("/pages/{page_id}")
-def delete_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        conn.execute("DELETE FROM collection_pages WHERE id=?", (page_id,))
-        conn.commit()
-    audit_log(user, "page.delete", "collection_page", page_id, "", request)
-    try:
-        run_event_sync(_fire_event("collection.page.deleted", {"page_id": page_id, "collection_id": row["collection_id"]}))
-    except Exception:
-        logger.exception("delete_page_v2")
-    return {"id": page_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/restore")
-def restore_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    # For soft-deleted pages (deleted_at) - but collection_pages has no deleted_at; handle pages table
-    with get_conn() as conn:
-        row = conn.execute("SELECT deleted_at FROM pages WHERE id=?", (page_id,)).fetchone()
-        if row and row["deleted_at"]:
-            conn.execute("UPDATE pages SET deleted_at=NULL WHERE id=?", (page_id,))
-            conn.commit()
-            try:
-                run_event_sync(_fire_event("page.restored", {"page_id": page_id}))
-            except Exception:
-                logger.exception("restore_page_v2")
-            return {"id": page_id, "status": "restored"}
-        raise HTTPException(404, "Page not found or not deleted")
-
-
-@router.post("/pages/{page_id}/move")
-def move_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        parent_id = body.get("parent_id", row["parent_id"])
-        position = body.get("position", row["position"])
-        conn.execute("UPDATE collection_pages SET parent_id=?, position=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (parent_id, position, page_id))
-        conn.commit()
-    audit_log(user, "page.move", "collection_page", page_id, f"parent={parent_id} pos={position}", request)
-    return {"id": page_id, "status": "moved"}
-
-
-@router.get("/pages/{page_id}/sub-items")
-def list_sub_items_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
-            raise HTTPException(404, "Page not found")
-        rows = conn.execute("SELECT * FROM collection_pages WHERE parent_id=? ORDER BY position", (page_id,)).fetchall()
-    return {"sub_items": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/pages/{page_id}/sub-items")
-def create_sub_item_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        parent = conn.execute("SELECT collection_id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not parent:
-            raise HTTPException(404, "Page not found")
-        title = (body.get("title") or "Untitled").strip()
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE parent_id=?", (page_id,)).fetchone()[0]
-        pv = json.dumps(body.get("property_values") or {})
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, parent_id, position, property_values_json) VALUES (?, ?, ?, ?, ?)", (parent["collection_id"], title, page_id, max_pos, pv))
-        nid = cur.lastrowid
-        conn.commit()
-    audit_log(user, "page.create_subitem", "collection_page", nid, title, request)
-    return {"id": nid, "status": "created"}
-
-
-@router.get("/pages/{page_id}/dependencies")
-def list_dependencies_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_dependencies WHERE page_id=?", (page_id,)).fetchall()
-    return {"dependencies": [dict(r) for r in rows]}
-
-
-@router.post("/pages/{page_id}/dependencies")
-def add_dependency_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    dep_id = body.get("dependency_id") or body.get("depends_on")
-    dtype = body.get("dependency_type") or "blocks"
-    if not dep_id:
-        raise HTTPException(400, "dependency_id required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
-            raise HTTPException(404, "Page not found")
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (dep_id,)).fetchone():
-            raise HTTPException(404, "Dependency page not found")
-        try:
-            conn.execute("INSERT INTO page_dependencies (page_id, dependency_id, dependency_type) VALUES (?, ?, ?)", (page_id, dep_id, dtype))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    audit_log(user, "page.add_dependency", "collection_page", page_id, str(dep_id), request)
-    return {"status": "added"}
-
-
-@router.delete("/pages/{page_id}/dependencies/{dep_id}")
-def remove_dependency_v2(page_id: int, dep_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_dependencies WHERE page_id=? AND dependency_id=?", (page_id, dep_id))
-        conn.commit()
-    audit_log(user, "page.remove_dependency", "collection_page", page_id, str(dep_id), request)
-    return {"status": "removed"}
-
-
-@router.get("/collections/{collection_id}/properties")
-def list_properties_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"properties": [row_to_dict(r) for r in rows]}
@@ -1,338 +0,0 @@
-"""FlowDeck — Public API v2 : engagement.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/pages/{page_id}/comments")
-def list_comments_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM comments WHERE target_id=? OR page_id=?", (page_id, page_id)).fetchone()[0]
-        rows = conn.execute("SELECT c.*, u.login, u.full_name FROM comments c LEFT JOIN users u ON u.id=c.user_id WHERE c.target_id=? OR c.page_id=? ORDER BY c.created_at LIMIT ? OFFSET ?", (page_id, page_id, limit, offset)).fetchall()
-    return {"comments": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
-
-
-@router.post("/pages/{page_id}/comments")
-def create_comment_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    text = (body.get("body") or body.get("content") or "").strip()
-    if not text:
-        raise HTTPException(400, "body is required")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO comments (page_id, user_id, body, target_type, target_id, anchor_block_id, anchor_start, anchor_end) VALUES (?, ?, ?, 'page', ?, ?, ?, ?)", (page_id, user["id"], text, page_id, body.get("anchor_block_id"), body.get("anchor_start"), body.get("anchor_end")))
-        nid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (nid,)).fetchone()
-    audit_log(user, "comment.create", "comment", nid, text[:80], request)
-    try:
-        run_event_sync(_fire_event("comment.added", {"comment_id": nid, "page_id": page_id, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("create_comment_v2")
-    return {"id": nid, "status": "created", "comment": row_to_dict(row)}
-
-
-@router.patch("/comments/{comment_id}")
-def patch_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your comment")
-        body_text = body.get("body", row["body"])
-        resolved = body.get("resolved", row["resolved"])
-        was_resolved = int(row["resolved"] or 0)
-        conn.execute("UPDATE comments SET body=?, resolved=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (body_text, int(bool(resolved)), comment_id))
-        conn.commit()
-    if int(bool(resolved)) and not was_resolved:
-        try:
-            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
-        except Exception:
-            logger.exception("patch_comment_v2")
-    return {"id": comment_id, "status": "updated"}
-
-
-@router.delete("/comments/{comment_id}")
-def delete_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your comment")
-        conn.execute("DELETE FROM comments WHERE id=?", (comment_id,))
-        conn.commit()
-    return {"id": comment_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/mentions")
-def create_mention_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    targets = body.get("user_ids") or body.get("mentions") or []
-    if isinstance(targets, int):
-        targets = [targets]
-    if not targets:
-        raise HTTPException(400, "user_ids required")
-    created = 0
-    with get_conn() as conn:
-        for uid in targets:
-            try:
-                conn.execute("INSERT INTO notifications (user_id, actor_id, ntype, title, message, resource_type, resource_id, url) VALUES (?, ?, 'mention', 'You were mentioned', ?, 'page', ?, ?)", (uid, user["id"], body.get("message") or f"Mentioned in page {page_id}", page_id, f"/pages/{page_id}"))
-                created += 1
-            except Exception:
-                logger.exception("create_mention_v2")
-        conn.commit()
-    if created:
-        try:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": [u for u in targets if isinstance(u, int)], "count": created}))
-        except Exception:
-            logger.exception("create_mention_v2")
-    return {"mentions": created, "status": "created"}
-
-
-@router.get("/notifications")
-def list_notifications_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    unread = request.query_params.get("unread")
-    with get_conn() as conn:
-        where = "user_id=?"
-        params: list = [user["id"]]
-        if unread == "1":
-            where += " AND is_read=0"
-        total = conn.execute(f"SELECT COUNT(*) FROM notifications WHERE {where}", params).fetchone()[0]
-        rows = conn.execute(f"SELECT * FROM notifications WHERE {where} ORDER BY created_at DESC LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
-    return {"notifications": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
-
-
-@router.get("/notifications/unread-count")
-def unread_count(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        cnt = conn.execute("SELECT COUNT(*) FROM notifications WHERE user_id=? AND is_read=0", (user["id"],)).fetchone()[0]
-    return {"unread": cnt}
-
-
-@router.post("/notifications/{notif_id}/read")
-def mark_read(notif_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?", (notif_id, user["id"]))
-        conn.commit()
-    return {"id": notif_id, "status": "read"}
-
-
-@router.post("/notifications/read-all")
-def mark_all_read(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("UPDATE notifications SET is_read=1 WHERE user_id=?", (user["id"],))
-        conn.commit()
-    return {"status": "all read"}
-
-
-@router.patch("/users/me/preferences")
-def patch_prefs(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
-        try:
-            cur = json.loads(row["notification_prefs"] or "{}")
-        except Exception:
-            cur = {}
-        cur.update(body)
-        conn.execute("UPDATE users SET notification_prefs=? WHERE id=?", (json.dumps(cur), user["id"]))
-        conn.commit()
-    return {"preferences": cur}
-
-
-@router.get("/favorites")
-def list_favorites_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT f.*, p.title, p.workspace_id FROM favorites f JOIN pages p ON p.id=f.page_id WHERE f.user_id=? ORDER BY f.position", (user["id"],)).fetchall()
-    return {"favorites": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/favorites")
-def add_favorite_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    pid = body.get("page_id")
-    if not pid:
-        raise HTTPException(400, "page_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO favorites (user_id, page_id) VALUES (?, ?)", (user["id"], pid))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    try:
-        run_event_sync(_fire_event("favorite.added", {"page_id": pid, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("add_favorite_v2")
-    return {"page_id": pid, "status": "added"}
-
-
-@router.delete("/favorites/{page_id}")
-def remove_favorite_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM favorites WHERE user_id=? AND page_id=?", (user["id"], page_id))
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("favorite.removed", {"page_id": page_id, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("remove_favorite_v2")
-    return {"page_id": page_id, "status": "removed"}
-
-
-@router.get("/tags")
-def list_tags_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (request.query_params.get("q") or "").strip()
-    with get_conn() as conn:
-        if q:
-            rows = conn.execute("SELECT * FROM tags WHERE user_id=? AND name LIKE ? ORDER BY name", (user["id"], f"%{q}%")).fetchall()
-        else:
-            rows = conn.execute("SELECT * FROM tags WHERE user_id=? ORDER BY name", (user["id"],)).fetchall()
-    return {"tags": [dict(r) for r in rows]}
-
-
-@router.post("/tags")
-def create_tag_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name required")
-    color = body.get("color", "#787774")
-    with get_conn() as conn:
-        try:
-            cur = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (name, color, user["id"]))
-            tid = cur.lastrowid
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"id": tid, "name": name, "color": color, "status": "created"}
-
-
-@router.patch("/tags/{tag_id}")
-def patch_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"])).fetchone()
-        if not row:
-            raise HTTPException(404, "Tag not found")
-        name = body.get("name", row["name"])
-        color = body.get("color", row["color"])
-        conn.execute("UPDATE tags SET name=?, color=? WHERE id=?", (name, color, tag_id))
-        conn.commit()
-    return {"id": tag_id, "status": "updated"}
-
-
-@router.delete("/tags/{tag_id}")
-def delete_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"]))
-        conn.commit()
-    return {"id": tag_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/tags")
-def attach_tag_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    tag_id = body.get("tag_id")
-    if not tag_id:
-        raise HTTPException(400, "tag_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO page_tags (page_id, tag_id) VALUES (?, ?)", (page_id, tag_id))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"page_id": page_id, "tag_id": tag_id, "status": "attached"}
-
-
-@router.delete("/pages/{page_id}/tags/{tag_id}")
-def detach_tag_v2(page_id: int, tag_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_tags WHERE page_id=? AND tag_id=?", (page_id, tag_id))
-        conn.commit()
-    return {"status": "detached"}
-
-
-@router.get("/recents")
-def list_recents_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit = int(request.query_params.get("limit", "20"))
-    st = request.query_params.get("source_type")
-    with get_conn() as conn:
-        if st:
-            rows = conn.execute("SELECT * FROM recents WHERE user_id=? AND source_type=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], st, limit)).fetchall()
-        else:
-            rows = conn.execute("SELECT * FROM recents WHERE user_id=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], limit)).fetchall()
-    return {"recents": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/pages/{page_id}/shares")
-def list_shares_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_shares WHERE page_id=?", (page_id,)).fetchall()
-    return {"shares": [dict(r) for r in rows]}
@@ -1,195 +0,0 @@
-"""FlowDeck — Public API v2 : identity.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-import secrets
-from datetime import datetime
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _hash, _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/tokens")
-def create_token(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "API token").strip()[:100]
-    scopes = validate_scopes_input(body.get("scopes") or "read,write")
-    expires_at = body.get("expires_at")
-    # Idempotency
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    token = f"fd_{secrets.token_urlsafe(32)}"
-    prefix = token[:12]
-    th = _hash(token)
-    exp_val = None
-    if expires_at:
-        try:
-            # accept ISO string
-            exp_val = str(expires_at)
-            # validate parse
-            datetime.fromisoformat(exp_val.replace("Z", "+00:00"))
-        except Exception as err:
-            raise HTTPException(400, "Invalid expires_at, use ISO-8601") from err
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes, expires_at) VALUES (?, ?, ?, ?, ?, ?)",
-                (user["id"], name, th, prefix, scopes, exp_val),
-            )
-            conn.commit()
-            tid = cur.lastrowid
-        except Exception as e:
-            raise HTTPException(409, f"Token creation failed: {e}") from None
-        row = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, created_at FROM api_tokens WHERE id=?", (tid,)).fetchone()
-    audit_log(user, "token.create", "api_token", tid, f"scopes={scopes}", request)
-    data = {"id": tid, "name": row["name"], "token": token, "prefix": prefix, "scopes": scopes, "expires_at": to_iso8601(row["expires_at"]) if row["expires_at"] else None, "note": "Copy token now — shown once. Use as Authorization: Bearer <token>"}
-    key = (request.headers.get("Idempotency-Key") or request.headers.get("idempotency-key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 200)
-    return data
-
-
-@router.get("/tokens")
-def list_tokens(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, last_used_at, created_at, revoked FROM api_tokens WHERE user_id=? ORDER BY created_at DESC", (user["id"],)).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["created_at"] = to_iso8601(d.get("created_at"))
-        d["expires_at"] = to_iso8601(d.get("expires_at")) if d.get("expires_at") else None
-        d["last_used_at"] = to_iso8601(d.get("last_used_at")) if d.get("last_used_at") else None
-        # never expose hash
-        out.append({k: v for k, v in d.items() if k != "token_hash"})
-    return {"tokens": out}
-
-
-@router.delete("/tokens/{token_id}")
-def revoke_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, user_id FROM api_tokens WHERE id=?", (token_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Token not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your token")
-        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
-        conn.commit()
-    audit_log(user, "token.revoke", "api_token", token_id, "", request)
-    return {"id": token_id, "status": "revoked"}
-
-
-@router.post("/tokens/{token_id}/rotate")
-def rotate_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, user_id, name, scopes FROM api_tokens WHERE id=?", (token_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Token not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your token")
-        # revoke old
-        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
-        new_token = f"fd_{secrets.token_urlsafe(32)}"
-        th = _hash(new_token)
-        prefix = new_token[:12]
-        cur = conn.execute("INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes) VALUES (?, ?, ?, ?, ?)", (row["user_id"], row["name"], th, prefix, row["scopes"] or "read,write"))
-        conn.commit()
-        nid = cur.lastrowid
-    audit_log(user, "token.rotate", "api_token", token_id, f"new_id={nid}", request)
-    return {"id": nid, "token": new_token, "prefix": prefix, "scopes": row["scopes"], "note": "Copy token now — shown once"}
-
-
-@router.get("/users/me")
-def get_me(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, is_active, auth_method, sidebar_config, notification_prefs, timezone, created_at FROM users WHERE id=?", (user["id"],)).fetchone()
-        if not row:
-            raise HTTPException(404, "User not found")
-        d = row_to_dict(row)
-        # parse json prefs
-        for k in ("notification_prefs", "sidebar_config"):
-            if isinstance(d.get(k), str):
-                try:
-                    d[k] = json.loads(d[k] or "{}")
-                except Exception:
-                    logger.exception("get_me")
-        # never expose secrets
-        return d
-
-
-@router.patch("/users/me")
-def patch_me(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    allowed = {"full_name", "email", "avatar_color", "notification_prefs", "sidebar_config", "timezone"}
-    updates = {}
-    for k in allowed:
-        if k in body:
-            updates[k] = body[k]
-    if not updates:
-        raise HTTPException(400, "No updatable fields")
-    # validation
-    if "email" in updates and updates["email"] and "@" not in str(updates["email"]):
-        raise HTTPException(400, "Invalid email")
-    with get_conn() as conn:
-        sets = []
-        params = []
-        for k, v in updates.items():
-            if k in ("notification_prefs", "sidebar_config"):
-                v = json.dumps(v) if isinstance(v, (dict, list)) else str(v)
-            sets.append(f"{k}=?")
-            params.append(v)
-        params.append(user["id"])
-        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
-        conn.commit()
-        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, timezone, notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
-    audit_log(user, "user.update", "user", user["id"], "", request)
-    return row_to_dict(row)
-
-
-@router.get("/users/search")
-def search_users(request: Request, q: str = "", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (q or request.query_params.get("q") or "").strip()
-    if not q:
-        return {"users": []}
-    like = f"%{q}%"
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color FROM users WHERE login LIKE ? OR email LIKE ? OR full_name LIKE ? LIMIT 20", (like, like, like)).fetchall()
-    return {"users": [dict(r) for r in rows]}
@@ -1,148 +0,0 @@
-"""FlowDeck — Public API v2 : planning.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/sprints")
-def create_sprint_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Sprint").strip()
-    start = body.get("start_date") or body.get("start") or ""
-    end = body.get("end_date") or body.get("end") or ""
-    if not start or not end:
-        raise HTTPException(400, "start_date and end_date required (YYYY-MM-DD)")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO sprints (collection_id, name, start_date, end_date, goal) VALUES (?, ?, ?, ?, ?)", (collection_id, name, start, end, body.get("goal") or ""))
-        sid = cur.lastrowid
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("sprint.created", {"sprint_id": sid, "collection_id": collection_id, "name": name}))
-    except Exception:
-        logger.exception("create_sprint_v2")
-    return {"id": sid, "name": name, "status": "created"}
-
-
-@router.patch("/sprints/{sprint_id}")
-def patch_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Sprint not found")
-        name = body.get("name", row["name"])
-        start = body.get("start_date", row["start_date"])
-        end = body.get("end_date", row["end_date"])
-        goal = body.get("goal", row["goal"])
-        status = body.get("status", row["status"])
-        conn.execute("UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=? WHERE id=?", (name, start, end, goal, status, sprint_id))
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("sprint.updated", {"sprint_id": sprint_id, "collection_id": row["collection_id"], "name": name, "status": status}))
-    except Exception:
-        logger.exception("patch_sprint_v2")
-    return {"id": sprint_id, "status": "updated"}
-
-
-@router.delete("/sprints/{sprint_id}")
-def delete_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM sprints WHERE id=?", (sprint_id,))
-        conn.commit()
-    return {"id": sprint_id, "status": "deleted"}
-
-
-@router.post("/sprints/{sprint_id}/assign")
-def assign_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    pid = body.get("page_id")
-    if not pid:
-        raise HTTPException(400, "page_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO sprint_pages (sprint_id, page_id, velocity_points) VALUES (?, ?, ?)", (sprint_id, pid, body.get("velocity_points", 1)))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"sprint_id": sprint_id, "page_id": pid, "status": "assigned"}
-
-
-@router.delete("/sprints/{sprint_id}/assign/{page_id}")
-def unassign_sprint_v2(sprint_id: int, page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sprint_id, page_id))
-        conn.commit()
-    return {"status": "removed"}
-
-
-@router.get("/sprints/{sprint_id}/burndown")
-def burndown_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        s = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
-        if not s:
-            raise HTTPException(404, "Sprint not found")
-        pages = conn.execute("SELECT sp.*, cp.property_values_json FROM sprint_pages sp JOIN collection_pages cp ON cp.id=sp.page_id WHERE sp.sprint_id=?", (sprint_id,)).fetchall()
-        total = len(pages)
-        # crude: completed where status property == Done (best-effort)
-        completed = 0
-        for p in pages:
-            try:
-                pv = json.loads(p["property_values_json"] or "{}")
-                for v in pv.values():
-                    if str(v).lower() in ("done", "completed", "terminé"):
-                        completed += 1
-                        break
-            except Exception:
-                logger.exception("burndown_v2")
-        remaining = total - completed
-        # ideal linear
-        ideal = [round(total * (1 - i / 10)) for i in range(11)]
-    return {"sprint_id": sprint_id, "total": total, "completed": completed, "remaining": remaining, "ideal": ideal}
-
-
-@router.get("/collections/{collection_id}/templates")
-def list_templates_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_templates WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
-    return {"templates": [row_to_dict(r) for r in rows]}
@@ -1,93 +0,0 @@
-"""FlowDeck — Public API v2 : projects.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/projects")
-def list_projects_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM projects ORDER BY proj_type, owner, name").fetchall()
-    return {"projects": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/projects/{owner}/{repo}/tree")
-async def project_tree_v2(owner: str, repo: str, request: Request, path: str = "", authorization: str | None = Header(default=None)):
-    get_bearer_user(request, authorization)
-    # proxy to gitea client? Return placeholder listing from projects table
-    with get_conn() as conn:
-        proj = conn.execute("SELECT * FROM projects WHERE owner=? AND name=?", (owner, repo)).fetchone()
-        if not proj:
-            raise HTTPException(404, "Project not found")
-    # delegate to gitea API if available (best-effort)
-    try:
-        from app.services.gitea_client import gitea
-        tree = await gitea.list_repo_files(owner, repo, path or "")
-        return {"owner": owner, "repo": repo, "path": path, "tree": tree}
-    except Exception:
-        return {"owner": owner, "repo": repo, "path": path, "tree": []}
-
-
-@router.get("/search")
-def search_v2(request: Request, query: str = "", workspace_id: int | None = None, type: str = "all", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (query or request.query_params.get("query") or "").strip()
-    if not q:
-        return {"results": [], "query": q}
-    like = f"%{q}%"
-    with get_conn() as conn:
-        pages = []
-        # try FTS5
-        try:
-            rows = conn.execute("SELECT p.id, p.title, p.content, p.workspace_id, snippet(pages_fts, -1, '<mark>', '</mark>', '...', 32) as snippet FROM pages_fts f JOIN pages p ON p.id=f.rowid WHERE pages_fts MATCH ? LIMIT 20", (q,)).fetchall()
-            pages = [{"type": "page", "id": r["id"], "title": r["title"], "snippet": r["snippet"]} for r in rows]
-        except Exception:
-            rows = conn.execute("SELECT id, title FROM pages WHERE title LIKE ? OR content LIKE ? LIMIT 20", (like, like)).fetchall()
-            pages = [{"type": "page", "id": r["id"], "title": r["title"]} for r in rows]
-        # collections
-        colls = conn.execute("SELECT id, name FROM collections WHERE name LIKE ? LIMIT 10", (like,)).fetchall()
-        results = pages + [{"type": "collection", "id": r["id"], "title": r["name"]} for r in colls]
-    return {"query": q, "results": results}
-
-
-@router.get("/admin/users")
-def admin_list_users_v2(request: Request, limit: int = 30, offset: int = 0, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    limit = max(1, min(limit, 100))
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-        rows = conn.execute("SELECT id, login, full_name, email, is_admin, is_active, created_at FROM users ORDER BY id LIMIT ? OFFSET ?", (limit, offset)).fetchall()
-    return {"users": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
@@ -1,151 +0,0 @@
-"""FlowDeck — Public API v2 : properties.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/properties")
-def create_property_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    ptype = body.get("prop_type") or body.get("type") or "text"
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        try:
-            cur = conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, number_format, position, required, visible_in_views, validation_json, group_name) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", (collection_id, name, ptype, json.dumps(body.get("options") or []), body.get("number_format") or "number", max_pos, int(bool(body.get("required"))), int(bool(body.get("visible_in_views", True))), json.dumps(body.get("validation") or {}), (body.get("group_name") or "").strip()))
-            conn.commit()
-            pid = cur.lastrowid
-        except Exception as e:
-            raise HTTPException(409, f"Property exists: {e}") from None
-    audit_log(user, "property.create", "property", pid, name, request)
-    return {"id": pid, "name": name, "prop_type": ptype, "status": "created"}
-
-
-@router.patch("/properties/{prop_id}")
-def patch_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Property not found")
-        name = body.get("name", row["name"])
-        opts = json.dumps(body.get("options", json.loads(row["options_json"] or "[]")))
-        nf = body.get("number_format", row["number_format"])
-        req = int(bool(body.get("required", row["required"])))
-        vis = int(bool(body.get("visible_in_views", row["visible_in_views"])))
-        vj = json.dumps(body.get("validation", json.loads(row["validation_json"] or "{}"))) if "validation" in body else (row["validation_json"] if "validation_json" in row.keys() else "{}")
-        grp = body.get("group_name", row["group_name"] if "group_name" in row.keys() else "")
-        conn.execute("UPDATE collection_properties SET name=?, options_json=?, number_format=?, required=?, visible_in_views=?, validation_json=?, group_name=? WHERE id=?", (name, opts, nf, req, vis, vj, grp, prop_id))
-        conn.commit()
-    audit_log(user, "property.update", "property", prop_id, "", request)
-    return {"id": prop_id, "status": "updated"}
-
-
-@router.delete("/properties/{prop_id}")
-def delete_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_properties WHERE id=?", (prop_id,)).fetchone():
-            raise HTTPException(404, "Property not found")
-        conn.execute("DELETE FROM collection_properties WHERE id=?", (prop_id,))
-        conn.commit()
-    audit_log(user, "property.delete", "property", prop_id, "", request)
-    return {"id": prop_id, "status": "deleted"}
-
-
-@router.post("/properties/{prop_id}/relation")
-def create_relation_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    related_id = body.get("related_collection_id")
-    reverse = (body.get("reverse_name") or "").strip()
-    if not related_id:
-        raise HTTPException(400, "related_collection_id required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT collection_id FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Property not found")
-        conn.execute("UPDATE collection_properties SET prop_type='relation', related_collection_id=?, reverse_name=? WHERE id=?", (related_id, reverse, prop_id))
-        if reverse:
-            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (related_id,)).fetchone()[0]
-            try:
-                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, related_collection_id, reverse_name, position) VALUES (?, ?, 'relation', ?, ?, ?)", (related_id, reverse, row["collection_id"], "", max_pos))
-            except Exception:
-                logger.exception("create_relation_v2")
-        conn.commit()
-    return {"id": prop_id, "status": "updated"}
-
-
-@router.post("/properties/evaluate-formula")
-def evaluate_formula_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    expr = body.get("expression") or body.get("formula")
-    if not expr:
-        raise HTTPException(400, "expression required")
-    ctx = body.get("context") or {}
-    try:
-        from app.services.formula_engine import FormulaEngine
-        res = FormulaEngine().evaluate(expr, ctx)
-    except Exception as e:
-        raise HTTPException(400, f"Formula error: {e}") from None
-    return {"result": res, "expression": expr}
-
-
-@router.post("/properties/compute-rollup")
-def compute_rollup_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    for k in ("collection_id", "relation_property_id", "target_property_id", "page_id"):
-        if k not in body:
-            raise HTTPException(400, f"{k} required")
-    try:
-        from app.services.rollup_engine import RollupEngine
-        res = RollupEngine().compute(body["collection_id"], body["relation_property_id"], body["target_property_id"], body["page_id"], body.get("function", "count"))
-    except Exception as e:
-        raise HTTPException(400, f"Rollup error: {e}") from None
-    return {"result": res}
-
-
-@router.get("/collections/{collection_id}/views")
-def list_views_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM collection_views WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"views": [row_to_dict(r) for r in rows]}
@@ -1,160 +0,0 @@
-"""FlowDeck — Public API v2 : sharing.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-from app.services.publish import fire_published, fire_unpublished, publish, unpublish
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/pages/{page_id}/shares")
-def create_share_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    perm = (body.get("permission") or "view").strip().lower()
-    if perm not in ("view", "comment", "edit"):
-        raise HTTPException(400, "Invalid permission. Use view, comment, or edit")
-    email = (body.get("email") or "").strip()
-    uid = body.get("user_id")
-    if not email and not uid:
-        raise HTTPException(400, "email or user_id required")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by) VALUES (?, ?, ?, ?, ?)", (page_id, uid, email, perm, user["id"]))
-        conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
-        conn.commit()
-        nid = cur.lastrowid
-    audit_log(user, "share.create", "share", nid, f"page={page_id}", request)
-    try:
-        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": nid, "permission": perm}))
-    except Exception:
-        logger.exception("create_share_v2")
-    return {"id": nid, "page_id": page_id, "status": "shared"}
-
-
-@router.patch("/shares/{share_id}")
-def patch_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    perm = (body.get("permission") or "").strip().lower()
-    if perm not in ("view", "comment", "edit"):
-        raise HTTPException(400, "Invalid permission")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM page_shares WHERE id=?", (share_id,)).fetchone():
-            raise HTTPException(404, "Share not found")
-        conn.execute("UPDATE page_shares SET permission=? WHERE id=?", (perm, share_id))
-        conn.commit()
-    return {"id": share_id, "status": "updated"}
-
-
-@router.delete("/shares/{share_id}")
-def delete_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT page_id FROM page_shares WHERE id=?", (share_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Share not found")
-        conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
-        # unset is_shared if no shares left
-        cnt = conn.execute("SELECT COUNT(*) FROM page_shares WHERE page_id=?", (row["page_id"],)).fetchone()[0]
-        if cnt == 0:
-            conn.execute("UPDATE pages SET is_shared=0 WHERE id=?", (row["page_id"],))
-        conn.commit()
-    return {"id": share_id, "status": "revoked"}
-
-
-@router.post("/pages/{page_id}/publish")
-def publish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    slug_in = (body.get("slug") or body.get("publish_slug") or "").strip() or None
-    slug, _title = publish(page_id, explicit_slug=slug_in)
-    audit_log(user, "page.publish", "page", page_id, slug, request)
-    run_event_sync(fire_published(page_id, slug))
-    return {"page_id": page_id, "slug": slug, "url": f"/p/{slug}", "status": "published"}
-
-
-@router.delete("/pages/{page_id}/publish")
-def unpublish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    unpublish(page_id)
-    run_event_sync(fire_unpublished(page_id))
-    return {"page_id": page_id, "status": "unpublished"}
-
-
-@router.get("/pages/{page_id}/history")
-def list_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT h.*, u.login FROM page_history h LEFT JOIN users u ON u.id=h.user_id WHERE h.page_id=? ORDER BY h.created_at DESC", (page_id,)).fetchall()
-        # also page_versions for block pages
-        vrows = conn.execute("SELECT * FROM page_versions WHERE page_id=? ORDER BY created_at DESC", (page_id,)).fetchall()
-    return {"history": [row_to_dict(r) for r in rows], "versions": [row_to_dict(r) for r in vrows]}
-
-
-@router.post("/pages/{page_id}/history/restore")
-def restore_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    hid = body.get("history_id") or body.get("id") or body.get("version_id")
-    if not hid:
-        raise HTTPException(400, "history_id required")
-    with get_conn() as conn:
-        h = conn.execute("SELECT * FROM page_versions WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
-        if h:
-            conn.execute("UPDATE pages SET content=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (h["blocks_json"], h["title"], page_id))
-            conn.commit()
-            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
-        h2 = conn.execute("SELECT * FROM page_history WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
-        if h2:
-            try:
-                snap = json.loads(h2["snapshot_json"] or "{}")
-            except Exception:
-                snap = {}
-            # best-effort restore content
-            if snap.get("content"):
-                conn.execute("UPDATE pages SET content=? WHERE id=?", (snap["content"], page_id))
-                conn.commit()
-            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
-        raise HTTPException(404, "History not found")
-
-
-@router.get("/collections/{collection_id}/sprints")
-def list_sprints_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM sprints WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        rows = conn.execute("SELECT * FROM sprints WHERE collection_id=? ORDER BY created_at DESC LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
-    return {"sprints": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
@@ -1,205 +0,0 @@
-"""FlowDeck — Public API v2 : templates_io.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import Response
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/templates")
-def create_template_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Template").strip()
-    pv = json.dumps(body.get("property_values") or body.get("property_values_json") or {})
-    cj = json.dumps(body.get("content") or body.get("content_json") or [])
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO page_templates (collection_id, name, property_values_json, content_json) VALUES (?, ?, ?, ?)", (collection_id, name, pv, cj))
-        tid = cur.lastrowid
-        conn.commit()
-    return {"id": tid, "name": name, "status": "created"}
-
-
-@router.patch("/templates/{template_id}")
-def patch_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Template not found")
-        name = body.get("name", row["name"])
-        pv = json.dumps(body.get("property_values", json.loads(row["property_values_json"] or "{}"))) if "property_values" in body else row["property_values_json"]
-        cj = json.dumps(body.get("content", json.loads(row["content_json"] or "[]"))) if "content" in body else row["content_json"]
-        conn.execute("UPDATE page_templates SET name=?, property_values_json=?, content_json=? WHERE id=?", (name, pv, cj, template_id))
-        conn.commit()
-    return {"id": template_id, "status": "updated"}
-
-
-@router.delete("/templates/{template_id}")
-def delete_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_templates WHERE id=?", (template_id,))
-        conn.commit()
-    return {"id": template_id, "status": "deleted"}
-
-
-@router.post("/templates/{template_id}/apply")
-def apply_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        tpl = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
-        if not tpl:
-            raise HTTPException(404, "Template not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (tpl["collection_id"],)).fetchone()[0]
-        pv = tpl["property_values_json"] or "{}"
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (tpl["collection_id"], tpl["name"], max_pos, pv))
-        pid = cur.lastrowid
-        conn.commit()
-    return {"template_id": template_id, "page_id": pid, "status": "applied"}
-
-
-@router.get("/templates/database")
-def list_db_templates_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM database_templates ORDER BY name").fetchall()
-    return {"templates": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/templates/database/{template_id}/apply")
-def apply_db_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        tpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (template_id,)).fetchone()
-        if not tpl:
-            raise HTTPException(404, "Template not found")
-        name = (body.get("name") or tpl["name"]).strip()
-        schema = json.loads(tpl["schema_json"] or "[]")
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, tpl["description"], tpl["icon"] if "icon" in tpl.keys() else "📋", json.dumps(schema), body.get("workspace_id"), user["id"]))
-        cid = cur.lastrowid
-        # A25 : pas de try — un échec de matérialisation doit interrompre la
-        # transaction plutôt que de commiter une collection sans schéma.
-        from app.services.db_templates import materialize_properties
-        materialize_properties(conn, cid, schema)
-        conn.commit()
-    return {"collection_id": cid, "name": name, "status": "created"}
-
-
-@router.get("/pages/{page_id}/export")
-def export_page_v2(page_id: int, request: Request, format: str = "markdown", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    fmt = (format or request.query_params.get("format") or "markdown").lower()
-    if fmt not in ("markdown", "html", "pdf"):
-        raise HTTPException(400, "format must be markdown, html or pdf")
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            # try collection_pages
-            row2 = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-            if not row2:
-                raise HTTPException(404, "Page not found")
-            # collection pages: return JSON
-            return {"page": row_to_dict(row2), "format": fmt}
-        # block pages: delegate to export service
-        from app.services.export import export_page as _export
-        try:
-            data, mime, fname = _export(row, fmt)  # type: ignore
-            return Response(content=data, media_type=mime, headers={"Content-Disposition": f'attachment; filename="{fname}"'})
-        except Exception as e:
-            raise HTTPException(500, f"Export failed: {e}") from None
-
-
-@router.get("/collections/{collection_id}/export/csv")
-def export_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    import csv
-    import io
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        props = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()]
-        rows = conn.execute("SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    out = io.StringIO()
-    writer = csv.writer(out)
-    header = ["Title"] + [p["name"] for p in props]
-    writer.writerow(header)
-    for r in rows:
-        try:
-            pv = json.loads(r["property_values_json"] or "{}")
-        except Exception:
-            pv = {}
-        vals = [r["title"]]
-        for p in props:
-            vals.append(str(pv.get(str(p["id"])) or pv.get(p["name"]) or ""))
-        writer.writerow(vals)
-    return Response(content=out.getvalue().encode("utf-8"), media_type="text/csv", headers={"Content-Disposition": f'attachment; filename="collection-{collection_id}.csv"'})
-
-
-@router.post("/collections/{collection_id}/import/csv")
-async def import_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    try:
-        form = await request.form()
-        file = form.get("file")
-        data = await file.read() if file else b""
-        text = data.decode("utf-8", errors="ignore")
-    except Exception as err:
-        raise HTTPException(400, "file required (multipart)") from err
-    import csv
-    import io
-    reader = csv.DictReader(io.StringIO(text))
-    created = 0
-    with get_conn() as conn:
-        for row in reader:
-            title = row.get("Title") or row.get("title") or "Untitled"
-            # map remaining columns to property names
-            pv = {}
-            # resolve prop name -> id
-            props = {p["name"]: p["id"] for p in conn.execute("SELECT id, name FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()}
-            for k, v in row.items():
-                if k in ("Title", "title"):
-                    continue
-                pid = props.get(k)
-                if pid:
-                    pv[str(pid)] = v
-            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-            conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (collection_id, title, max_pos, json.dumps(pv)))
-            created += 1
-        conn.commit()
-    return {"imported": created, "status": "ok"}
@@ -1,164 +0,0 @@
-"""FlowDeck — Public API v2 : views.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/views")
-def create_view_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "New View").strip()
-    vtype = body.get("view_type") or body.get("type") or "table"
-    config = body.get("config") or body.get("config_json") or {}
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, name, vtype, json.dumps(config), max_pos, user["id"]))
-        vid = cur.lastrowid
-        conn.commit()
-    audit_log(user, "view.create", "view", vid, name, request)
-    try:
-        run_event_sync(_fire_event("collection.view.created", {"view_id": vid, "collection_id": collection_id, "name": name, "view_type": vtype}))
-    except Exception:
-        logger.exception("create_view_v2")
-    return {"id": vid, "name": name, "view_type": vtype, "status": "created"}
-
-
-@router.patch("/views/{view_id}")
-def patch_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "View not found")
-        cfg = json.loads(row["config_json"] or "{}")
-        if "config" in body:
-            cfg.update(body["config"])
-        elif "config_json" in body:
-            try:
-                cfg.update(json.loads(body["config_json"]) if isinstance(body["config_json"], str) else body["config_json"])
-            except Exception:
-                logger.exception("patch_view_v2")
-        # also flat keys
-        for k in ("group_by", "sub_group_by", "wip_limits", "card_size", "cover_property", "cover_mode", "card_properties", "visible_properties", "filters", "sorts", "date_property"):
-            if k in body:
-                cfg[k] = body[k]
-        name = body.get("name", row["name"])
-        vtype = body.get("view_type") or body.get("type") or row["view_type"]
-        conn.execute("UPDATE collection_views SET name=?, view_type=?, config_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, vtype, json.dumps(cfg), view_id))
-        conn.commit()
-    audit_log(user, "view.update", "view", view_id, "", request)
-    return {"id": view_id, "status": "updated"}
-
-
-@router.delete("/views/{view_id}")
-def delete_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_views WHERE id=?", (view_id,)).fetchone():
-            raise HTTPException(404, "View not found")
-        conn.execute("DELETE FROM collection_views WHERE id=?", (view_id,))
-        conn.commit()
-    audit_log(user, "view.delete", "view", view_id, "", request)
-    return {"id": view_id, "status": "deleted"}
-
-
-@router.post("/views/{view_id}/save-as")
-def save_as_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip() or "Copy"
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "View not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (row["collection_id"],)).fetchone()[0]
-        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (row["collection_id"], name, row["view_type"], row["config_json"], max_pos, user["id"]))
-        nid = cur.lastrowid
-        conn.commit()
-    return {"id": nid, "name": name, "status": "created"}
-
-
-@router.get("/collections/{collection_id}/dashboards")
-def list_dashboards_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM collection_dashboards WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
-    return {"dashboards": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/collections/{collection_id}/dashboards")
-def create_dashboard_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Dashboard").strip()
-    layout = body.get("layout") or body.get("layout_json") or {"columns": 1, "widgets": []}
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO collection_dashboards (collection_id, name, layout_json) VALUES (?, ?, ?)", (collection_id, name, json.dumps(layout)))
-        did = cur.lastrowid
-        conn.commit()
-    return {"id": did, "name": name, "status": "created"}
-
-
-@router.patch("/dashboards/{dashboard_id}")
-def patch_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_dashboards WHERE id=?", (dashboard_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Dashboard not found")
-        name = body.get("name", row["name"])
-        layout = body.get("layout") or body.get("layout_json")
-        if layout is not None:
-            layout_json = json.dumps(layout)
-        else:
-            layout_json = row["layout_json"]
-        conn.execute("UPDATE collection_dashboards SET name=?, layout_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, layout_json, dashboard_id))
-        conn.commit()
-    return {"id": dashboard_id, "status": "updated"}
-
-
-@router.delete("/dashboards/{dashboard_id}")
-def delete_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM collection_dashboards WHERE id=?", (dashboard_id,))
-        conn.commit()
-    return {"id": dashboard_id, "status": "deleted"}
@@ -1,195 +0,0 @@
-"""FlowDeck — Public API v2 : webhooks.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/webhooks")
-def list_webhooks_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) AS n FROM webhook_subscriptions").fetchone()["n"]
-        rows = conn.execute(
-            "SELECT * FROM webhook_subscriptions ORDER BY created_at DESC LIMIT ? OFFSET ?",
-            (limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"webhooks": [dict(r) for r in rows]},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/webhooks")
-def create_webhook_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    from app.services.webhook_outbound import EVENTS, _event_matches
-    url = (body.get("url") or "").strip()
-    event = (body.get("event") or "page.created").strip()
-    secret = (body.get("secret") or "").strip()
-    if not url or not url.startswith("http"):
-        raise HTTPException(400, "url must start with http")
-    if not event or (event not in EVENTS and not (event.endswith(".*") or event in ("*", "all"))):
-        raise HTTPException(400, f"Unknown event '{event}'. See GET /api/v2/webhooks/events")
-    # make sure the pattern matches at least one known event
-    if not any(_event_matches(event, e) for e in EVENTS):
-        raise HTTPException(400, f"Event pattern '{event}' matches no known event")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO webhook_subscriptions (url, event, secret) VALUES (?, ?, ?)", (url, event, secret))
-        wid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (wid,)).fetchone()
-    audit_log(user, "webhook.create", "webhook", wid, url, request)
-    return {"id": wid, "status": "created", "webhook": dict(row) if row else {},
-            "signature_header": "X-FlowDeck-Signature (HMAC-SHA256, sha256=<hex>)" if secret else None}
-
-
-@router.patch("/webhooks/{webhook_id}")
-def patch_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Webhook not found")
-        url = body.get("url", row["url"])
-        event = body.get("event", row["event"])
-        secret = body.get("secret", row["secret"])
-        active = int(bool(body.get("active", row["active"])))
-        conn.execute("UPDATE webhook_subscriptions SET url=?, event=?, secret=?, active=? WHERE id=?", (url, event, secret, active, webhook_id))
-        conn.commit()
-    audit_log(user, "webhook.update", "webhook", webhook_id, "", request)
-    return {"id": webhook_id, "status": "updated"}
-
-
-@router.delete("/webhooks/{webhook_id}")
-def delete_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM webhook_subscriptions WHERE id=?", (webhook_id,))
-        conn.commit()
-    audit_log(user, "webhook.delete", "webhook", webhook_id, "", request)
-    return {"id": webhook_id, "status": "deleted"}
-
-
-@router.post("/webhooks/{webhook_id}/test")
-async def test_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Webhook not found")
-        # live delivery via the prod dispatcher (HMAC + retry + journal),
-        # direct to this subscription only (no wildcard fan-out)
-        from app.services.webhook_outbound import deliver_to_sub
-        ok = await deliver_to_sub(webhook_id, row["url"], "ping",
-                                  {"webhook_id": webhook_id, "test": True},
-                                  row["secret"] or "")
-    audit_log(user, "webhook.test", "webhook", webhook_id, f"ok={ok}", request)
-    return {"webhook_id": webhook_id, "status": "tested", "delivered": ok}
-
-
-@router.get("/webhooks/{webhook_id}/deliveries")
-def list_deliveries_v2(webhook_id: int, request: Request,
-                              status: str | None = None,
-                              authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        if status:
-            total = conn.execute(
-                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=? AND status=?",
-                (webhook_id, status)).fetchone()["n"]
-            rows = conn.execute(
-                "SELECT * FROM webhook_deliveries WHERE webhook_id=? AND status=? "
-                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
-                (webhook_id, status, limit, offset)).fetchall()
-        else:
-            total = conn.execute(
-                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=?",
-                (webhook_id,)).fetchone()["n"]
-            rows = conn.execute(
-                "SELECT * FROM webhook_deliveries WHERE webhook_id=? "
-                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
-                (webhook_id, limit, offset)).fetchall()
-    return JSONResponse(
-        content={"deliveries": [row_to_dict(r) for r in rows]},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/webhooks/{webhook_id}/retry")
-async def retry_webhook_deliveries(webhook_id: int, request: Request,
-                                    authorization: str | None = Header(default=None)):
-    """Manually retry failed deliveries for a webhook."""
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-
-    from app.services.webhook_outbound import retry_due_deliveries
-
-    with get_conn() as conn:
-        # Force retry by setting next_retry_at to the past
-        conn.execute(
-            """UPDATE webhook_deliveries
-               SET next_retry_at = strftime('%s', 'now', '-1 second')
-               WHERE webhook_id = ? AND status = 'retrying'""",
-            (webhook_id,),
-        )
-        conn.commit()
-
-    retried = await retry_due_deliveries()
-    audit_log(user, "webhook.retry", "webhook", webhook_id, f"retried={retried}", request)
-    return {"webhook_id": webhook_id, "status": "retried", "retried_count": retried}
-
-
-@router.post("/webhooks/verify-signature")
-def verify_webhook_signature(request: Request,
-                                    authorization: str | None = Header(default=None),
-                                    body: dict = Body(default={})):
-    """Verify a webhook signature (for debugging/testing)."""
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-
-    from app.services.webhook_outbound import verify_signature
-
-    secret = body.get("secret", "")
-    payload = body.get("payload", "{}")
-    signature = body.get("signature", "")
-
-    is_valid = verify_signature(secret, payload.encode(), signature)
-
-    audit_log(user, "webhook.signature_verify", "webhook", 0, f"valid={is_valid}", request)
-    return {"valid": is_valid, "secret": secret[:10] + "..." if len(secret) > 10 else secret}
@@ -1,230 +0,0 @@
-"""FlowDeck — Public API v2 : workspaces.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/workspaces")
-def list_workspaces(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM workspaces WHERE owner_id=? OR id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?)", (user["id"], user["id"])).fetchone()[0]
-        rows = conn.execute("SELECT w.*, wm.role FROM workspaces w LEFT JOIN workspace_members wm ON wm.workspace_id=w.id AND wm.user_id=? WHERE w.owner_id=? OR w.id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?) ORDER BY w.created_at DESC LIMIT ? OFFSET ?", (user["id"], user["id"], user["id"], limit, offset)).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["created_at"] = to_iso8601(d.get("created_at"))
-        try:
-            d["settings"] = json.loads(d.get("settings_json") or "{}")
-        except Exception:
-            d["settings"] = {}
-        out.append(d)
-    return {"workspaces": out, "total": total, "limit": limit, "offset": offset}
-
-
-@router.post("/workspaces")
-def create_workspace(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    settings_json = json.dumps(body.get("settings") or body.get("settings_json") or {})
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)", (name, user["id"], settings_json))
-        wid = cur.lastrowid
-        # owner is implicitly admin member
-        try:
-            conn.execute("INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')", (wid, user["id"]))
-        except Exception:
-            logger.exception("create_workspace")
-        conn.commit()
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (wid,)).fetchone()
-    audit_log(user, "workspace.create", "workspace", wid, name, request)
-    data = {"id": wid, "name": name, "owner_id": user["id"], "status": "created", "workspace": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 200)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/workspaces/{workspace_id}")
-def get_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        # ACL: must be member or owner
-        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-        is_owner = row["owner_id"] == user["id"]
-        if not is_owner and not member and not user.get("is_admin"):
-            raise HTTPException(404, "Workspace not found")
-        members = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
-    d = row_to_dict(row)
-    d["members"] = [dict(m) for m in members]
-    return d
-
-
-@router.patch("/workspaces/{workspace_id}")
-def patch_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        if row["owner_id"] != user["id"] and not user.get("is_admin"):
-            # check admin member
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can edit workspace")
-        name = body.get("name", row["name"])
-        sj = body.get("settings_json") or body.get("settings")
-        if sj is not None:
-            sj = json.dumps(sj) if isinstance(sj, (dict, list)) else str(sj)
-        else:
-            sj = row["settings_json"]
-        conn.execute("UPDATE workspaces SET name=?, settings_json=? WHERE id=?", (name, sj, workspace_id))
-        conn.commit()
-    audit_log(user, "workspace.update", "workspace", workspace_id, "", request)
-    return {"id": workspace_id, "status": "updated"}
-
-
-@router.delete("/workspaces/{workspace_id}")
-def delete_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        if row["owner_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Only owner can delete workspace")
-        conn.execute("DELETE FROM workspaces WHERE id=?", (workspace_id,))
-        conn.commit()
-    audit_log(user, "workspace.delete", "workspace", workspace_id, "", request)
-    return {"id": workspace_id, "status": "deleted"}
-
-
-@router.get("/workspaces/{workspace_id}/members")
-def list_workspace_members(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        rows = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
-    return {"members": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/workspaces/{workspace_id}/members")
-def invite_member(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    target_id = body.get("user_id") or body.get("uid")
-    email = (body.get("email") or "").strip()
-    role = (body.get("role") or "editor").strip().lower()
-    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
-        raise HTTPException(400, "Invalid role")
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        # only owner/admin can invite
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can invite")
-        uid = target_id
-        if not uid and email:
-            u = conn.execute("SELECT id FROM users WHERE email=?", (email,)).fetchone()
-            if not u:
-                raise HTTPException(404, f"User with email {email} not found")
-            uid = u["id"]
-        if not uid:
-            raise HTTPException(400, "user_id or email required")
-        try:
-            conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)", (workspace_id, uid, role))
-        except Exception:
-            conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
-        conn.commit()
-    audit_log(user, "workspace.invite", "workspace", workspace_id, f"uid={uid} role={role}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "added"}
-
-
-@router.patch("/workspaces/{workspace_id}/members/{uid}")
-def update_member_role(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    role = (body.get("role") or "").strip().lower()
-    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
-        raise HTTPException(400, "Invalid role")
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can change roles")
-        conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
-        if conn.total_changes == 0:
-            raise HTTPException(404, "Member not found")
-        conn.commit()
-    audit_log(user, "workspace.role_change", "workspace", workspace_id, f"uid={uid} role={role}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "updated"}
-
-
-@router.delete("/workspaces/{workspace_id}/members/{uid}")
-def remove_member(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can remove members")
-        conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, uid))
-        conn.commit()
-    audit_log(user, "workspace.remove_member", "workspace", workspace_id, f"uid={uid}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "status": "removed"}
@@ -1,657 +0,0 @@
-"""FlowDeck — Public API v2 : Agent & Skill marketplace (v6.6.0, phase 5).
-
-Thin Bearer+scopes wrappers over the existing agent logic (AgentEngine,
-`agent_skills`, the gallery service) so third-party integrations can drive
-FlowDeck Agent without a browser session:
-
-* ``/api/v2/agents`` — agents CRUD, conversations, synchronous runs (JSON,
-  the SSE stream stays an internal/UI concern), audit journal & rollback.
-* ``/api/v2/skills`` — the skill marketplace: CRUD, portable export/import and
-  the built-in gallery of installable presets.
-
-Rules honoured (see docs/API_GUIDE_V6.md): one code path (the engine and the
-gallery service are reused, never re-implemented), JSON only, no secrets or
-internal columns, rate limit + audit + idempotency on every mutation.
-"""
-from __future__ import annotations
-
-import json
-import time
-
-from fastapi import APIRouter, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.routers.agent import _default_agent
-from app.services import skill_gallery
-from app.services.agent_engine import AgentEngine, undo_action
-from app.services.api_v2_helpers import (
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    row_to_dict,
-    store_idempotency,
-)
-from app.services.llm_client import LLMClient
-from app.services.llm_config import get_user_llm_key
-
-router = APIRouter(prefix="/api/v2", tags=["api-v2-agent"])
-
-
-# ── Shared guards ──────────────────────────────────────────────────────────
-
-def _guard(request: Request, authorization: str | None, *, write: bool = False) -> dict:
-    """Bearer auth + per-token rate limit (+ write scope when required)."""
-    user = get_bearer_user(request, authorization)
-    ip = request.client.host if request.client else "unknown"
-    if not check_v2_rate_limit(user.get("_token_hash"), ip):
-        raise HTTPException(429, "Rate limit exceeded: 300 req/min per token")
-    if write and not has_scope(user.get("_token_scopes"), "write"):
-        raise HTTPException(403, "Insufficient scope. Required: write")
-    return user
-
-
-async def _json_body(request: Request) -> dict:
-    try:
-        body = await request.json()
-    except Exception:  # noqa: BLE001
-        return {}
-    return body if isinstance(body, dict) else {}
-
-
-def _workspace_of(request: Request, body: dict | None = None) -> int | None:
-    """Workspace resolution mirrors the internal agent router: explicit param
-    wins, then the token's own workspace, else NULL (shared/global scope)."""
-    body = body or {}
-    raw = body.get("workspace_id") or request.query_params.get("workspace_id")
-    if raw is None:
-        return None
-    try:
-        return int(raw)
-    except (TypeError, ValueError):
-        return None
-
-
-def _owned_conversation(conn, conversation_id: int, user_id: int):
-    """Conversation visible to this token's user (ownership is enforced here,
-    unlike the session router where the browser is already authenticated)."""
-    return conn.execute(
-        "SELECT * FROM agent_conversations WHERE id=? AND user_id=?",
-        (conversation_id, user_id),
-    ).fetchone()
-
-
-def _engine_for(user_id: int, workspace_id: int | None, provider: str | None) -> AgentEngine:
-    engine = AgentEngine(user_id, workspace_id=workspace_id)
-    if provider:
-        user_key = get_user_llm_key(user_id, provider)
-        if user_key and user_key.get("api_key"):
-            engine.llm = LLMClient(
-                provider=provider,
-                api_key=user_key["api_key"],
-                api_base=user_key.get("api_base") or None,
-            )
-        else:
-            engine.llm = LLMClient(provider=provider)
-    return engine
-
-
-# ── Agents ─────────────────────────────────────────────────────────────────
-
-@router.get("/agents")
-def list_agents_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    ws = _workspace_of(request)
-    with get_conn() as conn:
-        _default_agent(conn, user["id"])
-        clause = "WHERE workspace_id IS ? OR workspace_id=?"
-        total = conn.execute(f"SELECT COUNT(*) FROM agents {clause}", (ws, ws)).fetchone()[0]
-        rows = conn.execute(
-            f"SELECT * FROM agents {clause} ORDER BY agent_type, name LIMIT ? OFFSET ?",
-            (ws, ws, limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"agents": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/agents")
-async def create_agent_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    name = (body.get("name") or "").strip() or "Custom Agent"
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                """INSERT INTO agents (workspace_id, name, icon, agent_type, description,
-                       system_instructions, model, scope_json, trigger_json, approval_mode, created_by)
-                   VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
-                (ws, name, body.get("icon", "🤖"), body.get("agent_type", "custom"),
-                 body.get("description", ""), body.get("system_instructions", ""),
-                 body.get("model", "gpt-4o"),
-                 json.dumps(body.get("scope", {})), json.dumps(body.get("trigger", {})),
-                 body.get("approval_mode", "auto"), user["id"]),
-            )
-            conn.commit()
-            agent_id = cur.lastrowid
-            row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        except Exception as exc:  # noqa: BLE001
-            raise HTTPException(409, f"Cannot create agent: {exc}") from exc
-    audit_log(user, "agent.create", "agent", agent_id, name, request)
-    data = {"id": agent_id, "name": name, "status": "created", "agent": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/agents/{agent_id}")
-def get_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Agent not found")
-    return row_to_dict(row)
-
-
-@router.put("/agents/{agent_id}")
-async def update_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    with get_conn() as conn:
-        existing = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        if not existing:
-            raise HTTPException(404, "Agent not found")
-        sets, params = [], []
-        for col in ("name", "icon", "description", "system_instructions", "model",
-                    "approval_mode", "is_active"):
-            if col in body:
-                sets.append(f"{col}=?")
-                params.append(body[col])
-        if "scope" in body:
-            sets.append("scope_json=?")
-            params.append(json.dumps(body["scope"]))
-        if "trigger" in body:
-            sets.append("trigger_json=?")
-            params.append(json.dumps(body["trigger"]))
-        if sets:
-            params.append(agent_id)
-            conn.execute(f"UPDATE agents SET {', '.join(sets)} WHERE id=?", params)
-            conn.commit()
-    audit_log(user, "agent.update", "agent", agent_id, "", request)
-    return {"id": agent_id, "status": "updated"}
-
-
-@router.delete("/agents/{agent_id}")
-def delete_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone():
-            raise HTTPException(404, "Agent not found")
-        conn.execute("DELETE FROM agents WHERE id=?", (agent_id,))
-        conn.commit()
-    audit_log(user, "agent.delete", "agent", agent_id, "", request)
-    return {"id": agent_id, "status": "deleted"}
-
-
-# ── Conversations (static paths declared before /agents/{agent_id}) ────────
-
-@router.get("/agents/conversations")
-def list_conversations_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute(
-            "SELECT COUNT(*) FROM agent_conversations WHERE user_id=?", (user["id"],)
-        ).fetchone()[0]
-        rows = conn.execute(
-            """SELECT * FROM agent_conversations WHERE user_id=?
-               ORDER BY updated_at DESC LIMIT ? OFFSET ?""",
-            (user["id"], limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"conversations": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/agents/conversations")
-async def create_conversation_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    agent_id = body.get("agent_id")
-    with get_conn() as conn:
-        if agent_id is not None:
-            agent = conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone()
-            if not agent:
-                raise HTTPException(404, "Agent not found")
-            agent_id = agent["id"]
-        else:
-            agent_id = _default_agent(conn, user["id"])["id"]
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json, provider, model)
-               VALUES (?,?,?,?,?,?)""",
-            (agent_id, user["id"], body.get("title") or "New conversation",
-             json.dumps({"workspace_id": ws}),
-             body.get("provider") or "", body.get("model") or ""),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM agent_conversations WHERE id=?", (conv_id,)).fetchone()
-    audit_log(user, "agent.conversation.create", "agent_conversation", conv_id, "", request)
-    data = {"id": conv_id, "status": "created", "conversation": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/agents/conversations/{conversation_id}")
-def get_conversation_v2(conversation_id: int, request: Request,
-                              authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    with get_conn() as conn:
-        conv = _owned_conversation(conn, conversation_id, user["id"])
-        if not conv:
-            raise HTTPException(404, "Conversation not found")
-        messages = conn.execute(
-            "SELECT * FROM agent_messages WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    return {"conversation": row_to_dict(conv), "messages": [row_to_dict(m) for m in messages]}
-
-
-@router.delete("/agents/conversations/{conversation_id}")
-def delete_conversation_v2(conversation_id: int, request: Request,
-                                 authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        if not _owned_conversation(conn, conversation_id, user["id"]):
-            raise HTTPException(404, "Conversation not found")
-        conn.execute("DELETE FROM agent_conversations WHERE id=?", (conversation_id,))
-        conn.commit()
-    audit_log(user, "agent.conversation.delete", "agent_conversation", conversation_id, "", request)
-    return {"id": conversation_id, "status": "deleted"}
-
-
-@router.get("/agents/conversations/{conversation_id}/actions")
-def list_actions_v2(conversation_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    with get_conn() as conn:
-        if not _owned_conversation(conn, conversation_id, user["id"]):
-            raise HTTPException(404, "Conversation not found")
-        rows = conn.execute(
-            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    return {"actions": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/agents/actions/{action_id}/undo")
-def undo_action_v2(action_id: int, request: Request,
-                         authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        row = conn.execute(
-            """SELECT a.id FROM agent_actions a
-               JOIN agent_conversations c ON c.id = a.conversation_id
-               WHERE a.id=? AND c.user_id=?""",
-            (action_id, user["id"]),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Action not found")
-    try:
-        undo_action(action_id)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    except Exception as exc:  # noqa: BLE001
-        raise HTTPException(500, f"Rollback failed: {exc}") from exc
-    audit_log(user, "agent.action.undo", "agent_action", action_id, "", request)
-    return {"id": action_id, "status": "reverted"}
-
-
-# ── Runs (JSON — the SSE stream stays internal) ────────────────────────────
-
-def _collect_run_events(events: list[dict]) -> dict:
-    """Aggregate an engine event stream into a JSON run result.
-
-    Engine events are flat (``{"type": "final", "content": ...}``), the same
-    shape the SSE panel consumes.
-    """
-    final = None
-    reasoning = []
-    actions = []
-    error = None
-    for ev in events:
-        etype = ev.get("type")
-        if etype == "final":
-            final = ev.get("content") or final
-        elif etype == "reasoning":
-            reasoning.append(ev.get("content") or "")
-        elif etype == "action":
-            actions.append({k: v for k, v in ev.items() if k != "type"})
-        elif etype == "error":
-            error = ev.get("message") or "run failed"
-    return {
-        "status": "failed" if error else "completed",
-        "final": final,
-        "error": error,
-        "reasoning": reasoning,
-        "actions": actions,
-    }
-
-
-@router.post("/agents/conversations/{conversation_id}/run")
-async def run_conversation_v2(conversation_id: int, request: Request,
-                              authorization: str | None = Header(default=None)):
-    """Synchronous agent run: buffers the engine stream and returns JSON.
-
-    Third parties get one HTTP round-trip instead of an SSE subscription; the
-    same AgentEngine, permissions, journal and webhooks are used as the UI.
-    """
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    objective = (body.get("message") or body.get("objective") or "").strip()
-    if not objective:
-        raise HTTPException(400, "message is required")
-
-    with get_conn() as conn:
-        conv = _owned_conversation(conn, conversation_id, user["id"])
-        if not conv:
-            raise HTTPException(404, "Conversation not found")
-        eff_provider = body.get("provider") or conv["provider"] or None
-        eff_model = body.get("model") or conv["model"] or None
-        if body.get("provider") is not None or body.get("model") is not None:
-            conn.execute(
-                "UPDATE agent_conversations SET provider=?, model=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (body.get("provider", conv["provider"] or ""),
-                 body.get("model", conv["model"] or ""), conversation_id),
-            )
-            conn.commit()
-        conv_context = {}
-        try:
-            conv_context = json.loads(conv["context_json"] or "{}") or {}
-        except (TypeError, ValueError):
-            conv_context = {}
-
-    ws = _workspace_of(request, body)
-    if ws is None:
-        ws = conv_context.get("workspace_id")
-
-    engine = _engine_for(user["id"], ws, eff_provider)
-    started = time.time()
-    events = [
-        ev async for ev in engine.run(
-            conversation_id, objective,
-            model=eff_model,
-            mentions=body.get("mentions"),
-            files=body.get("files"),
-            skill_id=body.get("skill_id"),
-            skill_ids=body.get("skill_ids"),
-            extra_context=body.get("context"),
-        )
-    ]
-    result = _collect_run_events(events)
-    with get_conn() as conn:
-        actions = conn.execute(
-            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    payload = {
-        "conversation_id": conversation_id,
-        "status": result["status"],
-        "final": result["final"],
-        "error": result["error"],
-        "reasoning": result["reasoning"],
-        "actions": [row_to_dict(a) for a in actions],
-        "events": events,
-        "duration_ms": int((time.time() - started) * 1000),
-    }
-    audit_log(user, "agent.run", "agent_conversation", conversation_id, objective[:200], request)
-    status_code = 200 if result["status"] == "completed" else 500
-    data = payload
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, status_code)
-    return JSONResponse(content=data, status_code=status_code)
-
-
-@router.post("/agents/{agent_id}/trigger")
-async def trigger_agent_v2(agent_id: int, request: Request,
-                           authorization: str | None = Header(default=None)):
-    """Fire a custom agent from an external integration (JSON, synchronous)."""
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        agent = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        if not agent:
-            raise HTTPException(404, "Agent not found")
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
-               VALUES (?,?,?,?)""",
-            (agent_id, user["id"], f"Run: {agent['name']}", json.dumps({"workspace_id": ws})),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-
-    objective = (agent["system_instructions"] or "").strip() or f"Exécute l'agent « {agent['name']} »."
-    if body.get("message"):
-        objective = f"{objective}\n\n{body['message']}"
-    engine = _engine_for(user["id"], ws, agent["model"] or None)
-    started = time.time()
-    events = [ev async for ev in engine.run(conv_id, objective, model=agent["model"])]
-    result = _collect_run_events(events)
-    payload = {
-        "conversation_id": conv_id,
-        "agent_id": agent_id,
-        "status": result["status"],
-        "final": result["final"],
-        "error": result["error"],
-        "reasoning": result["reasoning"],
-        "actions": result["actions"],
-        "duration_ms": int((time.time() - started) * 1000),
-    }
-    audit_log(user, "agent.trigger", "agent", agent_id, objective[:200], request)
-    return JSONResponse(content=payload, status_code=200 if result["status"] == "completed" else 500)
-
-
-# ── Skill marketplace ──────────────────────────────────────────────────────
-
-@router.get("/skills")
-def list_skills_v2(request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    ws = _workspace_of(request)
-    with get_conn() as conn:
-        total = conn.execute(
-            "SELECT COUNT(*) FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?",
-            (ws, ws),
-        ).fetchone()[0]
-        rows = conn.execute(
-            """SELECT * FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?
-               ORDER BY name LIMIT ? OFFSET ?""",
-            (ws, ws, limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"skills": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/skills")
-async def create_skill_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    try:
-        fields = skill_gallery.parse_payload(
-            {k: body[k] for k in ("name", "description", "prompt_template", "allowed_tools")
-             if k in body} | {"format": skill_gallery.EXPORT_FORMAT}
-        )
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    try:
-        row, created = skill_gallery.upsert_skill(
-            fields, workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite")),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.create", "skill", row.get("id"), fields["name"], request)
-    data = {"id": row.get("id"), "name": fields["name"],
-            "status": "created" if created else "updated", "skill": row_to_dict(row) if row else {}}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201 if created else 200)
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-# Gallery & import are static segments: declared before /skills/{skill_id} so
-# FastAPI never tries to coerce "gallery" into an int path parameter.
-@router.get("/skills/gallery")
-def skills_gallery_v2(request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    presets = skill_gallery.list_gallery()
-    return {"gallery": presets, "total": len(presets),
-            "install": "POST /api/v2/skills/gallery/{slug}/install"}
-
-
-@router.post("/skills/gallery/{slug}/install")
-async def install_gallery_skill_v2(slug: str, request: Request,
-                                   authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    preset = skill_gallery.get_gallery(slug)
-    if not preset:
-        raise HTTPException(404, f"Unknown gallery skill: {slug}")
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    try:
-        row, created = skill_gallery.upsert_skill(
-            skill_gallery.parse_payload(preset),
-            workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite", True)),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.gallery.install", "skill", row.get("id"), slug, request)
-    data = {"slug": slug, "id": row.get("id"), "name": row.get("name"),
-            "status": "installed" if created else "updated", "skill": row_to_dict(row)}
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-@router.post("/skills/import")
-async def import_skill_v2(request: Request, authorization: str | None = Header(default=None)):
-    """Import a portable skill document (from another FlowDeck instance)."""
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    payload = body.get("payload") if isinstance(body.get("payload"), dict) else body
-    try:
-        fields = skill_gallery.parse_payload(payload)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    ws = _workspace_of(request, body)
-    try:
-        row, created = skill_gallery.upsert_skill(
-            fields, workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite")),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.import", "skill", row.get("id"), fields["name"], request)
-    data = {"id": row.get("id"), "name": fields["name"],
-            "status": "imported" if created else "updated", "skill": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201 if created else 200)
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-@router.get("/skills/{skill_id}")
-def get_skill_v2(skill_id: int, request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Skill not found")
-    return row_to_dict(row)
-
-
-@router.get("/skills/{skill_id}/export")
-def export_skill_v2(skill_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    """Portable JSON document — POST it to /api/v2/skills/import elsewhere."""
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Skill not found")
-    return skill_gallery.export_skill(row)
-
-
-@router.delete("/skills/{skill_id}")
-def delete_skill_v2(skill_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT name FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Skill not found")
-        conn.execute("DELETE FROM agent_skills WHERE id=?", (skill_id,))
-        conn.commit()
-    audit_log(user, "skill.delete", "skill", skill_id, row["name"] or "", request)
-    return {"id": skill_id, "status": "deleted"}
-
-
-@router.post("/skills/{skill_id}/apply")
-async def apply_skill_v2(skill_id: int, request: Request,
-                         authorization: str | None = Header(default=None)):
-    """Open a conversation pre-loaded with the skill (ready to run)."""
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        skill = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-        if not skill:
-            raise HTTPException(404, "Skill not found")
-        agent_id = _default_agent(conn, user["id"])["id"]
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
-               VALUES (?,?,?,?)""",
-            (agent_id, user["id"], skill["name"],
-             json.dumps({"workspace_id": ws if ws is not None else skill["workspace_id"],
-                         "skill_id": skill_id})),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-    audit_log(user, "skill.apply", "skill", skill_id, skill["name"], request)
-    return JSONResponse(content={"conversation_id": conv_id, "skill": skill["name"],
-                                 "status": "ready"}, status_code=201)
@@ -1,124 +0,0 @@
-"""FlowDeck — unified audit log API (v7.2.0).
-
-Merges ``api_audit_log`` + ``permission_audit_log`` + ``sso_login_history``
-with actor/resource/date filters and CSV export (10k rows max, 365-day
-retention note). Admin only. See ``docs/V72_Enterprise_SCIM_2FA.md``.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import JSONResponse, PlainTextResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.api_v2_helpers import (
-    has_scope,
-    parse_pagination,
-    resolve_bearer_token,
-)
-
-router = APIRouter(tags=["audit"])
-
-
-def _admin_user(request: Request) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        with get_conn() as conn:
-            row = conn.execute("SELECT is_admin FROM users WHERE id=?",
-                               (sess.get("id"),)).fetchone()
-        if row and row["is_admin"]:
-            return sess
-        raise HTTPException(403, "Admin required")
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if user and user.get("is_admin") and has_scope(
-                user.get("_token_scopes") or "read", "admin"):
-            return user
-    raise HTTPException(401, "Admin authentication required")
-
-
-def _query(source: str, actor: str, action: str, limit: int, offset: int):
-    """One source query → (rows, columns). All normalized to a common shape."""
-    with get_conn() as conn:
-        if source in ("api", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, user_id AS actor, action,
-                          resource_type || ':' || resource_id AS resource,
-                          ip_address AS ip, detail, 'api' AS source
-                   FROM api_audit_log
-                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
-                     AND (?='' OR action LIKE ?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
-            ).fetchall()
-            if source == "api":
-                return rows
-            api = [dict(r) for r in rows]
-        else:
-            api = []
-        if source in ("permissions", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, performed_by AS actor, action,
-                          resource_type || ':' || resource_id AS resource,
-                          ip_address AS ip,
-                          ('target=' || COALESCE(target_user_id, target_group_id, '')
-                           || ' ' || COALESCE(old_role,'') || '→' || COALESCE(new_role,'')) AS detail,
-                          'permissions' AS source
-                   FROM permission_audit_log
-                   WHERE (?='' OR CAST(performed_by AS TEXT)=?)
-                     AND (?='' OR action LIKE ?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
-            ).fetchall()
-            if source == "permissions":
-                return rows
-            perm = [dict(r) for r in rows]
-        else:
-            perm = []
-        if source in ("sso", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, user_id AS actor,
-                          ('sso_' || provider_type || '_' ||
-                            CASE success WHEN 1 THEN 'success' ELSE 'failure' END) AS action,
-                          provider_name AS resource, ip_address AS ip,
-                          COALESCE(error_message, sso_identifier, '') AS detail,
-                          'sso' AS source
-                   FROM sso_login_history
-                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, limit, offset)).fetchall()
-            if source == "sso":
-                return rows
-            sso = [dict(r) for r in rows]
-        else:
-            sso = []
-    merged = sorted(api + perm + sso, key=lambda d: str(d.get("at") or ""),
-                    reverse=True)
-    return merged[:limit]
-
-
-@router.get("/api/v2/audit/logs")
-def audit_logs(request: Request):
-    _admin_user(request)
-    qp = request.query_params
-    source = (qp.get("source") or "all").lower()
-    if source not in ("all", "api", "permissions", "sso"):
-        raise HTTPException(400, "source must be all|api|permissions|sso")
-    limit, offset = parse_pagination(request, default_limit=50, max_limit=500)
-    rows = _query(source, qp.get("actor") or "", qp.get("action") or "", limit, offset)
-    rows = [dict(r) if not isinstance(r, dict) else r for r in rows]
-    if qp.get("format") == "csv":
-        import csv
-        import io
-        buf = io.StringIO()
-        writer = csv.DictWriter(buf, fieldnames=["at", "source", "actor", "action",
-                                                 "resource", "ip", "detail"])
-        writer.writeheader()
-        for r in rows[:10000]:
-            writer.writerow({k: r.get(k, "") for k in writer.fieldnames})
-        return PlainTextResponse(buf.getvalue(), media_type="text/csv",
-                                 headers={"Content-Disposition":
-                                          "attachment; filename=audit.csv"})
-    return JSONResponse(content={"logs": rows, "source": source,
-                                 "limit": limit, "offset": offset})
@@ -4,43 +4,15 @@ from __future__ import annotations
 import logging
 import secrets

-from fastapi import APIRouter, Body, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi import APIRouter, Request, Query
+from fastapi.responses import RedirectResponse, HTMLResponse

 from app.auth.session import SessionManager
 from app.config import settings
-from app.templating import CSP_NONCE

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["auth"], prefix="/auth")

-
-def get_redirect_uri(request: Request) -> str:
-    """OAuth redirect URI for this request.
-
-    Explicit `OAUTH_REDIRECT_URI` env override wins (must be registered in the
-    provider's OAuth app). Otherwise it is derived from the request so it always
-    matches the URL the user actually used: scheme from `X-Forwarded-Proto`
-    (reverse proxies) falling back to the request scheme, host from
-    `X-Forwarded-Host` falling back to the `Host` header.
-    """
-    if settings.oauth_redirect_uri:
-        return settings.oauth_redirect_uri
-    proto = request.headers.get("x-forwarded-proto", "")
-    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
-    fwd_host = request.headers.get("x-forwarded-host", "")
-    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
-    return f"{scheme}://{host}/auth/callback"
-
-def _with_nonce(html: str) -> str:
-    """A20 : injecte le nonce CSP au moment du rendu.
-
-    `LOCAL_LOGIN_HTML` est une constante de module — le nonce, lui, est par
-    requête, donc il ne peut être figé qu'ici.
-    """
-    return html.replace("<script>", f'<script nonce="{CSP_NONCE.get()}">', 1)
-
-
 LOCAL_LOGIN_HTML = """<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -73,7 +45,6 @@ body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,
 .oauth-section{margin-top:20px;border-top:1px solid rgba(255,255,255,.08);padding-top:20px;}
 .oauth-btn{display:flex;align-items:center;justify-content:center;gap:8px;width:100%;padding:10px;border-radius:8px;font-size:14px;cursor:pointer;border:1px solid rgba(255,255,255,.12);background:#2A2A2A;color:#fff;}
 .oauth-btn:hover{background:#333;}
-.sso-btn{border-color:rgba(35,131,226,.5);}
 </style>
 </head>
 <body>
@@ -99,17 +70,11 @@ body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,
    <div class="form-group" id="name-group" style="display:none"><label>Name</label><input type="text" id="name"></div>
    <button type="submit" class="btn btn-primary" id="submit-btn">Login</button>
  </form>
-  <div class="oauth-section" id="oauth-section">
+  <div class="oauth-section">
    <p style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
    <button class="oauth-btn" onclick="window.location='/auth/login?provider=gitea'" style="margin-bottom:8px">🔗 <span id="gitea-btn-label">Login</span> with Gitea</button>
    <button class="oauth-btn" onclick="window.location='/auth/login?provider=github'">🐙 <span id="github-btn-label">Login</span> with GitHub</button>
  </div>
-  <!-- SSO / SAML + OIDC (v6.7.0) — buttons injected by loadSsoProviders() -->
-  <div class="oauth-section" id="sso-section" style="display:none">
-    <p id="sso-divider" style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
-    <div id="sso-buttons"></div>
-    <p id="sso-only-note" style="display:none;font-size:12px;color:rgba(255,255,255,.45);margin-top:12px;line-height:1.5;">This instance only accepts your organization account — local login is disabled.</p>
-  </div>
 </div>
 <script>
 // Show session expired banner if ?expired=1 in URL
@@ -118,47 +83,15 @@ let mode='login';
 function switchTab(t){mode=t;document.querySelectorAll('.tab').forEach(el=>el.classList.remove('active'));document.getElementById('tab-'+t).classList.add('active');document.getElementById('name-group').style.display=t==='register'?'block':'none';document.getElementById('submit-btn').textContent=t==='register'?'Register':'Login';document.getElementById('error-msg').style.display='none';document.getElementById('success-msg').style.display='none';var lbl=t==='register'?'Register':'Login';var e1=document.getElementById('gitea-btn-label');var e2=document.getElementById('github-btn-label');if(e1)e1.textContent=lbl;if(e2)e2.textContent=lbl;}
 function togglePassword(){var pw=document.getElementById('password');var btn=pw.parentElement.querySelector('.pw-toggle');if(pw.type==='password'){pw.type='text';btn.textContent='🙈';}else{pw.type='password';btn.textContent='👁';}}
 async function handleLogin(e){e.preventDefault();const email=document.getElementById('email').value;const password=document.getElementById('password').value;const name=document.getElementById('name').value;const url=mode==='register'?'/auth/register':'/auth/local-login';const body={email,password};if(mode==='register')body.name=name;try{const r=await fetch(url,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const d=await r.json();if(!r.ok){document.getElementById('error-msg').textContent=d.error||'Error';document.getElementById('error-msg').style.display='block';return;}if(d.status==='ok'){window.location='/workspaces';}}catch(err){document.getElementById('error-msg').textContent='Network error';document.getElementById('error-msg').style.display='block';}}
-// SSO buttons (v6.7.0) — rendered from /api/v2/sso/providers
-(async function loadSsoProviders(){
-  try{
-    const r = await fetch('/api/v2/sso/providers');
-    if(!r.ok) return;
-    const d = await r.json();
-    const providers = d.providers || [];
-    if(!providers.length) return;
-    const wrap = document.getElementById('sso-buttons');
-    providers.forEach(function(p){
-      const b = document.createElement('button');
-      b.className = 'oauth-btn sso-btn';
-      b.style.marginBottom = '8px';
-      b.title = 'Sign in with ' + (p.name || 'SSO');
-      b.onclick = function(){ window.location = p.login_url; };
-      const icon = document.createElement('span'); icon.textContent = p.icon || '🏢';
-      const label = document.createElement('span');
-      label.textContent = (mode === 'register' ? 'Sign up' : 'Login') + ' with ' + (p.name || 'SSO');
-      b.appendChild(icon); b.appendChild(label);
-      wrap.appendChild(b);
-    });
-    document.getElementById('sso-section').style.display = 'block';
-    if(d.sso_only){
-      // Local auth is refused server-side too — don't show a dead form.
-      const form = document.getElementById('login-form'); if(form) form.style.display = 'none';
-      const tabs = document.querySelector('.tabs'); if(tabs) tabs.style.display = 'none';
-      const oauth = document.getElementById('oauth-section'); if(oauth) oauth.style.display = 'none';
-      const note = document.getElementById('sso-only-note'); if(note) note.style.display = 'block';
-      const intro = document.querySelector('.login-box p'); if(intro) intro.textContent = 'Sign in with your organization account to continue';
-    }
-  }catch(e){}
-})();
 </script>
 </body>
 </html>"""


@router.get("/register")
-def register_page(request: Request):
+async def register_page(request: Request):
    """Show the registration page (local login page with register tab active)."""
-    return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML.replace(
+    return HTMLResponse(LOCAL_LOGIN_HTML.replace(
        'class="tab active" onclick="switchTab(\'login\')"',
        'class="tab" onclick="switchTab(\'login\')"'
    ).replace(
@@ -173,16 +106,16 @@ def register_page(request: Request):
    ).replace(
        'id="submit-btn">Login<',
        'id="submit-btn">Register<'
-    )), status_code=200)
+    ), status_code=200)


@router.get("/login")
-def login(request: Request, provider: str = Query("gitea")):
+async def login(request: Request, provider: str = Query("gitea")):
    """Redirect to OAuth2 authorize page or show local login page."""
    # Local login page (POST handled by /auth/local-login)
    from fastapi.responses import HTMLResponse
    if provider == "local":
-        return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML), status_code=200)
+        return HTMLResponse(LOCAL_LOGIN_HTML, status_code=200)

    # OAuth flow — check if provider is configured
    from app.auth.providers import get_provider
@@ -211,20 +144,23 @@ def login(request: Request, provider: str = Query("gitea")):
    # Encode auth mode in state to survive session loss during OAuth redirect
    signed_state = f"{state}:{mode}" if mode else state
    request.session["oauth_mode"] = mode
-    # Redirect URI derived from the incoming request (scheme-aware); stored in
-    # session so the callback reuses the EXACT same URI for token exchange
-    redirect_uri = get_redirect_uri(request)
-    request.session["oauth_redirect_uri"] = redirect_uri
-    auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=redirect_uri, force_login=(mode == "link"))
+    # Dynamic redirect URI based on incoming Host header
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=dynamic_redirect_uri, force_login=(mode == "link"))
    return RedirectResponse(url=auth_url, status_code=302)


@router.post("/register")
-def register(request: Request, body: dict = Body(default={})):
+async def register(request: Request):
    """Register a new local account."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    email = body.get("email", "").strip()
    password = body.get("password", "").strip()
    name = body.get("name", email.split("@")[0] if "@" in email else email)
@@ -236,16 +172,6 @@ def register(request: Request, body: dict = Body(default={})):
        from fastapi.responses import JSONResponse
        return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)

-    # SSO-only instance (v6.7.0): local registration is refused — accounts are
-    # auto-provisioned by the IdP instead (admins still come from Settings).
-    from app.services.sso_provisioning import is_sso_only
-    if is_sso_only():
-        from fastapi.responses import JSONResponse
-        return JSONResponse(
-            {"error": "Registration is disabled — sign in with your organization SSO"},
-            status_code=403,
-        )
-
    with get_conn() as conn:
        existing = conn.execute("SELECT id FROM users WHERE login=?", (email,)).fetchone()
        if existing:
@@ -265,7 +191,7 @@ def register(request: Request, body: dict = Body(default={})):
    user_data = dict(user)
    # Log login
    _log_login(user_data["id"], request)
-    session = SessionManager.create_session(user_data, request)
+    session = SessionManager.create_session(user_data)
    from fastapi.responses import JSONResponse
    response = JSONResponse({"status": "ok", "user": {"login": email, "name": name}})
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -273,14 +199,16 @@ def register(request: Request, body: dict = Body(default={})):


@router.post("/local-login")
-def local_login(request: Request, body: dict = Body(default={})):
+async def local_login(request: Request):
    """Login with email + password."""
-    import time
-
-    from fastapi.responses import JSONResponse
-
    from app.db import get_conn
-    from app.password_utils import is_locked, verify_password
+    from app.password_utils import verify_password, is_locked
+    from fastapi.responses import JSONResponse
+    import json, time
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    email = body.get("email", "").strip()
    password = body.get("password", "").strip()

@@ -311,42 +239,14 @@ def local_login(request: Request, body: dict = Body(default={})):
            conn.commit()
        return JSONResponse({"error": "Invalid credentials"}, status_code=401)

-    # Successful local login — SSO-only instances keep a way in for admins
-    # only (every other account must use the IdP, design §7.1).
-    from app.services.sso_provisioning import is_sso_only
-    if is_sso_only() and not ud.get("is_admin"):
-        return JSONResponse(
-            {"error": "Local login is disabled on this instance — sign in with SSO"},
-            status_code=403,
-        )
-
-    # v7.2.0: verified domain with SSO enforcement (admins keep local access).
-    if not ud.get("is_admin"):
-        with get_conn() as conn:
-            dom = (ud.get("email") or "").split("@")[-1].lower() if "@" in (ud.get("email") or "") else ""
-            if dom:
-                enforced = conn.execute(
-                    "SELECT id FROM domain_claims WHERE domain=? AND verified=1"
-                    " AND enforce_sso=1", (dom,)).fetchone()
-                if enforced:
-                    return JSONResponse(
-                        {"error": "Local login is disabled for your domain — sign in with SSO"},
-                        status_code=403)
-
+    # Successful login
    with get_conn() as conn:
        conn.execute(
            "UPDATE users SET login_attempts=0, locked_until=NULL, last_login=? WHERE id=?",
            (str(time.time()), ud["id"]),
        )
        conn.commit()
-
-    # v7.2.0: TOTP 2FA — password OK, but hold the session until code check.
-    from app.services import two_factor as _2fa
-    if _2fa.is_enabled(ud["id"]):
-        return JSONResponse({"status": "2fa_required",
-                             "pending": _2fa.mint_pending(ud["id"])})
-
-    session = SessionManager.create_session(ud, request)
+    session = SessionManager.create_session(ud)
    _log_login(ud["id"], request)
    response = JSONResponse({"status": "ok", "user": {"login": ud["login"], "name": ud["full_name"]}})
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -382,10 +282,10 @@ async def callback(
    if not oauth_provider:
        return HTMLResponse(f"<h1>Unknown provider: {provider_name}</h1>", status_code=400)

-    # Exchange code for token — reuse the redirect URI from the authorize step
-    # (stored in session), falling back to deriving it from this request
-    redirect_uri = request.session.get("oauth_redirect_uri") or get_redirect_uri(request)
-    token_data = await oauth_provider.exchange_code(code, redirect_uri=redirect_uri)
+    # Exchange code for token — use dynamic redirect URI matching the authorize step
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    token_data = await oauth_provider.exchange_code(code, redirect_uri=dynamic_redirect_uri)
    if not token_data:
        return HTMLResponse("<h1>Token exchange failed</h1>", status_code=400)

@@ -402,7 +302,7 @@ async def callback(
    oauth_mode = request.session.pop("oauth_mode", "")
    if oauth_mode == "link":
        from app.auth.session import get_current_user as gcu
-        current = gcu(request)
+        current = await gcu(request)
        if not current:
            return HTMLResponse("<h1>Not logged in — please log in first</h1>", status_code=400)
        from app.db import get_conn as _gc
@@ -444,7 +344,7 @@ async def callback(
    user_data = dict(user) if user else oauth_user

    # Create session
-    session = SessionManager.create_session(user_data, request)
+    session = SessionManager.create_session(user_data)
    _log_login(user_data["id"], request)
    response = RedirectResponse(url="/workspaces", status_code=302)
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -452,107 +352,22 @@ async def callback(


@router.get("/logout")
-def logout(request: Request):
-    """Clear session and redirect to login page.
-
-    SAML sessions additionally hand over to the IdP's Single Logout when one
-    is configured (the actual cookie clearing happens on the SLO route).
-    """
-    cookie = request.cookies.get("flowdeck_session", "")
-    user = SessionManager.decode_session(cookie) if cookie else None
-    local_target = "/auth/login?provider=local"
-
-    if user and user.get("_sso_name_id"):
-        # SSO session → let /auth/saml/logout revoke locally + notify the IdP.
-        return RedirectResponse(url=f"/auth/saml/logout?next={local_target}", status_code=302)
-
-    response = RedirectResponse(url=local_target, status_code=302)
+async def logout():
+    """Clear session and redirect to login page."""
+    response = RedirectResponse(url="/auth/login?provider=local", status_code=302)
    response.delete_cookie("flowdeck_session")
    return response


@router.get("/user")
-def current_user(request: Request):
+async def current_user(request: Request):
    """Return current user info as JSON."""
    from app.auth.session import get_current_user as gcu
-    user = gcu(request)
+    user = await gcu(request)
    if not user:
        return {"authenticated": False}
    return {"authenticated": True, "user": user}

-
-# ── v7.2.0 — TOTP 2FA ─────────────────────────────────────────────────────
-
-@router.post("/local-verify")
-def local_verify(request: Request, body: dict = Body(default={})):
-    """Exchange a 2FA ``pending`` token + TOTP/backup code for a session."""
-    from fastapi.responses import JSONResponse
-
-    from app.db import get_conn
-    from app.services import two_factor as _2fa
-    user_id = _2fa.redeem_pending(body.get("pending", ""))
-    if not user_id:
-        return JSONResponse({"error": "Challenge expired — log in again"}, status_code=401)
-    if not _2fa.verify_code(user_id, body.get("code", "")):
-        return JSONResponse({"error": "Invalid code"}, status_code=401)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-        if not row or not row["is_active"]:
-            return JSONResponse({"error": "Account disabled"}, status_code=403)
-        ud = dict(row)
-    session = SessionManager.create_session(ud, request)
-    _log_login(ud["id"], request)
-    response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
-    response.set_cookie("flowdeck_session", session, httponly=True,
-                        max_age=86400 * 7, samesite="lax", path="/")
-    return response
-
-
-def _session_user_or_401(request: Request) -> dict:
-    from fastapi import HTTPException
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user
-
-
-@router.get("/2fa/status")
-def twofa_status(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    return {"enabled": _2fa.is_enabled(user["id"]),
-            "backup_remaining": _2fa.remaining_backup_codes(user["id"])}
-
-
-@router.post("/2fa/setup")
-def twofa_setup(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    return _2fa.setup_secret(user["id"])
-
-
-@router.post("/2fa/activate")
-def twofa_activate(request: Request, body: dict = Body(default={})):
-    from fastapi.responses import JSONResponse
-
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    try:
-        codes = _2fa.activate_secret(user["id"], body.get("secret", ""),
-                                     body.get("code", ""))
-    except ValueError:
-        return JSONResponse({"error": "Invalid code — secret not activated"},
-                            status_code=400)
-    return {"status": "enabled", "backup_codes": codes}
-
-
-@router.post("/2fa/disable")
-def twofa_disable(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    _2fa.disable(user["id"])
-    return {"status": "disabled"}
-
 # ── Helpers ──
 def _log_login(user_id: int, request: Request):
    """Record login in history."""
@@ -567,4 +382,4 @@ def _log_login(user_id: int, request: Request):
            )
            conn.commit()
    except Exception:
-        logger.exception("_log_login")
+        pass
@@ -1,318 +0,0 @@
-"""FlowDeck — Automations API (v5.1.0): rules CRUD, manual/button run, history."""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Depends, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import (
-    get_page_context,
-    get_steps,
-    press_button,
-    run_automation,
-    validate_step,
-)
-
-logger = logging.getLogger(__name__)
-
-
-def _require_session(request: Request) -> None:
-    """A13 : toute la route (CRUD, run, press-button) exige une session."""
-    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        raise HTTPException(status_code=401, detail="Authentication required")
-
-
-router = APIRouter(tags=["automations"], dependencies=[Depends(_require_session)])
-
-TRIGGER_TYPES = ("event", "cron", "button")
-
-
-def _json_or_dumps(val, default="[]"):
-    """Store JSON string columns without double-encoding."""
-    if val is None:
-        return default
-    if isinstance(val, str):
-        try:
-            json.loads(val)
-            return val
-        except (TypeError, json.JSONDecodeError):
-            return json.dumps(val)
-    return json.dumps(val)
-
-
-def _current_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    return user if user and user.get("id") else {}
-
-
-def _validate_payload(body: dict) -> None:
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name required")
-    trigger_type = body.get("trigger_type", "event")
-    if trigger_type not in TRIGGER_TYPES:
-        raise HTTPException(status_code=400, detail="invalid trigger_type")
-    if trigger_type == "event" and not body.get("event"):
-        raise HTTPException(status_code=400, detail="event required for event trigger")
-    if trigger_type == "cron" and not (body.get("cron_expression") or "").strip():
-        raise HTTPException(status_code=400, detail="cron_expression required for cron trigger")
-    for key in ("condition_json", "actions_json"):
-        val = body.get(key, "[]")
-        try:
-            if isinstance(val, str):
-                json.loads(val)
-            else:
-                json.dumps(val)
-        except (TypeError, json.JSONDecodeError):
-            raise HTTPException(status_code=400, detail=f"{key} must be valid JSON") from None
-
-
-@router.get("/workspace/automations")
-def list_automations(request: Request):
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM automations ORDER BY created_at DESC").fetchall()
-    items = [dict(r) for r in rows]
-    return {"automations": items}
-
-
-@router.post("/workspace/automations")
-def create_automation(request: Request, body: dict = Body(default={})):
-    _validate_payload(body)
-    user = _current_user(request)
-    by = user["id"]
-    with get_conn() as conn:
-        cur = conn.execute(
-            """INSERT INTO automations
-               (workspace, name, trigger_type, event, cron_expression, collection_id,
-                condition_json, actions_json, enabled, created_by)
-               VALUES (?,?,?,?,?,?,?,?,?,?)""",
-            (
-                body.get("workspace", "") or "",
-                (body.get("name") or "").strip(),
-                body.get("trigger_type", "event"),
-                body.get("event", "page.created"),
-                body.get("cron_expression", "") or "",
-                body.get("collection_id") or None,
-                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
-                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
-                int(body.get("enabled", True)),
-                by,
-            ),
-        )
-        conn.commit()
-        new_id = cur.lastrowid
-    return {"id": new_id, "status": "created"}
-
-
-@router.get("/workspace/automations/{auto_id}")
-def get_automation(request: Request, auto_id: int):
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
-    if not row:
-        raise HTTPException(status_code=404, detail="Automation not found")
-    return dict(row)
-
-
-@router.put("/workspace/automations/{auto_id}")
-def update_automation(request: Request, auto_id: int, body: dict = Body(default={})):
-    _validate_payload(body)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id FROM automations WHERE id=?", (auto_id,)).fetchone()
-        if not row:
-            raise HTTPException(status_code=404, detail="Automation not found")
-        conn.execute(
-            """UPDATE automations SET
-                 name=?, trigger_type=?, event=?, cron_expression=?, collection_id=?,
-                 condition_json=?, actions_json=?, enabled=?, updated_at=CURRENT_TIMESTAMP
-               WHERE id=?""",
-            (
-                (body.get("name") or "").strip(),
-                body.get("trigger_type", "event"),
-                body.get("event", "page.created"),
-                body.get("cron_expression", "") or "",
-                body.get("collection_id") or None,
-                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
-                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
-                int(body.get("enabled", True)),
-                auto_id,
-            ),
-        )
-        conn.commit()
-    return {"id": auto_id, "status": "updated"}
-
-
-@router.delete("/workspace/automations/{auto_id}")
-def delete_automation(request: Request, auto_id: int):
-    with get_conn() as conn:
-        conn.execute("DELETE FROM automations WHERE id=?", (auto_id,))
-        conn.commit()
-    return {"id": auto_id, "status": "deleted"}
-
-
-async def _execute(automation_id: int, trigger_source: str, body: dict) -> dict:
-    page_id = body.get("page_id") if isinstance(body, dict) else None
-    collection_id = body.get("collection_id") if isinstance(body, dict) else None
-    context = {"collection_id": collection_id, "page_id": page_id}
-    if page_id:
-        context.update(get_page_context(int(page_id), collection_id or 0))
-    result = await run_automation(automation_id, trigger_source, context)
-    result["automation_id"] = automation_id
-    return result
-
-
-@router.post("/workspace/automations/{auto_id}/run")
-async def run_automation_endpoint(request: Request, auto_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
-    return await _execute(auto_id, "manual", body)
-
-
-@router.post("/api/automations/{auto_id}/run")
-async def run_automation_button(request: Request, auto_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
-    return await _execute(auto_id, "button", body)
-
-
-@router.get("/workspace/automations/{auto_id}/runs")
-def automation_runs_history(request: Request, auto_id: int, limit: int = 50):
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT * FROM automation_runs WHERE automation_id=?
-               ORDER BY created_at DESC, id DESC LIMIT ?""",
-            (auto_id, limit),
-        ).fetchall()
-    return {"runs": [dict(r) for r in rows]}
-
-
-# ── v7.0.0 — chained steps (trigger/condition/delay/action) ───────────────
-
-STEP_SECRET_FIELDS = {"webhook_url"}
-
-
-def _require_session(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-def _get_auto(auto_id: int) -> dict | None:
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
-    return dict(row) if row else None
-
-
-def _auto_404():
-    # NOTE: return (not raise) — the global 404 handler redirects non-/api
-    # paths to /workspaces, which TestClient follows into a 200.
-    from fastapi.responses import JSONResponse
-    return JSONResponse({"detail": "Automation not found"}, status_code=404)
-
-
-def _encrypt_step_config(config: dict) -> dict:
-    """Encrypt secret fields at rest (empty = keep existing, like sso_config)."""
-    from app.services.sso_provisioning import encrypt_secret
-    cfg = dict(config or {})
-    for field in STEP_SECRET_FIELDS:
-        if field in cfg and cfg[field]:
-            val = str(cfg[field])
-            if not val.startswith("gAAAAA"):
-                cfg[field] = encrypt_secret(val)
-    return cfg
-
-
-@router.get("/workspace/automations/{auto_id}/steps")
-def list_steps(request: Request, auto_id: int):
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    return {"automation_id": auto_id, "steps": get_steps(auto_id)}
-
-
-@router.post("/workspace/automations/{auto_id}/steps")
-def create_step(request: Request, auto_id: int, body: dict = Body(default={})):
-    _require_session(request)
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    kind = body.get("kind", "")
-    config = body.get("config", {}) or {}
-    validate_step(kind, config)
-    with get_conn() as conn:
-        pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1)+1 FROM automation_steps WHERE automation_id=?",
-            (auto_id,)).fetchone()[0]
-        cur = conn.execute(
-            "INSERT INTO automation_steps (automation_id, kind, position, config_json)"
-            " VALUES (?,?,?,?)",
-            (auto_id, kind, int(body.get("position", pos)),
-             json.dumps(_encrypt_step_config(config))))
-        conn.commit()
-        step_id = cur.lastrowid
-    return {"id": step_id, "status": "created"}
-
-
-@router.put("/workspace/automations/steps/{step_id}")
-def update_step(request: Request, step_id: int, body: dict = Body(default={})):
-    _require_session(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automation_steps WHERE id=?", (step_id,)).fetchone()
-        if not row:
-            from fastapi.responses import JSONResponse
-            return JSONResponse({"detail": "Step not found"}, status_code=404)
-        kind = body.get("kind", row["kind"])
-        try:
-            config = body.get("config", json.loads(row["config_json"] or "{}"))
-        except (TypeError, json.JSONDecodeError):
-            config = {}
-        validate_step(kind, config if isinstance(config, dict) else {})
-        conn.execute(
-            "UPDATE automation_steps SET kind=?, position=?, config_json=? WHERE id=?",
-            (kind, int(body.get("position", row["position"])),
-             json.dumps(_encrypt_step_config(config)), step_id))
-        conn.commit()
-    return {"id": step_id, "status": "updated"}
-
-
-@router.delete("/workspace/automations/steps/{step_id}")
-def delete_step(request: Request, step_id: int):
-    _require_session(request)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM automation_steps WHERE id=?", (step_id,))
-        conn.commit()
-    return {"id": step_id, "status": "deleted"}
-
-
-@router.put("/workspace/automations/{auto_id}/mode")
-def set_trigger_mode(request: Request, auto_id: int, body: dict = Body(default={})):
-    """Set multi-trigger mode: any (default) or all (5-minute window)."""
-    _require_session(request)
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    mode = (body.get("mode") or "any").lower()
-    if mode not in ("any", "all"):
-        raise HTTPException(status_code=400, detail="mode must be any or all")
-    with get_conn() as conn:
-        conn.execute("UPDATE automations SET trigger_mode=? WHERE id=?", (mode, auto_id))
-        conn.commit()
-    return {"id": auto_id, "trigger_mode": mode}
-
-
-@router.post("/api/automations/press-button")
-async def press_button_endpoint(request: Request):
-    """Run the automation linked to a native DB button cell (CSRF-exempt)."""
-    body = await request.json() if request.headers.get("content-type") else {}
-    try:
-        collection_id = int(body.get("collection_id", 0))
-        row_id = int(body.get("row_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(status_code=400, detail="collection_id + row_id required") from None
-    prop_ref = body.get("property", body.get("property_id", ""))
-    if not prop_ref:
-        raise HTTPException(status_code=400, detail="property required")
-    user = _current_user(request)
-    try:
-        result = await press_button(collection_id, row_id, prop_ref, user.get("id") or 1)
-    except ValueError as exc:
-        raise HTTPException(status_code=400, detail=str(exc)) from None
-    return result
@@ -1,208 +0,0 @@
-"""FlowDeck — Collaboration API (v4.9.0): inline comments on pages + mentions.
-
-Comments live in the existing `comments` table, extended with a target_type /
-target_id pair and inline anchors (anchor_block_id + text offsets). Mentions
-written in a comment body automatically notify the mentioned users.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import notifications as notif
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collaboration"], prefix="/api")
-
-
-def _current_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-def _page_url(page_id: int) -> str:
-    from app.config import settings
-    return f"{settings.app_base_url}/pages/{page_id}"
-
-
-def _serialize(rows):
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["author"] = {
-            "id": r["author_id"],
-            "login": r["author_login"],
-            "full_name": r["author_name"],
-            "avatar_url": r["author_avatar"],
-            "avatar_color": r["author_color"],
-        }
-        for k in ("author_id", "author_login", "author_name", "author_avatar", "author_color"):
-            d.pop(k, None)
-        out.append(d)
-    return out
-
-
-@router.get("/pages/{page_id}/comments")
-def list_comments(request: Request, page_id: int):
-    """List page-level and inline comments for a FlowDeck page."""
-    _current_user(request)
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        rows = conn.execute(
-            """SELECT c.*, c.user_id AS author_id, u.login AS author_login,
-                      u.full_name AS author_name, u.avatar_url AS author_avatar,
-                      u.avatar_color AS author_color
-               FROM comments c
-               JOIN users u ON c.user_id = u.id
-               WHERE c.target_type='page' AND c.target_id=?
-               ORDER BY c.created_at ASC, c.id ASC""",
-            (page_id,),
-        ).fetchall()
-    return {"page_id": page_id, "comments": _serialize(rows)}
-
-
-@router.post("/pages/{page_id}/comments")
-def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
-    """Create a page or inline comment. Mentions (@login) notify users."""
-    user = _current_user(request)
-    text = (body.get("body") or "").strip()
-    if not text:
-        raise HTTPException(400, "body required")
-
-    anchor_block = body.get("anchor_block_id")
-    anchor_start = body.get("anchor_start")
-    anchor_end = body.get("anchor_end")
-    # normalize empty anchor → page-level comment
-    if not anchor_block or anchor_start is None or anchor_end is None:
-        anchor_block, anchor_start, anchor_end = None, None, None
-    elif int(anchor_start) == int(anchor_end):
-        anchor_block, anchor_start, anchor_end = None, None, None
-
-    parent_id = body.get("parent_id")
-    uid = user["id"]
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        conn.execute(
-            "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
-            (uid, user.get("login", "admin"), user.get("full_name", "Admin")),
-        )
-        cur = conn.execute(
-            """INSERT INTO comments
-               (page_id, user_id, body, parent_id, target_type, target_id,
-                anchor_block_id, anchor_start, anchor_end)
-               VALUES (?,?,?,?, 'page', ?, ?, ?, ?)""",
-            (page_id, uid, text, parent_id, page_id, anchor_block, anchor_start, anchor_end),
-        )
-        comment_id = cur.lastrowid
-        conn.commit()
-
-        # v7.3.0: commenting implies following — the author gets the
-        # (throttled) page.updated notifications like any other follower.
-        from app.services import wiki as wiki_svc
-        wiki_svc.ensure_follow(page_id, uid, conn=conn)
-        conn.commit()
-
-        # Notify users @-mentioned in the comment (skip the author).
-        url = _page_url(page_id)
-        title = f"New comment on “{page['title']}”"
-        message = f"{user.get('full_name') or user.get('login')} commented: {text[:300]}"
-        notif.process_mentions(
-            text, uid, "mention", title, message,
-            "page", page_id, url, conn=conn,
-        )
-        conn.commit()
-
-    try:
-        run_event_sync(_fire_event("comment.added", {"comment_id": comment_id, "page_id": page_id, "user_id": uid}))
-        mentioned_ids = notif.extract_mentions(text)
-        if mentioned_ids:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "comment_id": comment_id, "count": len(mentioned_ids)}))
-    except Exception:
-        logger.exception("add_comment")
-
-    return {"id": comment_id, "status": "created"}
-
-
-@router.post("/pages/{page_id}/mentions")
-def notify_page_mentions(request: Request, page_id: int, body: dict = Body(default={})):
-    """Notify users @-mentioned in a page's content (called on save).
-
-    Accepts {"text": "..."} containing @login handles. Deduplicated server-side
-    against a per-page cache so repeated auto-saves don't spam notifications.
-    """
-    user = _current_user(request)
-    text = body.get("text") or ""
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        url = _page_url(page_id)
-        mentioned = notif.process_mentions(
-            text, user["id"], "mention", f"You were mentioned in “{page['title']}”",
-            f"{user.get('full_name') or user.get('login')} mentioned you on a page.",
-            "page", page_id, url, conn=conn,
-        )
-        conn.commit()
-    if mentioned:
-        try:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": mentioned, "count": len(mentioned)}))
-        except Exception:
-            logger.exception("notify_page_mentions")
-    return {"mentioned": mentioned}
-
-
-@router.put("/comments/{comment_id}")
-def update_comment(request: Request, comment_id: int, body: dict = Body(default={})):
-    """Update a comment body or resolve/unresolve it."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM comments WHERE id=?", (comment_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"]:
-            raise HTTPException(403, "Not allowed to edit this comment")
-        if "body" in body and body.get("body") is not None:
-            conn.execute(
-                "UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (body["body"].strip(), comment_id),
-            )
-        was_resolved = int(row["resolved"] or 0)
-        if "resolved" in body and body.get("resolved") is not None:
-            conn.execute("UPDATE comments SET resolved=? WHERE id=?",
-                         (1 if body["resolved"] else 0, comment_id))
-        conn.commit()
-    if body.get("resolved") and not was_resolved:
-        try:
-            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
-        except Exception:
-            logger.exception("update_comment")
-    return {"id": comment_id, "status": "updated"}
-
-
-@router.delete("/comments/{comment_id}")
-def delete_comment(request: Request, comment_id: int):
-    """Delete a comment and its replies."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"]:
-            # allow page "owners" — fall back to a simple ownership rule for now
-            raise HTTPException(403, "Not allowed to delete this comment")
-        conn.execute("DELETE FROM comments WHERE id=? OR parent_id=?", (comment_id, comment_id))
-        conn.commit()
-    return {"id": comment_id, "status": "deleted"}
@@ -1,77 +0,0 @@
-"""FlowDeck — Dashboard (pages HTML + API de l'app).
-
-Découpe A28 : l'ancien `dashboard.py` (2 735 lignes, 63 routes) est
-devenu ce package — un module par concern, helpers dans `_common`,
-re-export de tout ce que les 7 importateurs existants utilisent
-(main, board, my_tasks, web_clipper, wiki, sites, tests).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter
-
-from . import (  # ordre = ordre d'enregistrement d'origine (openapi identique)
-    account_api,
-    account_settings,
-    local_workspace,
-    pages_api,
-    pages_html,
-    public,
-    workspace,
-    workspaces,
-)
-from ._common import (  # noqa: F401 — re-export des helpers
-    _VERSION,
-    WORKSPACE_COOKIE,
-    _build_breadcrumb,
-    _build_tree_children,
-    _file_page_disk_path,
-    _format_size,
-    _get_active_workspace,
-    _get_app_version,
-    _get_user_id,
-    _get_user_or_redirect,
-    _local_workspaces_for_user,
-    _nav_breadcrumb,
-    _render_blocks_public,
-    _require_page_view,
-    _require_user_id,
-    _sanitize_id,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter()
-for _mod in (
-    pages_html,
-    account_api,
-    workspace,
-    local_workspace,
-    workspaces,
-    account_settings,
-    public,
-    pages_api,
-):
-    router.include_router(_mod.router)
-
-__all__ = [
-    "router",
-    "WORKSPACE_COOKIE",
-    "_VERSION",
-    "_build_breadcrumb",
-    "_build_tree_children",
-    "_file_page_disk_path",
-    "_format_size",
-    "_get_active_workspace",
-    "_get_app_version",
-    "_get_user_id",
-    "_get_user_or_redirect",
-    "_local_workspaces_for_user",
-    "_nav_breadcrumb",
-    "_render_blocks_public",
-    "_require_page_view",
-    "_require_user_id",
-    "_sanitize_id",
-    "_sidebar_data",
-]
@@ -1,774 +0,0 @@
-"""FlowDeck — Dashboard : helpers partagés des modules de routes (A28).
-
-Les 15 helpers top-level de l'ancien dashboard.py vivent ici (état :
-_VERSION, WORKSPACE_COOKIE) — ré-exportés par le package.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import HTTPException, Request
-from fastapi.responses import RedirectResponse
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-
-_VERSION = None
-
-WORKSPACE_COOKIE = "flowdeck_workspace"
-
-
-
-def _get_app_version() -> str:
-    """Read version from VERSION file with caching."""
-    global _VERSION
-    if _VERSION is not None:
-        return _VERSION
-    try:
-        import os
-        version_path = os.path.join(os.path.dirname(__file__), "..", "..", "VERSION")
-        if os.path.exists(version_path):
-            with open(version_path) as f:
-                _VERSION = f.read().strip()
-        else:
-            # Docker fallback
-            version_path = "/app/VERSION"
-            if os.path.exists(version_path):
-                with open(version_path) as f:
-                    _VERSION = f.read().strip()
-            else:
-                _VERSION = "0.0.0"
-    except Exception:
-        _VERSION = "0.0.0"
-    return _VERSION
-
-
-
-
-
-
-def _get_user_or_redirect(request: Request):
-    """Return decoded user or a RedirectResponse to login page.
-    Skips redirect when DB has no users (fresh install / test env)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        # Allow through if no users exist yet (fresh install / tests)
-        try:
-            with get_conn() as conn:
-                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-                if count == 0:
-                    return {"id": 1, "login": "admin", "full_name": "Admin", "is_admin": True}
-        except Exception:
-            logger.exception("_get_user_or_redirect")
-        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
-    return user
-
-
-
-
-
-
-def _local_workspaces_for_user(user: dict | None, workspace_id: int = 0) -> list[dict]:
-    """Return list of local workspaces for a user."""
-    if not user:
-        return []
-    try:
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, name FROM workspaces WHERE owner_id = ? ORDER BY name",
-                (user["id"],)
-            ).fetchall()
-            return [{"id": r["id"], "name": r["name"]} for r in rows]
-    except Exception:
-        return []
-
-
-
-
-
-
-def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool = True) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    ws = user.get("login", "Bruno") if user else "Bruno"
-    initial = ws[0].upper() if ws else "B"
-
-    # Get avatar info from DB
-    avatar_url = ""
-    avatar_color = "#3A3A3A"
-    if user:
-        try:
-            with get_conn() as conn:
-                row = conn.execute("SELECT avatar_url, avatar_color FROM users WHERE id = ?", (user["id"],)).fetchone()
-                if row:
-                    avatar_url = row["avatar_url"] or ""
-                    avatar_color = row["avatar_color"] or "#3A3A3A"
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    recent_pages = []
-    for repo in repos[:10]:
-        full_name = repo.get("full_name", "")
-        recent_pages.append({
-            "id": full_name,
-            "name": repo.get("name", full_name),
-            "icon": "folder",
-            "url": f"/board/{full_name}",
-            "active": False,
-            "indent": 0,
-            "depth": 0,
-            "has_children": False,
-            "children": [],
-        })
-
-    # Active workspace from cookie (skip on pages like /workspaces where no
-    # workspace context should be shown)
-    from app.routers.board import _load_workspace_pages
-    ws_cookie = request.cookies.get("flowdeck_workspace", "")
-    active_ws_name = "Workspace"
-    workspace_pages = []
-    gitea_workspace = False
-    gitea_owner = ""
-    gitea_repo = ""
-    has_active_workspace = False
-    local_ws_id = 0
-
-    if ws_cookie and ws_cookie.startswith("gitea:"):
-        # Gitea workspace: set owner/repo for client-side tree loading
-        # AND open the local workspace mirror of the same name in the
-        # sidebar's top "My Workspaces" section, in parallel with the
-        # Gitea repository tree.
-        parts = ws_cookie.split(":", 2)
-        if len(parts) >= 3:
-            gitea_owner = parts[1]
-            gitea_repo = parts[2]
-            active_ws_name = f"{gitea_owner}/{gitea_repo}"
-            gitea_workspace = True
-            has_active_workspace = True
-            # Load the local mirror workspace tree so it appears in "My
-            # Workspaces" alongside the Gitea repository section.
-            if user:
-                try:
-                    with get_conn() as conn:
-                        row = conn.execute(
-                            "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                            (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
-                        ).fetchone()
-                        if row:
-                            local_ws_id = row["id"]
-                            workspace_pages = _load_workspace_pages(str(local_ws_id))
-                except (ValueError, Exception):
-                    pass
-    elif include_workspace and ws_cookie and user:
-        try:
-            wsi = int(ws_cookie)
-            with get_conn() as conn:
-                # Verify this workspace belongs to the current user
-                row = conn.execute(
-                    "SELECT id, name, owner_id FROM workspaces WHERE id=? AND owner_id=?",
-                    (wsi, user["id"])
-                ).fetchone()
-                if row:
-                    active_ws_name = row["name"]
-                    workspace_pages = _load_workspace_pages(ws_cookie)
-                    has_active_workspace = True
-                # else: stale cookie from another user — ignore
-        except (ValueError, Exception):
-            pass
-
-    # Auth method & OAuth badge data
-    auth_method = "local"
-    gitea_linked = False
-    github_linked = False
-    if user and user.get("id"):
-        try:
-            with get_conn() as conn:
-                am_row = conn.execute("SELECT auth_method FROM users WHERE id=?", (user["id"],)).fetchone()
-                if am_row and am_row["auth_method"]:
-                    auth_method = am_row["auth_method"]
-                tokens = conn.execute(
-                    "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
-                ).fetchall()
-                for t in tokens:
-                    if t["provider"] == "gitea":
-                        gitea_linked = True
-                    elif t["provider"] == "github":
-                        github_linked = True
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Get local workspace ID for Gitea workspace mirror
-    local_ws_id = 0
-    if gitea_workspace and gitea_owner and gitea_repo:
-        try:
-            with get_conn() as conn:
-                row = conn.execute(
-                    "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                    (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
-                ).fetchone()
-                if row:
-                    local_ws_id = row["id"]
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Private pages for mirror workspace (when Gitea remote active)
-    private_pages = []
-    if gitea_workspace and local_ws_id:
-        try:
-            with get_conn() as conn:
-                pp_rows = conn.execute(
-                    "SELECT id, title FROM pages WHERE parent_section='Private' AND workspace_id=? AND deleted_at IS NULL ORDER BY updated_at DESC LIMIT 20",
-                    (local_ws_id,)
-                ).fetchall()
-                private_pages = [{"id": r[0], "title": r[1] or "Untitled"} for r in pp_rows]
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Shared / received / published pages for the sidebar (Par moi / Avec moi)
-    shared_made_pages = []
-    shared_received_pages = []
-    published_pages = []
-    shared_pages = []
-    if user and user.get("id"):
-        from app.routers.board import _load_shared_sidebar_pages
-        shared_made_pages, shared_received_pages, published_pages, shared_pages = _load_shared_sidebar_pages(user["id"])
-
-    sidebar = {
-        "workspace_name": ws, "workspace_initial": initial,
-        "active_ws_name": active_ws_name,
-        "workspace_key": f"{gitea_owner}/{gitea_repo}" if gitea_workspace else "",
-        "gitea_workspace": gitea_workspace,
-        "gitea_owner": gitea_owner,
-        "gitea_repo": gitea_repo,
-        "local_ws_id": local_ws_id,
-        "workspace_pages": workspace_pages,
-        "current_page": "Dashboard", "last_edited": "now",
-        "recent_pages": recent_pages,
-        "private_pages": private_pages,
-        "favorite_pages": [],
-        "shared_pages": shared_pages,
-        "shared_made_pages": shared_made_pages,
-        "shared_received_pages": shared_received_pages,
-        "published_pages": published_pages,
-        "user": user,
-        "avatar_url": avatar_url,
-        "avatar_color": avatar_color,
-        "auth_method": auth_method,
-        "gitea_linked": gitea_linked,
-        "github_linked": github_linked,
-        "has_active_workspace": has_active_workspace,
-        "app_version": _get_app_version(),
-    }
-
-    sidebar["local_workspaces"] = _local_workspaces_for_user(user)
-
-    return sidebar
-
-
-
-
-
-
-# ═══════════ User API endpoints ═══════════
-
-def _get_user_id(request: Request) -> int:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    return user["id"] if user and user.get("id") else 1
-
-
-
-
-
-
-def _require_user_id(request: Request) -> int:
-    """A3/A4 — 401 sans session (les routes qui mutent un compte ne tolèrent
-    plus le fallback « legacy single-user » → id 1 = l'admin seedé)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user["id"]
-
-
-
-
-
-
-def _file_page_disk_path(page: dict):
-    """Resolve the on-disk file behind a ``content_format == 'file'`` page.
-
-    Returns ``(abs_path: Path, filename: str, mime: str, size: int)`` or None
-    when the row is not a file page, references a non-textual/missing file, or
-    the path escapes the data root (path-traversal guard).
-    """
-    if (page.get("content_format") or "") != "file":
-        return None
-    import json as _json
-    try:
-        meta = _json.loads(page.get("content", "{}"))
-    except (_json.JSONDecodeError, TypeError):
-        meta = {}
-    if not isinstance(meta, dict):
-        return None
-    rel = (meta.get("file_path") or "").replace("\\", "/").strip()
-    if not rel or not rel.startswith("uploads/"):
-        return None
-    parts = rel.split("/")
-    if ".." in parts or "." in parts:
-        return None
-    from pathlib import Path
-    root = Path(settings.data_dir).resolve()
-    full = (root / rel).resolve()
-    try:
-        full.relative_to(root)
-    except ValueError:
-        return None
-    if not full.exists() or not full.is_file():
-        return None
-    filename = parts[-1] or page.get("title", "file")
-    mime = meta.get("mime_type") or "application/octet-stream"
-    size = meta.get("size") or 0
-    return (full, filename, mime, size)
-
-
-
-
-
-
-def _require_page_view(request: Request, page_id: int) -> None:
-    """A16 : lecture d'une pièce jointe = session + `can_view_page` (404 sinon)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    from app.services.permission_manager import PermissionManager
-
-    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-
-
-
-
-
-
-def _build_tree_children(conn, parent_id: int | None, ws_id: int, uid: int | None = None) -> list:
-    """Recursively build the tree of children for a node."""
-    if parent_id is None:
-        rows = conn.execute(
-            "SELECT id, title, parent_section, content_format, content, page_icon, "
-            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
-            "created_at, updated_at FROM pages "
-            "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
-            "ORDER BY created_at DESC",
-            (ws_id,),
-        ).fetchall()
-    else:
-        rows = conn.execute(
-            "SELECT id, title, parent_section, content_format, content, page_icon, "
-            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
-            "created_at, updated_at FROM pages "
-            "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
-            "ORDER BY created_at DESC",
-            (parent_id, ws_id),
-        ).fetchall()
-
-    # Get workspace owner name for author display
-    ws_owner = conn.execute(
-        "SELECT u.full_name, u.login FROM workspaces w JOIN users u ON u.id=w.owner_id WHERE w.id=?",
-        (ws_id,),
-    ).fetchone()
-    author = ws_owner["full_name"] or ws_owner["login"] if ws_owner else "—"
-
-    # Collect all page IDs to fetch tags in one query
-    all_ids = [r["id"] for r in rows]
-    tags_map = {}
-    favorited_ids = set()
-    if all_ids:
-        placeholders = ",".join("?" for _ in all_ids)
-        tag_rows = conn.execute(
-            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
-            f"JOIN tags t ON t.id=pt.tag_id WHERE pt.page_id IN ({placeholders})",
-            all_ids,
-        ).fetchall()
-        for tr in tag_rows:
-            tags_map.setdefault(tr["page_id"], []).append({
-                "id": tr["id"], "name": tr["name"], "color": tr["color"],
-            })
-        if uid is not None:
-            fav_rows = conn.execute(
-                f"SELECT page_id FROM favorites WHERE user_id=? AND page_id IN ({placeholders})",
-                [uid, *all_ids],
-            ).fetchall()
-            favorited_ids = {fr["page_id"] for fr in fav_rows}
-
-    tree = []
-    for r in rows:
-        is_folder = r["parent_section"] == "Workspace"
-        children = _build_tree_children(conn, r["id"], ws_id, uid)
-
-        # Compute size
-        size = 0
-        if r["content_format"] == "file":
-            import json as _json
-            try:
-                meta = _json.loads(r["content"])
-                size = meta.get("size", 0)
-            except Exception:
-                size = len(r["content"] or "")
-        else:
-            size = len(r["content"] or "")
-
-        tree.append({
-            "id": r["id"],
-            "name": r["title"] or "Untitled",
-            "type": "folder" if is_folder else "page",
-            "is_folder": is_folder,
-            "content_format": r["content_format"] if not is_folder else None,
-            "page_icon": r["page_icon"] or "",
-            "children": children,
-            "has_children": len(children) > 0,
-            "child_count": len(children),
-            "size": size,
-            "size_display": _format_size(size),
-            "created_at": r["created_at"],
-            "updated_at": r["updated_at"],
-            "author": author,
-            "tags": tags_map.get(r["id"], []),
-            "is_shared": bool(r["is_shared"]),
-            "favorited": r["id"] in favorited_ids,
-        })
-    return tree
-
-
-
-
-
-
-def _format_size(size_bytes: int) -> str:
-    """Human-readable file size."""
-    if size_bytes < 1024:
-        return f"{size_bytes} B"
-    elif size_bytes < 1024 * 1024:
-        return f"{size_bytes / 1024:.1f} KB"
-    elif size_bytes < 1024 * 1024 * 1024:
-        return f"{size_bytes / (1024 * 1024):.1f} MB"
-    return f"{size_bytes / (1024 * 1024 * 1024):.2f} GB"
-
-
-
-
-
-
-def _build_breadcrumb(conn, folder_id: int) -> list:
-    """Build breadcrumb trail from root to folder_id."""
-    breadcrumb = []
-    current = folder_id
-    seen = set()
-    while current and current not in seen:
-        seen.add(current)
-        row = conn.execute(
-            "SELECT id, title, parent_id, parent_section FROM pages WHERE id=?",
-            (current,),
-        ).fetchone()
-        if row:
-            breadcrumb.insert(0, {
-                "id": row["id"],
-                "name": row["title"] or "Untitled",
-                "is_folder": row["parent_section"] == "Workspace",
-            })
-            current = row["parent_id"]
-        else:
-            break
-    return breadcrumb
-
-
-
-
-
-
-def _nav_breadcrumb(conn, page_id: int) -> list:
-    """Build a Notion-style breadcrumb chain (root -> page) for the header.
-
-    Returns a list of dicts: {id, label, url, icon, menu}. The last item is the
-    current page (url = None). Every item has ``menu: True`` so the header can
-    open a sibling-navigation dropdown for it.
-    """
-    from app.routers.board import _file_icon
-    chain = []
-    current = page_id
-    seen = set()
-    while current and current not in seen:
-        seen.add(current)
-        row = conn.execute(
-            "SELECT id, title, parent_id, parent_section, content_format "
-            "FROM pages WHERE id=? AND deleted_at IS NULL",
-            (current,),
-        ).fetchone()
-        if not row:
-            break
-        is_folder = row["parent_section"] == "Workspace"
-        title = row["title"] or "Untitled"
-        chain.insert(0, {
-            "id": row["id"],
-            "label": title,
-            "url": None,
-            "icon": "folder" if is_folder else _file_icon(title, row["content_format"]),
-            "menu": True,
-        })
-        current = row["parent_id"]
-    # All items except the current page are navigable links.
-    for i, item in enumerate(chain):
-        if i < len(chain) - 1:
-            item["url"] = f"/pages/{item['id']}"
-    return chain
-
-
-
-
-
-
-def _get_active_workspace(request: Request, user_id: int = None) -> dict | None:
-    """Get the active workspace ID from the cookie (verified for current user), or first user workspace, or None."""
-    ws_id = request.cookies.get(WORKSPACE_COOKIE)
-    if ws_id:
-        try:
-            with get_conn() as conn:
-                ws = conn.execute("SELECT * FROM workspaces WHERE id=?",
-                                  (int(ws_id),)).fetchone()
-                if ws:
-                    ws_dict = dict(ws)
-                    # Verify ownership — only return if it belongs to the current user
-                    if user_id is None or ws_dict.get("owner_id") == user_id:
-                        return ws_dict
-        except (ValueError, Exception):
-            pass
-    # Fallback: first workspace owned by this user
-    if user_id:
-        with get_conn() as conn:
-            ws = conn.execute(
-                "SELECT * FROM workspaces WHERE owner_id=? ORDER BY id LIMIT 1",
-                (user_id,)
-            ).fetchone()
-            if ws:
-                return dict(ws)
-    return None
-
-
-
-
-
-
-def _sanitize_id(block_id: str) -> str:
-    """Sanitize a block id for use as an HTML anchor (only alnum kept)."""
-    if not block_id:
-        return ""
-    return "".join(ch for ch in str(block_id) if ch.isalnum())
-
-
-
-
-
-
-def _render_blocks_public(blocks: list, titles: dict | None = None) -> str:
-    """Render FlowDeck blocks as plain HTML for public pages.
-
-    v5.11.0: ``titles`` (token → label, see app.services.wiki_links) turns
-    ``[[fdpage:ID]]`` / ``[[fddate:...]]`` tokens into chips/links.
-    """
-    html_parts = []
-
-    def _wiki(c: str) -> str:
-        if titles and ("[[fdpage:" in c or "[[fddate:" in c):
-            from app.services.wiki_links import resolve_tokens_html
-            return resolve_tokens_html(c, titles)
-        return c
-
-    for b in blocks:
-        t = b.get("type", "paragraph")
-        c = _wiki(b.get("content", "") or "")
-        if t == "heading_1":
-            html_parts.append(f'<h1 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:2.5rem;font-weight:700;margin:32px 0 8px;">{c}</h1>')
-        elif t == "heading_2":
-            html_parts.append(f'<h2 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.75rem;font-weight:600;margin:28px 0 6px;">{c}</h2>')
-        elif t == "heading_3":
-            html_parts.append(f'<h3 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.35rem;font-weight:600;margin:24px 0 4px;">{c}</h3>')
-        elif t == "heading_4":
-            html_parts.append(f'<h4 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.15rem;font-weight:600;margin:20px 0 4px;">{c}</h4>')
-        elif t == "bulleted_list":
-            html_parts.append(f'<li style="margin-left:24px;">{c}</li>')
-        elif t == "numbered_list":
-            html_parts.append(f'<li style="margin-left:24px;list-style:decimal;">{c}</li>')
-        elif t == "to_do":
-            checked = "checked" if b.get("checked") else ""
-            todo_style = "text-decoration:line-through;opacity:.5" if b.get("checked") else ""
-            html_parts.append(
-                f'<div style="display:flex;align-items:center;gap:8px;margin:4px 0;">'
-                f'<input type="checkbox" {checked} disabled>'
-                f'<span style="{todo_style}">{c}</span>'
-                f'</div>'
-            )
-        elif t == "toggle":
-            children_html = ""
-            if b.get("children"):
-                children_html = '<div style="margin-left:22px;padding-left:12px;border-left:1px solid rgba(255,255,255,.1);margin-top:4px;">'
-                children_html += _render_blocks_public(b["children"], titles)
-                children_html += "</div>"
-            html_parts.append(
-                f'<details style="margin:8px 0;" open><summary style="cursor:pointer;font-weight:500;">{c}</summary>{children_html}</details>'
-            )
-        elif t == "quote":
-            html_parts.append(
-                f'<blockquote style="border-left:3px solid var(--accent,#4c9aff);margin:12px 0;padding:4px 16px;opacity:.85;">{c}</blockquote>'
-            )
-        elif t == "table_of_contents":
-            toc = [
-                x for x in blocks
-                if x.get("type", "").startswith("heading_") and (x.get("content") or "").strip()
-            ]
-            if toc:
-                items = []
-                for h in toc:
-                    lvl = int(h["type"].split("_")[-1])
-                    items.append(
-                        f'<div style="margin-left:{max(0, lvl - 1) * 14}px;padding:5px 8px;font-size:14px;">'
-                        f'<a href="#h-{_sanitize_id(h.get("id",""))}" style="color:inherit;text-decoration:none;display:block;">{h.get("content","")}</a></div>'
-                    )
-                html_parts.append(
-                    '<div style="border:1px solid rgba(255,255,255,.1);border-radius:8px;padding:16px 20px;margin:4px 0;">'
-                    '<div style="font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.5px;opacity:.5;margin-bottom:10px;">On this page</div>'
-                    + "".join(items) + "</div>"
-                )
-        elif t == "math":
-            tex = c.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
-            html_parts.append(
-                f'<div data-katex="{tex}" style="margin:12px 0;padding:12px 16px;background:rgba(255,255,255,.04);border-radius:8px;overflow-x:auto;"></div>'
-            )
-        elif t == "columns":
-            cols_html = ""
-            for child in b.get("children") or []:
-                cols_html += (
-                    '<div style="flex:1;min-width:0;padding:10px 12px;background:rgba(255,255,255,.05);'
-                    'border-radius:8px;box-sizing:border-box;">'
-                    + _render_blocks_public([child], titles) + "</div>"
-                )
-            html_parts.append(
-                f'<div style="display:flex;gap:12px;margin:8px 0 16px;align-items:stretch;">{cols_html}</div>'
-            )
-        elif t == "callout":
-            icon = b.get("icon", "💡")
-            bg = (b.get("style") or {}).get("bgColor", "rgba(76,154,255,.1)")
-            html_parts.append(
-                f'<div style="display:flex;gap:10px;padding:14px 18px;margin:12px 0;border-radius:8px;'
-                f'background:{bg};align-items:flex-start;">'
-                f'<span style="font-size:20px;flex-shrink:0;">{icon}</span>'
-                f'<span>{c}</span></div>'
-            )
-        elif t == "code":
-            lang = b.get("language", "")
-            lang_label = f"<div style='font-size:11px;opacity:.4;margin-bottom:8px;'>{lang}</div>" if lang else ""
-            html_parts.append(
-                f'<pre style="background:rgba(255,255,255,.05);padding:16px 20px;border-radius:8px;'
-                f'overflow-x:auto;font-size:14px;line-height:1.5;margin:12px 0;">'
-                f'{lang_label}'
-                f'<code>{c}</code></pre>'
-            )
-        elif t == "divider":
-            html_parts.append('<hr style="border:none;border-top:1px solid rgba(255,255,255,.1);margin:16px 0;">')
-        elif t == "image":
-            src = b.get("src", "")
-            alt = b.get("alt", "")
-            html_parts.append(
-                f'<figure style="margin:16px 0;text-align:center;">'
-                f'<img src="{src}" alt="{alt}" data-full="{src}" style="max-width:100%;border-radius:8px;cursor:zoom-in;">'
-                f'</figure>'
-            )
-        elif t == "video":
-            src = b.get("src", "")
-            if src:
-                html_parts.append(
-                    f'<video controls preload="metadata" style="max-width:100%;border-radius:8px;display:block;margin:12px auto;">'
-                    f'<source src="{src}"></video>'
-                )
-        elif t == "audio":
-            src = b.get("src", "")
-            if src:
-                html_parts.append(
-                    f'<audio controls preload="metadata" style="width:100%;margin:8px 0;"><source src="{src}"></audio>'
-                )
-        elif t == "bookmark":
-            url = b.get("url") or b.get("src") or ""
-            title = b.get("title") or url
-            desc = b.get("description") or ""
-            img = b.get("image") or ""
-            site = b.get("site_name") or ""
-            img_html = (
-                f'<img src="{img}" alt="" style="width:120px;height:90px;object-fit:cover;border-radius:8px;flex-shrink:0;">' if img else ""
-            )
-            desc_html = f'<div style="font-size:13px;opacity:.75;margin-top:4px;">{desc}</div>' if desc else ""
-            site_html = f'<div style="font-size:11px;opacity:.5;text-transform:uppercase;letter-spacing:.5px;margin-top:6px;">{site}</div>' if site else ""
-            html_parts.append(
-                f'<a href="{url}" target="_blank" rel="noopener noreferrer" style="text-decoration:none;color:inherit;">'
-                f'<div style="display:flex;gap:14px;align-items:center;border:1px solid rgba(255,255,255,.12);border-radius:10px;'
-                f'padding:14px 16px;margin:14px 0;background:rgba(255,255,255,.03);">'
-                f'<div style="flex:1;min-width:0;"><div style="font-weight:600;font-size:15px;">{title}</div>'
-                f'{desc_html}{site_html}</div>{img_html}</div></a>'
-            )
-        elif t == "embed":
-            url = b.get("src", "")
-            emb = b.get("embed_type") or ""
-            if emb in ("inline_dbs", "collection"):
-                html_parts.append('<div>[Embedded content]</div>')
-            elif emb == "download":
-                html_parts.append(
-                    f'<a href="{url}" download style="display:inline-block;margin:12px 0;color:var(--accent,#4c9aff);">⬇ {b.get("file_name") or "Download"}</a>'
-                )
-            elif emb == "pdf" and url:
-                html_parts.append(
-                    f'<iframe src="{url}" style="width:100%;height:70vh;border:none;border-radius:8px;margin:12px 0;"></iframe>'
-                )
-            elif url:
-                from app.services.embeds import embed_src
-                src = b.get("embed_src") or embed_src(url) or url
-                height = b.get("height") or 520
-                try:
-                    height = int(height)
-                except (ValueError, TypeError):
-                    height = 520
-                html_parts.append(
-                    f'<div style="position:relative;width:100%;height:{height}px;border-radius:8px;overflow:hidden;'
-                    f'background:#0a0a0a;"><iframe src="{src}" loading="lazy" frameborder="0" '
-                    f'style="position:absolute;inset:0;width:100%;height:100%;" allowfullscreen allow="autoplay; encrypted-media; picture-in-picture"></iframe></div>'
-                )
-        elif t == "synced":
-            # v6.5.0: render synced block instances (resolved server-side).
-            if b.get("_synced_deleted"):
-                html_parts.append(
-                    '<div style="margin:8px 0;padding:8px 12px;border-left:3px solid #e05e5e;'
-                    'background:rgba(224,94,94,.08);border-radius:4px;font-size:13px;opacity:.8;">'
-                    'Deleted synced block</div>'
-                )
-            else:
-                inner = b.get("_synced_content")
-                if not isinstance(inner, list) or not inner:
-                    try:
-                        import json as _sj
-                        parsed = _sj.loads(b.get("content") or "[]")
-                        inner = parsed if isinstance(parsed, list) else []
-                    except (ValueError, TypeError):
-                        inner = []
-                inner = [{"type": "paragraph", "content": str(x)} if not isinstance(x, dict) else x
-                         for x in inner]
-                if inner:
-                    html_parts.append(
-                        '<div style="margin:8px 0;padding-left:12px;'
-                        'border-left:3px solid var(--accent,#4c9aff);">'
-                        + _render_blocks_public(inner, titles) + '</div>'
-                    )
-        else:
-            html_parts.append(f'<p style="margin:4px 0;line-height:1.7;">{c}</p>')
-    return "\n".join(html_parts)
-
-
-# ═══════════ Library page actions API ═══════════
-
-
@@ -1,77 +0,0 @@
-"""FlowDeck — Dashboard : account_api.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-
-from ._common import _require_user_id
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.put("/api/user/profile")
-def update_profile(request: Request, body: dict = Body(default={})):
-    full_name = body.get("full_name", "").strip()
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET full_name=? WHERE id=?", (full_name, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.put("/api/user/password")
-def update_password(request: Request, body: dict = Body(default={})):
-    from app.password_utils import hash_password, verify_password
-    password = body.get("password", "").strip()
-    if len(password) < 6:
-        return {"error": "Password must be at least 6 characters"}
-    uid = _require_user_id(request)
-    # A3 : le mot de passe actuel est exigé (session volée ≠ droit de changer le mdp).
-    current = body.get("current_password", "")
-    with get_conn() as conn:
-        row = conn.execute("SELECT password_hash FROM users WHERE id=?", (uid,)).fetchone()
-        if not row or not verify_password(current, row["password_hash"]):
-            raise HTTPException(403, "Current password is incorrect")
-        conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(password), uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/user/token")
-def generate_token(request: Request):
-    import secrets
-    uid = _require_user_id(request)
-    token = secrets.token_hex(32)
-    with get_conn() as conn:
-        conn.execute(
-            "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
-            (uid, token),
-        )
-        conn.commit()
-    return {"token": f"fd_{token}"}
-
-
-
-
-@router.delete("/api/user/forge/{provider}")
-def disconnect_forge(request: Request, provider: str):
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM user_oauth_tokens WHERE user_id=? AND provider=?", (uid, provider)
-        )
-        conn.commit()
-    return {"status": "ok"}
@@ -1,439 +0,0 @@
-"""FlowDeck — Dashboard : settings.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-from ._common import _format_size, _get_active_workspace, _get_user_id, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Settings Page ═══════════
-
-@router.get("/settings", response_class=HTMLResponse)
-def app_settings_page(request: Request):
-    """Settings & configuration page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("settings.html")
-    return template.render(**ctx)
-
-
-
-
-@router.post("/api/settings/avatar")
-async def upload_avatar(request: Request):
-    """Upload a user avatar image."""
-    import os
-    import uuid
-    from pathlib import Path
-    form = await request.form()
-    file = form.get("file")
-    if not file:
-        return {"error": "No file"}, 400
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return {"error": "Not authenticated"}, 401
-    # Save to data/avatars
-    avatars_dir = Path("/data/avatars")
-    avatars_dir.mkdir(parents=True, exist_ok=True)
-    ext = os.path.splitext(file.filename)[1] or ".png"
-    filename = f"{user['id']}_{uuid.uuid4().hex[:8]}{ext}"
-    filepath = avatars_dir / filename
-    content = await file.read()
-    filepath.write_bytes(content)
-    # Update user avatar_url
-    avatar_url = f"/api/settings/avatar/{filename}"
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET avatar_url = ? WHERE id = ?", (avatar_url, user["id"]))
-        conn.commit()
-    return {"avatar_url": avatar_url}
-
-
-
-
-@router.get("/api/settings/avatar/{filename:path}")
-def serve_avatar_file(filename: str):
-    """Serve an uploaded avatar image file."""
-    from pathlib import Path
-
-    from fastapi.responses import FileResponse
-    # A11 : garde path traversal (motif de serve_uploaded_file) — `:path` Starlette
-    # accepte les `/`, donc `..%2f` ressortirait du dossier avatars.
-    base_dir = Path("/data/avatars").resolve()
-    filepath = (base_dir / filename).resolve()
-    try:
-        filepath.relative_to(base_dir)
-    except ValueError:
-        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
-    if not filepath.is_file():
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    return FileResponse(filepath)
-
-
-
-
-@router.get("/api/avatar/{user_id:int}")
-def get_avatar(user_id: int):
-    """Redirect to the user's avatar."""
-    with get_conn() as conn:
-        row = conn.execute("SELECT avatar_url FROM users WHERE id = ?", (user_id,)).fetchone()
-    if row and row["avatar_url"]:
-        return RedirectResponse(row["avatar_url"], status_code=302)
-    return JSONResponse({"error": "No avatar"}, status_code=404)
-
-
-
-
-@router.post("/api/settings/avatar-color")
-def set_avatar_color(request: Request, body: dict = Body(default={})):
-    """Set the user's avatar background color."""
-    color = body.get("color", "#3A3A3A")
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return {"error": "Not authenticated"}, 401
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET avatar_url = '', avatar_color = ? WHERE id = ?", (color, user["id"]))
-        conn.commit()
-    return {"status": "ok", "color": color}
-
-
-# ═══════════ Tag Management API (per-user) ═══════════
-
-
-
-
-# ═══════════ Tag Management API (per-user) ═══════════
-
-@router.post("/api/settings/tags")
-def create_tag_global(request: Request, body: dict = Body(default={})):
-    """Create a tag for the current user."""
-    tag_name = body.get("name", "").strip().lower()
-    color = body.get("color", "#787774")
-    uid = _get_user_id(request)
-    if not tag_name or not uid:
-        return {"error": "Tag name required"}, 400
-    with get_conn() as conn:
-        tag = conn.execute("SELECT id FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
-        if tag:
-            conn.execute("UPDATE tags SET color = ? WHERE id = ?", (color, tag["id"]))
-            conn.commit()
-            return {"tag": {"id": tag["id"], "name": tag_name, "color": color}}
-        cursor = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, color, uid))
-        conn.commit()
-        return {"tag": {"id": cursor.lastrowid, "name": tag_name, "color": color}}
-
-
-
-
-@router.put("/api/settings/tags/{tag_id:int}")
-def update_tag_global(tag_id: int, request: Request, body: dict = Body(default={})):
-    """Update a tag (name or color) — only if owned by user."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        if "name" in body:
-            conn.execute("UPDATE tags SET name = ? WHERE id = ? AND user_id = ?", (body["name"].strip().lower(), tag_id, uid))
-        if "color" in body:
-            conn.execute("UPDATE tags SET color = ? WHERE id = ? AND user_id = ?", (body["color"], tag_id, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/settings/tags/{tag_id:int}")
-def delete_tag_global(tag_id: int, request: Request):
-    """Delete a tag — only if owned by user."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_tags WHERE tag_id = ?", (tag_id,))
-        conn.execute("DELETE FROM tags WHERE id = ? AND user_id = ?", (tag_id, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/settings/tags/all")
-def list_all_tags_global(request: Request):
-    """List current user's tags with counts."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color, COUNT(pt.page_id) as count "
-            "FROM tags t LEFT JOIN page_tags pt ON pt.tag_id = t.id "
-            "WHERE t.user_id = ? GROUP BY t.id ORDER BY t.name",
-            (uid,),
-        ).fetchall()
-    return JSONResponse(
-        {"tags": [dict(r) for r in rows]},
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-# ═══════════ Workspace Tags API ═══════════
-
-
-
-
-# ═══════════ Workspace Tags API ═══════════
-
-@router.get("/api/local-workspace/tags")
-def list_tags(request: Request):
-    """List ALL user tags with counts scoped to the active workspace."""
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    uid = _get_user_id(request)
-    if not ws_id:
-        return {"tags": []}
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color, "
-            "(SELECT COUNT(*) FROM page_tags pt "
-            " JOIN pages p ON p.id = pt.page_id AND p.workspace_id = ? "
-            " WHERE pt.tag_id = t.id) as count "
-            "FROM tags t WHERE t.user_id = ? ORDER BY t.name",
-            (ws_id, uid),
-        ).fetchall()
-    return JSONResponse(
-        {"tags": [dict(r) for r in rows]},
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-
-
-@router.get("/api/local-workspace/items/{item_id:int}/tags")
-def get_item_tags(item_id: int):
-    """Get tags for a specific item."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color FROM tags t "
-            "JOIN page_tags pt ON pt.tag_id = t.id "
-            "WHERE pt.page_id = ? ORDER BY t.name",
-            (item_id,),
-        ).fetchall()
-    return {"tags": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/local-workspace/items/{item_id:int}/tags")
-def add_item_tag(request: Request, item_id: int, body: dict = Body(default={})):
-    """Add a tag to an item (creates tag if new, scoped to user)."""
-    tag_name = body.get("name", "").strip().lower()
-    tag_color = body.get("color", "#787774")
-    uid = _get_user_id(request)
-    if not tag_name:
-        return {"error": "Tag name required"}, 400
-
-    with get_conn() as conn:
-        # Get or create tag (per user)
-        tag = conn.execute("SELECT id, name, color FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
-        if not tag:
-            cursor = conn.execute(
-                "INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, tag_color, uid)
-            )
-            conn.commit()
-            tag_id = cursor.lastrowid
-            tag = {"id": tag_id, "name": tag_name, "color": tag_color}
-        else:
-            tag_id = tag["id"]
-
-        # Link tag to page (ignore duplicate)
-        try:
-            conn.execute(
-                "INSERT OR IGNORE INTO page_tags (page_id, tag_id) VALUES (?, ?)",
-                (item_id, tag_id),
-            )
-            conn.commit()
-        except Exception:
-            logger.exception("add_item_tag")
-
-    return {"tag": {"id": tag["id"], "name": tag["name"], "color": tag["color"]}}
-
-
-
-
-@router.delete("/api/local-workspace/items/{item_id:int}/tags/{tag_id:int}")
-def remove_item_tag(item_id: int, tag_id: int):
-    """Remove a tag from an item."""
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM page_tags WHERE page_id = ? AND tag_id = ?",
-            (item_id, tag_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/local-workspace/tags/search")
-def search_by_tags(request: Request, tags: str = ""):
-    """Search items by tags (comma-separated)."""
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"items": []}
-    tag_names = [t.strip().lower() for t in tags.split(",") if t.strip()]
-    if not tag_names:
-        return {"items": []}
-    with get_conn() as conn:
-        placeholders = ",".join("?" for _ in tag_names)
-        rows = conn.execute(
-            f"SELECT DISTINCT p.id, p.title, p.content_format, p.parent_section, "
-            f"p.content, p.created_at, p.updated_at "
-            f"FROM pages p "
-            f"JOIN page_tags pt ON pt.page_id = p.id "
-            f"JOIN tags t ON t.id = pt.tag_id "
-            f"WHERE t.name IN ({placeholders}) AND p.workspace_id = ? AND p.deleted_at IS NULL "
-            f"ORDER BY p.updated_at DESC",
-            tag_names + [ws_id],
-        ).fetchall()
-    items = []
-    for r in rows:
-        is_folder = r["parent_section"] == "Workspace"
-        size = len(r["content"] or "")
-        items.append({
-            "id": r["id"],
-            "name": r["title"] or "Untitled",
-            "is_folder": is_folder,
-            "content_format": r["content_format"],
-            "created_at": r["created_at"],
-            "updated_at": r["updated_at"],
-            "size": size,
-            "size_display": _format_size(size),
-        })
-    return {"items": items}
-
-
-# ── Account update ──
-
-
-
-
-# ── Account update ──
-@router.put("/api/settings/account")
-def update_account(request: Request, body: dict = Body(default={})):
-    """Update current user's profile: full_name, login, email, password."""
-    from app.password_utils import hash_password
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return JSONResponse({"error": "Not authenticated"}, status_code=401)
-    with get_conn() as conn:
-        uid = user["id"]
-        if "full_name" in body:
-            conn.execute("UPDATE users SET full_name=? WHERE id=?", (body["full_name"].strip(), uid))
-        if "login" in body:
-            new_login = body["login"].strip()
-            if new_login and new_login != user.get("login"):
-                existing = conn.execute("SELECT id FROM users WHERE login=? AND id!=?", (new_login, uid)).fetchone()
-                if existing:
-                    return JSONResponse({"error": "Username already taken"}, status_code=409)
-                conn.execute("UPDATE users SET login=? WHERE id=?", (new_login, uid))
-        if "email" in body:
-            conn.execute("UPDATE users SET email=? WHERE id=?", (body["email"].strip(), uid))
-        if "password" in body and body["password"].strip():
-            pw = body["password"].strip()
-            if len(pw) < 6:
-                return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
-            conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(pw), uid))
-        conn.commit()
-        row = conn.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
-        user_data = dict(row)
-    # Refresh session cookie with updated data (keeps the same session id)
-    cookie = request.cookies.get("flowdeck_session", "")
-    new_session = SessionManager.refresh_session(cookie, user_data, request)
-    response = JSONResponse({"status": "ok", "user": {k: user_data[k] for k in ("id","login","full_name","email","is_admin")}})
-    response.set_cookie("flowdeck_session", new_session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
-    return response
-
-
-# ═══════════ Sidebar Refresh API ═══════════
-
-
-
-
-# ═══════════ Sidebar Refresh API ═══════════
-
-@router.get("/api/sidebar/workspace-tree")
-def sidebar_workspace_tree(request: Request):
-    """Return the sidebar workspace tree as HTML fragment.
-
-    Called by appState().refreshSidebarTree() after CRUD operations
-    in the main content area to keep the sidebar in sync.
-    """
-    from app.routers.board import _load_workspace_pages
-    from app.templating import ENV
-
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return HTMLResponse("")
-
-    ws_cookie = request.cookies.get("flowdeck_workspace", "")
-    if not ws_cookie:
-        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">📄</span><span class="page-name text-dim">No pages yet</span></li>')
-
-    # Gitea workspace — no server-side tree, loaded client-side
-    if ws_cookie.startswith("gitea:"):
-        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">🔗</span><span class="page-name text-dim">Remote workspace</span></li>')
-
-    try:
-        ws_id = int(ws_cookie)
-        with get_conn() as conn:
-            # Verify workspace belongs to user
-            row = conn.execute(
-                "SELECT id FROM workspaces WHERE id=? AND owner_id=?",
-                (ws_id, user["id"])
-            ).fetchone()
-            if not row:
-                return HTMLResponse(
-                    '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-                    '<span class="page-name text-dim">No pages yet</span></li>'
-                )
-
-        pages = _load_workspace_pages(ws_cookie)
-        if not pages:
-            return HTMLResponse(
-                '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-                '<span class="page-name text-dim">No pages yet</span></li>'
-            )
-
-        # Render the tree using the extracted macro
-        env = ENV
-        template = env.from_string(
-            "{% from '_workspace_tree_macro.html' import render_workspace_tree %}"
-            "{{ render_workspace_tree(pages) }}"
-        )
-        html = template.render(pages=pages)
-        return HTMLResponse(html)
-    except (ValueError, Exception) as e:
-        logger.error(f"sidebar_workspace_tree failed: {e}", exc_info=True)
-        return HTMLResponse(
-            '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-            '<span class="page-name text-dim">No pages yet</span></li>'
-        )
-
-
-# ═══════════ Public Published Page ═══════════
@@ -1,559 +0,0 @@
-"""FlowDeck — Dashboard : local_workspace.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-from datetime import UTC
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-
-from ._common import (
-    _build_breadcrumb,
-    _build_tree_children,
-    _file_page_disk_path,
-    _get_active_workspace,
-    _get_user_id,
-    _require_page_view,
-    _require_user_id,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Local Workspace (file/folder CRUD) ═══════════
-
-@router.get("/local-workspace", response_class=HTMLResponse)
-def local_workspace_page(request: Request, folder: int = None):
-    """Local workspace page with file/folder tree.
-
-    If ?folder=ID is provided, shows that folder's contents with breadcrumb.
-    """
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-
-    ws = _get_active_workspace(request, user_id=user["id"])
-    ws_id = ws["id"] if ws else None
-
-    # If no workspace exists for this user, redirect to workspaces page
-    if not ws_id:
-        return RedirectResponse("/workspaces", status_code=302)
-
-    # Build breadcrumb if navigating into a folder
-    breadcrumb = []
-    current_folder_id = folder
-    if folder and ws_id:
-        with get_conn() as conn:
-            breadcrumb = _build_breadcrumb(conn, folder)
-
-    ctx = {
-        **sidebar,
-        "user": user,
-        "workspace_name": sidebar.get("active_ws_name", "My Workspace"),
-        "current_folder_id": current_folder_id or 0,
-        "workspace_id": ws_id or 0,
-        "nav_workspace_id": ws_id or 0,
-        "breadcrumb": breadcrumb,
-        "breadcrumbs": breadcrumb,
-    }
-    template = env.get_template("local_workspace.html")
-    return HTMLResponse(
-        content=template.render(**ctx),
-        headers={
-            "Cache-Control": "no-cache, no-store, must-revalidate",
-            "Pragma": "no-cache",
-            "Expires": "0",
-        }
-    )
-
-
-
-
-@router.get("/api/local-workspace/tree")
-def local_workspace_tree(request: Request, folder: int = None):
-    """Return the file/folder tree filtered by active workspace.
-
-    If ?folder=ID is provided, returns only that folder's children.
-    Otherwise returns the full recursive tree from root.
-    """
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"tree": [], "breadcrumb": []}
-    uid = _get_user_id(request)
-
-    with get_conn() as conn:
-        if folder:
-            # Show only this folder's children + build breadcrumb
-            children = _build_tree_children(conn, folder, ws_id, uid)
-            breadcrumb = _build_breadcrumb(conn, folder)
-            return {"tree": children, "breadcrumb": breadcrumb, "current_folder": folder}
-        else:
-            # Full tree from root
-            roots = _build_tree_children(conn, None, ws_id, uid)
-            return {"tree": roots, "breadcrumb": [], "current_folder": None}
-
-
-
-
-@router.get("/api/local-workspace/page-content/{page_id:int}")
-def get_page_content(page_id: int):
-    """Return the raw content of a page (for preview)."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT content, content_format FROM pages WHERE id=?", (page_id,)
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    fmt = row["content_format"]
-    if fmt == "file":
-        return JSONResponse({"content": "(uploaded file)", "format": fmt})
-    # v6.5.0: resolve synced blocks server-side (fresh content on read).
-    from app.services.synced_blocks import resolve_content_json
-    return {"content": resolve_content_json(row["content"] or "", fmt), "format": fmt}
-
-
-
-
-@router.get("/api/pages/{page_id}/download")
-def download_page_file(request: Request, page_id: int):
-    """Download the original uploaded file of a ``file`` page (attachment)."""
-    _require_page_view(request, page_id)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format FROM pages "
-            "WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    resolved = _file_page_disk_path(dict(row))
-    if not resolved:
-        return JSONResponse({"error": "No downloadable file"}, status_code=404)
-    full, filename, mime, _size = resolved
-    from fastapi.responses import FileResponse
-    return FileResponse(
-        str(full), media_type=mime or "application/octet-stream",
-        filename=filename, content_disposition_type="attachment",
-    )
-
-
-
-
-@router.get("/api/pages/{page_id}/file-content")
-def page_file_content(request: Request, page_id: int):
-    """Return the textual content of a ``file`` page (for copy to clipboard).
-
-    Binary files (PDF, images…) answer ``{ok: false}`` — the clipboard copy is
-    only meaningful for plain-text / code / markdown files.
-    """
-    from app.services.export import _file_text
-
-    _require_page_view(request, page_id)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format FROM pages "
-            "WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    page = dict(row)
-    text = _file_text(page)
-    if text is None:
-        return JSONResponse(
-            {"ok": False, "error": "Not a textual file", "name": page.get("title", "")},
-            status_code=415,
-        )
-    return {"ok": True, "name": page.get("title") or "File", "content": text}
-
-
-
-
-@router.get("/api/local-workspace/breadcrumb")
-def local_workspace_breadcrumb(request: Request, folder: int):
-    """Return breadcrumb trail for a folder."""
-    with get_conn() as conn:
-        breadcrumb = _build_breadcrumb(conn, folder)
-    return {"breadcrumb": breadcrumb}
-
-
-
-
-@router.get("/api/nav/menu")
-def nav_menu(request: Request, workspace_id: int = None, parent_id: int = None):
-    """Return the pages at one level for the header breadcrumb navigation menu.
-
-    If ``parent_id`` is given, returns that page's children; otherwise the
-    workspace's root pages. Each item includes ``has_children`` so the frontend
-    can render an expandable sub-menu.
-    """
-    from app.routers.board import _file_icon
-    ws_id = workspace_id
-    if not ws_id:
-        ws = _get_active_workspace(request, user_id=_get_user_id(request))
-        ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"items": []}
-    with get_conn() as conn:
-        if parent_id:
-            rows = conn.execute(
-                "SELECT id, title, parent_section, content_format FROM pages "
-                "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
-                "ORDER BY sort_order ASC, created_at DESC",
-                (parent_id, ws_id),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, title, parent_section, content_format FROM pages "
-                "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
-                "ORDER BY sort_order ASC, created_at DESC",
-                (ws_id,),
-            ).fetchall()
-        ids = [r["id"] for r in rows]
-        child_counts = {}
-        if ids:
-            placeholders = ",".join("?" for _ in ids)
-            cc_rows = conn.execute(
-                f"SELECT parent_id, COUNT(*) AS c FROM pages "
-                f"WHERE parent_id IN ({placeholders}) AND deleted_at IS NULL "
-                f"GROUP BY parent_id",
-                ids,
-            ).fetchall()
-            for cr in cc_rows:
-                child_counts[cr["parent_id"]] = cr["c"]
-        items = []
-        for r in rows:
-            is_folder = r["parent_section"] == "Workspace"
-            title = r["title"] or "Untitled"
-            items.append({
-                "id": r["id"],
-                "name": title,
-                "icon": "folder" if is_folder else _file_icon(title, r["content_format"]),
-                "has_children": child_counts.get(r["id"], 0) > 0,
-                "url": f"/pages/{r['id']}",
-            })
-    return {"items": items}
-
-
-
-
-@router.post("/api/local-workspace/items")
-def create_local_workspace_item(request: Request, body: dict = Body(default={})):
-    """Create a new file in the active workspace."""
-    name = (body.get("name") or "").strip() or "Untitled"
-    item_type = body.get("type", "page")
-    parent_id = body.get("parent_id")
-    explicit_ws_id = body.get("workspace_id")
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = explicit_ws_id or (ws["id"] if ws else None)
-    ws_key = (ws["name"] if ws else "Workspace") if not explicit_ws_id else ""
-    section = 'Workspace' if item_type == 'folder' else 'Private'
-    with get_conn() as conn:
-        cursor = conn.execute(
-            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id) "
-            "VALUES (?, ?, ?, '', 'blocks', ?, ?)",
-            (ws_key, ws_id, name, section, parent_id)
-        )
-        conn.commit()
-        pid = cursor.lastrowid
-    return {"id": pid, "name": name, "type": item_type}
-
-
-
-
-@router.put("/api/local-workspace/items/{item_id:int}")
-def rename_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
-    """Rename a file."""
-    name = body.get("name", "Untitled").strip()
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET title=? WHERE id=?", (name, item_id))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/local-workspace/items/{item_id:int}")
-def delete_local_workspace_item(request: Request, item_id: int):
-    """Soft-delete a file/folder (sets deleted_at)."""
-    from datetime import datetime
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET deleted_at=? WHERE id=? AND deleted_at IS NULL",
-            (datetime.now(UTC).replace(tzinfo=None).isoformat(), item_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/local-workspace/items/{item_id:int}/restore")
-def restore_local_workspace_item(request: Request, item_id: int):
-    """Restore a soft-deleted file/folder."""
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET deleted_at=NULL WHERE id=?",
-            (item_id,),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/files/{ws_id:int}/{filename:path}")
-def serve_uploaded_file(ws_id: int, filename: str):
-    """Serve an uploaded file from disk."""
-    import mimetypes
-    from pathlib import Path
-    root = Path(settings.data_dir)
-    base_dir = (root / f"uploads/workspace_{ws_id}").resolve()
-    fp = (base_dir / filename).resolve()
-    try:
-        fp.relative_to(base_dir)
-    except ValueError:
-        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
-    if not fp.exists():
-        return JSONResponse({"error": "File not found"}, status_code=404)
-    mime, _ = mimetypes.guess_type(str(fp))
-    content = fp.read_bytes()
-    from fastapi.responses import Response
-    return Response(content=content, media_type=mime or "application/octet-stream")
-
-
-
-
-@router.put("/api/local-workspace/items/{item_id:int}/move")
-def move_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
-    """Move an item to a new parent (drag & drop)."""
-    new_parent_id = body.get("parent_id")  # None = move to root
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET parent_id=? WHERE id=?",
-            (new_parent_id, item_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/local-workspace/upload")
-async def upload_local_workspace_file(request: Request):
-    """Upload one or more files via drag-and-drop.
-
-    Accepts multipart form with 'files' field (one or multiple files).
-    Optional: 'parent_id' to place files in a specific folder.
-    Stores files on disk at /data/uploads/workspace_{id}/ and creates DB records.
-    """
-    import json
-    from pathlib import Path
-
-    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
-    ws = _get_active_workspace(request, user_id=uid)
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return JSONResponse({"error": "No active workspace"}, status_code=400)
-
-    try:
-        form = await request.form()
-    except Exception:
-        return JSONResponse({"error": "Invalid form data"}, status_code=400)
-
-    parent_id_raw = form.get("parent_id")
-    parent_id = int(parent_id_raw) if parent_id_raw else None
-    files = form.getlist("files")
-
-    if not files:
-        return JSONResponse({"error": "No files provided"}, status_code=400)
-
-
-    from app.middleware.security import validate_upload
-
-    data_root = Path(settings.data_dir)
-    upload_dir = data_root / f"uploads/workspace_{ws_id}"
-    upload_dir.mkdir(parents=True, exist_ok=True)
-
-    results = []
-    with get_conn() as conn:
-        for f in files:
-            filename = f.filename or "untitled"
-            # Sanitize filename: only keep basename, prevent path traversal
-            safe_name = Path(filename).name
-            if not safe_name:
-                safe_name = "untitled"
-
-            # Unique filename on disk
-            file_path = upload_dir / safe_name
-            stem, suffix = file_path.stem, file_path.suffix
-            counter = 1
-            while file_path.exists():
-                file_path = upload_dir / f"{stem} ({counter}){suffix}"
-                counter += 1
-
-            content = await f.read()
-            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
-            if err:
-                results.append({"name": safe_name, "error": err})
-                continue
-            file_path.write_bytes(content)
-
-            # Determine if this is a folder marker or actual file
-            rel_path = str(file_path.relative_to(data_root))
-            size = len(content)
-            mime = f.content_type or "application/octet-stream"
-
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
-                (ws_id, file_path.name,
-                 json.dumps({"file_path": rel_path, "size": size, "mime_type": mime}),
-                 parent_id),
-            )
-            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": size})
-
-        conn.commit()
-
-    return {"status": "ok", "items": results}
-
-
-
-
-@router.post("/api/local-workspace/upload-folder")
-async def upload_local_workspace_folder(request: Request):
-    """Handle recursive folder upload.
-
-    Frontend walks the directory tree with webkitGetAsEntry and sends:
-    - 'structure': JSON array of {path: str, type: 'folder'|'file'}
-    - 'files': multipart files (one per file in the structure)
-    - 'parent_id': target folder (optional)
-
-    Creates folders first, then uploads files into their respective folders.
-    """
-    import json
-    from pathlib import Path
-
-    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
-    ws = _get_active_workspace(request, user_id=uid)
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return JSONResponse({"error": "No active workspace"}, status_code=400)
-
-    try:
-        form = await request.form()
-    except Exception:
-        return JSONResponse({"error": "Invalid form data"}, status_code=400)
-
-    parent_id_raw = form.get("parent_id")
-    root_parent_id = int(parent_id_raw) if parent_id_raw else None
-    structure_raw = form.get("structure")
-
-    if not structure_raw:
-        return JSONResponse({"error": "No structure provided"}, status_code=400)
-
-    try:
-        structure = json.loads(structure_raw)
-    except json.JSONDecodeError:
-        return JSONResponse({"error": "Invalid structure JSON"}, status_code=400)
-
-
-    from app.middleware.security import validate_upload
-
-    data_root = Path(settings.data_dir)
-    upload_dir = data_root / f"uploads/workspace_{ws_id}"
-    upload_dir.mkdir(parents=True, exist_ok=True)
-
-    results = []
-    created_folders = {}  # relative_path -> db_id
-
-    with get_conn() as conn:
-        # Phase 1: Create all folders
-        for item in structure:
-            if item.get("type") != "folder":
-                continue
-            path_parts = item["path"].strip("/").split("/")
-            folder_name = path_parts[-1]
-            # Determine parent: parent of this folder in the tree
-            if len(path_parts) == 1:
-                actual_parent = root_parent_id
-            else:
-                parent_path = "/".join(path_parts[:-1])
-                actual_parent = created_folders.get(parent_path)
-
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, '', 'blocks', 'Workspace', ?)""",
-                (ws_id, folder_name, actual_parent),
-            )
-            fid = cursor.lastrowid
-            created_folders[item["path"].strip("/")] = fid
-            results.append({"id": fid, "name": folder_name, "type": "folder"})
-
-        # Phase 2: Upload files into their respective folders
-        for item in structure:
-            if item.get("type") != "file":
-                continue
-            path_parts = item["path"].strip("/").split("/")
-            file_name = path_parts[-1]
-            if len(path_parts) == 1:
-                file_parent = root_parent_id
-            else:
-                parent_path = "/".join(path_parts[:-1])
-                file_parent = created_folders.get(parent_path)
-
-            # Find the matching file in multipart data
-            matched = None
-            for f in form.getlist("files"):
-                if f.filename and (f.filename == item["path"] or f.filename.endswith("/" + file_name)):
-                    matched = f
-                    break
-            if not matched:
-                continue
-
-            safe_name = Path(file_name).name
-            file_path = upload_dir / safe_name
-            stem, suffix = file_path.stem, file_path.suffix
-            counter = 1
-            while file_path.exists():
-                file_path = upload_dir / f"{stem} ({counter}){suffix}"
-                counter += 1
-
-            content = await matched.read()
-            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
-            if err:
-                results.append({"name": safe_name, "error": err})
-                continue
-            file_path.write_bytes(content)
-
-            rel_path = str(file_path.relative_to(data_root))
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
-                (ws_id, file_path.name,
-                 json.dumps({"file_path": rel_path, "size": len(content), "mime_type": matched.content_type or "application/octet-stream"}),
-                 file_parent),
-            )
-            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": len(content)})
-
-        conn.commit()
-
-    return {"status": "ok", "items": results}
-
-
-# ═══════════ Workspaces CRUD ═══════════
@@ -1,240 +0,0 @@
-"""FlowDeck — Dashboard : pages_api.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Library page actions API ═══════════
-
-@router.get("/api/pages/{page_id:int}/content")
-def api_page_content(page_id: int):
-    """Get page content for side peek preview."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT title, content, content_format FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-        if not row:
-            return JSONResponse({"error": "Not found"}, status_code=404)
-    # v6.5.0: resolve synced blocks server-side (fresh content on read).
-    from app.services.synced_blocks import resolve_content_json
-    return {
-        "title": row["title"],
-        "content": resolve_content_json(row["content"], row["content_format"]),
-        "format": row["content_format"] or "blocks",
-    }
-
-
-
-
-@router.put("/api/pages/{page_id:int}/rename")
-def api_rename_page(page_id: int, request: Request, body: dict = Body(default={})):
-    """Inline rename a page title."""
-    title = (body.get("title") or "").strip()
-    if not title:
-        return JSONResponse({"error": "Title required"}, status_code=400)
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=? AND deleted_at IS NULL",
-            (title, page_id),
-        )
-        # v6.5.0: renaming a database row's content page updates the row.
-        from app.services.row_pages import sync_page_title_to_row
-        sync_page_title_to_row(conn, page_id)
-        conn.commit()
-    return {"status": "ok", "title": title}
-
-
-
-
-@router.post("/api/pages/{page_id:int}/trash")
-def api_trash_page(page_id: int):
-    """Soft-delete a page (move to trash)."""
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET parent_section='Trash', deleted_at=CURRENT_TIMESTAMP WHERE id=?",
-            (page_id,),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/pages/{page_id:int}/convert-to-database")
-def api_convert_to_database(page_id: int, request: Request, body: dict = Body(default={})):
-    """Convert a page into a full-page database (Notion-style).
-
-    Creates a collection linked to this page, adds the default 'Name' property,
-    and sets the page's content_format to 'collection'.
-    """
-    import json as _json
-    db_name = (body.get("name") or "").strip()
-
-    with get_conn() as conn:
-        page = conn.execute(
-            "SELECT id, title, workspace_id FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-        if not page:
-            return JSONResponse({"error": "Page not found"}, status_code=404)
-
-        if not db_name:
-            db_name = page["title"] or "New Database"
-
-        # Create the collection
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, is_inline, parent_page_id, workspace_id)
-               VALUES (?, '', '📋', '[]', 0, ?, ?)""",
-            (db_name, page_id, page["workspace_id"]),
-        )
-        collection_id = cur.lastrowid
-
-        # Create default "Name" property (text, position 0)
-        conn.execute(
-            """INSERT INTO collection_properties
-               (collection_id, name, prop_type, position, required, visible_in_views)
-               VALUES (?, 'Name', 'title', 0, 1, 1)""",
-            (collection_id,),
-        )
-
-        # Create default "Table" view
-        conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json, position)
-               VALUES (?, 'Table', 'table', ?, 0)""",
-            (collection_id, _json.dumps({"visible_properties": ["Name"]})),
-        )
-
-        # Update the page to be a database page
-        conn.execute(
-            "UPDATE pages SET content_format='collection', collection_id=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (collection_id, page_id),
-        )
-
-        conn.commit()
-
-    return {
-        "status": "converted",
-        "collection_id": collection_id,
-        "name": db_name,
-        "view_url": f"/pages/{page_id}",
-    }
-
-
-
-
-@router.get("/api/collections/{collection_id:int}/table-data")
-def api_collection_table_data(collection_id: int):
-    """Get collection properties + pages for rendering the table view."""
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not coll:
-            return JSONResponse({"error": "Collection not found"}, status_code=404)
-
-        properties = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-        pages = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-        views = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-    return {
-        "collection": dict(coll),
-        "properties": properties,
-        "pages": pages,
-        "views": views,
-    }
-
-
-
-
-@router.post("/api/collections/{collection_id:int}/pages")
-def api_create_collection_page(collection_id: int, request: Request, body: dict = Body(default={})):
-    """Create a new page (row) in a collection."""
-    import json as _json
-    title = body.get("title", "New page").strip() or "New page"
-    icon = body.get("icon", "file")
-
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT id FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not coll:
-            return JSONResponse({"error": "Collection not found"}, status_code=404)
-
-        # Get next position
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        # Load default property values from collection properties
-        props = [
-            dict(r) for r in conn.execute(
-                "SELECT id, name, prop_type FROM collection_properties WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-        default_values = {}
-        for p in props:
-            if p["prop_type"] == "title":
-                default_values[str(p["id"])] = title
-        # Caller-provided values (e.g. board "add card in column X") win.
-        incoming = body.get("properties") or {}
-        if isinstance(incoming, dict):
-            default_values.update(incoming)
-
-        from app.services.property_types import apply_auto_properties
-        user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {"login": "admin", "id": 1}
-        apply_auto_properties(props, default_values, user, is_create=True)
-
-        cur = conn.execute(
-            """INSERT INTO collection_pages
-               (collection_id, title, icon, cover_url, position, property_values_json)
-               VALUES (?, ?, ?, ?, ?, ?)""",
-            (collection_id, title, icon, body.get("cover_url", ""), max_pos,
-             _json.dumps(default_values)),
-        )
-        page_id = cur.lastrowid
-        conn.commit()
-
-    return {
-        "id": page_id,
-        "title": title,
-        "icon": icon,
-        "position": max_pos,
-        "property_values_json": default_values,
-        "status": "created",
-    }
@@ -1,485 +0,0 @@
-"""FlowDeck — Dashboard : pages_html.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-from ._common import _get_active_workspace, _get_user_id, _nav_breadcrumb, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.get("/trash", response_class=HTMLResponse)
-def trash_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
-    """Trash page — scoped to workspace if owner/repo provided."""
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    sidebar = board_sidebar(request, owner, repo)
-    with get_conn() as conn:
-        ws_key = f"{owner}/{repo}" if owner and repo else ""
-        # Pages are soft-deleted via parent_section='Trash'
-        if ws_key:
-            rows = conn.execute(
-                "SELECT id, title, workspace FROM pages WHERE parent_section='Trash' AND workspace=? ORDER BY updated_at DESC",
-                (ws_key,),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, title, workspace FROM pages WHERE parent_section='Trash' ORDER BY updated_at DESC",
-            ).fetchall()
-    sidebar["trash_items"] = [{"id": r["id"], "name": r["title"] or "Untitled", "workspace": r["workspace"]} for r in rows]
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    sidebar["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("trash.html")
-    return template.render(**sidebar)
-
-
-
-
-@router.get("/library", response_class=HTMLResponse)
-def library_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
-    """Library page — tabbed view (recents, favorites, shared, published, private, workspace).
-
-    Sidebar data is kept intact. Tab content is loaded client-side via /api/library/* endpoints.
-    """
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    sidebar = board_sidebar(request, owner, repo)
-    # Pass active workspace for breadcrumb nav menu
-    ws_key_ws = f"{owner}/{repo}" if owner and repo else ""
-    if ws_key_ws:
-        with get_conn() as conn:
-            ws_row = conn.execute("SELECT id FROM workspaces WHERE name=? AND owner_id=?", (ws_key_ws, _get_user_id(request))).fetchone()
-            sidebar["nav_workspace_id"] = ws_row["id"] if ws_row else 0
-    else:
-        ws = _get_active_workspace(request, user_id=_get_user_id(request))
-        sidebar["nav_workspace_id"] = ws["id"] if ws else 0
-
-    template = env.get_template("library.html")
-    sidebar["active_workspace_id"] = sidebar.get("nav_workspace_id", 0)
-    # Gitea workspace context for Repository tab
-    sidebar["is_gitea_workspace"] = bool(owner and repo)
-    sidebar["gitea_workspace_owner"] = owner
-    sidebar["gitea_workspace_repo"] = repo
-    return template.render(**sidebar)
-
-
-
-
-@router.get("/pages/{page_id}", response_class=HTMLResponse)
-def view_page_root(request: Request, page_id: int):
-    """Render a Markdown page at root level with workspace context — or file viewer.
-    ?embed=1 — minimal mode for side peek (editor only, no header)."""
-    embed = request.query_params.get("embed") == "1"
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            return RedirectResponse("/workspaces", status_code=302)
-    page = dict(row)
-    # v6.5.0: synced blocks resolve server-side at read time.
-    from app.services.synced_blocks import resolve_content_json
-    page["content"] = resolve_content_json(page.get("content", ""), page.get("content_format"))
-
-    ws = page.get("workspace", "")
-    parts = ws.split("/") if "/" in ws else ["", ""]
-    owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
-    sidebar = board_sidebar(request, owner, repo)
-    # Load sub-pages
-    with get_conn() as conn:
-        subs = conn.execute(
-            "SELECT id, title FROM pages WHERE parent_id=? ORDER BY updated_at DESC",
-            (page_id,),
-        ).fetchall()
-        fav = conn.execute(
-            "SELECT id FROM favorites WHERE user_id=? AND page_id=?",
-            (1, page_id),
-        ).fetchone()
-
-    # Build page_data, including file metadata for uploaded files
-    _locked = bool(page.get("is_locked", 0))
-    _locked_by = page.get("locked_by") if "locked_by" in page else None
-    _sess_user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    _uid = _sess_user.get("id") if _sess_user and _sess_user.get("id") else None
-    _can_edit = (not _locked) or bool(_sess_user and _sess_user.get("is_admin")) or (_locked_by and _uid and _locked_by == _uid)
-    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0)),
-                 "is_locked": _locked,
-                 "locked_by": _locked_by,
-                 "can_edit": _can_edit,
-                 "full_width": bool(page.get("full_width", 0)) if "full_width" in page else False,
-                 "font_small": bool(page.get("font_small", 0)) if "font_small" in page else False}
-
-    # For file pages, extract file metadata and add to page_data
-    if page.get("content_format") == "file":
-        import json as _json
-        try:
-            meta = _json.loads(page.get("content", "{}"))
-        except _json.JSONDecodeError:
-            meta = {}
-        file_path = meta.get("file_path", "").replace("\\", "/")
-        mime_type = meta.get("mime_type", "application/octet-stream")
-        file_size = meta.get("size", 0)
-        fp_parts = file_path.split("/")
-        ws_id = ""
-        for p in fp_parts:
-            if p.startswith("workspace_"):
-                ws_id = p.replace("workspace_", "")
-                break
-        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
-        from urllib.parse import quote
-        safe_name = quote(filename, safe='')
-        file_url = f"/api/files/{ws_id}/{safe_name}" if ws_id else ""
-        page_data["file_url"] = file_url
-        page_data["file_mime"] = mime_type
-        page_data["file_size"] = file_size
-        page_data["file_name"] = filename
-
-    # For collection (database) pages, load collection + properties + pages
-    collection_data = None
-    if page.get("content_format") == "collection" and page.get("collection_id"):
-        with get_conn() as conn:
-            col = conn.execute(
-                "SELECT * FROM collections WHERE id=?", (page["collection_id"],)
-            ).fetchone()
-            if col:
-                props = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                cpages = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                cviews = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                collection_data = {
-                    "collection": dict(col),
-                    "properties": props,
-                    "pages": cpages,
-                    "views": cviews,
-                }
-        page_data["collection_id"] = page["collection_id"]
-
-    with get_conn() as conn:
-        nav_crumbs = _nav_breadcrumb(conn, page_id)
-    # dérivé calculé UNE fois : ctx ET page_data (JSON) l'utilisent (A27)
-    page_is_shared = (
-        bool(page.get("is_shared", 0))
-        or page.get("share_mode", "private") != "private"
-        or bool(page.get("published", 0))
-    )
-    ctx = {**sidebar, "page": page, "sub_pages": [dict(s) for s in subs],
-           "page_favorited": fav is not None,
-           "page_share_mode": page.get("share_mode", "private"),
-           "page_published": bool(page.get("published", 0)),
-           "page_is_shared": page_is_shared,
-           "page_data": page_data,
-           "collection_data": collection_data,
-           "breadcrumb_items": nav_crumbs,
-           "nav_workspace_id": page.get("workspace_id") or 0,
-           "nav_page_id": page_id,
-           "embed_mode": embed}
-    # A27 phase 2 : le JS de l'éditeur lit ces valeurs dans page-data (JSON)
-    # au lieu des interpolations Jinja — une seule source, même calculs que le
-    # ctx ci-dessus.
-    from app.templating import ENV as _ENV27
-    page_data.update(
-        updated_at=page.get("updated_at", ""),
-        created_at=page.get("created_at", ""),
-        user_id=_uid or 0,
-        is_shared=page_is_shared,
-        clip_icon=_ENV27.from_string(
-            "{% from '_icons.html' import fd_icon %}{{ fd_icon('paperclip', 14) }}"
-        ).render(),
-    )
-    # Select template: collection pages use database table view
-    if page.get("content_format") == "collection" and not embed:
-        template = env.get_template("page_editor_collection.html")
-    else:
-        template = env.get_template("page_editor_embed.html" if embed else "page_editor.html")
-    response = template.render(**ctx)
-    return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})
-
-
-
-
-@router.get("/accounts", response_class=HTMLResponse)
-def accounts_page(request: Request):
-    """Account management panel."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    with get_conn() as conn:
-        users = conn.execute(
-            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
-            "is_admin, is_active, created_at FROM users ORDER BY created_at DESC"
-        ).fetchall()
-    ctx = {**sidebar, "user": user, "users": [dict(u) for u in users]}
-    template = env.get_template("accounts.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/help", response_class=HTMLResponse)
-def help_page(request: Request):
-    """Comprehensive help & documentation page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    # Render via a block-based template so content_html lands in {% block content %}
-    block_tpl = env.from_string(
-        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
-    )
-    return HTMLResponse(block_tpl.render(
-        **sidebar,
-        request=request,
-        page_title="Help",
-        title_prefix="Help",
-        page_icon="❓",
-        content_html="""<style>
-.help-page{max-width:900px;margin:0 auto;padding:40px 24px 80px;}
-.help-hero{text-align:center;margin-bottom:48px;}
-.help-hero h1{font-size:32px;font-weight:800;margin:0 0 8px;}
-.help-hero p{font-size:16px;color:var(--text-dim);max-width:500px;margin:0 auto;}
-.help-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin-bottom:48px;}
-.help-card{background:var(--bg-card);border:1px solid var(--border);border-radius:12px;padding:24px;transition:border-color .15s;}
-.help-card:hover{border-color:rgba(255,255,255,.12);}
-.help-card h3{font-size:15px;font-weight:600;margin:0 0 4px;display:flex;align-items:center;gap:8px;}
-.help-card .icon{font-size:20px;}
-.help-card p{font-size:13px;color:var(--text-dim);line-height:1.5;margin:8px 0 0;}
-.help-card ul{list-style:none;padding:0;margin:12px 0 0;}
-.help-card li{font-size:13px;padding:3px 0;color:var(--text-dim);}
-.help-card li::before{content:'• ';color:var(--accent);}
-.help-section{margin-bottom:48px;}
-.help-section h2{font-size:20px;font-weight:700;margin:0 0 16px;padding-bottom:8px;border-bottom:1px solid var(--border);}
-.help-kbd{display:inline-block;padding:2px 8px;background:var(--bg-tertiary);border:1px solid var(--border);border-radius:4px;font-family:monospace;font-size:12px;color:var(--text);min-width:16px;text-align:center;}
-.help-shortcut-row{display:flex;align-items:center;gap:12px;padding:8px 12px;border-radius:6px;margin-bottom:2px;}
-.help-shortcut-row:hover{background:var(--bg-hover);}
-.help-shortcut-row .keys{display:flex;gap:4px;min-width:140px;}
-.help-shortcut-row .desc{font-size:13px;color:var(--text-dim);}
-.help-badge{display:inline-block;padding:2px 10px;border-radius:20px;font-size:11px;font-weight:600;}
-.help-badge.local{background:rgba(35,131,226,.15);color:#2C8CEB;}
-.help-badge.gitea{background:rgba(0,200,100,.15);color:#00CC66;}
-.help-badge.github{background:rgba(130,80,220,.15);color:#A060F0;}
-.help-badge.sso{background:rgba(217,115,13,.18);color:#E0952B;}
-</style>
-<div class="help-page">
-<div class="help-hero">
-<h1>❓ FlowDeck Help</h1>
-<p>Everything you need to know about your Notion-style workspace with Gitea & GitHub integration.</p>
-</div>
-
-<div class="help-grid">
-<div class="help-card">
-<h3><span class="icon">🚀</span>Getting Started</h3>
-<p>FlowDeck is your private, self-hosted workspace. Create pages, organize projects, and integrate with your Git forge.</p>
-<ul>
-<li>Create a workspace from the <b>Workspaces</b> page</li>
-<li>Click <b>📄 New Page</b> in the sidebar to start writing</li>
-<li>Use <span class="help-kbd">Ctrl+N</span> anywhere to create a page</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📝</span>Pages & Editor</h3>
-<p>Notion-style block editor with slash commands, markdown shortcuts, and rich formatting.</p>
-<ul>
-<li>Type <span class="help-kbd">/</span> for the slash command menu</li>
-<li>Drag & drop pages in the sidebar to reorganize</li>
-<li>Right-click for context menu (duplicate, rename, delete)</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">{{ fd_icon("folder",16) }}</span>Workspaces</h3>
-<p>Organize your work into separate workspaces. Each has its own pages and files.</p>
-<ul>
-<li><span class="help-badge local">Local</span> Files stored on your server</li>
-<li><span class="help-badge gitea">Gitea</span> Connect to browse & edit repos</li>
-<li><span class="help-badge github">GitHub</span> Connect via Settings → Integrations</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">🦎</span>Gitea Integration</h3>
-<p>Connect your Gitea account to access repositories directly from FlowDeck.</p>
-<ul>
-<li>Go to <b>Settings → Integrations</b> to connect</li>
-<li>Browse repo file trees in the sidebar</li>
-<li>Create & edit files with commit messages</li>
-<li>Sync labels as tags</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">🌐</span>Sharing & Publishing</h3>
-<p>Share pages with collaborators or publish them to the web.</p>
-<ul>
-<li>Click <b>Share</b> in the page editor top-right</li>
-<li>Share with specific users or get a public link</li>
-<li>Publish to make a page visible at <code>/p/your-slug</code></li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📚</span>Library, Trash & Tasks</h3>
-<p>Find all your content in one place with powerful filtering.</p>
-<ul>
-<li><b>Library</b> — Tabs for Recents, Favorites, Shared, Published</li>
-<li><b>Trash</b> — Soft-deleted pages (30-day retention)</li>
-<li><b>My Tasks</b> — Aggregated tasks from all collections</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📶</span>Offline & PWA</h3>
-<p>Install FlowDeck as an app and keep working without a connection.</p>
-<ul>
-<li><b>Install</b> — browser menu → <i>Install app</i> / <i>Add to Home Screen</i></li>
-<li>Edits made offline are queued locally and synced automatically</li>
-<li>A <b>⟳</b> marker shows pages with pending changes</li>
-</ul>
-</div>
-</div>
-
-<div class="help-section">
-<h2>⌨️ Keyboard Shortcuts</h2>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">N</span></div><div class="desc">Create new page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">K</span></div><div class="desc">Quick find / command palette</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">S</span></div><div class="desc">Save current page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">F2</span></div><div class="desc">Rename selected item</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Delete</span></div><div class="desc">Move selected item to trash</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Escape</span></div><div class="desc">Close modal / cancel editing</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Enter</span></div><div class="desc">Open selected page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">O</span></div><div class="desc">New AI chat (in footer)</div></div>
-</div>
-
-<div class="help-section">
-<h2>🔐 Authentication</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck supports three authentication methods:<br>
-<span class="help-badge local">Local</span> Email + password — create an account on the login page.<br>
-<span class="help-badge gitea">Gitea OAuth</span> Login with your Gitea account. Your repos appear as workspaces.<br>
-<span class="help-badge github">GitHub OAuth</span> Login or link your GitHub account in Settings → Integrations.<br><br>
-<b>Tip:</b> You can connect Gitea/GitHub to an existing local account — your identity stays as your local user.
-</p>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-<span class="help-badge sso">SSO</span> <b>Enterprise SSO</b> (v6.7.0) — sign in with your organization account.<br>
-<i>For administrators:</i> open <b>Settings → Admin → SSO / Enterprise</b> and pick a provider:<br>
-• <b>SAML 2.0</b> — paste the IdP <i>Entity ID</i>, <i>SSO URL</i> and signing certificate, then give the IdP this
-<code>/auth/saml/metadata</code> link (it contains the SP Entity ID, ACS URL and certificate).<br>
-• <b>OpenID Connect</b> — paste the <i>Issuer URL</i>, <i>Client ID</i> and <i>Client Secret</i> (PKCE is used, scopes default to <code>openid profile email</code>).<br>
-• <b>Provisioning</b> — accounts are created automatically on first login, groups from the IdP map to workspace roles,
-and <i>SSO only</i> disables local login (admins keep their local door). Every attempt is audited in
-<b>Settings → Admin → SSO / Enterprise</b> (login history).
-</p>
-</div>
-
-<div class="help-section">
-<h2>📶 Offline mode (PWA)</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck is a Progressive Web App: pages you visited stay available offline and your
-edits are saved locally, then synchronised when the connection returns.<br><br>
-<b>Install:</b> open your browser menu and choose <i>Install app</i> (Chrome/Edge) or
-<i>Add to Home Screen</i> (Safari/iOS). FlowDeck then opens in its own window.<br>
-<b>Offline editing:</b> while offline, the editor stores changes in the browser
-(IndexedDB) and shows an offline banner with the number of pending changes. A
-<b>⟳</b> icon appears next to pages that have unsynced edits.<br>
-<b>Reconnection:</b> the queue is replayed automatically (and via Background Sync).
-A spinner badge appears while syncing, followed by a confirmation toast.<br>
-<b>Conflicts:</b> if a page changed on the server, the latest edit wins and a notice is
-shown. If a page was deleted server-side, your offline copy is recreated as an orphan
-page. If a page with the same title already exists, the offline copy is renamed
-<i>“Title (copie offline)”</i>.
-</p>
-</div>
-
-<div class="help-section">
-<h2>🔌 API publique v2</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck exposes a full REST API under <b>/api/v2</b> for third-party integrations.<br>
-<b>Auth:</b> create a token in Settings → API tokens, then send it as
-<code>Authorization: Bearer &lt;token&gt;</code>. Tokens carry scopes
-<code>read</code>, <code>write</code> or <code>admin</code> (a higher scope implies the lower ones).<br>
-<b>Features:</b> CRUD on collections, pages, properties, views, comments, notifications,
-favorites, tags, sharing, sprints and templates; pagination (<code>?limit=&amp;offset=</code> +
-<code>X-Total-Count</code>), filters (<code>filter[prop]=value</code>), sorting, full-text search
-(<code>/api/v2/search</code>), idempotency (<code>Idempotency-Key</code>) and RFC 7807 error bodies.<br>
-<b>Reference:</b> interactive OpenAPI docs at <a href="/docs" target="_blank" rel="noopener">/docs</a>
-(also <code>/redoc</code>, <code>docs/openapi-v2.json</code>).
-</p>
-</div>
-
-<div class="help-section">
-<h2>💡 Tips</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-• Toggle the sidebar with the <b>«</b> button in the top-left corner.<br>
-• Switch between workspaces using the dropdown menu in the sidebar header.<br>
-• The <b>Private</b> section appears when a remote workspace is active — files here stay local.<br>
-• Hover over any sidebar item to see action buttons (favorite, share, delete).<br>
-• Use <b>Ctrl+Click</b> or <b>Shift+Click</b> to multi-select items in the sidebar.
-</p>
-</div>
-
-</div>"""
-    ))
-
-
-
-
-@router.get("/accounts/settings", response_class=HTMLResponse)
-def settings_page(request: Request):
-    """User settings page — profile, forges, tokens."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        from fastapi.responses import RedirectResponse
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    # Check forge connections
-    gitea_connected = False
-    github_connected = False
-    if user.get("id"):
-        with get_conn() as conn:
-            tokens = conn.execute(
-                "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
-            ).fetchall()
-            for t in tokens:
-                if t["provider"] == "gitea":
-                    gitea_connected = True
-                elif t["provider"] == "github":
-                    github_connected = True
-    ctx = {**sidebar, "user": user, "gitea_connected": gitea_connected, "github_connected": github_connected}
-    template = env.get_template("settings.html")
-    response = template.render(**ctx)
-    return HTMLResponse(content=response)
-
-
-# ═══════════ User API endpoints ═══════════
@@ -1,78 +0,0 @@
-"""FlowDeck — Dashboard : public.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-
-from ._common import _render_blocks_public
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Public Published Page ═══════════
-
-
-@router.get("/p/{slug}", response_class=HTMLResponse)
-def public_published_page(request: Request, slug: str):
-    """Serve a published page at /p/<slug> — no auth required."""
-    from app.templating import ENV
-
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format, updated_at, created_at, cover_url, page_icon "
-            "FROM pages WHERE publish_slug=? AND is_published=1",
-            (slug,),
-        ).fetchone()
-
-    if not row:
-        return HTMLResponse(
-            """<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
-<title>Not Found — FlowDeck</title>
-<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;
-justify-content:center;height:100vh;margin:0;background:#191919;color:#ccc;}
-h1{font-size:3rem;opacity:.3}</style></head><body><h1>404</h1></body></html>""",
-            status_code=404,
-        )
-
-    page = dict(row)
-    env = ENV
-
-    # Convert blocks to HTML for rendering
-    content_html = ""
-    if page.get("content_format") == "blocks" and page.get("content"):
-        import json as _json
-        try:
-            blocks = _json.loads(page["content"])
-            from app.services.synced_blocks import resolve_synced_block
-            blocks = resolve_synced_block(blocks)
-            from app.db import get_conn as _gc
-            from app.services.wiki_links import token_labels
-            with _gc() as conn:
-                wiki_titles_map = token_labels(conn, page["content"])
-            content_html = _render_blocks_public(blocks, wiki_titles_map)
-        except (_json.JSONDecodeError, Exception):
-            content_html = f"<p>{page.get('content', '')}</p>"
-    elif page.get("content"):
-        # Plain text / markdown
-        text = page["content"]
-        content_html = f"<pre style='white-space:pre-wrap;font-family:system-ui;font-size:16px;line-height:1.6;'>{text}</pre>"
-
-    template = env.get_template("public_page.html")
-    return template.render(
-        title=page["title"] or "Untitled",
-        content_html=content_html,
-        updated_at=page.get("updated_at", ""),
-        created_at=page.get("created_at", ""),
-        cover_url=page.get("cover_url", ""),
-        page_icon=page.get("page_icon", ""),
-    )
@@ -1,321 +0,0 @@
-"""FlowDeck — Dashboard : workspace.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.gitea_client import get_user_gitea_client, gitea
-
-from ._common import _get_active_workspace, _get_user_id, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.get("/", response_class=HTMLResponse)
-async def dashboard(
-    request: Request,
-    search: str = Query(default=""),
-    show_archived: bool = Query(default=False),
-):
-    """Smart root route: landing for visitors, local workspace for new users, dashboard for Gitea users."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-
-    # ── Not authenticated → show landing page ──
-    if not user:
-        # Allow through if DB is empty (fresh install)
-        try:
-            with get_conn() as conn:
-                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-                if count == 0:
-                    from app.templating import ENV
-                    env = ENV
-                    template = env.get_template("landing.html")
-                    return template.render()
-        except Exception:
-            logger.exception("dashboard")
-        from app.templating import ENV
-        env = ENV
-        template = env.get_template("landing.html")
-        return template.render()
-
-    # ── Authenticated ──
-    user_id = user.get("id", 1)
-    has_gitea = False
-    try:
-        with get_conn() as conn:
-            tok = conn.execute(
-                "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider='gitea'",
-                (user_id,),
-            ).fetchone()
-            has_gitea = bool(tok)
-    except Exception:
-        logger.exception("dashboard")
-
-    if not has_gitea:
-        # Check if user has any workspace
-        try:
-            with get_conn() as conn:
-                ws_count = conn.execute(
-                    "SELECT COUNT(*) FROM workspaces WHERE owner_id=?", (user_id,)
-                ).fetchone()[0]
-                if ws_count == 0:
-                    # v5.2.0: first-launch → onboarding wizard
-                    return RedirectResponse("/welcome", status_code=302)
-        except Exception:
-            logger.exception("dashboard")
-        return RedirectResponse("/local-workspace", status_code=302)
-
-    # ── Gitea user → full dashboard ──
-    try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
-        if search:
-            q = search.lower()
-            repos = [r for r in repos if q in r.get("full_name", "").lower()
-                     or q in (r.get("description") or "").lower()]
-        if not show_archived:
-            repos = [r for r in repos if not r.get("archived", False)]
-        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
-    except Exception as e:
-        logger.error("Dashboard error: %s", e)
-        repos = []
-
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, repos)
-    template = env.get_template("dashboard.html")
-    return template.render(request=request, repos=repos, search=search,
-                           show_archived=show_archived, **sidebar)
-
-
-# ═══════════ Workspace ═══════════
-
-
-
-
-# ═══════════ Workspace ═══════════
-
-@router.get("/workspace", response_class=HTMLResponse)
-def workspace_page(request: Request):
-    """Unified workspace showing all projects."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("workspace.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/gitea-workspace", response_class=HTMLResponse)
-def gitea_workspace_page(request: Request):
-    """Gitea workspace — browse repo files."""
-    import json
-
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    owner = request.query_params.get("owner", "")
-    repo = request.query_params.get("repo", "")
-    ws_key = f"{owner}/{repo}" if owner and repo else ""
-    ws_name = ws_key or "Gitea Workspace"
-    # Auto-create local workspace mirror for storing local files
-    local_ws_id = None
-    if ws_key:
-        with get_conn() as conn:
-            existing = conn.execute(
-                "SELECT id, owner_id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                (user["id"], ws_key, "%gitea_repo%")
-            ).fetchone()
-            if existing:
-                local_ws_id = existing["id"]
-            else:
-                c = conn.execute(
-                    "INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)",
-                    (ws_key, user["id"], json.dumps({"gitea_repo": ws_key, "gitea_owner": owner}))
-                )
-                local_ws_id = c.lastrowid
-                conn.execute(
-                    "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
-                    (local_ws_id, user["id"], "admin")
-                )
-                conn.commit()
-    ctx = {
-        **sidebar,
-        "user": user,
-        "active_ws_name": ws_name,
-        "workspace_key": ws_key,
-        "gitea_workspace": True,  # always true on this page
-        "gitea_owner": owner,
-        "gitea_repo": repo,
-        "workspace_name": ws_name,
-        "workspace_initial": repo[0].upper() if repo else "G",
-        "owner": owner,
-        "repo": repo,
-        "nav_workspace_id": local_ws_id or 0,  # for breadcrumb nav menu
-    }
-    template = env.get_template("gitea_workspace.html")
-    resp = HTMLResponse(content=template.render(**ctx))
-    resp.set_cookie("flowdeck_workspace", f"gitea:{owner}:{repo}", path="/", samesite="lax")
-    return resp
-
-
-
-
-@router.get("/api/workspace/projects")
-async def list_workspace_projects(request: Request):
-    """List all projects: built-in + Gitea + GitHub.
-    Uses the user's own Gitea token if connected, not the global admin token."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-
-    builtin = []
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title FROM pages WHERE parent_id IS NULL AND collection_row_id IS NULL ORDER BY updated_at DESC LIMIT 20"
-        ).fetchall()
-        # A23 : une seule agrégation GROUP BY au lieu d'un COUNT par ligne.
-        counts = {}
-        if rows:
-            for c in conn.execute(
-                "SELECT parent_id, COUNT(*) AS c FROM pages WHERE parent_id IN ({}) GROUP BY parent_id".format(
-                    ",".join("?" * len(rows))
-                ),
-                [r["id"] for r in rows],
-            ).fetchall():
-                counts[c["parent_id"]] = c["c"]
-        for r in rows:
-            builtin.append({"id": str(r["id"]), "name": r["title"] or "Untitled", "pageCount": counts.get(r["id"], 0), "forge": "builtin"})
-
-    gitea_repos = []
-    # Use per-user token if available, otherwise return empty
-    user_gitea = get_user_gitea_client(request) if user else None
-    if user_gitea:
-        try:
-            repos = await user_gitea.get_user_repos(page=1, limit=50)
-            for repo in repos:
-                gitea_repos.append({
-                    "id": str(repo.get("id", "")),
-                    "name": repo.get("name", ""),
-                    "full_name": repo.get("full_name", ""),
-                    "description": repo.get("description", ""),
-                    "html_url": repo.get("html_url", ""),
-                    "language": repo.get("language", ""),
-                    "forge": "gitea",
-                })
-        except Exception:
-            logger.exception("list_workspace_projects")
-
-    return {"builtin": builtin, "gitea": gitea_repos, "github": []}
-
-
-
-
-@router.post("/api/workspace/projects")
-def create_workspace_project(request: Request, body: dict = Body(default={})):
-    name = body.get("name", "").strip()
-    if not name:
-        return {"error": "Name required"}
-    with get_conn() as conn:
-        cursor = conn.execute(
-            "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')",
-            (name,),
-        )
-        conn.commit()
-        pid = cursor.lastrowid
-    return {"id": pid, "name": name, "forge": "builtin"}
-
-
-# ═══════════ Workspace Members API ═══════════
-
-
-
-
-# ═══════════ Workspace Members API ═══════════
-
-@router.get("/api/workspace/{ws_id:int}/members")
-def list_members(request: Request, ws_id: int):
-    """List all members of a workspace."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at
-               FROM workspace_members wm JOIN users u ON u.id = wm.user_id
-               WHERE wm.workspace_id=? ORDER BY wm.joined_at""", (ws_id,)
-        ).fetchall()
-    return {"members": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/workspace/{ws_id:int}/members")
-def invite_member(request: Request, ws_id: int, body: dict = Body(default={})):
-    """Invite a user to a workspace by email."""
-    email = body.get("email", "").strip()
-    role = body.get("role", "editor")
-    if role not in ("owner", "admin", "editor", "viewer"):
-        return {"error": "Invalid role"}, 400
-    with get_conn() as conn:
-        user = conn.execute("SELECT id FROM users WHERE login=? OR email=?", (email, email)).fetchone()
-        if not user:
-            return {"error": "User not found"}, 404
-        try:
-            conn.execute(
-                "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
-                (ws_id, user["id"], role),
-            )
-            conn.commit()
-        except Exception:
-            return {"error": "Already a member"}, 409
-    return {"status": "ok", "user_id": user["id"], "role": role}
-
-
-
-
-@router.put("/api/workspace/{ws_id:int}/members/{user_id:int}")
-def update_member_role(request: Request, ws_id: int, user_id: int, body: dict = Body(default={})):
-    """Change a member's role."""
-    role = body.get("role", "editor")
-    if role not in ("owner", "admin", "editor", "viewer"):
-        return {"error": "Invalid role"}
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?",
-            (role, ws_id, user_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/workspace/{ws_id:int}/members/{user_id:int}")
-def remove_member(request: Request, ws_id: int, user_id: int):
-    """Remove a member from a workspace."""
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?",
-            (ws_id, user_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-# ═══════════ Local Workspace (file/folder CRUD) ═══════════
@@ -1,131 +0,0 @@
-"""FlowDeck — Dashboard : workspaces.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-from ._common import WORKSPACE_COOKIE, _get_active_workspace, _get_user_id, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.get("/workspaces", response_class=HTMLResponse)
-def workspaces_page(request: Request):
-    """Workspaces list page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [], include_workspace=False)
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu (null on workspaces home)
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("workspaces.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/api/workspaces")
-def list_workspaces(request: Request):
-    """List all workspaces for the current user."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT w.*, (SELECT COUNT(*) FROM pages WHERE workspace_id=w.id AND collection_row_id IS NULL) as page_count "
-            "FROM workspaces w WHERE w.owner_id=? ORDER BY w.created_at DESC",
-            (uid,),
-        ).fetchall()
-    workspaces = []
-    for r in rows:
-        d = dict(r)
-        workspaces.append(d)
-    active = _get_active_workspace(request, user_id=_get_user_id(request))
-    return {"workspaces": workspaces, "active_id": active["id"] if active else None}
-
-
-
-
-@router.post("/api/workspaces")
-def create_workspace(request: Request, body: dict = Body(default={})):
-    """Create a new workspace."""
-    name = body.get("name", "New Workspace").strip()
-    if not name:
-        return {"error": "Name required"}
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        # Ensure user exists (FK constraint)
-        uid_ok = conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone()
-        if not uid_ok:
-            conn.execute(
-                "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?, ?, ?, 1)",
-                (uid, user.get("login", "admin") if user else "admin",
-                 user.get("full_name", "Admin") if user else "Admin"),
-            )
-        cursor = conn.execute(
-            "INSERT INTO workspaces (name, owner_id) VALUES (?, ?)",
-            (name, uid),
-        )
-        ws_id = cursor.lastrowid
-        # Add owner as member
-        conn.execute(
-            "INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')",
-            (ws_id, uid),
-        )
-        conn.commit()
-    return {"id": ws_id, "name": name}
-
-
-
-
-@router.put("/api/workspaces/{ws_id:int}")
-def rename_workspace(request: Request, ws_id: int, body: dict = Body(default={})):
-    """Rename a workspace."""
-    name = body.get("name", "").strip()
-    if not name:
-        return {"error": "Name required"}
-    with get_conn() as conn:
-        conn.execute("UPDATE workspaces SET name=? WHERE id=?", (name, ws_id))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/workspaces/{ws_id:int}")
-def delete_workspace(request: Request, ws_id: int):
-    """Delete a workspace and all its pages."""
-    with get_conn() as conn:
-        conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws_id,))
-        conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws_id,))
-        conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/workspaces/{ws_id:int}/select")
-def select_workspace(request: Request, ws_id: int):
-    """Set the active workspace via cookie."""
-    response = JSONResponse({"status": "ok", "workspace_id": ws_id})
-    response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
-    return response
-
-
-# ═══════════ Settings Page ═══════════
@@ -1,100 +0,0 @@
-"""FlowDeck — custom workspace emojis (v5.6.0).
-
-Uploaded emoji images stored per-workspace and usable as page icons. Kept on a
-prefix-less router so the paths stay ``/api/custom-emojis`` (the board router's
-``/{owner}/{repo}`` HTML catch-all would otherwise shadow them).
-"""
-from __future__ import annotations
-
-import datetime
-import re
-from pathlib import Path
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.config import settings
-from app.db import get_conn
-
-router = APIRouter(tags=["emojis"])
-
-_IMAGE_EXTS = {"png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico", "avif"}
-
-
-def _upload_root() -> Path:
-
-    return Path(settings.data_dir)
-
-
-def _active_ws(request: Request) -> int:
-    """Workspace id from the active-workspace cookie, fallback 1."""
-    try:
-        ws_id = int(request.cookies.get("flowdeck_workspace", "") or 0)
-        if ws_id > 0:
-            return ws_id
-    except (ValueError, TypeError):
-        pass
-    return 1
-
-
-@router.get("/api/custom-emojis")
-def list_custom_emojis(request: Request):
-    """List the current workspace's custom emojis."""
-    ws_id = _active_ws(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, name, url FROM custom_emojis WHERE workspace_id=? ORDER BY created_at DESC",
-            (ws_id,),
-        ).fetchall()
-    return {"status": "ok", "emojis": [dict(r) for r in rows]}
-
-
-@router.post("/api/custom-emojis")
-async def create_custom_emoji(request: Request):
-    """Upload a custom emoji image (multipart: ``name`` + ``file``)."""
-    form = await request.form()
-    name = (form.get("name") or "").strip()[:40] or "emoji"
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    original = (upload.filename or "emoji.png").replace("\\", "/").rsplit("/", 1)[-1]
-    safe = re.sub(r"[^A-Za-z0-9._-]", "_", original)[:80]
-    ext = safe.rsplit(".", 1)[-1].lower() if "." in safe else "png"
-    if ext not in _IMAGE_EXTS:
-        raise HTTPException(400, "Unsupported image format")
-    ws_id = _active_ws(request)
-    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S%f")
-    folder = _upload_root() / f"uploads/workspace_{ws_id}"
-    folder.mkdir(parents=True, exist_ok=True)
-    final = f"emoji_{stamp}_{safe}"
-    (folder / final).write_bytes(await upload.read())
-    url = f"/api/files/{ws_id}/{final}"
-    with get_conn() as conn:
-        cur = conn.execute(
-            "INSERT INTO custom_emojis (workspace_id, name, url) VALUES (?, ?, ?)",
-            (ws_id, name, url),
-        )
-        conn.commit()
-        emoji_id = cur.lastrowid
-    return {"status": "ok", "emoji": {"id": emoji_id, "name": name, "url": url}}
-
-
-@router.delete("/api/custom-emojis/{emoji_id}")
-def delete_custom_emoji(request: Request, emoji_id: int):
-    """Delete a custom emoji (and its stored file)."""
-    ws_id = _active_ws(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT url FROM custom_emojis WHERE id=? AND workspace_id=?",
-            (emoji_id, ws_id),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "emoji not found")
-        conn.execute("DELETE FROM custom_emojis WHERE id=?", (emoji_id,))
-        conn.commit()
-    try:
-        fname = (row["url"] or "").rsplit("/", 1)[-1]
-        if fname:
-            (_upload_root() / f"uploads/workspace_{ws_id}" / fname).unlink(missing_ok=True)
-    except OSError:
-        pass
-    return {"status": "ok", "id": emoji_id}
@@ -1,103 +0,0 @@
-"""FlowDeck — Export endpoints (v4.7.0).
-
-Routes /api/export/* — generate Markdown, HTML, PDF and static-site (zip)
-exports server-side for a given page.
-"""
-from __future__ import annotations
-
-import logging
-import re
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import Response
-
-from app.db import get_conn
-from app.services.export import (
-    build_static_site_bytes,
-    page_to_markdown,
-    page_to_pdf_bytes,
-    page_to_standalone_html,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["export"], prefix="/api/export")
-
-
-def _load_page_or_404(request: Request, page_id: int) -> dict:
-    """A16 : session obligatoire + `PermissionManager.can_view_page` — l'export ne
-    doit pas délivrer le contenu d'une page énumérable par id."""
-    from app.auth.session import SessionManager
-    from app.services.permission_manager import PermissionManager
-
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        raise HTTPException(status_code=404, detail="Page not found")
-    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
-        raise HTTPException(status_code=404, detail="Page not found")
-    return dict(row)
-
-
-def _download_header(filename: str, media_type: str) -> dict:
-    ascii_name = re.sub(r"[^\x00-\x7F]", "_", filename)
-    quoted = filename.replace('"', '')
-    return {
-        "Content-Disposition": f'attachment; filename="{ascii_name}"; filename*=UTF-8\'\'{quoted}',
-        "Cache-Control": "no-store",
-        "Content-Type": media_type,
-    }
-
-
-def _safe_filename(page: dict, ext: str) -> str:
-    title = (page.get("title") or "Untitled").strip() or "Untitled"
-    title = re.sub(r'[\\/:*?"<>|]+', "_", title)
-    return f"{title}.{ext}"
-
-
-@router.get("/markdown/{page_id}")
-def export_markdown(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    md = page_to_markdown(page)
-    filename = _safe_filename(page, "md")
-    headers = _download_header(filename, "text/markdown")
-    return Response(content=md.encode("utf-8"), status_code=200, headers=headers)
-
-
-@router.get("/html/{page_id}")
-def export_html(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    html = page_to_standalone_html(page)
-    filename = _safe_filename(page, "html")
-    headers = _download_header(filename, "text/html")
-    return Response(content=html.encode("utf-8"), status_code=200, headers=headers)
-
-
-@router.get("/pdf/{page_id}")
-def export_pdf(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    try:
-        pdf_bytes = page_to_pdf_bytes(page)
-    except ImportError:
-        raise HTTPException(status_code=501, detail="PDF export requires 'weasyprint' or 'xhtml2pdf'") from None
-    except Exception as exc:  # noqa: BLE001
-        logger.error("PDF export failed for page %s: %s", page_id, exc)
-        raise HTTPException(status_code=500, detail="PDF generation failed") from exc
-    filename = _safe_filename(page, "pdf")
-    headers = _download_header(filename, "application/pdf")
-    return Response(content=pdf_bytes, status_code=200, headers=headers)
-
-
-@router.get("/site/{page_id}")
-def export_site(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    site_bytes = build_static_site_bytes(page)
-    title = _safe_filename(page, "site").replace(".site", "") or "flowdeck-site"
-    filename = f"{title}_site.zip"
-    headers = _download_header(filename, "application/zip")
-    return Response(content=site_bytes, status_code=200, headers=headers)
@@ -1,5 +1,5 @@
 """FlowDeck — Gitea integration API routes."""
-from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException
 from fastapi.responses import JSONResponse

 router = APIRouter(tags=["gitea"], prefix="/api/gitea")
@@ -7,7 +7,7 @@ router = APIRouter(tags=["gitea"], prefix="/api/gitea")

 def _require_gitea(request: Request):
    """Return a per-user GiteaClient or raise 401.
-
+    
    Only returns a client if the user has personally connected their Gitea
    account (OAuth token). No fallback to admin token — each user must link
    their own Gitea account to see Gitea projects.
@@ -19,8 +19,16 @@ def _require_gitea(request: Request):
    return client


+def _require_user_gitea(request: Request):
+    """Return a per-user GiteaClient or raise 401 (required for write ops)."""
+    from app.services.gitea_client import get_user_gitea_client
+    client = get_user_gitea_client(request)
+    if not client:
+        raise HTTPException(status_code=401, detail="Gitea not connected. Go to Settings → Integrations or register with Gitea.")
+    return client


+# ── Orgs ──
@router.get("/orgs")
 async def list_orgs(request: Request):
    """List organizations the user belongs to."""
@@ -84,6 +92,7 @@ async def get_file(request: Request, owner: str, repo: str, path: str):
@router.put("/projects/{owner}/{repo}/file")
 async def save_file(request: Request, owner: str, repo: str):
    """Create or update a file in the repo."""
+    import json
    gitea = _require_gitea(request)  # admin token can write too
    try:
        body = await request.json()
@@ -131,6 +140,7 @@ async def upload_file(request: Request, owner: str, repo: str):
@router.delete("/projects/{owner}/{repo}/file")
 async def delete_file(request: Request, owner: str, repo: str):
    """Delete a file from the repo."""
+    import json
    gitea = _require_gitea(request)  # admin token can write too
    path = request.query_params.get("path", "")
    sha = request.query_params.get("sha", "")
@@ -152,8 +162,8 @@ async def get_labels(request: Request, owner: str, repo: str):
    try:
        labels = await gitea.get_labels(owner, repo)
        return {"labels": [
-            {"id": lbl["id"], "name": lbl["name"], "color": lbl.get("color", "#787774")}
-            for lbl in labels
+            {"id": l["id"], "name": l["name"], "color": l.get("color", "#787774")}
+            for l in labels
        ]}
    except Exception as e:
        return JSONResponse({"error": str(e)}, status_code=502)
@@ -162,7 +172,7 @@ async def get_labels(request: Request, owner: str, repo: str):
 # ── Account linking ──

@router.get("/status")
-def gitea_status(request: Request):
+async def gitea_status(request: Request):
    """Check if the current user has Gitea linked."""
    from app.services.gitea_client import get_user_gitea_client
    client = get_user_gitea_client(request)
@@ -170,7 +180,7 @@ def gitea_status(request: Request):


@router.delete("/disconnect")
-def disconnect_gitea(request: Request):
+async def disconnect_gitea(request: Request):
    """Remove all Gitea OAuth tokens for the current user."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -186,7 +196,7 @@ def disconnect_gitea(request: Request):
 # ── Private Pages (local FlowDeck pages linked to Gitea project) ──

@router.get("/projects/{owner}/{repo}/private-pages")
-def list_private_pages(owner: str, repo: str, request: Request):
+async def list_private_pages(owner: str, repo: str, request: Request):
    """List private pages for this Gitea project."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -202,14 +212,18 @@ def list_private_pages(owner: str, repo: str, request: Request):


@router.post("/projects/{owner}/{repo}/private-pages")
-def create_private_page(owner: str, repo: str, request: Request, body: dict = Body(default={})):
+async def create_private_page(owner: str, repo: str, request: Request):
    """Create a new private page for this Gitea project."""
-
    from app.auth.session import SessionManager
    from app.db import get_conn
+    import json
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    title = body.get("title", "Untitled").strip() or "Untitled"
    with get_conn() as conn:
        cursor = conn.execute(
@@ -221,7 +235,7 @@ def create_private_page(owner: str, repo: str, request: Request, body: dict = Bo


@router.get("/projects/{owner}/{repo}/private-pages/{page_id}")
-def get_private_page(owner: str, repo: str, page_id: int, request: Request):
+async def get_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Get a single private page."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -239,14 +253,18 @@ def get_private_page(owner: str, repo: str, page_id: int, request: Request):


@router.put("/projects/{owner}/{repo}/private-pages/{page_id}")
-def update_private_page(owner: str, repo: str, page_id: int, request: Request, body: dict = Body(default={})):
+async def update_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Update a private page."""
-
    from app.auth.session import SessionManager
    from app.db import get_conn
+    import json
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    title = body.get("title", "").strip()
    content = body.get("content", "")
    with get_conn() as conn:
@@ -264,7 +282,7 @@ def update_private_page(owner: str, repo: str, page_id: int, request: Request, b


@router.delete("/projects/{owner}/{repo}/private-pages/{page_id}")
-def delete_private_page(owner: str, repo: str, page_id: int, request: Request):
+async def delete_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Delete a private page."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -298,7 +316,7 @@ async def sync_labels(request: Request, owner: str, repo: str):
    """Sync Gitea labels to FlowDeck tags for the current user."""
    from app.auth.session import get_current_user as gcu
    from app.db import get_conn
-    user = gcu(request)
+    user = await gcu(request)
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
    gitea = _require_gitea(request)
@@ -311,8 +329,7 @@ async def sync_labels(request: Request, owner: str, repo: str):
        for label in labels:
            name = label.get("name", "")
            color = label.get("color", "#787774")
-            if not name:
-                continue
+            if not name: continue
            existing = conn.execute(
                "SELECT id FROM tags WHERE name=? AND user_id=?", (name, user["id"])
            ).fetchone()
@@ -6,7 +6,7 @@ router = APIRouter(tags=["github"], prefix="/api/github")


@router.get("/status")
-def github_status(request: Request):
+async def github_status(request: Request):
    """Check if the current user has GitHub linked."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -22,7 +22,7 @@ def github_status(request: Request):


@router.delete("/disconnect")
-def disconnect_github(request: Request):
+async def disconnect_github(request: Request):
    """Remove all GitHub OAuth tokens for the current user."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -1,90 +0,0 @@
-"""FlowDeck — agent governance API (v7.2.0): policies + approval queue."""
-from __future__ import annotations
-
-import json
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import agent_policies as policies
-from app.services.api_v2_helpers import audit_log
-
-router = APIRouter(tags=["governance"])
-
-
-def _owner_or_admin(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
-        is_admin = bool(row and row["is_admin"])
-        if not is_admin and request.query_params.get("workspace_id"):
-            member = conn.execute(
-                "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
-                (request.query_params.get("workspace_id"), user["id"])).fetchone()
-            owner = conn.execute("SELECT id FROM workspaces WHERE id=? AND owner_id=?",
-                                 (request.query_params.get("workspace_id"),
-                                  user["id"])).fetchone()
-            if not member and not owner:
-                raise HTTPException(403, "Workspace access required")
-            if member and member["role"] not in ("admin", "editor", "owner"):
-                raise HTTPException(403, "Editor role required")
-    user["is_admin"] = is_admin
-    return user
-
-
-@router.get("/api/v2/agent-policies")
-def list_policies(request: Request):
-    _owner_or_admin(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM agent_policies ORDER BY workspace_id").fetchall()
-    return {"policies": [dict(r) for r in rows]}
-
-
-@router.post("/api/v2/agent-policies")
-def upsert_policy(request: Request, body: dict = Body(default={})):
-    user = _owner_or_admin(request)
-    wid = body.get("workspace_id")
-    tools = body.get("allowed_tools")
-    if tools is not None and not isinstance(tools, list):
-        raise HTTPException(400, "allowed_tools must be a list or null")
-    with get_conn() as conn:
-        conn.execute(
-            """INSERT INTO agent_policies (workspace_id, allowed_tools_json, max_steps,
-                                           require_approval)
-               VALUES (?,?,?,?)
-               ON CONFLICT(workspace_id) DO UPDATE SET
-                 allowed_tools_json=excluded.allowed_tools_json,
-                 max_steps=excluded.max_steps, require_approval=excluded.require_approval""",
-            (wid, json.dumps(tools) if tools is not None else None,
-             max(1, min(int(body.get("max_steps") or 12), 50)),
-             1 if body.get("require_approval") else 0))
-        conn.commit()
-        row = conn.execute("SELECT * FROM agent_policies WHERE workspace_id IS ?",
-                           (wid,)).fetchone()
-    audit_log(user, "agent.policy.upsert", "workspace", wid or 0, "", request)
-    return JSONResponse(status_code=201, content=dict(row))
-
-
-@router.get("/api/v2/agent-approvals")
-def list_approvals(request: Request):
-    _owner_or_admin(request)
-    status = request.query_params.get("status", "pending")
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM agent_approvals WHERE status=? ORDER BY id DESC"
-                            " LIMIT 100", (status,)).fetchall()
-    return {"approvals": [dict(r) for r in rows]}
-
-
-@router.post("/api/v2/agent-approvals/{approval_id}/decide")
-def decide_approval(approval_id: int, request: Request, body: dict = Body(default={})):
-    user = _owner_or_admin(request)
-    out = policies.decide_approval(approval_id, user["id"], bool(body.get("approve")))
-    if out is None:
-        raise HTTPException(404, "Pending approval not found")
-    audit_log(user, "agent.approval.decide", "agent_approval", approval_id,
-              out["status"], request)
-    return out
@@ -1,378 +0,0 @@
-"""FlowDeck — unified import API (v5.6.0, Phase 0/1/2).
-
-Exposes the importer registry, a dry-run preview, a synchronous run and an
-optional background job with polling. Works with the existing workspace cookie
-(``flowdeck_workspace``) and session.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import HTMLResponse, RedirectResponse, Response
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event
-from app.services.importers import (
-    get_job,
-    list_jobs,
-    list_sources,
-    parse_upload,
-    preview_result,
-    resolve_relations,
-    run_import,
-    start_import_job,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/api/import", tags=["import"])
-page_router = APIRouter(tags=["import"])
-
-MAX_UPLOAD_BYTES = 200 * 1024 * 1024
-
-
-def _current_user(request: Request) -> dict:
-    return SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {}
-
-
-@page_router.get("/import", response_class=HTMLResponse)
-def import_page(request: Request):
-    """Standalone import wizard (source picker, dry-run, mapping, progress)."""
-    user = _current_user(request)
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    from app.templating import ENV
-
-    env = ENV
-    return HTMLResponse(content=env.get_template("import.html").render(user=user))
-
-
-def _workspace(request: Request) -> tuple[int | None, str]:
-    """Resolve (workspace_id, login) from the workspace cookie + session."""
-    ws_id: int | None = None
-    cookie = request.cookies.get("flowdeck_workspace", "")
-    try:
-        value = int(cookie)
-        if value > 0:
-            ws_id = value
-    except (ValueError, TypeError):
-        pass
-    user = _current_user(request)
-    login = user.get("login", "") if user else ""
-    return ws_id, login
-
-
-async def _read_upload(request: Request) -> tuple[str, bytes, str | None]:
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
-    data = await upload.read()
-    if len(data) > MAX_UPLOAD_BYTES:
-        raise HTTPException(413, "File too large (max 200 MB)")
-    source_id = form.get("source") or None
-    return filename, data, source_id
-
-
-@router.get("/sources")
-def import_sources(request: Request):
-    """List every available importer for the UI source picker."""
-    return {"sources": list_sources()}
-
-
-@router.post("/preview")
-async def import_preview(request: Request):
-    """Dry-run: parse the upload and describe what would be created."""
-    filename, data, source_id = await _read_upload(request)
-    imp, result = parse_upload(filename, data, source_id)
-    if imp is None:
-        raise HTTPException(400, "Format non reconnu — choisissez une source")
-    out = preview_result(result)
-    out["detected_source"] = imp.source_id
-    out["source_label"] = imp.label
-    return out
-
-
-@router.post("/run")
-async def import_run(request: Request):
-    """Import an upload (synchronously, or as a background job when async=true)."""
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
-    data = await upload.read()
-    if len(data) > MAX_UPLOAD_BYTES:
-        raise HTTPException(413, "File too large (max 200 MB)")
-
-    source_id = form.get("source") or None
-    parent_id = _int_or_none(form.get("parent_id"))
-    target = _int_or_none(form.get("target_collection_id"))
-    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
-    async_mode = str(form.get("async", "false")).lower() in ("true", "1", "yes")
-    mapping = _parse_mapping(form.get("mapping"))
-    mode = _parse_mode(form.get("mode"))
-    ws_id, login = _workspace(request)
-
-    if async_mode:
-        job = start_import_job(
-            filename=filename, data=data, source_id=source_id,
-            workspace_id=ws_id, workspace_name=login, user_login=login,
-            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-            mapping=mapping, mode=mode,
-        )
-        return {"status": "queued", "job_id": job["id"]}
-
-    imp, result = parse_upload(filename, data, source_id)
-    if imp is None:
-        raise HTTPException(400, "Format non reconnu — choisissez une source")
-    report = run_import(
-        result, workspace_id=ws_id, workspace_name=login, user_login=login,
-        parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-        mapping=mapping, mode=mode,
-    )
-    report["detected_source"] = imp.source_id
-    if imp.source_id == "notion":
-        with get_conn() as conn:
-            report["relations"] = resolve_relations(conn, ws_id)
-    for page_id in report.get("page_ids", [])[:100]:
-        try:
-            await fire_event("page.created", {"page_id": page_id, "title": "", "workspace": login})
-        except Exception:  # noqa: BLE001 - events are best-effort
-            pass
-    return report
-
-
-@router.post("/forge")
-async def import_forge(request: Request):
-    """Import a forge repo's issues (+ labels/milestones) into collections."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    provider = str(body.get("provider") or "gitea").lower()
-    owner = str(body.get("owner") or "").strip()
-    repo = str(body.get("repo") or "").strip()
-    if not owner or not repo:
-        raise HTTPException(400, "owner and repo are required")
-    state = str(body.get("state") or "all")
-    include_labels = bool(body.get("include_labels", True))
-    include_milestones = bool(body.get("include_milestones", True))
-    ws_id, login = _workspace(request)
-
-    if provider == "gitea":
-        from app.services.gitea_client import get_user_gitea_client
-        from app.services.importers.forge import GiteaForgeAdapter
-        client = get_user_gitea_client(request)
-        if client is None:
-            raise HTTPException(400, "Gitea non connecté")
-        adapter = GiteaForgeAdapter(client)
-    elif provider == "github":
-        from app.services.github_adapter import GitHubAdapter
-        token = _user_oauth_token(request, "github")
-        if not token:
-            raise HTTPException(400, "GitHub non connecté")
-        adapter = GitHubAdapter(token)
-    else:
-        raise HTTPException(400, "provider must be 'gitea' or 'github'")
-
-    from app.services.importers.forge import fetch_forge_issues
-    result = await fetch_forge_issues(
-        adapter, owner, repo, provider=provider, state=state,
-        include_labels=include_labels, include_milestones=include_milestones,
-    )
-    report = run_import(
-        result, workspace_id=ws_id, workspace_name=login, user_login=login,
-    )
-    report["detected_source"] = f"forge:{provider}"
-    return report
-
-
-@router.post("/forge-repo")
-async def import_forge_repo(request: Request):
-    """Import a forge repo's text files as pages (folder hierarchy preserved)."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    provider = str(body.get("provider") or "gitea").lower()
-    owner = str(body.get("owner") or "").strip()
-    repo = str(body.get("repo") or "").strip()
-    if not owner or not repo:
-        raise HTTPException(400, "owner and repo are required")
-    path = str(body.get("path") or "")
-    max_files = min(int(body.get("max_files") or 200), 1000)
-    ws_id, login = _workspace(request)
-
-    adapter = _forge_adapter(request, provider)
-
-    from app.services.importers.forge_repo import fetch_forge_repo
-    result = await fetch_forge_repo(
-        adapter, owner, repo, provider=provider, path=path, max_files=max_files,
-    )
-    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
-    report["detected_source"] = f"forge-repo:{provider}"
-    return report
-
-
-@router.post("/url")
-async def import_url(request: Request):
-    """Web clipper: fetch a URL and create a page (bookmark card + content)."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    url = str(body.get("url") or "").strip()
-    if not url:
-        raise HTTPException(400, "url is required")
-    ws_id, login = _workspace(request)
-
-    from app.services.importers.url_fetch import fetch_url_result
-    try:
-        result = await fetch_url_result(url)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    if not result.pages:
-        raise HTTPException(422, "; ".join(result.warnings) or "Page introuvable")
-    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
-    report["detected_source"] = "url"
-    return report
-
-
-@router.post("/run-batch")
-async def import_run_batch(request: Request):
-    """Import several uploaded files sequentially, returning one report each."""
-    form = await request.form()
-    uploads = form.getlist("file")
-    if not uploads:
-        raise HTTPException(400, "file field required")
-    source_id = form.get("source") or None
-    parent_id = _int_or_none(form.get("parent_id"))
-    target = _int_or_none(form.get("target_collection_id"))
-    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
-    mode = _parse_mode(form.get("mode"))
-    mapping = _parse_mapping(form.get("mapping"))
-    ws_id, login = _workspace(request)
-
-    results: list[dict] = []
-    summary = {"files": 0, "pages_created": 0, "rows_created": 0, "errors": 0}
-    for upload in uploads:
-        filename = (getattr(upload, "filename", "") or "import").replace("\\", "/").rsplit("/", 1)[-1]
-        data = await upload.read()
-        if len(data) > MAX_UPLOAD_BYTES:
-            results.append({"filename": filename, "report": {"status": "error",
-                            "errors": [{"title": filename, "error": "File too large"}]}})
-            summary["errors"] += 1
-            continue
-        imp, result = parse_upload(filename, data, source_id)
-        if imp is None:
-            results.append({"filename": filename, "report": {"status": "error",
-                            "errors": [{"title": filename, "error": "Format non reconnu"}]}})
-            summary["errors"] += 1
-            continue
-        report = run_import(
-            result, workspace_id=ws_id, workspace_name=login, user_login=login,
-            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-            mapping=mapping, mode=mode,
-        )
-        report["detected_source"] = imp.source_id
-        results.append({"filename": filename, "report": report})
-        summary["files"] += 1
-        summary["pages_created"] += report.get("pages_created", 0)
-        summary["rows_created"] += report.get("rows_created", 0)
-        summary["errors"] += len(report.get("errors", []))
-    return {"status": "ok", "summary": summary, "results": results}
-
-
-@router.post("/relations/resolve")
-def import_resolve_relations(request: Request):
-    """Convert text columns referencing another collection into relation props."""
-    ws_id, _ = _workspace(request)
-    with get_conn() as conn:
-        return resolve_relations(conn, ws_id)
-
-
-@router.get("/jobs")
-def import_jobs(request: Request):
-    return {"jobs": list_jobs()}
-
-
-@router.get("/jobs/{job_id}")
-def import_job(job_id: str):
-    job = get_job(job_id)
-    if not job:
-        raise HTTPException(404, "Job not found")
-    return job
-
-
-@router.get("/jobs/{job_id}/report")
-def import_job_report(job_id: str):
-    """Download a job's import report as JSON."""
-    job = get_job(job_id)
-    if not job:
-        raise HTTPException(404, "Job not found")
-    payload = json.dumps(job.get("report") or {}, ensure_ascii=False, indent=2)
-    return Response(
-        content=payload,
-        media_type="application/json",
-        headers={"Content-Disposition": f'attachment; filename="import-{job_id}.json"'},
-    )
-
-
-def _forge_adapter(request: Request, provider: str):
-    if provider == "gitea":
-        from app.services.gitea_client import get_user_gitea_client
-        from app.services.importers.forge import GiteaForgeAdapter
-        client = get_user_gitea_client(request)
-        if client is None:
-            raise HTTPException(400, "Gitea non connecté")
-        return GiteaForgeAdapter(client)
-    if provider == "github":
-        from app.services.github_adapter import GitHubAdapter
-        token = _user_oauth_token(request, "github")
-        if not token:
-            raise HTTPException(400, "GitHub non connecté")
-        return GitHubAdapter(token)
-    raise HTTPException(400, "provider must be 'gitea' or 'github'")
-
-
-def _int_or_none(value) -> int | None:
-    try:
-        ivalue = int(value)
-        return ivalue if ivalue > 0 else None
-    except (ValueError, TypeError):
-        return None
-
-
-def _parse_mapping(value) -> dict[str, str] | None:
-    if not value:
-        return None
-    try:
-        parsed = json.loads(value)
-    except (ValueError, TypeError):
-        return None
-    if isinstance(parsed, dict):
-        return {str(k): str(v) for k, v in parsed.items() if v}
-    return None
-
-
-def _parse_mode(value) -> str | None:
-    mode = str(value or "").strip().lower()
-    return mode if mode in ("skip", "update", "duplicate") else None
-
-
-def _user_oauth_token(request: Request, provider: str) -> str:
-    user = _current_user(request)
-    if not user or not user.get("id"):
-        return ""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider=? "
-            "ORDER BY updated_at DESC LIMIT 1",
-            (user["id"], provider),
-        ).fetchone()
-    return row["access_token"] if row else ""
@@ -3,10 +3,11 @@ from __future__ import annotations

 import logging

-from fastapi import APIRouter, Query, Request
+from fastapi import APIRouter, Request, Query
+from fastapi.responses import JSONResponse

-from app.auth.session import SessionManager
 from app.db import get_conn
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["library"], prefix="/api/library")
@@ -59,12 +60,9 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
    elif content_format == "file":
        icon = "📄"
        fn = title.lower()
-        if fn.endswith(".pdf"):
-            icon = "📕"
-        elif any(fn.endswith(e) for e in [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]):
-            icon = "🖼️"
-        elif any(fn.endswith(e) for e in [".py", ".js", ".ts", ".go", ".rs"]):
-            icon = "📜"
+        if fn.endswith(".pdf"): icon = "📕"
+        elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+        elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
    else:
        icon = "📝"

@@ -72,7 +70,6 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
        "id": page_id,
        "title": title,
        "icon": icon,
-        "page_icon": db_row.get("page_icon") or "",
        "is_folder": bool(db_row.get("is_folder", 0)),
        "source_type": source_type,
        "source_label": _source_label(source_type, workspace),
@@ -87,8 +84,6 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
        "url": url,
        "content_format": content_format,
        "favorited": bool(db_row.get("favorited", 0)),
-        "share_mode": db_row.get("share_mode", "private"),
-        "tags": [],
    }


@@ -103,30 +98,7 @@ def _apply_source_filter(query: str, params: list, source_type: str) -> tuple[st


 def _rows_to_items(rows, uid: int = 1) -> list:
-    items = [_build_item(dict(r), uid) for r in rows]
-    return _attach_tags(items)
-
-
-def _attach_tags(items: list) -> list:
-    """Batch-load page tags for library items."""
-    if not items:
-        return items
-    ids = [it["id"] for it in items]
-    placeholders = ",".join("?" for _ in ids)
-    with get_conn() as conn:
-        rows = conn.execute(
-            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
-            f"JOIN tags t ON t.id = pt.tag_id WHERE pt.page_id IN ({placeholders})",
-            ids,
-        ).fetchall()
-    tag_map: dict = {}
-    for r in rows:
-        tag_map.setdefault(r["page_id"], []).append({
-            "id": r["id"], "name": r["name"], "color": r["color"],
-        })
-    for it in items:
-        it["tags"] = tag_map.get(it["id"], [])
-    return items
+    return [_build_item(dict(r), uid) for r in rows]


 def _enrich_children(items: list) -> list:
@@ -152,12 +124,12 @@ def _enrich_children(items: list) -> list:

 BASE_SELECT = (
    "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
-    "p.parent_id, p.share_mode, p.parent_section, p.page_icon"
+    "p.parent_id, p.share_mode, p.parent_section"
 )


@router.get("/recents")
-def library_recents(
+async def library_recents(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -191,7 +163,7 @@ def library_recents(


@router.get("/favorites")
-def library_favorites(
+async def library_favorites(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -201,10 +173,10 @@ def library_favorites(

    uid = _get_user_id(request)
    query = (
-        "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
-        "p.parent_id, p.share_mode, p.parent_section, 1 as favorited "
-        "FROM favorites f JOIN pages p ON p.id = f.page_id "
-        "WHERE f.user_id = ? AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+        f"SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
+        f"p.parent_id, p.share_mode, p.parent_section, 1 as favorited "
+        f"FROM favorites f JOIN pages p ON p.id = f.page_id "
+        f"WHERE f.user_id = ? AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
    )
    params: list = [uid]
    if tree:
@@ -221,58 +193,17 @@ def library_favorites(


@router.get("/shared")
-def library_shared(
+async def library_shared(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
-    dir: str = Query(default="all"),
 ):
    if source_type not in SOURCE_TYPES:
        source_type = "all"
-    if dir not in ("made", "received", "all"):
-        dir = "all"

    uid = _get_user_id(request)
-
-    # Page ids the user shares toward others (nominal page_shares) or receives
-    # (direct shares + group shares via group_members)
-    with get_conn() as conn:
-        made_rows = conn.execute(
-            "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.created_by=?",
-            (uid,),
-        ).fetchall()
-        try:
-            recv_rows = conn.execute(
-                """SELECT DISTINCT s.page_id FROM page_shares s
-                   LEFT JOIN group_members gm ON gm.group_id = s.shared_with_group_id AND gm.user_id=?
-                   WHERE s.shared_with_user_id=? OR gm.user_id=?""",
-                (uid, uid, uid),
-            ).fetchall()
-        except Exception:
-            recv_rows = conn.execute(
-                "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.shared_with_user_id=?",
-                (uid,),
-            ).fetchall()
-    made_ids = {r[0] for r in made_rows}
-    recv_ids = {r[0] for r in recv_rows}
-
-    conds: list[str] = []
+    query = f"{BASE_SELECT} FROM pages p WHERE p.share_mode != 'private' AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
    params: list = []
-    if dir in ("all", "made"):
-        conds.append("p.share_mode != 'private'")
-    if dir in ("all", "made") and made_ids:
-        conds.append(f"p.id IN ({','.join('?' for _ in made_ids)})")
-        params.extend(made_ids)
-    if dir in ("all", "received") and recv_ids:
-        conds.append(f"p.id IN ({','.join('?' for _ in recv_ids)})")
-        params.extend(recv_ids)
-    if dir == "received" and not recv_ids:
-        return {"items": []}
-
-    query = (
-        f"{BASE_SELECT} FROM pages p "
-        f"WHERE ({' OR '.join(conds)}) AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
-    )
    if tree:
        query += " AND p.parent_id IS NULL"
    query, params = _apply_source_filter(query, params, source_type)
@@ -282,17 +213,12 @@ def library_shared(
        rows = conn.execute(query, params).fetchall()

    items = _rows_to_items(rows, uid)
-    for it in items:
-        sid = it["id"]
-        is_made = sid in made_ids or it.get("share_mode", "private") != "private"
-        is_recv = sid in recv_ids
-        it["share_dir"] = "both" if (is_made and is_recv) else ("made" if is_made else ("received" if is_recv else ""))
    _enrich_children(items)
    return {"items": items}


@router.get("/published")
-def library_published(
+async def library_published(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -317,7 +243,7 @@ def library_published(


@router.get("/private")
-def library_private(
+async def library_private(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -341,8 +267,71 @@ def library_private(
    return {"items": items}


+@router.get("/local-workspace-children/{item_id:int}")
+async def library_local_workspace_children(item_id: int, request: Request):
+    """Return children of a local workspace item for tree expansion."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        # Get the item to find its workspace
+        item = conn.execute(
+            "SELECT workspace_id FROM local_workspace_items WHERE id=? AND deleted_at IS NULL",
+            [item_id],
+        ).fetchone()
+        if not item:
+            return {"items": []}
+
+        rows = conn.execute(
+            "SELECT id, name, is_folder, parent_id, content_format, size, "
+            "COALESCE(updated_at, created_at) as updated_at "
+            "FROM local_workspace_items "
+            "WHERE parent_id = ? AND deleted_at IS NULL "
+            "ORDER BY is_folder DESC, name COLLATE NOCASE",
+            [item_id],
+        ).fetchall()
+
+    items = []
+    for r in rows:
+        name = r["name"] or "Untitled"
+        is_folder = bool(r["is_folder"])
+        icon = "📁" if is_folder else "📄"
+        fn = name.lower()
+        if not is_folder:
+            if fn.endswith(".pdf"): icon = "📕"
+            elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+            elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
+
+        with get_conn() as conn:
+            child_count = conn.execute(
+                "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
+                [r["id"]],
+            ).fetchone()[0]
+
+        items.append({
+            "id": r["id"],
+            "title": name,
+            "icon": icon,
+            "is_folder": is_folder,
+            "source_type": "local-ws",
+            "source_label": "",
+            "workspace": "",
+            "workspace_name": "",
+            "author": "",
+            "author_initial": "?",
+            "updated_at": r["updated_at"] or "",
+            "visited_at": "",
+            "has_children": child_count > 0,
+            "children": [],
+            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
+            "content_format": r["content_format"] or "file",
+            "favorited": False,
+            "size_display": _format_size(r["size"]) if r["size"] else "",
+        })
+
+    return {"items": items}
+
+
@router.get("/children/{page_id:int}")
-def library_children(page_id: int, request: Request):
+async def library_children(page_id: int, request: Request):
    """Return child pages for a given parent page (for tree expansion in Library)."""
    uid = _get_user_id(request)
    with get_conn() as conn:
@@ -358,7 +347,7 @@ def library_children(page_id: int, request: Request):


@router.get("/repository")
-def library_repository(
+async def library_repository(
    request: Request,
    gitea_owner: str = Query(default=""),
    gitea_repo: str = Query(default=""),
@@ -381,8 +370,84 @@ def library_repository(
    return {"items": items}


+@router.get("/local-workspace")
+async def library_local_workspace(
+    request: Request,
+    workspace_id: int = Query(default=0),
+):
+    """Return local workspace items (files/folders) formatted for Library display."""
+    from app.routers.dashboard import _get_active_workspace
+    uid = _get_user_id(request)
+
+    # Get the active workspace
+    ws = _get_active_workspace(request, user_id=uid)
+    if not ws:
+        return {"items": []}
+
+    ws_id = workspace_id or ws["id"]
+
+    # Query local workspace tree
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, name, is_folder, parent_id, content_format, size, "
+            "COALESCE(updated_at, created_at) as updated_at "
+            "FROM local_workspace_items "
+            "WHERE workspace_id = ? AND deleted_at IS NULL "
+            "ORDER BY is_folder DESC, name COLLATE NOCASE",
+            [ws_id],
+        ).fetchall()
+
+    items = []
+    for r in rows:
+        name = r["name"] or "Untitled"
+        is_folder = bool(r["is_folder"])
+        icon = "📁" if is_folder else "📄"
+        fn = name.lower()
+        if not is_folder:
+            if fn.endswith(".pdf"): icon = "📕"
+            elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+            elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
+
+        # Check for children
+        child_count = conn.execute(
+            "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
+            [r["id"]],
+        ).fetchone()[0]
+
+        items.append({
+            "id": r["id"],
+            "title": name,
+            "icon": icon,
+            "is_folder": is_folder,
+            "source_type": "local-ws",
+            "source_label": ws.get("name", "Workspace"),
+            "workspace": ws.get("name", ""),
+            "workspace_name": ws.get("name", ""),
+            "author": "",
+            "author_initial": "?",
+            "updated_at": r["updated_at"] or "",
+            "visited_at": "",
+            "has_children": child_count > 0,
+            "children": [],
+            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
+            "content_format": r["content_format"] or "file",
+            "favorited": False,
+            "size_display": _format_size(r["size"]) if r["size"] else "",
+        })
+
+    return {"items": items}
+
+
+def _format_size(size_bytes):
+    if not size_bytes: return ""
+    if size_bytes < 1024: return f"{size_bytes} B"
+    if size_bytes < 1048576: return f"{size_bytes/1024:.1f} KB"
+    if size_bytes < 1073741824: return f"{size_bytes/1048576:.1f} MB"
+    return f"{size_bytes/1073741824:.1f} GB"
+
+
@router.get("/workspace")
-def library_workspace(
+async def library_workspace(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -1,198 +0,0 @@
-"""FlowDeck — Calendar links + Meetings API (v7.1.0).
-
-``/api/v2/calendar-links*`` — Google/CalDAV link CRUD (session or Bearer
-``write``), manual sync trigger. ``GET /db/{id}/calendar/freebusy`` —
-weekday availability. ``/api/v2/meetings/*`` — audio upload, manual
-transcript, AI summary (fires ``meeting.summarized``).
-
-See ``docs/V71_Calendar_Meetings.md``.
-"""
-from __future__ import annotations
-
-import secrets
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import calendar_sync as cal
-from app.services import meetings as meet
-from app.services.api_v2_helpers import (
-    audit_log,
-    has_scope,
-    resolve_bearer_token,
-    row_to_dict,
-)
-
-router = APIRouter(tags=["calendar-meetings"])
-
-
-def _auth_user(request: Request, *, require_write: bool = False) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        return sess
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if not user:
-            raise HTTPException(401, "Invalid or expired API token")
-        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
-            raise HTTPException(403, "Insufficient scope. Required: write")
-        return user
-    raise HTTPException(401, "Authentication required")
-
-
-# ── calendar links ─────────────────────────────────────────────────────────
-
-@router.post("/api/v2/calendar-links")
-def create_link(request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    provider = (body.get("provider") or "").lower()
-    if provider not in cal.PROVIDERS:
-        raise HTTPException(400, "provider must be google|caldav")
-    try:
-        collection_id = int(body.get("collection_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(400, "collection_id required") from None
-    creds = body.get("credentials") or {}
-    if provider == "google" and not creds.get("access_token"):
-        raise HTTPException(400, "google needs credentials.access_token")
-    if provider == "caldav" and not creds.get("url"):
-        raise HTTPException(400, "caldav needs credentials.url")
-    try:
-        out = cal.save_link(user["id"], provider, collection_id, creds,
-                            body.get("calendar_id") or "primary",
-                            body.get("date_property") or "")
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    audit_log(user, "calendar.link", "collection", collection_id, provider, request)
-    return JSONResponse(status_code=201, content=out)
-
-
-@router.get("/api/v2/calendar-links")
-def get_links(request: Request):
-    user = _auth_user(request)
-    return {"links": cal.list_links(user["id"])}
-
-
-@router.delete("/api/v2/calendar-links/{link_id}")
-def remove_link(link_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    if not cal.delete_link(user["id"], link_id):
-        raise HTTPException(404, "Link not found")
-    audit_log(user, "calendar.unlink", "calendar_link", link_id, "", request)
-    return {"status": "deleted", "id": link_id}
-
-
-@router.post("/api/v2/calendar-links/{link_id}/sync")
-async def sync_now(link_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM calendar_links WHERE id=?", (link_id,)).fetchone()
-    if not row or (row["user_id"] != user["id"] and not user.get("is_admin")):
-        raise HTTPException(404, "Link not found")
-    try:
-        stats = await cal.sync_link(link_id)
-    except (cal.SyncError, ValueError) as exc:
-        raise HTTPException(502 if isinstance(exc, cal.SyncError) else 400,
-                            str(exc)) from None
-    audit_log(user, "calendar.sync", "calendar_link", link_id, str(stats), request)
-    return {"link_id": link_id, **stats}
-
-
-# ── free/busy ──────────────────────────────────────────────────────────────
-
-@router.get("/db/{collection_id}/calendar/freebusy")
-def freebusy(collection_id: int, request: Request):
-    _auth_user(request)
-    qp = request.query_params
-    try:
-        out = cal.freebusy(collection_id, qp.get("from", ""), qp.get("to", ""),
-                           qp.get("date_property", ""))
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    return out
-
-
-# ── meetings ───────────────────────────────────────────────────────────────
-
-@router.post("/api/v2/meetings/transcribe")
-async def upload_and_transcribe(request: Request):
-    user = _auth_user(request, require_write=True)
-    try:
-        form = await request.form()
-    except Exception:
-        raise HTTPException(400, "multipart upload required") from None
-    upload = form.get("audio")
-    try:
-        page_id = int(form.get("page_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(400, "page_id required") from None
-    language = (form.get("language") or "fr")[:10]
-    manual = (form.get("transcript") or "").strip()
-    if upload is None and not manual:
-        raise HTTPException(400, "audio file or transcript required")
-    audio_path = ""
-    if upload is not None:
-        filename = (upload.filename or "").lower()
-        ext = filename.rsplit(".", 1)[-1] if "." in filename else ""
-        if ext not in meet.AUDIO_EXTENSIONS:
-            raise HTTPException(400, f"audio must be one of {sorted(meet.AUDIO_EXTENSIONS)}")
-        data = await upload.read()
-        if len(data) > meet.MAX_AUDIO_BYTES:
-            raise HTTPException(413, "audio exceeds 100 MB")
-        if not data:
-            raise HTTPException(400, "empty audio file")
-        audio_path = str(meet.meetings_dir()
-                         / f"{page_id}_{secrets.token_hex(8)}.{ext}")
-        with open(audio_path, "wb") as fh:
-            fh.write(data)
-    transcript = manual
-    if not transcript and audio_path:
-        try:
-            transcript = meet.transcribe_audio(audio_path, language)
-        except meet.TranscriptionUnavailable as exc:
-            transcript = ""  # stored; client transcribes or posts manual text later
-            _ = exc
-    try:
-        tid = meet.save_transcript(page_id, transcript, language, audio_path)
-    except ValueError as exc:
-        raise HTTPException(404, str(exc)) from None
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?", (tid,)).fetchone()
-    audit_log(user, "meeting.transcribe", "page", page_id, f"transcript={tid}", request)
-    return JSONResponse(status_code=201, content={
-        **row_to_dict(row), "transcribed": bool(transcript)})
-
-
-@router.post("/api/v2/meetings/transcripts/{transcript_id}/text")
-def set_transcript_text(transcript_id: int, request: Request, body: dict = Body(default={})):
-    """Store a client-side (manual) transcript on an existing row."""
-    _auth_user(request, require_write=True)
-    text = (body.get("transcript") or "").strip()
-    if not text:
-        raise HTTPException(400, "transcript required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM meeting_transcripts WHERE id=?",
-                            (transcript_id,)).fetchone():
-            raise HTTPException(404, "Transcript not found")
-        conn.execute("UPDATE meeting_transcripts SET transcript=? WHERE id=?",
-                     (text, transcript_id))
-        conn.commit()
-        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?",
-                           (transcript_id,)).fetchone()
-    return row_to_dict(row)
-
-
-@router.post("/api/v2/meetings/transcripts/{transcript_id}/summarize")
-async def summarize(transcript_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    try:
-        out = await meet.summarize_transcript(transcript_id, user.get("id"))
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    except RuntimeError as exc:
-        raise HTTPException(502, str(exc)) from None
-    audit_log(user, "meeting.summarize", "transcript", transcript_id, "", request)
-    return out
@@ -4,12 +4,12 @@ from __future__ import annotations
 import json
 import logging

-from fastapi import APIRouter, Request
+from fastapi import APIRouter, Request, HTTPException, Query
 from fastapi.responses import HTMLResponse
+from jinja2 import Environment, FileSystemLoader

-from app.auth.session import SessionManager
 from app.db import get_conn
-from app.templating import ENV
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["my-tasks"], prefix="/my-tasks")
@@ -21,7 +21,7 @@ def _get_current_user(request: Request) -> dict | None:


@router.get("", response_class=HTMLResponse)
-def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
+async def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
    """My Tasks — aggregates all pages assigned to the current user across all collections."""
    user = _get_current_user(request)
    user_login = user.get("login", "admin") if user else "admin"
@@ -102,7 +102,7 @@ def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
 </div>"""

    from app.routers.dashboard import _sidebar_data
-    env = ENV
+    env = Environment(loader=FileSystemLoader("app/templates"))
    sidebar = _sidebar_data(request, [])
    block_tpl = env.from_string(
        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
@@ -118,10 +118,10 @@ def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):


@router.get("/api")
-def my_tasks_api(request: Request, view: str = "all", days: int = 7):
+async def my_tasks_api(request: Request, view: str = "all", days: int = 7):
    """API: return my tasks as JSON."""
    user = _get_current_user(request)
-    user.get("login", "admin") if user else "admin"
+    user_login = user.get("login", "admin") if user else "admin"

    with get_conn() as conn:
        collections = conn.execute("SELECT * FROM collections ORDER BY name").fetchall()
@@ -13,7 +13,7 @@ router = APIRouter(tags=["notes"], prefix="/notes")


@router.get("/{owner}/{repo}", response_class=HTMLResponse)
-def get_notes(request: Request, owner: str, repo: str):
+async def get_notes(request: Request, owner: str, repo: str):
    with get_conn() as conn:
        row = conn.execute(
            "SELECT content FROM notes WHERE project_owner=? AND project_name=? AND title='Notes'",
@@ -21,9 +21,9 @@ def get_notes(request: Request, owner: str, repo: str):
        ).fetchone()
    content = row["content"] if row else ""

+    from jinja2 import Environment, FileSystemLoader
    from app.auth.session import SessionManager
-    from app.templating import ENV
-    env = ENV
+    env = Environment(loader=FileSystemLoader("app/templates"))
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    template = env.get_template("notes.html")
    return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
@@ -44,9 +44,9 @@ async def save_notes(request: Request, owner: str, repo: str):
        )
        conn.commit()

+    from jinja2 import Environment, FileSystemLoader
    from app.auth.session import SessionManager
-    from app.templating import ENV
-    env = ENV
+    env = Environment(loader=FileSystemLoader("app/templates"))
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    template = env.get_template("notes.html")
    return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
@@ -1,149 +0,0 @@
-"""FlowDeck — Notifications API (v4.9.0 collaboration)."""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["notifications"], prefix="/api/notifications")
-
-
-def _current_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-@router.get("")
-def list_notifications(request: Request, limit: int = 50):
-    """List the current user's notifications, newest first."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT n.*, a.login AS actor_login, a.full_name AS actor_name,
-                      a.avatar_url AS actor_avatar, a.avatar_color AS actor_color
-               FROM notifications n
-               LEFT JOIN users a ON n.actor_id = a.id
-               WHERE n.user_id=?
-               ORDER BY n.created_at DESC, n.id DESC LIMIT ?""",
-            (user["id"], limit),
-        ).fetchall()
-        unread = conn.execute(
-            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
-            (user["id"],),
-        ).fetchone()["c"]
-    return {
-        "notifications": [dict(r) for r in rows],
-        "unread": unread,
-    }
-
-
-@router.get("/unread-count")
-def unread_count(request: Request):
-    """Unread count for the topbar badge."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        c = conn.execute(
-            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
-            (user["id"],),
-        ).fetchone()["c"]
-    return {"unread": c}
-
-
-@router.post("/read")
-def mark_read(request: Request, body: dict = Body(default={})):
-    """Mark one notification as read (id) or all (id omitted)."""
-    user = _current_user(request)
-    nid = body.get("id")
-    with get_conn() as conn:
-        if nid:
-            conn.execute(
-                "UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?",
-                (nid, user["id"]),
-            )
-        else:
-            conn.execute(
-                "UPDATE notifications SET is_read=1 WHERE user_id=?",
-                (user["id"],),
-            )
-        conn.commit()
-    return {"status": "ok"}
-
-
-@router.post("/read-all")
-async def mark_all_read(request: Request):
-    """Mark all notifications as read."""
-    return await mark_read(request)
-
-
-@router.get("/prefs")
-def get_prefs(request: Request):
-    """Return the current user's notification email preferences."""
-    user = _current_user(request)
-    from app.services import notifications as notif
-    return {"prefs": notif.get_user_prefs(user["id"])}
-
-
-@router.post("/prefs")
-def set_prefs(request: Request, body: dict = Body(default={})):
-    """Update the current user's notification email preferences."""
-    user = _current_user(request)
-    from app.services import notifications as notif
-    prefs = notif.get_user_prefs(user["id"])
-    for key in ("comments", "mentions", "reminders", "assignments"):
-        if key in body:
-            prefs[key] = bool(body[key])
-    notif.set_user_prefs(user["id"], prefs)
-    return {"status": "ok", "prefs": prefs}
-
-
-@router.get("/timezone")
-def get_timezone(request: Request):
-    """Return the current user's IANA timezone ('' = UTC)."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT timezone FROM users WHERE id=?", (user["id"],)).fetchone()
-    tz = (row["timezone"] if row and "timezone" in row.keys() else "") or ""
-    from app.services.recurrence import common_timezones
-    return {"timezone": tz, "zones": common_timezones()}
-
-
-@router.post("/timezone")
-def set_timezone(request: Request, body: dict = Body(default={})):
-    """Update the current user's IANA timezone (empty string = UTC)."""
-    user = _current_user(request)
-    tz = (body.get("timezone") or "").strip()
-    from app.services.recurrence import is_valid_timezone
-    if tz and not is_valid_timezone(tz):
-        raise HTTPException(status_code=400, detail=f"Unknown timezone '{tz}'")
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET timezone=? WHERE id=?", (tz, user["id"]))
-        conn.commit()
-    return {"status": "ok", "timezone": tz}
-
-
-@router.get("/users/search")
-def search_users(request: Request, q: str = ""):
-    """User autocomplete for @mentions."""
-    _current_user(request)
-    q = (q or "").strip()
-    with get_conn() as conn:
-        if q:
-            like = f"%{q}%"
-            rows = conn.execute(
-                """SELECT id, login, full_name, avatar_url, avatar_color
-                   FROM users WHERE login LIKE ? OR full_name LIKE ?
-                   ORDER BY (login=? OR full_name=?) DESC, login LIMIT 20""",
-                (like, like, q, q),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                """SELECT id, login, full_name, avatar_url, avatar_color
-                   FROM users ORDER BY login LIMIT 20"""
-            ).fetchall()
-    return {"users": [dict(r) for r in rows]}
@@ -1,127 +0,0 @@
-"""FlowDeck — v5.2.0 Onboarding: /welcome wizard + its API.
-
-First-launch experience: create workspace → connect a forge (optional) →
-create the first project (welcome page), then land in the app.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["onboarding"])
-
-WORKSPACE_COOKIE = "flowdeck_workspace"
-
-
-def _require_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Not authenticated")
-    return user
-
-
-@router.get("/welcome", response_class=HTMLResponse)
-def onboarding_page(request: Request):
-    """Onboarding wizard. Redirects logged-out users to login and users who
-    already have a workspace straight to the app."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    with get_conn() as conn:
-        ws_count = conn.execute(
-            "SELECT COUNT(*) FROM workspaces WHERE owner_id=?", (user["id"],)
-        ).fetchone()[0]
-    if ws_count > 0:
-        return RedirectResponse("/workspaces", status_code=302)
-
-    from app.templating import ENV
-    env = ENV
-    template = env.get_template("welcome.html")
-    return HTMLResponse(content=template.render(
-        user=user,
-        gitea_url_configured=_forge_configured("gitea"),
-        github_url_configured=_forge_configured("github"),
-    ))
-
-
-def _forge_configured(provider: str) -> bool:
-    try:
-        from app.auth.providers import get_provider
-        return get_provider(provider) is not None
-    except Exception:
-        return False
-
-
-# ═══════════ Onboarding API ═══════════
-
-
-@router.post("/api/onboarding/workspace")
-def onboarding_create_workspace(request: Request, body: dict = Body(default={})):
-    """Step 1 — create the first local workspace."""
-    user = _require_user(request)
-    name = (body.get("name") or "").strip() or "My Workspace"
-
-    with get_conn() as conn:
-        cur = conn.execute(
-            "INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, '{}')",
-            (name, user["id"]),
-        )
-        conn.execute(
-            "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')",
-            (cur.lastrowid, user["id"]),
-        )
-        conn.commit()
-        ws_id = cur.lastrowid
-
-    response = JSONResponse({"status": "ok", "id": ws_id, "name": name})
-    response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
-    return response
-
-
-@router.post("/api/onboarding/project")
-def onboarding_create_project(request: Request, body: dict = Body(default={})):
-    """Step 3 — create the first project: a welcome page in the workspace."""
-    user = _require_user(request)
-    title = (body.get("title") or "").strip() or "Welcome to FlowDeck"
-    workspace_id = body.get("workspace_id")
-
-    with get_conn() as conn:
-        ws = None
-        if workspace_id:
-            ws = conn.execute(
-                "SELECT id FROM workspaces WHERE id=? AND owner_id=?",
-                (workspace_id, user["id"]),
-            ).fetchone()
-        if not ws:
-            ws = conn.execute(
-                "SELECT id FROM workspaces WHERE owner_id=? ORDER BY id LIMIT 1",
-                (user["id"],),
-            ).fetchone()
-        if not ws:
-            raise HTTPException(status_code=400, detail="Create a workspace first")
-
-        blocks = [
-            {"id": "1", "type": "heading_1", "content": title},
-            {"id": "2", "type": "paragraph",
-             "content": "Welcome to FlowDeck 🎉 — your workspace is ready."},
-            {"id": "3", "type": "paragraph",
-             "content": "Use the slash command « / » in any page to add blocks, databases, to-dos and more."},
-            {"id": "4", "type": "paragraph",
-             "content": "Connect Gitea or GitHub in Settings → Integrations to sync your repositories."},
-        ]
-        cur = conn.execute(
-            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section) "
-            "VALUES (?, ?, ?, ?, 'blocks', 'Private')",
-            (user.get("login", "local"), ws["id"], title, json.dumps(blocks)),
-        )
-        conn.commit()
-        page_id = cur.lastrowid
-
-    return {"status": "ok", "id": page_id, "title": title, "workspace_id": ws["id"]}
@@ -1,518 +0,0 @@
-"""FlowDeck — v6.0.0 Granular permissions API (page/collection/property ACL).
-
-Backend for the page-editor "Permissions" panel, database property visibility
-and user-group management. Grants are stored in ``page_permissions`` /
-``collection_permissions`` / ``property_permissions``; every mutation is logged
-into ``permission_audit_log`` for the admin audit view.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.permission_manager import PermissionManager
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["permissions"], prefix="/api/v2")
-
-
-PAGE_ROLES = ("viewer", "commenter", "editor", "owner")
-COLLECTION_ROLES = ("viewer", "commenter", "editor", "owner")
-PROPERTY_ROLES = ("viewer", "editor")
-PERMISSION_TYPES = ("inherit", "restricted", "private")
-
-
-def _require_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Not authenticated")
-    return user
-
-
-def _pm(request: Request) -> PermissionManager:
-    return PermissionManager(_require_user(request)["id"])
-
-
-def _client_ip(request: Request) -> str:
-    try:
-        return request.client.host if request.client else ""
-    except Exception:
-        return ""
-
-
-def _perm_list(conn, table: str, fk: str, resource_id: int) -> list[dict]:
-    rows = conn.execute(
-        f"""SELECT p.*,
-                   u.login AS user_login, u.full_name AS user_name,
-                   g.name AS group_name
-              FROM {table} p
-              LEFT JOIN users u ON u.id = p.user_id
-              LEFT JOIN user_groups g ON g.id = p.group_id
-             WHERE p.{fk}=? ORDER BY p.id""",
-        (resource_id,),
-    ).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        if d.get("user_id"):
-            d["name"] = d["user_name"] or d["user_login"] or f"User #{d['user_id']}"
-            d["kind"] = "user"
-        else:
-            d["name"] = d["group_name"] or f"Group #{d['group_id']}"
-            d["kind"] = "group"
-        out.append(d)
-    return out
-
-
-def _grant_common(request: Request, pm: PermissionManager, resource_type: str,
-                  resource_id: int, body: dict, table: str, fk: str,
-                  allowed_roles: tuple[str, ...],
-                  extra_cols: dict | None = None) -> dict:
-    user_id = body.get("user_id")
-    group_id = body.get("group_id")
-    role = (body.get("role") or "").strip()
-    if role not in allowed_roles:
-        raise HTTPException(400, f"role must be one of {', '.join(allowed_roles)}")
-    if not user_id and not group_id:
-        raise HTTPException(400, "Provide either user_id or group_id")
-    if user_id and not isinstance(user_id, int):
-        raise HTTPException(400, "user_id must be an integer")
-    if group_id and not isinstance(group_id, int):
-        raise HTTPException(400, "group_id must be an integer")
-    actor = _require_user(request)["id"]
-    with get_conn() as conn:
-        if user_id:
-            exists = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
-            if not exists:
-                raise HTTPException(404, "User not found")
-        if group_id:
-            exists = conn.execute("SELECT id FROM user_groups WHERE id=?", (group_id,)).fetchone()
-            if not exists:
-                raise HTTPException(404, "Group not found")
-        existing = conn.execute(
-            f"SELECT id, role FROM {table} WHERE {fk}=? AND user_id IS ? AND group_id IS ?",
-            (resource_id, user_id, group_id),
-        ).fetchone()
-        if existing:
-            conn.execute(f"UPDATE {table} SET role=? WHERE id=?",
-                         (role, existing["id"]))
-            old_role = existing["role"]
-            perm_id = existing["id"]
-        else:
-            cols = [fk, "user_id", "group_id", "role", "granted_by"]
-            vals: list = [resource_id, user_id, group_id, role, actor]
-            for col, val in (extra_cols or {}).items():
-                cols.append(col)
-                vals.append(val)
-            placeholders = ", ".join("?" for _ in cols)
-            cur = conn.execute(
-                f"INSERT INTO {table} ({', '.join(cols)}) VALUES ({placeholders})",
-                tuple(vals),
-            )
-            perm_id = cur.lastrowid
-            old_role = None
-        conn.commit()
-    pm.invalidate()
-    pm.log_permission_change(resource_type, resource_id, "grant",
-                             target_user_id=user_id, target_group_id=group_id,
-                             old_role=old_role, new_role=role, ip_address=_client_ip(request))
-    return {"status": "ok", "id": perm_id, "role": role, "user_id": user_id, "group_id": group_id}
-
-
-def _revoke_common(request: Request, pm: PermissionManager, resource_type: str,
-                   resource_id: int, table: str, fk: str, perm_id: int) -> dict:
-    with get_conn() as conn:
-        row = conn.execute(
-            f"SELECT user_id, group_id, role FROM {table} WHERE id=? AND {fk}=?",
-            (perm_id, resource_id),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Permission not found")
-        conn.execute(f"DELETE FROM {table} WHERE id=?", (perm_id,))
-        conn.commit()
-    pm.invalidate()
-    pm.log_permission_change(resource_type, resource_id, "revoke",
-                             target_user_id=row["user_id"], target_group_id=row["group_id"],
-                             old_role=row["role"], new_role=None, ip_address=_client_ip(request))
-    return {"status": "revoked"}
-
-
-def _set_permission_type(request: Request, pm: PermissionManager, resource_type: str,
-                         resource_id: int, table: str, body: dict) -> dict:
-    ptype = (body.get("permission_type") or "").strip()
-    if ptype not in PERMISSION_TYPES:
-        raise HTTPException(400, f"permission_type must be one of {', '.join(PERMISSION_TYPES)}")
-    with get_conn() as conn:
-        conn.execute(f"UPDATE {table} SET permission_type=? WHERE id=?", (ptype, resource_id))
-        conn.commit()
-    pm.invalidate()
-    pm.log_permission_change(resource_type, resource_id, "type_change",
-                             new_role=ptype, ip_address=_client_ip(request))
-    return {"status": "ok", "permission_type": ptype}
-
-
-# ═══════════════ Page permissions ═══════════════
-
-
-@router.get("/pages/{page_id}/permissions")
-def list_page_permissions(page_id: int, request: Request):
-    """List explicit page grants + the caller's effective role."""
-    pm = _pm(request)
-    if not pm.can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-    with get_conn() as conn:
-        grants = _perm_list(conn, "page_permissions", "page_id", page_id)
-    return {
-        "permissions": grants,
-        "mine": pm.get_page_permission(page_id),
-        "permission_type": _page_type(page_id),
-        "can_manage": pm.can_manage_page_permissions(page_id),
-    }
-
-
-@router.get("/pages/{page_id}/permissions/mine")
-def my_page_permission(page_id: int, request: Request):
-    """Effective role of the current user on a page (UI gating)."""
-    pm = _pm(request)
-    if not pm.can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-    return {
-        "role": pm.get_page_permission(page_id),
-        "can_edit": pm.can_edit_page(page_id),
-        "can_comment": pm.can_comment_page(page_id),
-        "can_manage": pm.can_manage_page_permissions(page_id),
-        "permission_type": _page_type(page_id),
-    }
-
-
-def _page_type(page_id: int) -> str:
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT permission_type FROM pages WHERE id=?", (page_id,)
-        ).fetchone()
-    return (row["permission_type"] if row else "inherit") or "inherit"
-
-
-@router.post("/pages/{page_id}/permissions")
-def grant_page_permission(page_id: int, request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    if not pm.can_manage_page_permissions(page_id):
-        raise HTTPException(403, "Only a page owner can manage its permissions")
-    return _grant_common(request, pm, "page", page_id, body,
-                         "page_permissions", "page_id", PAGE_ROLES)
-
-
-@router.post("/pages/{page_id}/permissions/batch")
-def batch_page_permissions(page_id: int, request: Request, body: dict = Body(default={})):
-    """Grant several permissions in one call: {grants: [{user_id|group_id, role}, ...]}."""
-    pm = _pm(request)
-    if not pm.can_manage_page_permissions(page_id):
-        raise HTTPException(403, "Only a page owner can manage its permissions")
-    grants = body.get("grants") or []
-    if not isinstance(grants, list) or not grants:
-        raise HTTPException(400, "grants must be a non-empty list")
-    results = []
-    for g in grants:
-        results.append(_grant_common(request, pm, "page", page_id, g,
-                                     "page_permissions", "page_id", PAGE_ROLES))
-    return {"status": "ok", "granted": results}
-
-
-@router.delete("/pages/{page_id}/permissions/{perm_id}")
-def revoke_page_permission(page_id: int, perm_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_manage_page_permissions(page_id):
-        raise HTTPException(403, "Only a page owner can manage its permissions")
-    return _revoke_common(request, pm, "page", page_id, "page_permissions", "page_id", perm_id)
-
-
-@router.post("/pages/{page_id}/permission-type")
-async def set_page_permission_type(page_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_manage_page_permissions(page_id):
-        raise HTTPException(403, "Only a page owner can manage its permissions")
-    return _set_permission_type(request, pm, "page", page_id, "pages", await request.json())
-
-
-# ═══════════════ Collection permissions ═══════════════
-
-
-@router.get("/collections/{collection_id}/permissions")
-def list_collection_permissions(collection_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_view_collection(collection_id):
-        raise HTTPException(404, "Collection not found")
-    with get_conn() as conn:
-        grants = _perm_list(conn, "collection_permissions", "collection_id", collection_id)
-    return {
-        "permissions": grants,
-        "mine": pm.get_collection_permission(collection_id),
-        "permission_type": _collection_type(collection_id),
-        "can_manage": pm.can_manage_collection_permissions(collection_id),
-    }
-
-
-def _collection_type(collection_id: int) -> str:
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT permission_type FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-    return (row["permission_type"] if row else "inherit") or "inherit"
-
-
-@router.post("/collections/{collection_id}/permissions")
-def grant_collection_permission(collection_id: int, request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    if not pm.can_manage_collection_permissions(collection_id):
-        raise HTTPException(403, "Only a collection owner can manage its permissions")
-    return _grant_common(request, pm, "collection", collection_id, body,
-                         "collection_permissions", "collection_id", COLLECTION_ROLES)
-
-
-@router.delete("/collections/{collection_id}/permissions/{perm_id}")
-def revoke_collection_permission(collection_id: int, perm_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_manage_collection_permissions(collection_id):
-        raise HTTPException(403, "Only a collection owner can manage its permissions")
-    return _revoke_common(request, pm, "collection", collection_id,
-                          "collection_permissions", "collection_id", perm_id)
-
-
-@router.post("/collections/{collection_id}/permission-type")
-async def set_collection_permission_type(collection_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_manage_collection_permissions(collection_id):
-        raise HTTPException(403, "Only a collection owner can manage its permissions")
-    return _set_permission_type(request, pm, "collection", collection_id,
-                                "collections", await request.json())
-
-
-@router.get("/collections/{collection_id}/properties/visible")
-def visible_properties(collection_id: int, request: Request):
-    """Split property ids into visible / hidden for the current user."""
-    pm = _pm(request)
-    if not pm.can_view_collection(collection_id):
-        raise HTTPException(404, "Collection not found")
-    visible = pm.get_visible_properties(collection_id)
-    with get_conn() as conn:
-        all_ids = [r["id"] for r in conn.execute(
-            "SELECT id FROM collection_properties WHERE collection_id=?",
-            (collection_id,),
-        ).fetchall()]
-    return {
-        "visible": visible,
-        "hidden": [pid for pid in all_ids if pid not in visible],
-        "can_edit": pm.can_edit_collection(collection_id),
-    }
-
-
-# ═══════════════ Property permissions ═══════════════
-
-
-@router.get("/collections/{collection_id}/properties/{property_id}/permissions")
-def list_property_permissions(collection_id: int, property_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_view_collection(collection_id):
-        raise HTTPException(404, "Collection not found")
-    with get_conn() as conn:
-        grants = _perm_list(conn, "property_permissions", "property_id", property_id)
-    return {
-        "permissions": grants,
-        "mine_view": pm.can_view_property(collection_id, property_id),
-        "mine_edit": pm.can_edit_property(collection_id, property_id),
-        "can_manage": pm.can_manage_collection_permissions(collection_id),
-    }
-
-
-@router.post("/collections/{collection_id}/properties/{property_id}/permissions")
-def grant_property_permission(collection_id: int, property_id: int, request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    if not pm.can_manage_collection_permissions(collection_id):
-        raise HTTPException(403, "Only a collection owner can manage property permissions")
-    with get_conn() as conn:
-        prop = conn.execute(
-            "SELECT id FROM collection_properties WHERE id=? AND collection_id=?",
-            (property_id, collection_id),
-        ).fetchone()
-        if not prop:
-            raise HTTPException(404, "Property not found")
-    return _grant_common(request, pm, "property", property_id, body,
-                         "property_permissions", "property_id", PROPERTY_ROLES,
-                         extra_cols={"collection_id": collection_id})
-
-
-@router.delete("/collections/{collection_id}/properties/{property_id}/permissions/{perm_id}")
-def revoke_property_permission(collection_id: int, property_id: int,
-                                     perm_id: int, request: Request):
-    pm = _pm(request)
-    if not pm.can_manage_collection_permissions(collection_id):
-        raise HTTPException(403, "Only a collection owner can manage property permissions")
-    return _revoke_common(request, pm, "property", property_id,
-                          "property_permissions", "property_id", perm_id)
-
-
-# ═══════════════ Groups ═══════════════
-
-
-@router.get("/groups")
-def list_groups(request: Request, workspace_id: int | None = None):
-    user = _require_user(request)
-    pm = PermissionManager(user["id"])
-    return {"groups": pm.get_groups_for_workspace(workspace_id)}
-
-
-@router.post("/groups")
-def create_group(request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    ws_id = body.get("workspace_id")
-    gid = pm.create_group(ws_id, body.get("name") or "", body.get("description") or "",
-                          created_by=pm.user_id)
-    pm.log_permission_change("group", gid, "group_create",
-                             target_group_id=gid, new_role="",
-                             ip_address=_client_ip(request))
-    return {"status": "ok", "id": gid}
-
-
-@router.put("/groups/{group_id}")
-def update_group(group_id: int, request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Group not found")
-        if not pm.is_workspace_admin(row["workspace_id"]):
-            raise HTTPException(403, "Only a workspace owner or admin can edit groups")
-        conn.execute(
-            "UPDATE user_groups SET name=?, description=? WHERE id=?",
-            (name, body.get("description") or "", group_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-@router.delete("/groups/{group_id}")
-def delete_group(group_id: int, request: Request):
-    pm = _pm(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Group not found")
-        if not pm.is_workspace_admin(row["workspace_id"]):
-            raise HTTPException(403, "Only a workspace owner or admin can delete groups")
-    pm.delete_group(group_id)
-    pm.log_permission_change("group", group_id, "group_delete",
-                             target_group_id=group_id, ip_address=_client_ip(request))
-    return {"status": "deleted"}
-
-
-@router.get("/groups/{group_id}/members")
-def list_group_members(group_id: int, request: Request):
-    user = _require_user(request)
-    return {"members": PermissionManager(user["id"]).get_group_members(group_id)}
-
-
-@router.post("/groups/{group_id}/members")
-def add_group_member(group_id: int, request: Request, body: dict = Body(default={})):
-    pm = _pm(request)
-    user_id = body.get("user_id")
-    if not user_id or not isinstance(user_id, int):
-        raise HTTPException(400, "user_id is required")
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Group not found")
-        if not pm.is_workspace_admin(row["workspace_id"]):
-            raise HTTPException(403, "Only a workspace owner or admin can manage groups")
-    pm.add_user_to_group(group_id, user_id)
-    pm.invalidate()
-    pm.log_permission_change("group", group_id, "member_add",
-                             target_user_id=user_id, target_group_id=group_id,
-                             ip_address=_client_ip(request))
-    return {"status": "ok"}
-
-
-@router.delete("/groups/{group_id}/members/{user_id}")
-def remove_group_member(group_id: int, user_id: int, request: Request):
-    pm = _pm(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Group not found")
-        if not pm.is_workspace_admin(row["workspace_id"]):
-            raise HTTPException(403, "Only a workspace owner or admin can manage groups")
-    pm.remove_user_from_group(group_id, user_id)
-    pm.invalidate()
-    pm.log_permission_change("group", group_id, "member_remove",
-                             target_user_id=user_id, target_group_id=group_id,
-                             ip_address=_client_ip(request))
-    return {"status": "ok"}
-
-
-# ═══════════════ Users (access pickers) + audit ═══════════════
-
-
-@router.get("/users")
-def list_users(request: Request, workspace_id: int | None = None, q: str = ""):
-    """Workspace members (+ admins) for the grant pickers."""
-    _require_user(request)
-    q = (q or "").strip().lower()
-    with get_conn() as conn:
-        if workspace_id:
-            rows = conn.execute(
-                """SELECT DISTINCT u.id, u.login, u.full_name, u.email, u.avatar_color
-                   FROM users u
-                   LEFT JOIN workspace_members wm ON wm.user_id=u.id AND wm.workspace_id=?
-                   WHERE u.is_admin=1 OR wm.id IS NOT NULL
-                   ORDER BY u.login""",
-                (workspace_id,),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, login, full_name, email, avatar_color FROM users ORDER BY login"
-            ).fetchall()
-    users = []
-    for r in rows:
-        d = dict(r)
-        if q and q not in (d["login"].lower(), d["full_name"].lower(),
-                           d["email"].lower()):
-            continue
-        users.append({"id": d["id"], "login": d["login"], "name": d["full_name"] or d["login"],
-                      "email": d["email"], "avatar_color": d["avatar_color"]})
-    return {"users": users}
-
-
-@router.get("/audit/permissions")
-def permission_audit(request: Request, limit: int = 100):
-    """Full permission change history — workspace owner/admin only."""
-    user = _require_user(request)
-    uid = user["id"]
-    is_admin = bool(user.get("is_admin"))
-    limit = max(1, min(int(limit), 500))
-    with get_conn() as conn:
-        if not is_admin:
-            owned = conn.execute(
-                "SELECT id FROM workspaces WHERE owner_id=?", (uid,)
-            ).fetchall()
-            if not owned:
-                raise HTTPException(403, "Only a workspace owner or admin can view the audit log")
-        rows = conn.execute(
-            """SELECT a.*, u.login AS actor_login
-               FROM permission_audit_log a LEFT JOIN users u ON u.id=a.performed_by
-               ORDER BY a.created_at DESC, a.id DESC LIMIT ?""",
-            (limit,),
-        ).fetchall()
-    return {"events": [dict(r) for r in rows]}
@@ -1,66 +0,0 @@
-"""FlowDeck — v5.2.0 Projects API: list, register, manual sync + backups admin."""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.services import projects as projects_svc
-from app.services.backup import backup_db, list_backups
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["projects"], prefix="/api/projects")
-backups_router = APIRouter(tags=["backups"])
-
-
-def _require_admin(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("is_admin"):
-        raise HTTPException(status_code=403, detail="Admin only")
-    return user
-
-
-@router.get("")
-def list_projects(request: Request):
-    """List all synced projects (optionally filtered by type)."""
-    proj_type = request.query_params.get("type") or None
-    return {"projects": projects_svc.list_projects(proj_type)}
-
-
-@router.post("")
-def create_project(request: Request, body: dict = Body(default={})):
-    """Register a standalone (builtin) project."""
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name required")
-    project = projects_svc.create_builtin_project(name, body.get("owner", ""), body.get("description", ""))
-    return {"status": "ok", "project": project}
-
-
-@router.post("/sync")
-async def sync_projects(request: Request):
-    """Trigger an immediate forge sync for every connected account."""
-    _require_admin(request)
-    stats = await projects_svc.sync_all_projects()
-    return {"status": "ok", "stats": stats}
-
-
-# ═══════════ Backups (admin) ═══════════
-
-
-@backups_router.post("/api/settings/backups/run")
-def run_backup_now(request: Request):
-    """Admin: create a database backup immediately."""
-    _require_admin(request)
-    filename = backup_db()
-    if not filename:
-        raise HTTPException(status_code=400, detail="Backups disabled or no database file")
-    return {"status": "ok", "filename": filename}
-
-
-@backups_router.get("/api/settings/backups")
-def admin_list_backups(request: Request):
-    """Admin: list stored backups."""
-    _require_admin(request)
-    return {"backups": list_backups()}
@@ -1,13 +1,12 @@
-"""FlowDeck — Public API router (v2.1.0, v5.2.0 per-user tokens)."""
+"""FlowDeck — Public API router (v2.1.0)."""
 from __future__ import annotations

-import hashlib
+import json
 import logging
 from secrets import token_urlsafe

-from fastapi import APIRouter, Depends, Header, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException, Header, Depends

-from app.auth.session import SessionManager
 from app.db import get_conn

 logger = logging.getLogger(__name__)
@@ -15,71 +14,41 @@ router = APIRouter(tags=["public-api"], prefix="/api/v1")
 DEFAULT_TOKEN = "fd-public-key"


-def _hash_token(token: str) -> str:
-    return hashlib.sha256(token.encode("utf-8")).hexdigest()
-
-
-def _token_owner(token: str) -> dict | None:
-    """Resolve an api_tokens row by its sha256 hash (revoked → None)."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, user_id, name FROM api_tokens WHERE token_hash=? AND revoked=0",
-            (_hash_token(token),),
-        ).fetchone()
-        if not row:
-            return None
-        conn.execute(
-            "UPDATE api_tokens SET last_used_at=CURRENT_TIMESTAMP WHERE id=?", (row["id"],)
-        )
-        conn.commit()
-        return dict(row)
-
-
 def verify_token(authorization: str | None = Header(None)):
    if not authorization or not authorization.startswith("Bearer "):
-        raise HTTPException(401, "API token required. Generate one via Settings → API tokens.")
+        raise HTTPException(401, "API token required. Generate one via POST /api/v1/token.")
    token = authorization[7:]  # strip "Bearer "
    if token == DEFAULT_TOKEN:
-        from app.config import settings as _s
-        if not _s.public_api_insecure_ok:
-            raise HTTPException(401, "Default token disabled. Set PUBLIC_API_INSECURE_OK=true in dev or use a real Bearer token.")
        return token
    with get_conn() as conn:
        row = conn.execute("SELECT 1 FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
-    if row:
-        return token
-    owner = _token_owner(token)
-    if not owner:
+    if not row:
        raise HTTPException(403, "Invalid API token")
    return token


@router.post("/token")
-def generate_token(request: Request):
-    """Generate a public API access token (A4 : session obligatoire — plus de
-    « legacy shared token » `user_id=0` créable par un anonymous)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
+async def generate_token(request: Request):
+    """Generate a public API access token."""
    token = f"fd_{token_urlsafe(24)}"
    with get_conn() as conn:
        conn.execute(
-            "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix) VALUES (?, ?, ?, ?)",
-            (user["id"], "API token", _hash_token(token), token[:12]),
+            "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
+            (0, token),
        )
        conn.commit()
    return {"token": token, "note": "Use as: Authorization: Bearer <token>"}


@router.get("/collections", dependencies=[Depends(verify_token)])
-def public_list_collections(request: Request):
+async def public_list_collections(request: Request):
    with get_conn() as conn:
        rows = conn.execute("SELECT id, name, description, icon, created_at FROM collections ORDER BY name").fetchall()
    return {"collections": [dict(r) for r in rows]}


@router.get("/collections/{collection_id}", dependencies=[Depends(verify_token)])
-def public_get_collection(request: Request, collection_id: int):
+async def public_get_collection(request: Request, collection_id: int):
    with get_conn() as conn:
        coll = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
        if not coll:
@@ -92,7 +61,7 @@ def public_get_collection(request: Request, collection_id: int):


@router.get("/collections/{collection_id}/pages", dependencies=[Depends(verify_token)])
-def public_list_pages(request: Request, collection_id: int):
+async def public_list_pages(request: Request, collection_id: int):
    with get_conn() as conn:
        pages = conn.execute(
            "SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? AND parent_id IS NULL ORDER BY position",
@@ -102,7 +71,7 @@ def public_list_pages(request: Request, collection_id: int):


@router.get("/pages/{page_id}", dependencies=[Depends(verify_token)])
-def public_get_page(request: Request, page_id: int):
+async def public_get_page(request: Request, page_id: int):
    with get_conn() as conn:
        p = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
        if not p:
@@ -111,7 +80,7 @@ def public_get_page(request: Request, page_id: int):


@router.get("/my-tasks", dependencies=[Depends(verify_token)])
-def public_my_tasks(request: Request):
+async def public_my_tasks(request: Request):
    """Public API: list tasks (requires valid token)."""
    with get_conn() as conn:
        pages = conn.execute(
@@ -1,63 +0,0 @@
-"""FlowDeck — v5.13.0 Realtime: WebSocket gateway /ws/pages/{page_id}.
-
-Auth via cookie session (flowdeck_session). Rooms in-memory par page.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Request, WebSocket
-from starlette.websockets import WebSocketDisconnect
-
-from app.auth.session import SessionManager
-from app.services.realtime_server import manager
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["realtime"])
-
-
-@router.get("/api/realtime/stats")
-def realtime_stats(request: Request):
-    """Observabilité realtime v6.4.0 : rooms, connexions, ops, merges, conflits.
-
-    Réservé aux utilisateurs authentifiés (données d'activité internes).
-    """
-    user = SessionManager.decode_session(
-        request.cookies.get("flowdeck_session", "")
-    )
-    if not user or not user.get("id"):
-        return {"error": "unauthorized"}
-    return manager.stats()
-
-
-@router.websocket("/ws/pages/{page_id}")
-async def ws_page(websocket: WebSocket, page_id: int):
-    await websocket.accept()
-    user = SessionManager.decode_session(
-        websocket.cookies.get("flowdeck_session", "")
-    )
-    if not user or not user.get("id"):
-        try:
-            await websocket.close(code=4401)
-        except Exception:
-            logger.exception("ws_page")
-        return
-
-    conn = await manager.connect(websocket, page_id, user)
-    if not conn:
-        return
-    try:
-        while True:
-            raw = await websocket.receive_text()
-            try:
-                msg = json.loads(raw)
-            except (TypeError, ValueError):
-                continue
-            await manager.handle(conn, msg)
-    except WebSocketDisconnect:
-        pass
-    except Exception as e:  # noqa: BLE001
-        logger.debug("ws closed: %s", e)
-    finally:
-        await manager.disconnect(conn)
@@ -1,277 +0,0 @@
-"""FlowDeck — SCIM 2.0 provisioning + domain claims (v7.2.0).
-
-``/scim/v2/Users`` (Bearer ``scim_tokens``, admin) : IT systems provision and
-deprovision accounts. Suspend (``active=false``) flips ``users.is_active`` and
-revokes ``user_sessions``. Domain claims: ``/.well-known`` HTTP verification +
-optional local-login enforcement per email domain.
-
-See ``docs/V72_Enterprise_SCIM_2FA.md``.
-"""
-from __future__ import annotations
-
-import hashlib
-import secrets
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.api_v2_helpers import audit_log
-from app.services.http_client import shared_client
-
-router = APIRouter(tags=["scim"])
-SCIM_SCHEMAS = ["urn:ietf:params:scim:schemas:core:2.0:User"]
-
-
-# ── auth ───────────────────────────────────────────────────────────────────
-
-def _scim_guard(request: Request) -> dict:
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        digest = hashlib.sha256(auth[7:].strip().encode()).hexdigest()
-        with get_conn() as conn:
-            row = conn.execute("SELECT * FROM scim_tokens WHERE token_hash=? AND revoked=0",
-                               (digest,)).fetchone()
-        if row:
-            return {"scim_token_id": row["id"], "name": row["name"]}
-    raise HTTPException(401, "SCIM token required")
-
-
-def _admin_session(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
-    if not row or not row["is_admin"]:
-        raise HTTPException(403, "Admin required")
-    return user
-
-
-def _scim_user(row) -> dict:
-    d = dict(row)
-    return {"schemas": SCIM_SCHEMAS, "id": str(d["id"]), "userName": d["login"],
-            "name": {"formatted": d.get("full_name") or d["login"]},
-            "emails": [{"value": d.get("email") or "", "primary": True}],
-            "active": bool(d.get("is_active", 1)),
-            "meta": {"resourceType": "User"}}
-
-
-# ── SCIM resources ─────────────────────────────────────────────────────────
-
-@router.get("/scim/v2/Users")
-def scim_list(request: Request):
-    _scim_guard(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM users ORDER BY id LIMIT 100").fetchall()
-    items = [_scim_user(r) for r in rows]
-    return {"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
-            "totalResults": len(items), "Resources": items}
-
-
-@router.post("/scim/v2/Users")
-def scim_create(request: Request, body: dict = Body(default={})):
-    _scim_guard(request)
-    username = (body.get("userName") or "").strip()
-    if not username:
-        raise HTTPException(400, "userName required")
-    email = ""
-    for em in body.get("emails") or []:
-        if isinstance(em, dict) and em.get("value"):
-            email = em["value"]
-            break
-    name = ((body.get("name") or {}).get("formatted") or username)[:200]
-    active = body.get("active", True)
-    with get_conn() as conn:
-        if conn.execute("SELECT id FROM users WHERE login=?", (username,)).fetchone():
-            raise HTTPException(409, "User already exists")
-        cur = conn.execute(
-            "INSERT INTO users (login, full_name, email, is_active, auth_method)"
-            " VALUES (?,?,?,?,'saml')",
-            (username, name, email, 1 if active else 0))
-        conn.commit()
-        row = conn.execute("SELECT * FROM users WHERE id=?", (cur.lastrowid,)).fetchone()
-    return JSONResponse(status_code=201, content=_scim_user(row))
-
-
-@router.get("/scim/v2/Users/{user_id}")
-def scim_get(user_id: str, request: Request):
-    _scim_guard(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "User not found")
-    return _scim_user(row)
-
-
-def _apply_scim_update(conn, user_id: str, body: dict) -> None:
-    row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "User not found")
-    updates: dict = {}
-    if "userName" in body and body["userName"]:
-        updates["login"] = body["userName"].strip()
-    if isinstance(body.get("name"), dict) and body["name"].get("formatted"):
-        updates["full_name"] = body["name"]["formatted"][:200]
-    if isinstance(body.get("emails"), list):
-        for em in body["emails"]:
-            if isinstance(em, dict) and em.get("value"):
-                updates["email"] = em["value"][:200]
-                break
-    if "active" in body:
-        updates["is_active"] = 1 if body["active"] else 0
-    if updates:
-        sets = ", ".join(f"{k}=?" for k in updates)
-        conn.execute(f"UPDATE users SET {sets} WHERE id=?", (*updates.values(), user_id))
-    if body.get("active") is False:
-        conn.execute("UPDATE user_sessions SET revoked=1 WHERE user_id=?", (user_id,))
-    conn.commit()
-
-
-@router.put("/scim/v2/Users/{user_id}")
-def scim_replace(user_id: str, request: Request, body: dict = Body(default={})):
-    _scim_guard(request)
-    with get_conn() as conn:
-        _apply_scim_update(conn, user_id, body)
-        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-    return _scim_user(row)
-
-
-@router.patch("/scim/v2/Users/{user_id}")
-def scim_patch(user_id: str, request: Request, body: dict = Body(default={})):
-    _scim_guard(request)
-    flat: dict = {}
-    for op in body.get("Operations") or []:
-        path = (op.get("path") or "").lower()
-        if path in ("username", "active"):
-            flat["userName" if path == "username" else "active"] = op.get("value")
-    with get_conn() as conn:
-        _apply_scim_update(conn, user_id, {**body, **flat})
-        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-    return _scim_user(row)
-
-
-@router.delete("/scim/v2/Users/{user_id}")
-def scim_delete(user_id: str, request: Request):
-    _scim_guard(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "User not found")
-        # Deprovision = suspend (keeps content + audit trail).
-        conn.execute("UPDATE users SET is_active=0 WHERE id=?", (user_id,))
-        conn.execute("UPDATE user_sessions SET revoked=1 WHERE user_id=?", (user_id,))
-        conn.commit()
-    return JSONResponse(status_code=204, content=None)
-
-
-# ── SCIM token management (admin, session) ─────────────────────────────────
-
-@router.post("/api/v2/scim/tokens")
-def create_scim_token(request: Request, body: dict = Body(default={})):
-    admin = _admin_session(request)
-    raw = f"scim_{secrets.token_urlsafe(32)}"
-    digest = hashlib.sha256(raw.encode()).hexdigest()
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO scim_tokens (token_hash, name, created_by)"
-                           " VALUES (?,?,?)",
-                           (digest, str(body.get("name") or "SCIM")[:120], admin["id"]))
-        conn.commit()
-    audit_log(admin, "scim.token.create", "scim_token", cur.lastrowid, "", request)
-    return JSONResponse(status_code=201,
-                        content={"id": cur.lastrowid, "token": raw,
-                                 "warning": "shown once"})
-
-
-@router.get("/api/v2/scim/tokens")
-def list_scim_tokens(request: Request):
-    _admin_session(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, name, created_by, revoked, created_at"
-                            " FROM scim_tokens ORDER BY id DESC").fetchall()
-    return {"tokens": [dict(r) for r in rows]}
-
-
-@router.delete("/api/v2/scim/tokens/{token_id}")
-def revoke_scim_token(token_id: int, request: Request):
-    admin = _admin_session(request)
-    with get_conn() as conn:
-        conn.execute("UPDATE scim_tokens SET revoked=1 WHERE id=?", (token_id,))
-        conn.commit()
-    audit_log(admin, "scim.token.revoke", "scim_token", token_id, "", request)
-    return {"status": "revoked", "id": token_id}
-
-
-# ── domain claims ──────────────────────────────────────────────────────────
-
-@router.get("/api/v2/domain-claims")
-def list_domains(request: Request):
-    _admin_session(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM domain_claims ORDER BY domain").fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d.pop("txt_token", None)
-        out.append(d)
-    return {"domains": out}
-
-
-@router.post("/api/v2/domain-claims")
-def create_domain(request: Request, body: dict = Body(default={})):
-    admin = _admin_session(request)
-    domain = (body.get("domain") or "").strip().lower()
-    if not domain or "." not in domain or "/" in domain:
-        raise HTTPException(400, "valid domain required")
-    token = f"flowdeck-verify={secrets.token_hex(16)}"
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                """INSERT INTO domain_claims
-                   (domain, txt_token, auto_join_role, enforce_sso, workspace_id)
-                   VALUES (?,?,?,?,?)""",
-                (domain, token, body.get("auto_join_role") or "viewer",
-                 1 if body.get("enforce_sso") else 0, body.get("workspace_id")))
-            conn.commit()
-        except Exception:
-            raise HTTPException(409, "Domain already claimed") from None
-        did = cur.lastrowid
-    audit_log(admin, "domain.claim", "domain", did, domain, request)
-    return JSONResponse(status_code=201, content={
-        "id": did, "domain": domain,
-        "verify_url": f"https://{domain}/.well-known/flowdeck-verify.txt",
-        "expected_content": token})
-
-
-@router.post("/api/v2/domain-claims/{domain_id}/verify")
-async def verify_domain(domain_id: int, request: Request):
-    admin = _admin_session(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM domain_claims WHERE id=?", (domain_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Domain not found")
-        claim = dict(row)
-    url = f"https://{claim['domain']}/.well-known/flowdeck-verify.txt"
-    try:
-        async with shared_client(timeout=10, follow_redirects=True) as client:
-            resp = await client.get(url)
-        ok = resp.status_code == 200 and claim["txt_token"] in (resp.text or "")
-    except Exception:  # noqa: BLE001 — unreachable domain = not verified
-        ok = False
-    if ok:
-        with get_conn() as conn:
-            conn.execute("UPDATE domain_claims SET verified=1 WHERE id=?", (domain_id,))
-            conn.commit()
-    audit_log(admin, "domain.verify", "domain", domain_id, str(ok), request)
-    return {"id": domain_id, "verified": ok}
-
-
-@router.delete("/api/v2/domain-claims/{domain_id}")
-def delete_domain(domain_id: int, request: Request):
-    admin = _admin_session(request)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM domain_claims WHERE id=?", (domain_id,))
-        conn.commit()
-    audit_log(admin, "domain.delete", "domain", domain_id, "", request)
-    return {"status": "deleted", "id": domain_id}
@@ -1,27 +0,0 @@
-"""FlowDeck — unified search router (v5.0.0).
-
-``GET /api/search?q=`` backs the Ctrl+K command palette. Returns matching
-editor pages and databases scoped to the current user's accessible workspaces.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter, Query, Request
-
-from app.auth.session import SessionManager
-from app.services.search import search as search_service
-
-router = APIRouter(tags=["search"])
-
-
-@router.get("/api/search")
-def search(request: Request, q: str = Query(default="")):
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    user_id = user.get("id") if user and user.get("id") else None
-
-    data = search_service(q, user_id=user_id)
-    return {
-        "query": q,
-        "pages": data["pages"],
-        "collections": data["collections"],
-        "total": len(data["pages"]) + len(data["collections"]),
-    }
@@ -1,95 +0,0 @@
-"""FlowDeck — hybrid search + Ask AI API (v6.9.0).
-
-``GET /api/v2/search/hybrid`` — lexical (FTS5/LIKE) fused with vector cosine
-(RRF), workspace-scoped, ACL-filtered, paginated with ``X-Total-Count``.
-``POST /api/v2/search/ask`` — RAG answer with ``[[fdpage:ID]]`` citations
-(LLM when configured, extractive offline fallback), cached 10 min.
-
-Auth: session cookie first, Bearer fallback (``read`` scope suffices).
-See ``docs/V69_Search_Ask_AI.md``.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import semantic_search as sem
-from app.services.api_v2_helpers import (
-    audit_log,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    resolve_bearer_token,
-)
-
-router = APIRouter(tags=["search-ai"])
-
-
-def _auth_user(request: Request) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        return sess
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if not user:
-            raise HTTPException(401, "Invalid or expired API token")
-        if not has_scope(user.get("_token_scopes") or "read", "read"):
-            raise HTTPException(403, "Insufficient scope. Required: read")
-        return user
-    raise HTTPException(401, "Authentication required")
-
-
-@router.get("/api/v2/search/hybrid")
-def hybrid(request: Request):
-    user = _auth_user(request)
-    q = (request.query_params.get("q") or request.query_params.get("query") or "").strip()
-    if not q:
-        raise HTTPException(400, "q is required")
-    limit, offset = parse_pagination(request)
-    ws_raw = request.query_params.get("workspace_id")
-    workspace_id = int(ws_raw) if ws_raw and str(ws_raw).isdigit() else None
-    results, _total = sem.hybrid_search(q, user, limit=limit + offset,
-                                        workspace_id=workspace_id)
-    page = results[offset:offset + limit]
-    # Index-on-read: a fresh page may not be indexed yet (scheduler runs every
-    # 5 min). Best-effort is handled by tests calling index_resource directly.
-    resp = JSONResponse({"query": q, "results": page,
-                         "total": len(results), "limit": limit, "offset": offset})
-    for k, v in paginate_headers(len(results)).items():
-        resp.headers[k] = v
-    return resp
-
-
-@router.post("/api/v2/search/ask")
-async def ask_ai(request: Request):
-    user = _auth_user(request)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
-    question = (body.get("question") or body.get("q") or "").strip()
-    if not question:
-        raise HTTPException(400, "question is required")
-    ws = body.get("workspace_id")
-    workspace_id = int(ws) if isinstance(ws, int) or (isinstance(ws, str) and ws.isdigit()) else None
-    out = await sem.ask(question, user, workspace_id)
-    audit_log(user, "search.ask", "search", "", question[:200], request)
-    return {"question": question, "workspace_id": workspace_id, **out}
-
-
-@router.get("/api/v2/search/index-status")
-def index_status(request: Request):
-    """How many resources are indexed vs pending (owner/admin visibility)."""
-    user = _auth_user(request)
-    with get_conn() as conn:
-        indexed = conn.execute("SELECT COUNT(*) FROM semantic_index_state").fetchone()[0]
-        vectors = conn.execute("SELECT COUNT(*) FROM semantic_embeddings").fetchone()[0]
-        pages_total = conn.execute(
-            "SELECT COUNT(*) FROM pages WHERE (deleted_at IS NULL OR deleted_at='') "
-            "AND COALESCE(search_excluded, 0)=0").fetchone()[0]
-    return {"indexed_resources": indexed, "vectors": vectors,
-            "indexable_pages": pages_total, "model": sem.MODEL, "dim": sem.DIM,
-            "user_id": user.get("id")}
@@ -1,120 +0,0 @@
-"""FlowDeck — v5.2.0 Security: per-user API tokens & active sessions.
-
-Backend for the Settings → API tokens / Sessions UI.
-"""
-from __future__ import annotations
-
-import hashlib
-import logging
-from secrets import token_urlsafe
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["security"], prefix="/api/settings")
-
-
-def _hash_token(token: str) -> str:
-    return hashlib.sha256(token.encode("utf-8")).hexdigest()
-
-
-def _current_user_id(request: Request) -> int:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Not authenticated")
-    return user["id"]
-
-
-# ═══════════ API tokens ═══════════
-
-
-@router.get("/tokens")
-def list_tokens(request: Request):
-    """List the current user's API tokens (prefix only, no secrets)."""
-    uid = _current_user_id(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, name, token_prefix, last_used_at, revoked, created_at "
-            "FROM api_tokens WHERE user_id=? ORDER BY created_at DESC",
-            (uid,),
-        ).fetchall()
-    return {"tokens": [dict(r) for r in rows]}
-
-
-@router.post("/tokens")
-def create_token(request: Request, body: dict = Body(default={})):
-    """Create an API token for the current user. The secret is returned once."""
-    uid = _current_user_id(request)
-    name = (body.get("name") or "").strip() or "API token"
-    token = f"fd_{token_urlsafe(24)}"
-    with get_conn() as conn:
-        cur = conn.execute(
-            "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix) VALUES (?, ?, ?, ?)",
-            (uid, name[:80], _hash_token(token), token[:12]),
-        )
-        conn.commit()
-        tid = cur.lastrowid
-    return {"id": tid, "name": name, "token": token,
-            "note": "Copy this token now — it won't be shown again."}
-
-
-@router.delete("/tokens/{token_id:int}")
-def revoke_token(token_id: int, request: Request):
-    """Revoke an API token (soft delete)."""
-    uid = _current_user_id(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id FROM api_tokens WHERE id=? AND user_id=?", (token_id, uid)
-        ).fetchone()
-        if not row:
-            raise HTTPException(status_code=404, detail="Token not found")
-        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
-        conn.commit()
-    return {"status": "revoked"}
-
-
-# ═══════════ Active sessions ═══════════
-
-
-@router.get("/sessions")
-def list_sessions(request: Request):
-    """List the current user's active sessions with their devices."""
-    uid = _current_user_id(request)
-    current_sid = SessionManager.session_id(request.cookies.get("flowdeck_session", ""))
-    sessions = SessionManager.list_sessions(uid)
-    now = __import__("datetime").datetime.now()
-    for s in sessions:
-        s["is_current"] = (s["id"] == current_sid)
-        # A session older than 7 days is implicitly expired (cookie max-age).
-        created = s.get("created_at") or ""
-        try:
-            from datetime import datetime
-            created_dt = datetime.fromisoformat(str(created).replace("Z", ""))
-            s["expired"] = (now - created_dt).days >= 7
-        except Exception:
-            s["expired"] = False
-    return {"sessions": sessions}
-
-
-@router.post("/sessions/{sid}/revoke")
-def revoke_session(sid: str, request: Request):
-    """Revoke an active session. If it's the current one, the user is logged out."""
-    uid = _current_user_id(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id FROM user_sessions WHERE id=? AND user_id=?", (sid, uid)
-        ).fetchone()
-    if not row:
-        raise HTTPException(status_code=404, detail="Session not found")
-    SessionManager.revoke_session(sid)
-    # Also wipe the OAuth state cookie if the current session was revoked.
-    current_sid = SessionManager.session_id(request.cookies.get("flowdeck_session", ""))
-    if current_sid == sid:
-        try:
-            request.session.clear()
-        except Exception:
-            logger.exception("revoke_session")
-    return {"status": "revoked"}
@@ -2,15 +2,14 @@
 from __future__ import annotations

 import logging
-from datetime import UTC, datetime
+import re
+import unicodedata
+from datetime import datetime

-from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException

-from app.auth.session import SessionManager
 from app.db import get_conn
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-from app.services.publish import fire_published, fire_unpublished, publish, unpublish
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["sharing"], prefix="/api")
@@ -24,27 +23,31 @@ def _require_auth(request: Request) -> dict:
    return user


+def _slugify(title: str) -> str:
+    """Generate a URL-safe slug from a page title."""
+    slug = unicodedata.normalize("NFKD", title).encode("ascii", "ignore").decode("ascii")
+    slug = re.sub(r"[^\w\s-]", "", slug.lower())
+    slug = re.sub(r"[-\s]+", "-", slug).strip("-")
+    return slug or "untitled"
+
+
 # ── Page Sharing ──


@router.post("/pages/{page_id}/share")
-def share_page(page_id: int, request: Request, body: dict = Body(default={})):
-    """Invite a user, an email, or a group to a page."""
+async def share_page(page_id: int, request: Request):
+    """Invite a user or email to a page."""
    user = _require_auth(request)
+    body = await request.json() if request.headers.get("content-type") else {}
    target_user_id = body.get("user_id")
-    target_group_id = body.get("group_id")
    email = body.get("email", "")
    permission = body.get("permission", "view")

    if permission not in ("view", "comment", "edit"):
        raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")

-    if not target_user_id and not target_group_id and not email:
-        raise HTTPException(400, "Provide user_id, group_id or email to share with.")
-
-    # Bridge share permission (view/comment/edit) → granular role
-    # (viewer/commenter/editor) so page_permissions grants stay in sync.
-    _SHARE_TO_ROLE = {"view": "viewer", "comment": "commenter", "edit": "editor"}
+    if not target_user_id and not email:
+        raise HTTPException(400, "Provide user_id or email to share with.")

    with get_conn() as conn:
        # Verify page exists
@@ -58,173 +61,38 @@ def share_page(page_id: int, request: Request, body: dict = Body(default={})):
            if not target:
                raise HTTPException(404, "Target user not found")

-        # Verify target group exists if group_id given
-        if target_group_id:
-            gtarget = conn.execute("SELECT id FROM user_groups WHERE id=?", (target_group_id,)).fetchone()
-            if not gtarget:
-                raise HTTPException(404, "Target group not found")
-
-        # Upsert to avoid duplicates: update the existing permission if the same
-        # target (user, group or email) is already shared on this page.
-        target_row = None
-        if target_user_id:
-            target_row = conn.execute(
-                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_user_id=?",
-                (page_id, target_user_id),
-            ).fetchone()
-        elif target_group_id:
-            target_row = conn.execute(
-                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_group_id=?",
-                (page_id, target_group_id),
-            ).fetchone()
-        elif email:
-            target_row = conn.execute(
-                """SELECT id FROM page_shares
-                   WHERE page_id=? AND shared_with_email=? AND shared_with_user_id IS NULL AND shared_with_group_id IS NULL""",
-                (page_id, email.strip()),
-            ).fetchone()
-
-        if target_row:
-            conn.execute(
-                "UPDATE page_shares SET permission=?, created_by=? WHERE id=?",
-                (permission, user["id"], target_row["id"]),
-            )
-            share_id = target_row["id"]
-        else:
-            if not email:
-                email = ""
-            try:
-                cur = conn.execute(
-                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_group_id, shared_with_email, permission, created_by)
-                       VALUES (?, ?, ?, ?, ?, ?)""",
-                    (page_id, target_user_id, target_group_id, email.strip(), permission, user["id"]),
-                )
-            except Exception:
-                # Fallback for DBs where the migration has not run yet
-                cur = conn.execute(
-                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
-                       VALUES (?, ?, ?, ?, ?)""",
-                    (page_id, target_user_id, email.strip(), permission, user["id"]),
-                )
-            share_id = cur.lastrowid
+        cur = conn.execute(
+            """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
+               VALUES (?, ?, ?, ?, ?)""",
+            (page_id, target_user_id, email, permission, user["id"]),
+        )
        conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
-        # ── Mirror group shares into page_permissions so the ACL used by
-        # PermissionManager (can_view/edit/comment) grants real access to
-        # every group member. Best-effort: never break legacy page_shares.
-        if target_group_id:
-            try:
-                _mirror_share_grant(conn, page_id, target_group_id, _SHARE_TO_ROLE[permission], user["id"])
-            except Exception:
-                logger.warning("share→page_permissions mirror failed (page=%s group=%s)", page_id, target_group_id)
        conn.commit()

-    try:
-        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": share_id, "permission": permission}))
-    except Exception:
-        logger.exception("share_page")
-
    return {
-        "id": share_id,
+        "id": cur.lastrowid,
        "page_id": page_id,
        "shared_with_user_id": target_user_id,
-        "shared_with_group_id": target_group_id,
        "shared_with_email": email,
        "permission": permission,
        "status": "shared",
    }


-def _mirror_share_grant(conn, page_id: int, group_id: int, role: str, granted_by: int) -> None:
-    """Upsert a ``page_permissions`` grant mirroring a group ``page_shares`` row.
-
-    Keeps the granular ACL (used by ``PermissionManager``) in sync with what
-    the share dialog shows, so invited groups get effective view/edit rights.
-    """
-    existing = conn.execute(
-        "SELECT id FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
-        (page_id, group_id),
-    ).fetchone()
-    if existing:
-        conn.execute("UPDATE page_permissions SET role=?, granted_by=? WHERE id=?",
-                     (role, granted_by, existing["id"]))
-    else:
-        conn.execute(
-            "INSERT INTO page_permissions (page_id, user_id, group_id, role, granted_by) "
-            "VALUES (?, NULL, ?, ?, ?)",
-            (page_id, group_id, role, granted_by),
-        )
-
-
-def _mirror_share_revoke(conn, page_id: int, group_id: int) -> None:
-    """Remove the mirrored grant when a group share is updated away or deleted."""
-    conn.execute(
-        "DELETE FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
-        (page_id, group_id),
-    )
-
-
-@router.put("/pages/{page_id}/share/{share_id}", description="Update a share's permission.")
-def update_share_permission(page_id: int, share_id: int, request: Request, body: dict = Body(default={})):
-    """Change the permission level of an existing share entry."""
-    user = _require_auth(request)
-
-    permission = body.get("permission", "")
-
-    if permission not in ("view", "comment", "edit"):
-        raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")
-
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
-            (share_id, page_id),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Share entry not found")
-
-        conn.execute(
-            "UPDATE page_shares SET permission=? WHERE id=?",
-            (permission, share_id),
-        )
-        # Keep the mirrored ACL grant in sync for group shares.
-        try:
-            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
-        except Exception:
-            gid = None
-        if gid:
-            try:
-                _mirror_share_grant(conn, page_id, gid,
-                                    {"view": "viewer", "comment": "commenter", "edit": "editor"}[permission],
-                                    user["id"])
-            except Exception:
-                logger.warning("share→page_permissions mirror failed (share=%s)", share_id)
-        conn.commit()
-
-    return {"status": "updated", "share_id": share_id, "permission": permission}
-
-
@router.delete("/pages/{page_id}/share/{share_id}")
-def remove_share(page_id: int, share_id: int, request: Request):
+async def remove_share(page_id: int, share_id: int, request: Request):
    """Remove a share invitation."""
    _require_auth(request)

    with get_conn() as conn:
        row = conn.execute(
-            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
+            "SELECT id FROM page_shares WHERE id=? AND page_id=?",
            (share_id, page_id),
        ).fetchone()
        if not row:
            raise HTTPException(404, "Share entry not found")

        conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
-        try:
-            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
-        except Exception:
-            gid = None
-        if gid:
-            try:
-                _mirror_share_revoke(conn, page_id, gid)
-            except Exception:
-                logger.warning("share→page_permissions revoke failed (share=%s)", share_id)
        # If no more shares, unset is_shared
        remaining = conn.execute(
            "SELECT COUNT(*) AS c FROM page_shares WHERE page_id=?", (page_id,)
@@ -237,7 +105,7 @@ def remove_share(page_id: int, share_id: int, request: Request):


@router.get("/pages/{page_id}/shares")
-def list_shares(page_id: int, request: Request):
+async def list_shares(page_id: int, request: Request):
    """Get all shares for a page."""
    _require_auth(request)

@@ -246,25 +114,14 @@ def list_shares(page_id: int, request: Request):
        if not page:
            raise HTTPException(404, "Page not found")

-        try:
-            rows = conn.execute(
-                """SELECT s.*, u.login, u.full_name, u.avatar_url, g.name AS group_name
-                   FROM page_shares s
-                   LEFT JOIN users u ON s.shared_with_user_id = u.id
-                   LEFT JOIN user_groups g ON s.shared_with_group_id = g.id
-                   WHERE s.page_id=?
-                   ORDER BY s.created_at DESC""",
-                (page_id,),
-            ).fetchall()
-        except Exception:
-            rows = conn.execute(
-                """SELECT s.*, u.login, u.full_name, u.avatar_url
-                   FROM page_shares s
-                   LEFT JOIN users u ON s.shared_with_user_id = u.id
-                   WHERE s.page_id=?
-                   ORDER BY s.created_at DESC""",
-                (page_id,),
-            ).fetchall()
+        rows = conn.execute(
+            """SELECT s.*, u.login, u.full_name, u.avatar_url
+               FROM page_shares s
+               LEFT JOIN users u ON s.shared_with_user_id = u.id
+               WHERE s.page_id=?
+               ORDER BY s.created_at DESC""",
+            (page_id,),
+        ).fetchall()

    return {
        "page_id": page_id,
@@ -272,7 +129,6 @@ def list_shares(page_id: int, request: Request):
            {
                "id": r["id"],
                "shared_with_user_id": r["shared_with_user_id"],
-                "shared_with_group_id": r["shared_with_group_id"] if "shared_with_group_id" in r.keys() else None,
                "shared_with_email": r["shared_with_email"],
                "permission": r["permission"],
                "created_at": r["created_at"],
@@ -280,8 +136,6 @@ def list_shares(page_id: int, request: Request):
                "user_login": r["login"],
                "user_full_name": r["full_name"],
                "user_avatar_url": r["avatar_url"],
-                "group_name": r["group_name"] if "group_name" in r.keys() else None,
-                "kind": "group" if (("shared_with_group_id" in r.keys() and r["shared_with_group_id"]) or ("group_name" in r.keys() and r["group_name"])) else "user",
            }
            for r in rows
        ],
@@ -292,11 +146,33 @@ def list_shares(page_id: int, request: Request):


@router.post("/pages/{page_id}/publish")
-def publish_page(page_id: int, request: Request):
+async def publish_page(page_id: int, request: Request):
    """Publish a page (is_published=1) with a URL slug."""
-    _require_auth(request)
-    slug, _title = publish(page_id)
-    run_event_sync(fire_published(page_id, slug))
+    user = _require_auth(request)
+
+    with get_conn() as conn:
+        page = conn.execute(
+            "SELECT id, title, is_published FROM pages WHERE id=?", (page_id,)
+        ).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        slug = _slugify(page["title"])
+        # Ensure uniqueness by appending suffix if needed
+        base_slug = slug
+        counter = 1
+        while conn.execute(
+            "SELECT id FROM pages WHERE publish_slug=? AND id!=?", (slug, page_id)
+        ).fetchone():
+            slug = f"{base_slug}-{counter}"
+            counter += 1
+
+        conn.execute(
+            "UPDATE pages SET is_published=1, publish_slug=? WHERE id=?",
+            (slug, page_id),
+        )
+        conn.commit()
+
    return {
        "page_id": page_id,
        "is_published": True,
@@ -306,11 +182,23 @@ def publish_page(page_id: int, request: Request):


@router.delete("/pages/{page_id}/publish")
-def unpublish_page(page_id: int, request: Request):
+async def unpublish_page(page_id: int, request: Request):
    """Unpublish a page."""
    _require_auth(request)
-    unpublish(page_id)
-    run_event_sync(fire_unpublished(page_id))
+
+    with get_conn() as conn:
+        page = conn.execute(
+            "SELECT id, is_published FROM pages WHERE id=?", (page_id,)
+        ).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        conn.execute(
+            "UPDATE pages SET is_published=0, publish_slug='' WHERE id=?",
+            (page_id,),
+        )
+        conn.commit()
+
    return {
        "page_id": page_id,
        "is_published": False,
@@ -322,9 +210,10 @@ def unpublish_page(page_id: int, request: Request):


@router.post("/recents/track")
-def track_recent(request: Request, body: dict = Body(default={})):
+async def track_recent(request: Request):
    """Record a page access in recents."""
    user = _require_auth(request)
+    body = await request.json() if request.headers.get("content-type") else {}
    page_id = body.get("page_id")
    workspace = body.get("workspace", "")
    source_type = body.get("source_type", "local")
@@ -344,7 +233,7 @@ def track_recent(request: Request, body: dict = Body(default={})):
               DO UPDATE SET workspace=excluded.workspace,
                             source_type=excluded.source_type,
                             accessed_at=excluded.accessed_at""",
-            (user["id"], page_id, workspace, source_type, datetime.now(UTC).replace(tzinfo=None).isoformat()),
+            (user["id"], page_id, workspace, source_type, datetime.utcnow().isoformat()),
        )
        conn.commit()

@@ -352,5 +241,5 @@ def track_recent(request: Request, body: dict = Body(default={})):
        "status": "tracked",
        "user_id": user["id"],
        "page_id": page_id,
-        "accessed_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
+        "accessed_at": datetime.utcnow().isoformat(),
    }
@@ -1,112 +0,0 @@
-"""FlowDeck — Sidebar customization API (v4.6.0)."""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["sidebar"], prefix="/api/sidebar")
-
-
-def _get_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        raise HTTPException(status_code=401, detail="Not authenticated")
-    return user
-
-
-DEFAULT_CONFIG = {
-    "workspace": {"visible": True, "order": 0, "show_count": None},
-    "gitea": {"visible": True, "order": 1, "show_count": None},
-    "meetings": {"visible": True, "order": 2, "show_count": 5},
-    "recents": {"visible": True, "order": 3, "show_count": 10},
-    "favorites": {"visible": True, "order": 4, "show_count": 10},
-    "agents": {"visible": True, "order": 5, "show_count": None},
-    "teamspaces": {"visible": True, "order": 6, "show_count": None},
-    "shared": {"visible": True, "order": 7, "show_count": 10},
-    "published": {"visible": True, "order": 8, "show_count": 10},
-    "private": {"visible": True, "order": 9, "show_count": None},
-}
-
-
-@router.get("/config")
-def get_sidebar_config(request: Request):
-    """Get the current user's sidebar customization config."""
-    user = _get_user(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT sidebar_config FROM users WHERE id=?", (user["id"],)
-        ).fetchone()
-    if not row:
-        return {"config": DEFAULT_CONFIG}
-
-    raw = row["sidebar_config"]
-    if not raw:
-        return {"config": DEFAULT_CONFIG}
-
-    try:
-        stored = json.loads(raw)
-    except (json.JSONDecodeError, TypeError):
-        return {"config": DEFAULT_CONFIG}
-
-    # Merge with defaults to ensure all keys exist
-    merged = dict(DEFAULT_CONFIG)
-    merged.update(stored)
-    return {"config": merged}
-
-
-def get_sidebar_config_sync(user_id: int) -> dict:
-    """Synchronous helper to get sidebar config (used during template rendering)."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT sidebar_config FROM users WHERE id=?", (user_id,)
-        ).fetchone()
-    if not row:
-        return dict(DEFAULT_CONFIG)
-    raw = row["sidebar_config"]
-    if not raw:
-        return dict(DEFAULT_CONFIG)
-    try:
-        stored = json.loads(raw)
-    except (json.JSONDecodeError, TypeError):
-        return dict(DEFAULT_CONFIG)
-    merged = dict(DEFAULT_CONFIG)
-    merged.update(stored)
-    return merged
-
-
-@router.put("/config")
-def save_sidebar_config(request: Request, body: dict = Body(...)):
-    """Save the current user's sidebar customization config."""
-    user = _get_user(request)
-
-    config = body.get("config")
-    if not config or not isinstance(config, dict):
-        raise HTTPException(status_code=400, detail="config object is required")
-
-    # Merge with defaults to ensure validity
-    merged = dict(DEFAULT_CONFIG)
-    for key, val in config.items():
-        if key in DEFAULT_CONFIG and isinstance(val, dict):
-            merged[key] = {
-                "visible": val.get("visible", DEFAULT_CONFIG[key]["visible"]),
-                "order": val.get("order", DEFAULT_CONFIG[key]["order"]),
-                "show_count": val.get("show_count", DEFAULT_CONFIG[key]["show_count"]),
-            }
-        elif key not in DEFAULT_CONFIG:
-            # Allow new custom sections
-            merged[key] = val
-
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE users SET sidebar_config=? WHERE id=?",
-            (json.dumps(merged), user["id"]),
-        )
-        conn.commit()
-
-    return {"status": "ok", "config": merged}
@@ -1,822 +0,0 @@
-"""FlowDeck — Sites & public Forms (v6.8.0).
-
-Notion Sites + Forms parity: multi-page public sites (/s/<slug>) with nav,
-password/expiry gating, SEO + view stats, and anonymous collection forms
-(/f/<token>) with rate limiting, validation and notifications.
-
-Auth: session cookie first, Bearer token fallback (api_tokens,
-extension_devices, legacy user_tokens) via api_v2_helpers.
-"""
-from __future__ import annotations
-
-import hashlib
-import html
-import json
-import logging
-import re
-import secrets
-import time
-import unicodedata
-from datetime import UTC, datetime
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse, PlainTextResponse
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-from app.password_utils import hash_password, verify_password
-from app.services.api_v2_helpers import (
-    audit_log,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    resolve_bearer_token,
-    row_to_dict,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(tags=["sites"])
-
-_SLUG_RE = re.compile(r"^[a-z0-9-]{3,50}$")
-_FORM_TOKEN_RE = re.compile(r"^f_[A-Za-z0-9_-]{6,64}$")
-
-# In-memory rate limiting for anonymous form posts: ip -> (window_start, count).
-_form_rate: dict[str, tuple[float, int]] = {}
-_FORM_RATE_MAX = 20
-_FORM_RATE_WINDOW = 3600.0
-
-
-# ── helpers ────────────────────────────────────────────────────────────────
-
-def _slugify(title: str) -> str:
-    slug = unicodedata.normalize("NFKD", title or "").encode("ascii", "ignore").decode("ascii")
-    slug = re.sub(r"[^\w\s-]", "", slug.lower())
-    slug = re.sub(r"[-\s]+", "-", slug).strip("-")
-    return slug or "untitled"
-
-
-def _check_slug(slug: str) -> None:
-    if not _SLUG_RE.match(slug or ""):
-        raise HTTPException(400, "Invalid slug: 3-50 chars, lowercase letters, digits, dashes.")
-
-
-def _auth_user(request: Request, *, require_write: bool = False) -> dict:
-    """Session-first auth, Bearer fallback. Enforces scope for Bearer tokens."""
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        return sess
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if not user:
-            raise HTTPException(401, "Invalid or expired API token")
-        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
-            raise HTTPException(403, "Insufficient scope. Required: write")
-        return user
-    raise HTTPException(401, "Authentication required")
-
-
-def _site_auth_cookie(site_id: int) -> str:
-    return f"site_auth_{site_id}"
-
-
-def _site_unlocked(request: Request, site: dict) -> bool:
-    if not site.get("password_hash"):
-        return True
-    from itsdangerous import BadSignature, URLSafeTimedSerializer
-    ser = URLSafeTimedSerializer(settings.app_secret_key, salt="site-auth")
-    try:
-        val = ser.loads(request.cookies.get(_site_auth_cookie(site["id"]), ""), max_age=86400)
-        return val == site["id"]
-    except BadSignature:
-        return False
-    except Exception:
-        return False
-
-
-def _site_expired(site: dict) -> bool:
-    exp = site.get("expires_at")
-    if not exp:
-        return False
-    try:
-        dt = datetime.fromisoformat(str(exp).replace("Z", "+00:00"))
-        if dt.tzinfo is None:
-            dt = dt.replace(tzinfo=UTC)
-        return dt.timestamp() < time.time()
-    except Exception:
-        return False
-
-
-def _resolve_site(conn, *, slug: str = "", host: str = "") -> dict | None:
-    row = None
-    if slug:
-        row = conn.execute("SELECT * FROM sites WHERE slug=?", (slug,)).fetchone()
-    elif host:
-        row = conn.execute("SELECT * FROM sites WHERE custom_domain=?", (host.split(":")[0],)).fetchone()
-    return dict(row) if row else None
-
-
-def _site_pages(conn, site_id: int) -> list[dict]:
-    rows = conn.execute(
-        """SELECT p.id, p.title, p.page_icon, p.cover_url, p.updated_at, sp.position
-           FROM site_pages sp JOIN pages p ON p.id = sp.page_id
-           WHERE sp.site_id=? AND (p.deleted_at IS NULL OR p.deleted_at='')
-           ORDER BY sp.position, p.id""",
-        (site_id,),
-    ).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["slug"] = _slugify(d.get("title") or "untitled") or f"page-{d['id']}"
-        out.append(d)
-    return out
-
-
-def _find_site_page(pages: list[dict], ref: str) -> dict | None:
-    ref = (ref or "").strip()
-    if ref.isdigit():
-        for p in pages:
-            if p["id"] == int(ref):
-                return p
-    for p in pages:
-        if p["slug"] == ref:
-            return p
-    # slug with -<id> suffix fallback
-    m = re.search(r"-(\d+)$", ref)
-    if m:
-        for p in pages:
-            if p["id"] == int(m.group(1)):
-                return p
-    return None
-
-
-def _render_page_html(page: dict) -> str:
-    """Render a pages row to HTML (blocks → public renderer, else <pre>)."""
-    if page.get("content_format") == "blocks" and page.get("content"):
-        try:
-            from app.routers import dashboard as _dash
-            blocks = json.loads(page["content"])
-            try:
-                from app.services.synced_blocks import resolve_synced_block
-                blocks = resolve_synced_block(blocks)
-            except Exception:
-                logger.exception("_render_page_html")
-            titles: dict = {}
-            try:
-                from app.db import get_conn as _gc
-                from app.services.wiki_links import token_labels
-                with _gc() as _c:
-                    titles = token_labels(_c, page["content"])
-            except Exception:
-                titles = {}
-            return _dash._render_blocks_public(blocks, titles)
-        except Exception:
-            return f"<p>{html.escape(str(page.get('content', '')))}</p>"
-    if page.get("content"):
-        return (
-            "<pre style='white-space:pre-wrap;font-family:system-ui;"
-            f"font-size:16px;line-height:1.6;'>{html.escape(page['content'])}</pre>"
-        )
-    return "<p style='color:#999'>Empty page.</p>"
-
-
-def _site_shell(*, site: dict, pages: list[dict], current_id: int, title: str,
-                body_html: str, noindex: bool = False) -> str:
-    nav = "".join(
-        f"<a href='/s/{site['slug']}/{p['slug']}'"
-        f" style='display:block;padding:6px 10px;border-radius:6px;text-decoration:none;"
-        f"color:{'#fff' if p['id'] == current_id else '#bbb'};"
-        f"background:{'#333' if p['id'] == current_id else 'transparent'}'>"
-        f"{html.escape((p.get('page_icon') or '') + ' ' + (p.get('title') or 'Untitled'))}</a>"
-        for p in pages
-    )
-    robots = "noindex,nofollow" if (noindex or site.get("noindex")) else "index,follow"
-    desc = html.escape((site.get("title") or title)[:160])
-    theme_bg = "#191919" if site.get("theme", "dark") == "dark" else "#ffffff"
-    theme_fg = "#e0e0e0" if site.get("theme", "dark") == "dark" else "#222222"
-    return f"""<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
-<meta name="viewport" content="width=device-width,initial-scale=1.0">
-<meta name="robots" content="{robots}">
-<meta name="description" content="{desc}">
-<meta property="og:title" content="{html.escape(title)}">
-<meta property="og:description" content="{desc}">
-<meta name="twitter:card" content="summary">
-<title>{html.escape(title)} — {html.escape(site.get('title') or 'FlowDeck Site')}</title>
-<style>body{{font-family:system-ui,sans-serif;background:{theme_bg};color:{theme_fg};margin:0}}
-.layout{{display:flex;min-height:100vh}}.nav{{width:240px;padding:16px;border-right:1px solid #333}}
-.main{{flex:1;padding:32px;max-width:860px}}a{{color:#4c9aff}}
-@media(max-width:700px){{.nav{{display:none}}.main{{padding:16px}}}}</style></head>
-<body><div class="layout"><nav class="nav">
-<a href="/s/{site['slug']}" style="font-weight:700;color:{theme_fg};text-decoration:none">
-{html.escape(site.get('title') or 'Site')}</a><div style="height:12px"></div>{nav}</nav>
-<main class="main">{body_html}</main></div></body></html>"""
-
-
-def _track_view(site_id: int) -> None:
-    day = datetime.now(UTC).strftime("%Y-%m-%d")
-    try:
-        with get_conn() as conn:
-            conn.execute(
-                """INSERT INTO site_views (site_id, day, views) VALUES (?, ?, 1)
-                   ON CONFLICT(site_id, day) DO UPDATE SET views=views+1""",
-                (site_id, day),
-            )
-            conn.commit()
-    except Exception:
-        logger.exception("_track_view")
-
-
-def _form_config(conn, collection_id: int) -> dict:
-    row = conn.execute(
-        "SELECT id, name, form_config_json FROM collections WHERE id=?", (collection_id,)
-    ).fetchone()
-    if not row:
-        raise HTTPException(404, "Collection not found")
-    try:
-        cfg = json.loads(row["form_config_json"] or "{}")
-    except Exception:
-        cfg = {}
-    return {"id": row["id"], "name": row["name"], "config": cfg}
-
-
-def _check_form_rate(ip: str) -> None:
-    now = time.time()
-    start, count = _form_rate.get(ip, (now, 0))
-    if now - start > _FORM_RATE_WINDOW:
-        _form_rate[ip] = (now, 1)
-        return
-    if count >= _FORM_RATE_MAX:
-        raise HTTPException(429, "Too many submissions. Try again later.")
-    _form_rate[ip] = (start, count + 1)
-
-
-# ── Sites CRUD (session or Bearer) ─────────────────────────────────────────
-
-@router.post("/api/v2/sites")
-def create_site(request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    root_page_id = body.get("root_page_id")
-    if not root_page_id:
-        raise HTTPException(400, "root_page_id is required")
-    slug = (body.get("slug") or "").strip().lower() or None
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (root_page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Root page not found")
-        if not slug:
-            slug = _slugify(page["title"])
-            base, i = slug, 1
-            while conn.execute("SELECT id FROM sites WHERE slug=?", (slug,)).fetchone():
-                slug = f"{base}-{i}"
-                i += 1
-        else:
-            _check_slug(slug)
-            if conn.execute("SELECT id FROM sites WHERE slug=?", (slug,)).fetchone():
-                raise HTTPException(409, "Slug already taken")
-        theme = body.get("theme", "dark")
-        if theme not in ("light", "dark"):
-            raise HTTPException(400, "theme must be light or dark")
-        custom_domain = (body.get("custom_domain") or "").strip() or None
-        if custom_domain and conn.execute(
-            "SELECT id FROM sites WHERE custom_domain=?", (custom_domain,)
-        ).fetchone():
-            raise HTTPException(409, "Domain already linked to another site")
-        expires_at = body.get("expires_at")
-        if expires_at:
-            try:
-                datetime.fromisoformat(str(expires_at).replace("Z", "+00:00"))
-            except Exception:
-                raise HTTPException(400, "Invalid expires_at (use ISO-8601)") from None
-        cur = conn.execute(
-            """INSERT INTO sites (slug, root_page_id, title, theme, custom_domain,
-                                  expires_at, noindex, analytics_id, created_by)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-            (slug, root_page_id, body.get("title") or page["title"],
-             theme, custom_domain, expires_at,
-             1 if body.get("noindex") else 0,
-             (body.get("analytics_id") or "")[:120], user["id"]),
-        )
-        site_id = cur.lastrowid
-        conn.execute(
-            "INSERT OR IGNORE INTO site_pages (site_id, page_id, position) VALUES (?, ?, 0)",
-            (site_id, root_page_id),
-        )
-        conn.commit()
-        site = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-    audit_log(user, "site.create", "site", site_id, f"slug={slug}", request)
-    return JSONResponse(status_code=201, content=row_to_dict(site))
-
-
-@router.get("/api/v2/sites")
-def list_sites(request: Request):
-    user = _auth_user(request)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute(
-            "SELECT COUNT(*) FROM sites WHERE created_by=?", (user["id"],)
-        ).fetchone()[0]
-        rows = conn.execute(
-            "SELECT * FROM sites WHERE created_by=? ORDER BY id DESC LIMIT ? OFFSET ?",
-            (user["id"], limit, offset),
-        ).fetchall()
-    resp = JSONResponse([row_to_dict(r) for r in rows])
-    for k, v in paginate_headers(total).items():
-        resp.headers[k] = v
-    return resp
-
-
-@router.get("/api/v2/sites/{site_id}")
-def get_site(site_id: int, request: Request):
-    user = _auth_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Site not found")
-        site = dict(row)
-        if site.get("created_by") != user["id"] and not user.get("is_admin"):
-            raise HTTPException(404, "Site not found")
-        pages = _site_pages(conn, site_id)
-    out = row_to_dict(row)
-    out["pages"] = pages
-    return out
-
-
-@router.patch("/api/v2/sites/{site_id}")
-def update_site(site_id: int, request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Site not found")
-        site = dict(row)
-        if site.get("created_by") != user["id"] and not user.get("is_admin"):
-            raise HTTPException(404, "Site not found")
-        updates: dict = {}
-        if "title" in body:
-            updates["title"] = str(body["title"] or "")[:200]
-        if "theme" in body:
-            if body["theme"] not in ("light", "dark"):
-                raise HTTPException(400, "theme must be light or dark")
-            updates["theme"] = body["theme"]
-        if "slug" in body and body["slug"] != site["slug"]:
-            _check_slug(str(body["slug"]).lower())
-            if conn.execute(
-                "SELECT id FROM sites WHERE slug=? AND id!=?", (body["slug"].lower(), site_id)
-            ).fetchone():
-                raise HTTPException(409, "Slug already taken")
-            updates["slug"] = str(body["slug"]).lower()
-        if "custom_domain" in body:
-            dom = (body["custom_domain"] or "").strip() or None
-            if dom and conn.execute(
-                "SELECT id FROM sites WHERE custom_domain=? AND id!=?", (dom, site_id)
-            ).fetchone():
-                raise HTTPException(409, "Domain already linked to another site")
-            updates["custom_domain"] = dom
-        if "expires_at" in body:
-            if body["expires_at"]:
-                try:
-                    datetime.fromisoformat(str(body["expires_at"]).replace("Z", "+00:00"))
-                except Exception:
-                    raise HTTPException(400, "Invalid expires_at (use ISO-8601)") from None
-            updates["expires_at"] = body["expires_at"]
-        if "noindex" in body:
-            updates["noindex"] = 1 if body["noindex"] else 0
-        if "analytics_id" in body:
-            updates["analytics_id"] = str(body["analytics_id"] or "")[:120]
-        if "password" in body:
-            updates["password_hash"] = hash_password(str(body["password"])) if body["password"] else ""
-        if updates:
-            updates["updated_at"] = datetime.now(UTC).strftime("%Y-%m-%d %H:%M:%S")
-            sets = ", ".join(f"{k}=?" for k in updates)
-            conn.execute(f"UPDATE sites SET {sets} WHERE id=?", (*updates.values(), site_id))
-            conn.commit()
-        site = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-    audit_log(user, "site.update", "site", site_id, ",".join(updates), request)
-    return row_to_dict(site)
-
-
-@router.delete("/api/v2/sites/{site_id}")
-def delete_site(site_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Site not found")
-        if row["created_by"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(404, "Site not found")
-        conn.execute("DELETE FROM sites WHERE id=?", (site_id,))
-        conn.commit()
-    audit_log(user, "site.delete", "site", site_id, "", request)
-    return {"status": "deleted", "id": site_id}
-
-
-@router.get("/api/v2/sites/{site_id}/pages")
-def list_site_pages(site_id: int, request: Request):
-    user = _auth_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
-            raise HTTPException(404, "Site not found")
-        return {"site_id": site_id, "pages": _site_pages(conn, site_id)}
-
-
-@router.post("/api/v2/sites/{site_id}/pages")
-def add_site_page(site_id: int, request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    page_id = body.get("page_id")
-    if not page_id:
-        raise HTTPException(400, "page_id is required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
-            raise HTTPException(404, "Site not found")
-        if not conn.execute("SELECT id FROM pages WHERE id=?", (page_id,)).fetchone():
-            raise HTTPException(404, "Page not found")
-        pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1)+1 FROM site_pages WHERE site_id=?", (site_id,)
-        ).fetchone()[0]
-        conn.execute(
-            "INSERT OR IGNORE INTO site_pages (site_id, page_id, position) VALUES (?, ?, ?)",
-            (site_id, page_id, pos),
-        )
-        conn.commit()
-        pages = _site_pages(conn, site_id)
-    audit_log(user, "site.page.add", "site", site_id, f"page={page_id}", request)
-    return {"site_id": site_id, "pages": pages}
-
-
-@router.delete("/api/v2/sites/{site_id}/pages/{page_id}")
-def remove_site_page(site_id: int, page_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
-            raise HTTPException(404, "Site not found")
-        if page_id == row["root_page_id"]:
-            raise HTTPException(400, "Cannot remove the root page")
-        conn.execute(
-            "DELETE FROM site_pages WHERE site_id=? AND page_id=?", (site_id, page_id)
-        )
-        conn.commit()
-    audit_log(user, "site.page.remove", "site", site_id, f"page={page_id}", request)
-    return {"status": "removed", "site_id": site_id, "page_id": page_id}
-
-
-@router.get("/api/v2/sites/{site_id}/stats")
-def site_stats(site_id: int, request: Request, days: int = 30):
-    user = _auth_user(request)
-    days = max(1, min(int(days or 30), 365))
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
-        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
-            raise HTTPException(404, "Site not found")
-        rows = conn.execute(
-            "SELECT day, views FROM site_views WHERE site_id=? ORDER BY day DESC LIMIT ?",
-            (site_id, days),
-        ).fetchall()
-        total = conn.execute(
-            "SELECT COALESCE(SUM(views), 0) FROM site_views WHERE site_id=?", (site_id,)
-        ).fetchone()[0]
-    return {"site_id": site_id, "total_views": total,
-            "days": [{"day": r["day"], "views": r["views"]} for r in rows]}
-
-
-# ── Public site rendering ──────────────────────────────────────────────────
-
-def _public_guard(site: dict, request: Request):
-    if _site_expired(site):
-        return HTMLResponse("<h1>410 — Site expired.</h1>", status_code=410)
-    if site.get("password_hash") and not _site_unlocked(request, site):
-        return HTMLResponse(
-            f"""<!DOCTYPE html><html><body style="font-family:system-ui;background:#191919;color:#eee;
-            display:flex;align-items:center;justify-content:center;height:100vh">
-            <form method="post" action="/s/{site['slug']}/auth">
-            <h2>🔒 {html.escape(site.get('title') or 'Protected site')}</h2>
-            <input type="password" name="password" placeholder="Password"
-             style="padding:8px;border-radius:6px;border:1px solid #444;background:#222;color:#fff">
-            <button style="padding:8px 14px;border-radius:6px">Unlock</button></form></body></html>""",
-            status_code=401,
-        )
-    return None
-
-
-@router.get("/s/{slug}", response_class=HTMLResponse)
-def public_site_home(request: Request, slug: str):
-    with get_conn() as conn:
-        site = _resolve_site(conn, slug=slug,
-                             host=request.headers.get("host", ""))
-        if not site:
-            return HTMLResponse("<h1>404 — Site not found.</h1>", status_code=404)
-        guard = _public_guard(site, request)
-        if guard:
-            return guard
-        pages = _site_pages(conn, site["id"])
-        page = conn.execute("SELECT * FROM pages WHERE id=?", (site["root_page_id"],)).fetchone()
-        if not page:
-            return HTMLResponse("<h1>404 — Root page removed.</h1>", status_code=404)
-        page = dict(page)
-    _track_view(site["id"])
-    body = f"<h1>{html.escape(page.get('title') or 'Untitled')}</h1>" + _render_page_html(page)
-    return _site_shell(site=site, pages=pages, current_id=page["id"],
-                       title=page.get("title") or "Untitled", body_html=body)
-
-
-@router.get("/s/{slug}/sitemap.xml", response_class=PlainTextResponse)
-def site_sitemap(request: Request, slug: str):
-    with get_conn() as conn:
-        site = _resolve_site(conn, slug=slug)
-        if not site or _site_expired(site) or site.get("password_hash"):
-            return PlainTextResponse("Not found", status_code=404)
-        pages = _site_pages(conn, site["id"])
-    base = str(request.base_url).rstrip("/")
-    urls = [f"<url><loc>{base}/s/{slug}</loc></url>"] + [
-        f"<url><loc>{base}/s/{slug}/{p['slug']}</loc></url>" for p in pages
-    ]
-    return PlainTextResponse(
-        "<?xml version='1.0' encoding='UTF-8'?>"
-        "<urlset xmlns='http://www.sitemaps.org/schemas/sitemap/0.9'>"
-        f"{''.join(urls)}</urlset>",
-        media_type="application/xml",
-    )
-
-
-@router.get("/s/{slug}/{page_ref}", response_class=HTMLResponse)
-def public_site_page(request: Request, slug: str, page_ref: str):
-    with get_conn() as conn:
-        site = _resolve_site(conn, slug=slug, host=request.headers.get("host", ""))
-        if not site:
-            return HTMLResponse("<h1>404 — Site not found.</h1>", status_code=404)
-        guard = _public_guard(site, request)
-        if guard:
-            return guard
-        pages = _site_pages(conn, site["id"])
-        target = _find_site_page(pages, page_ref)
-        if not target:
-            return HTMLResponse("<h1>404 — Page not in this site.</h1>", status_code=404)
-        page = conn.execute("SELECT * FROM pages WHERE id=?", (target["id"],)).fetchone()
-        if not page:
-            return HTMLResponse("<h1>404 — Page removed.</h1>", status_code=404)
-        page = dict(page)
-    _track_view(site["id"])
-    body = f"<h1>{html.escape(page.get('title') or 'Untitled')}</h1>" + _render_page_html(page)
-    return _site_shell(site=site, pages=pages, current_id=page["id"],
-                       title=page.get("title") or "Untitled", body_html=body)
-
-
-@router.post("/s/{slug}/auth")
-async def public_site_auth(request: Request, slug: str):
-    with get_conn() as conn:
-        site = _resolve_site(conn, slug=slug)
-        if not site:
-            return JSONResponse({"detail": "Site not found"}, status_code=404)
-    if not site.get("password_hash"):
-        return {"status": "public"}
-    ctype = request.headers.get("content-type", "")
-    password = ""
-    if "application/json" in ctype:
-        try:
-            password = (await request.json()).get("password", "")
-        except Exception:
-            logger.exception("public_site_auth")
-            password = ""
-    else:
-        try:
-            form = await request.form()
-            password = form.get("password", "")
-        except Exception:
-            logger.exception("public_site_auth")
-            password = ""
-    if not verify_password(password or "", site["password_hash"] or ""):
-        raise HTTPException(401, "Wrong password")
-    from itsdangerous import URLSafeTimedSerializer
-    ser = URLSafeTimedSerializer(settings.app_secret_key, salt="site-auth")
-    resp = JSONResponse({"status": "unlocked"})
-    resp.set_cookie(_site_auth_cookie(site["id"]), ser.dumps(site["id"]),
-                    httponly=True, samesite="lax", max_age=86400, path="/")
-    return resp
-
-
-# ── Public Forms ───────────────────────────────────────────────────────────
-
-@router.get("/api/v2/collections/{collection_id}/form")
-def get_form_config(collection_id: int, request: Request):
-    _auth_user(request)
-    with get_conn() as conn:
-        info = _form_config(conn, collection_id)
-    return {"collection_id": collection_id, "name": info["name"], "form": info["config"]}
-
-
-@router.put("/api/v2/collections/{collection_id}/form")
-def put_form_config(collection_id: int, request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        info = _form_config(conn, collection_id)
-        cfg = info["config"] if isinstance(info["config"], dict) else {}
-        if "enabled" in body:
-            cfg["enabled"] = bool(body["enabled"])
-        for key in ("title", "success_message"):
-            if key in body:
-                cfg[key] = str(body[key] or "")[:300]
-        for key in ("fields", "required", "notify_user_ids"):
-            if key in body and isinstance(body[key], list):
-                cfg[key] = body[key][:50]
-        if "public_token" in body and body["public_token"]:
-            tok = str(body["public_token"])
-            if not _FORM_TOKEN_RE.match(tok):
-                raise HTTPException(400, "Invalid public_token (f_ + 6-64 chars)")
-            cfg["public_token"] = tok
-        if cfg.get("enabled") and not cfg.get("public_token"):
-            cfg["public_token"] = "f_" + secrets.token_urlsafe(9)
-        conn.execute(
-            "UPDATE collections SET form_config_json=? WHERE id=?",
-            (json.dumps(cfg), collection_id),
-        )
-        conn.commit()
-    audit_log(user, "form.config", "collection", collection_id, "", request)
-    return {"collection_id": collection_id, "form": cfg}
-
-
-def _collection_props(conn, collection_id: int) -> list[dict]:
-    return [dict(r) for r in conn.execute(
-        "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-        (collection_id,)).fetchall()]
-
-
-@router.get("/f/{token}", response_class=HTMLResponse)
-def public_form(request: Request, token: str):
-    embed = request.query_params.get("embed") == "1"
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections").fetchone()
-        target = None
-        if _FORM_TOKEN_RE.match(token or ""):
-            for c in conn.execute("SELECT id, name, form_config_json FROM collections").fetchall():
-                try:
-                    cfg = json.loads(c["form_config_json"] or "{}")
-                except Exception:
-                    continue
-                if cfg.get("enabled") and cfg.get("public_token") == token:
-                    target = (c, cfg)
-                    break
-        _ = row
-        if not target:
-            return HTMLResponse("<h1>404 — Form not found.</h1>", status_code=404)
-        coll, cfg = target
-        props = _collection_props(conn, coll["id"])
-    fields = cfg.get("fields") or [p["name"] for p in props if p["prop_type"] != "formula"][:10]
-    required = set(cfg.get("required") or [])
-    inputs = ""
-    for name in fields:
-        prop = next((p for p in props if p["name"] == name), None)
-        ptype = (prop or {}).get("prop_type", "text")
-        itype = {"number": "number", "email": "email", "url": "url",
-                 "date": "date", "phone": "tel"}.get(ptype, "text")
-        req = "required" if name in required else ""
-        if ptype in ("select", "status") and prop:
-            try:
-                opts = json.loads(prop.get("options_json") or "[]")
-            except Exception:
-                opts = []
-            opts_html = "".join(
-                f"<option>{html.escape(o.get('name', ''))}</option>" for o in opts)
-            inputs += (f"<label>{html.escape(name)}{'*' if req else ''}</label>"
-                       f"<select name='{html.escape(name)}' {req}>{opts_html}</select>")
-        elif ptype == "checkbox":
-            inputs += (f"<label><input type='checkbox' name='{html.escape(name)}'> "
-                       f"{html.escape(name)}</label>")
-        else:
-            inputs += (f"<label>{html.escape(name)}{'*' if req else ''}</label>"
-                       f"<input type='{itype}' name='{html.escape(name)}' {req}>")
-    chrome = "" if embed else f"<h1>{html.escape(cfg.get('title') or coll['name'])}</h1>"
-    return HTMLResponse(
-        f"""<!DOCTYPE html><html><head><meta charset="UTF-8">
-<meta name="viewport" content="width=device-width,initial-scale=1.0">
-<title>{html.escape(cfg.get('title') or coll['name'])}</title>
-<style>body{{font-family:system-ui;background:#191919;color:#eee;margin:0;padding:24px}}
-form{{max-width:520px;margin:auto}}label{{display:block;margin:12px 0 4px}}
-input,select,textarea{{width:100%;padding:8px;border-radius:6px;border:1px solid #444;background:#222;color:#fff}}
-button{{margin-top:16px;padding:10px 18px;border-radius:6px;border:0;background:#2383E2;color:#fff}}</style>
-</head><body>{chrome}
-<form method="post" action="/f/{token}">
-<input type="text" name="__hp" style="display:none" tabindex="-1" autocomplete="off">
-{inputs}<button>Submit</button></form></body></html>"""
-    )
-
-
-@router.post("/f/{token}")
-async def submit_form(request: Request, token: str):
-    ip = request.client.host if request.client else "unknown"
-    _check_form_rate(ip or "unknown")
-    ctype = request.headers.get("content-type", "")
-    data: dict = {}
-    if "application/json" in ctype:
-        try:
-            data = await request.json()
-        except Exception:
-            data = {}
-    else:
-        try:
-            form = await request.form()
-            data = dict(form)
-        except Exception:
-            data = {}
-    if data.get("__hp"):
-        raise HTTPException(400, "Spam detected")
-    with get_conn() as conn:
-        target = None
-        if _FORM_TOKEN_RE.match(token or ""):
-            for c in conn.execute("SELECT id, name, form_config_json FROM collections").fetchall():
-                try:
-                    cfg = json.loads(c["form_config_json"] or "{}")
-                except Exception:
-                    continue
-                if cfg.get("enabled") and cfg.get("public_token") == token:
-                    target = (c, cfg)
-                    break
-        if not target:
-            # NOTE: return (not raise) — the global 404 handler redirects
-            # non-/api paths to /workspaces, which would turn this into a 200.
-            return JSONResponse({"detail": "Form not found"}, status_code=404)
-        coll, cfg = target
-        props = _collection_props(conn, coll["id"])
-        by_name = {p["name"]: p for p in props}
-        fields = cfg.get("fields") or list(by_name)[:10]
-        required = set(cfg.get("required") or [])
-        values: dict = {}
-        for name in fields:
-            prop = by_name.get(name)
-            if not prop:
-                continue
-            raw = data.get(name, "")
-            if prop["prop_type"] == "checkbox":
-                raw = True if raw in (True, "on", "true", "1", "checked") else False
-            if name in required and (raw is None or raw == "" or raw is False):
-                raise HTTPException(400, f"Field required: {name}")
-            values[str(prop["id"])] = raw
-        # Validate via property_types.validate_property_rule
-        try:
-            from app.services.property_types import validate_property_rule
-            for name in fields:
-                prop = by_name.get(name)
-                if not prop:
-                    continue
-                ok, _msg = validate_property_rule(
-                    prop.get("prop_type", "text"), values.get(str(prop["id"])),
-                    prop.get("validation_json") or prop.get("options_json") or "")
-                if not ok:
-                    raise HTTPException(400, f"Invalid value for {name}: {_msg}")
-        except HTTPException:
-            raise
-        except Exception:
-            logger.exception("submit_form")
-        title = str(data.get(by_name[fields[0]]["name"], "Form response") if fields else "Form response")[:200]
-        cur = conn.execute(
-            """INSERT INTO collection_pages (collection_id, title, property_values_json)
-               VALUES (?, ?, ?)""",
-            (coll["id"], title or "Form response", json.dumps(values)),
-        )
-        row_id = cur.lastrowid
-        ip_hash = hashlib.sha256(f"{ip}|{datetime.now(UTC).strftime('%Y-%m-%d')}".encode()).hexdigest()
-        conn.execute(
-            "INSERT INTO form_responses (collection_id, row_id, ip_hash) VALUES (?, ?, ?)",
-            (coll["id"], row_id, ip_hash),
-        )
-        conn.commit()
-        notify_ids = cfg.get("notify_user_ids") or []
-    # Notify (never throws the submission)
-    try:
-        from app.services.notifications import create_notification
-        for uid in notify_ids[:20]:
-            try:
-                create_notification(int(uid), None, "form_response",
-                                    f"New response: {coll['name']}",
-                                    f"{title}", "collection", coll["id"],
-                                    f"/db/{coll['id']}")
-            except Exception:
-                continue
-    except Exception:
-        logger.exception("submit_form")
-    try:
-        from app.services.automations import fire_event as _fire
-        await _fire("form.submitted", {"collection_id": coll["id"], "row_id": row_id})
-    except Exception:
-        logger.exception("submit_form")
-    if "application/json" in ctype:
-        return {"status": "ok", "row_id": row_id,
-                "message": cfg.get("success_message") or "Merci !"}
-    return HTMLResponse(
-        f"""<!DOCTYPE html><html><body style="font-family:system-ui;background:#191919;color:#eee;
-        display:flex;align-items:center;justify-content:center;height:100vh">
-        <p>{html.escape(cfg.get('success_message') or 'Merci !')}</p></body></html>"""
-    )
-
-
-# used by tests to reset the anonymous rate limiter
-def _reset_form_rate() -> None:
-    _form_rate.clear()
-
-
-# Backwards-compat alias for tests importing ``get_bearer_user`` from here.
-__all__ = ["router", "get_bearer_user"]
@@ -1,652 +0,0 @@
-"""FlowDeck — v6.7.0 SSO: SAML 2.0 + OIDC endpoints and admin config API.
-
-Two families of routes:
-
-* ``/auth/saml/*`` and ``/auth/oidc/*`` — the browser flows (login redirect,
-  ACS callback, SP metadata, Single Logout). The callback endpoints are
-  CSRF-exempt (cross-site POST from the IdP) and instead protected by the
-  single-use ``sso_requests`` relay token + full assertion validation.
-* ``/api/v2/sso/*`` — admin configuration API (session admin or Bearer token
-  with write scope), consumed by Settings → Admin → SSO / Enterprise.
-
-Every attempt — success or rejection — lands in ``sso_login_history``.
-"""
-from __future__ import annotations
-
-import logging
-import secrets
-import time
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
-
-from app.auth.providers import oidc_provider, saml_provider
-from app.auth.session import SessionManager
-from app.services import sso_provisioning as sso
-from app.services.api_v2_helpers import has_scope, resolve_bearer_token
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["sso"])
-
-DEFAULT_NEXT = "/workspaces"
-
-# ── Rate limiting (design §5.2: 5 SSO attempts / minute / IP) ──────────────
-_RATE_WINDOW = 60.0
-_RATE_MAX = 5
-_rate_store: dict[str, tuple[float, int]] = {}
-
-
-def _rate_ok(request: Request, bucket: str = "sso") -> bool:
-    from app.config import settings
-
-    if not settings.rate_limit_enabled:
-        return True
-    ip = request.client.host if request.client else "unknown"
-    key = f"{bucket}:{ip}"
-    now = time.time()
-    window, count = _rate_store.get(key, (0.0, 0))
-    if now - window > _RATE_WINDOW:
-        _rate_store[key] = (now, 1)
-        return True
-    if count >= _RATE_MAX:
-        return False
-    _rate_store[key] = (window, count + 1)
-    return True
-
-
-def _page(title: str, body: str, status: int = 200) -> HTMLResponse:
-    """Small standalone error/info page (same styling as the login page)."""
-    return HTMLResponse(
-        f"""<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
-<title>FlowDeck — {title}</title><style>
-*{{margin:0;padding:0;box-sizing:border-box}}
-body{{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;
-display:flex;align-items:center;justify-content:center;min-height:100vh;}}
-.box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:460px;text-align:center;}}
-h1{{font-size:20px;margin-bottom:12px}}p{{color:rgba(255,255,255,.55);font-size:14px;margin-bottom:10px;line-height:1.5;word-break:break-word}}
-a{{color:#2383E2;font-size:14px;text-decoration:none}}a:hover{{text-decoration:underline}}
-</style></head><body><div class="box"><h1>{title}</h1>{body}</div></body></html>""",
-        status_code=status,
-    )
-
-
-def _sso_config_or_error() -> dict | None:
-    cfg = sso.get_sso_config()
-    return sso.normalize_config(cfg) if cfg else None
-
-
-def _session_cookie(user_data: dict, request: Request):
-    """Signed, revocable session cookie (same shape as local/OAuth logins)."""
-    return SessionManager.create_session(user_data, request)
-
-
-def _login_error(message: str, *, cfg: dict | None, identifier: str = "", request=None) -> HTMLResponse:
-    provider_type = (cfg or {}).get("provider_type", "saml")
-    sso.log_sso_login(
-        user_id=None,
-        provider_type=provider_type,
-        provider_name=(cfg or {}).get("name") or "SSO",
-        identifier=identifier,
-        request=request,
-        success=False,
-        error=message,
-    )
-    logger.warning("SSO login rejected: %s", message)
-    safe = (
-        message.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")[:400]
-    )
-    return _page(
-        "SSO sign-in failed",
-        f"<p>{safe}</p><p><a href=\"/auth/login?provider=local\">↩ Back to login</a></p>",
-        status=403,
-    )
-
-
-# ═══════════════════════════════ SAML 2.0 ════════════════════════════════
-
-
-@router.get("/auth/saml/login")
-def saml_login(request: Request, next: str = DEFAULT_NEXT):
-    """SP-initiated SSO: issue an AuthnRequest and redirect to the IdP."""
-    if not _rate_ok(request, "saml"):
-        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "saml":
-        return _page(
-            "SAML not configured",
-            "<p>Single Sign-On has not been set up by the server administrator.</p>"
-            "<p><a href=\"/auth/login?provider=local\">↩ Use local login</a></p>",
-            status=404,
-        )
-
-    cfg = sso.ensure_sp_keypair(cfg)
-    # RelayState = "<AuthnRequest id>.<CSRF token>" — both checked at the ACS.
-    csrf_token = secrets.token_hex(16)
-    # The id is only known after building the request, so build it first with a
-    # placeholder relay state, then re-issue with the real one? python3-saml
-    # builds the AuthnRequest inside login(); we instead create the row right
-    # after login() returns the URL — but the RelayState is already embedded.
-    # So: generate the request id ourselves is not possible → build the URL,
-    # then patch the RelayState by rebuilding with the known id.
-    from urllib.parse import parse_qs, urlencode, urlparse
-
-    provisional = saml_provider.create_login(request, cfg, relay_state="_pending_")
-    authn_id = provisional[1]
-    relay = f"{authn_id}.{csrf_token}"
-    sso.create_request(
-        "saml_authn",
-        request_id=authn_id,
-        relay_state=csrf_token,
-        next_path=sso.safe_next_path(next),
-    )
-    # Replace the placeholder RelayState with the real token (same SAMLRequest).
-    parsed = urlparse(provisional[0])
-    params = parse_qs(parsed.query)
-    params["RelayState"] = [relay]
-    flat = [(k, v) for k, values in params.items() for v in values]
-    url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urlencode(flat)}"
-    return RedirectResponse(url, status_code=302)
-
-
-@router.post("/auth/saml/callback")
-async def saml_callback(request: Request):
-    """Assertion Consumer Service — validate the SAMLResponse and open a session."""
-    if not _rate_ok(request, "saml-cb"):
-        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
-
-    form = await request.form()
-    saml_response = str(form.get("SAMLResponse") or "")
-    relay_state = str(form.get("RelayState") or "")
-    if not saml_response:
-        return _login_error("Missing SAMLResponse", cfg=None, request=request)
-
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "saml":
-        return _login_error("SAML is not configured", cfg=None, request=request)
-
-    authn_id, _, csrf_token = relay_state.partition(".")
-    pending = sso.peek_request("saml_authn", authn_id)
-    if not pending and sso.was_consumed("saml_authn", authn_id):
-        # Same assertion twice: the single-use row is already spent.
-        return _login_error(
-            "Replayed SAML response rejected", cfg=cfg, identifier=authn_id, request=request
-        )
-    if not pending or not csrf_token or not secrets.compare_digest(
-        pending.get("relay_state", ""), csrf_token
-    ):
-        return _login_error(
-            "Unknown or expired login request (start again from the login page)",
-            cfg=cfg, request=request,
-        )
-
-    try:
-        identity = saml_provider.process_response(
-            request, cfg, {"SAMLResponse": saml_response, "RelayState": relay_state}, authn_id
-        )
-    except saml_provider.SAMLError as err:
-        return _login_error(str(err), cfg=cfg, identifier=authn_id, request=request)
-
-    # Single-use: the same AuthnRequest id can never authenticate twice.
-    consumed = sso.consume_request("saml_authn", authn_id, csrf_token)
-    if not consumed:
-        return _login_error(
-            "Replayed SAML response rejected", cfg=cfg, identifier=authn_id, request=request
-        )
-
-    claims = sso.identity_from_saml(identity, cfg)
-    identifier = sso.sso_identifier_field(claims)
-    try:
-        user = sso.handle_sso_login(claims, provider_type="saml", cfg=cfg, request=request)
-    except sso.SSOProvisioningError as err:
-        # _login_error() below records the failed attempt itself.
-        return _login_error(str(err), cfg=cfg, identifier=identifier, request=request)
-
-    sso.log_sso_login(
-        user_id=user["id"], provider_type="saml",
-        provider_name=cfg.get("name") or "SSO", identifier=identifier,
-        request=request, success=True,
-    )
-    user_data = dict(user)
-    user_data["_sso_name_id"] = identity.name_id
-    user_data["_sso_session_index"] = identity.session_index
-    response = RedirectResponse(consumed.get("next_path") or DEFAULT_NEXT, status_code=302)
-    response.set_cookie(
-        "flowdeck_session", _session_cookie(user_data, request),
-        httponly=True, max_age=86400 * 7, samesite="lax", path="/",
-    )
-    return response
-
-
-@router.get("/auth/saml/metadata")
-def saml_metadata(request: Request):
-    """SP metadata XML — paste into the IdP (Azure AD / Okta / Keycloak…)."""
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "saml":
-        return _page("SAML not configured", "<p>No SAML configuration found.</p>", status=404)
-    cfg = sso.ensure_sp_keypair(cfg)
-    try:
-        xml = saml_provider.metadata_xml(request, cfg)
-    except saml_provider.SAMLError as err:
-        return _page("Metadata error", f"<p>{err}</p>", status=500)
-    return HTMLResponse(xml, media_type="application/samlmetadata+xml")
-
-
-async def _saml_logout(request: Request, next: str = "/auth/login?provider=local"):
-    """Single Logout: SP-initiated (our logout button) or IdP-initiated.
-
-    * no SAML payload → build a LogoutRequest to the IdP (after revoking the
-      local session);
-    * ``SAMLRequest`` / ``SAMLResponse`` present → process it (LogoutResponse
-      of our own SLO, or a LogoutRequest issued by the IdP).
-    """
-    form = dict(await request.form()) if request.method == "POST" else {}
-    query = dict(request.query_params)
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "saml":
-        response = RedirectResponse(next, status_code=302)
-        response.delete_cookie("flowdeck_session")
-        return response
-
-    payload = form.get("SAMLRequest") or form.get("SAMLResponse") or query.get("SAMLResponse")
-    if payload:
-        try:
-            url, errors = saml_provider.process_slo_form(request, cfg, form, query)
-        except saml_provider.SAMLError as err:
-            logger.warning("SLO processing failed: %s", err)
-            return _login_error(str(err), cfg=cfg, request=request)
-        if errors:
-            return _login_error(
-                "; ".join(errors)[:300], cfg=cfg, request=request
-            )
-        response = RedirectResponse(url or next, status_code=302)
-        response.delete_cookie("flowdeck_session")
-        return response
-
-    # SP-initiated
-    cookie = request.cookies.get("flowdeck_session", "")
-    user = SessionManager.decode_session(cookie) if cookie else None
-    response = RedirectResponse(next, status_code=302)
-    if cookie:
-        sid = SessionManager.session_id(cookie)
-        if sid:
-            SessionManager.revoke_session(sid)
-        response.delete_cookie("flowdeck_session")
-    if user and cfg.get("slo_url") and user.get("_sso_name_id"):
-        try:
-            logout_url = saml_provider.build_logout_url(
-                request, cfg,
-                return_to=sso.safe_next_path(next),
-                name_id=user.get("_sso_name_id", ""),
-                session_index=user.get("_sso_session_index", ""),
-            )
-            # Keep the cookie-clearing headers built above: hand the browser
-            # to the IdP with our local session already dead.
-            response = RedirectResponse(logout_url, status_code=302)
-            response.delete_cookie("flowdeck_session")
-            return response
-        except saml_provider.SAMLError as err:
-            logger.warning("SP-initiated SLO failed: %s", err)
-    return response
-
-
-
-@router.get("/auth/saml/logout")
-async def saml_logout(request: Request, next: str = "/auth/login?provider=local"):
-    """SP-initiated Single Logout (GET) — hands the browser to the IdP."""
-    return await _saml_logout(request, next)
-
-
-@router.post("/auth/saml/logout")
-async def saml_logout_post(request: Request, next: str = "/auth/login?provider=local"):
-    """IdP-initiated Single Logout (POST with SAMLRequest/SAMLResponse)."""
-    return await _saml_logout(request, next)
-
-
-# ═════════════════════════════════ OIDC ═══════════════════════════════════
-
-
-@router.get("/auth/oidc/login")
-async def oidc_login(request: Request, next: str = DEFAULT_NEXT):
-    """Redirect to the OIDC provider (authorization code + PKCE)."""
-    if not _rate_ok(request, "oidc"):
-        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "oidc":
-        return _page(
-            "OIDC not configured",
-            "<p>Single Sign-On has not been set up by the server administrator.</p>"
-            "<p><a href=\"/auth/login?provider=local\">↩ Use local login</a></p>",
-            status=404,
-        )
-    try:
-        doc = await oidc_provider.discover(cfg["issuer_url"])
-    except oidc_provider.OIDCError as err:
-        return _login_error(str(err), cfg=cfg, request=request)
-
-    from app.auth.providers.saml_provider import external_base_url
-
-    state = secrets.token_hex(32)
-    nonce = secrets.token_hex(16)
-    verifier, challenge = oidc_provider.pkce_pair()
-    sso.create_request(
-        "oidc",
-        request_id=state,
-        relay_state=nonce,
-        code_verifier=verifier,
-        next_path=sso.safe_next_path(next),
-    )
-    url = oidc_provider.build_authorize_url(
-        doc,
-        client_id=cfg["client_id"],
-        redirect_uri=f"{external_base_url(request)}/auth/oidc/callback",
-        scope=cfg.get("scope") or "openid profile email",
-        state=state,
-        nonce=nonce,
-        code_challenge=challenge,
-    )
-    return RedirectResponse(url, status_code=302)
-
-
-async def _oidc_callback(request: Request):
-    """OIDC callback: exchange the code, validate the ID token, open a session."""
-    if not _rate_ok(request, "oidc-cb"):
-        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
-
-    params = dict(request.query_params)
-    if request.method == "POST":
-        params.update({k: str(v) for k, v in (await request.form()).items()})
-
-    cfg = _sso_config_or_error()
-    if not cfg or cfg["provider_type"] != "oidc":
-        return _login_error("OIDC is not configured", cfg=None, request=request)
-
-    if params.get("error"):
-        return _login_error(
-            f"Provider error: {params.get('error')} {params.get('error_description', '')}".strip(),
-            cfg=cfg, request=request,
-        )
-    code, state = params.get("code", ""), params.get("state", "")
-    pending = sso.consume_request("oidc", state)
-    if not code or not pending:
-        return _login_error(
-            "Unknown or expired OIDC state (start again from the login page)",
-            cfg=cfg, request=request,
-        )
-
-    from app.auth.providers.saml_provider import external_base_url
-
-    try:
-        doc = await oidc_provider.discover(cfg["issuer_url"])
-        tokens = await oidc_provider.exchange_code(
-            doc,
-            client_id=cfg["client_id"],
-            client_secret=sso.client_secret_value(cfg),
-            code=code,
-            redirect_uri=f"{external_base_url(request)}/auth/oidc/callback",
-            code_verifier=pending.get("code_verifier", ""),
-        )
-        jwks = await _fetch_jwks(doc)
-        claims = oidc_provider.validate_id_token(
-            tokens.get("id_token", ""),
-            issuer=cfg["issuer_url"],
-            client_id=cfg["client_id"],
-            nonce=pending.get("relay_state", ""),
-            jwks=jwks,
-        )
-        userinfo = await oidc_provider.fetch_userinfo(doc, tokens.get("access_token", ""))
-    except oidc_provider.OIDCError as err:
-        return _login_error(str(err), cfg=cfg, identifier=state, request=request)
-
-    merged = {**claims, **userinfo}
-    identity = oidc_provider.claims_to_identity(merged, cfg.get("attribute_mapping") or None)
-    identifier = sso.sso_identifier_field(identity)
-    try:
-        user = sso.handle_sso_login(identity, provider_type="oidc", cfg=cfg, request=request)
-    except sso.SSOProvisioningError as err:
-        # _login_error() below records the failed attempt itself.
-        return _login_error(str(err), cfg=cfg, identifier=identifier, request=request)
-
-    sso.log_sso_login(
-        user_id=user["id"], provider_type="oidc",
-        provider_name=cfg.get("name") or "SSO", identifier=identifier,
-        request=request, success=True,
-    )
-    response = RedirectResponse(pending.get("next_path") or DEFAULT_NEXT, status_code=302)
-    response.set_cookie(
-        "flowdeck_session", _session_cookie(dict(user), request),
-        httponly=True, max_age=86400 * 7, samesite="lax", path="/",
-    )
-    return response
-
-
-
-@router.get("/auth/oidc/callback")
-async def oidc_callback(request: Request):
-    """OIDC callback (GET, authorization code in the query string)."""
-    return await _oidc_callback(request)
-
-
-@router.post("/auth/oidc/callback")
-async def oidc_callback_post(request: Request):
-    """OIDC callback (POST, form_post response mode)."""
-    return await _oidc_callback(request)
-
-
-async def _fetch_jwks(doc: dict) -> dict:
-    url = doc.get("jwks_uri")
-    if not url:
-        raise oidc_provider.OIDCError("Discovery document has no jwks_uri")
-
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.get(url)
-            r.raise_for_status()
-            data = r.json()
-    except Exception as err:
-        raise oidc_provider.OIDCError(f"Could not fetch the issuer JWKS: {err}") from err
-    if not isinstance(data, dict) or not data.get("keys"):
-        raise oidc_provider.OIDCError("Issuer JWKS contains no keys")
-    return data
-
-
-async def _oidc_logout(request: Request, next: str = "/auth/login?provider=local"):
-    """Local logout + RP-initiated logout at the provider when supported."""
-    cfg = _sso_config_or_error()
-    response = RedirectResponse(next, status_code=302)
-    cookie = request.cookies.get("flowdeck_session", "")
-    if cookie:
-        sid = SessionManager.session_id(cookie)
-        if sid:
-            SessionManager.revoke_session(sid)
-        response.delete_cookie("flowdeck_session")
-    if cfg and cfg["provider_type"] == "oidc":
-        try:
-            doc = await oidc_provider.discover(cfg["issuer_url"])
-            end_session = doc.get("end_session_endpoint")
-            if end_session:
-                from urllib.parse import urlencode
-
-                from app.auth.providers.saml_provider import external_base_url
-
-                qs = urlencode({
-                    "client_id": cfg["client_id"],
-                    "post_logout_redirect_uri": external_base_url(request) + next,
-                })
-                sep = "&" if "?" in end_session else "?"
-                return RedirectResponse(f"{end_session}{sep}{qs}", status_code=302)
-        except oidc_provider.OIDCError as err:
-            logger.debug("RP-initiated logout skipped: %s", err)
-    return response
-
-
-
-@router.get("/auth/oidc/logout")
-async def oidc_logout(request: Request, next: str = "/auth/login?provider=local"):
-    """OIDC logout (GET) — local session first, then the IdP end-session URL."""
-    return await _oidc_logout(request, next)
-
-
-@router.post("/auth/oidc/logout")
-async def oidc_logout_post(request: Request, next: str = "/auth/login?provider=local"):
-    """OIDC logout (POST)."""
-    return await _oidc_logout(request, next)
-
-
-# ═══════════════════════ Admin configuration API ══════════════════════════
-
-
-def _require_admin(request: Request, *, write: bool) -> dict:
-    """Admin identity: Bearer token (scope read/write) or an admin session.
-
-    Session-authenticated writes also need the CSRF header — ``/api/v2`` is
-    exempted in the middleware, so the check lives here for this router.
-    """
-    auth_header = request.headers.get("authorization") or ""
-    if auth_header.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth_header[7:].strip())
-        if not user:
-            raise HTTPException(status_code=401, detail="Invalid or expired token")
-        scopes = user.get("_token_scopes") or ""
-        need = "write" if write else "read"
-        if not (has_scope(scopes, need) or has_scope(scopes, "admin")):
-            raise HTTPException(status_code=403, detail=f"Insufficient scope. Required: {need}")
-        if not user.get("is_admin"):
-            raise HTTPException(status_code=403, detail="Admin access required")
-        return user
-
-    from app.db import get_conn
-
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Not authenticated")
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, login, full_name, email, is_admin FROM users WHERE id=?",
-            (user["id"],),
-        ).fetchone()
-    if not row or not row["is_admin"]:
-        raise HTTPException(status_code=403, detail="Admin access required")
-    if write and request.method in ("POST", "PUT", "PATCH", "DELETE"):
-        cookie = request.cookies.get("csrf_token", "")
-        header = request.headers.get("X-CSRF-Token", "")
-        if not cookie or not header or not secrets.compare_digest(cookie, header):
-            raise HTTPException(status_code=403, detail="CSRF validation failed")
-    return dict(row)
-
-
-@router.get("/api/v2/sso/providers")
-def sso_providers(request: Request):
-    """Public: what the login page should show (button list + sso_only flag)."""
-    cfg = _sso_config_or_error()
-    if not cfg:
-        return {"providers": [], "sso_only": False}
-    from app.auth.providers.saml_provider import external_base_url
-
-    base = external_base_url(request)
-    login_path = "/auth/saml/login" if cfg["provider_type"] == "saml" else "/auth/oidc/login"
-    return {
-        "providers": [{
-            "type": cfg["provider_type"],
-            "name": cfg.get("name") or "Company SSO",
-            "icon": "🏢",
-            "login_url": f"{login_path}?next={DEFAULT_NEXT}",
-        }],
-        "sso_only": bool(cfg.get("sso_only")),
-        "base_url": base,
-    }
-
-
-@router.get("/api/v2/sso/config")
-def get_sso_config_api(request: Request):
-    """Read the current SSO configuration (secrets never returned)."""
-    _require_admin(request, write=False)
-    cfg = _sso_config_or_error()
-    return sso.public_config_view(cfg)
-
-
-@router.post("/api/v2/sso/config")
-@router.put("/api/v2/sso/config")
-def save_sso_config_api(request: Request, payload: dict = Body(...)):
-    """Create/replace the SSO configuration (admin, scope write)."""
-    admin = _require_admin(request, write=True)
-    try:
-        saved = sso.save_sso_config(payload, created_by=admin.get("id"))
-    except sso.SSOConfigError as err:
-        raise HTTPException(status_code=400, detail=str(err)) from err
-    from app.services.api_v2_helpers import audit_log
-
-    audit_log(admin, "sso.config.save", "sso_config", saved.get("id", 0),
-              f"provider={saved.get('provider_type')}", request)
-    return sso.public_config_view(saved)
-
-
-@router.delete("/api/v2/sso/config")
-def delete_sso_config_api(request: Request):
-    """Disable SSO — local logins keep working (design §8 « SSO disable »)."""
-    admin = _require_admin(request, write=True)
-    removed = sso.delete_sso_config()
-    from app.services.api_v2_helpers import audit_log
-
-    audit_log(admin, "sso.config.disable", "sso_config", 0, "", request)
-    return {"status": "ok", "disabled": removed}
-
-
-@router.get("/api/v2/sso/workspaces")
-def sso_workspaces(request: Request):
-    """Workspaces available for default assignment / group mapping."""
-    _require_admin(request, write=False)
-    from app.db import get_conn
-
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, name, owner_id FROM workspaces ORDER BY name"
-        ).fetchall()
-    cfg = _sso_config_or_error()
-    return {
-        "workspaces": [dict(r) for r in rows],
-        "default_workspace_id": (cfg or {}).get("default_workspace_id"),
-        "sso_only": bool((cfg or {}).get("sso_only")),
-        "provisioned_users": sso.provisioned_count(),
-    }
-
-
-@router.post("/api/v2/sso/sync")
-def sso_sync(request: Request):
-    """Re-apply group → workspace role mapping for every SSO user."""
-    admin = _require_admin(request, write=True)
-    try:
-        result = sso.force_sync_all_groups()
-    except sso.SSOProvisioningError as err:
-        raise HTTPException(status_code=400, detail=str(err)) from err
-    from app.services.api_v2_helpers import audit_log
-
-    audit_log(admin, "sso.sync", "sso_config", 0, str(result), request)
-    return {"status": "ok", **result}
-
-
-@router.get("/api/v2/sso/history")
-def sso_history(request: Request, limit: int = 50):
-    """Audit trail of SSO login attempts (successes and rejections)."""
-    _require_admin(request, write=False)
-    from app.db import get_conn
-
-    limit = max(1, min(int(limit or 50), 200))
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT h.id, h.user_id, u.login, h.provider_type, h.provider_name,
-                      h.sso_identifier, h.ip_address, h.success, h.error_message,
-                      h.created_at
-               FROM sso_login_history h LEFT JOIN users u ON u.id = h.user_id
-               ORDER BY h.id DESC LIMIT ?""",
-            (limit,),
-        ).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        ident = d.get("sso_identifier") or ""
-        if "|" in ident:  # drop the stored group list from the UI payload
-            d["sso_identifier"] = ident.split("|", 1)[0]
-        d["success"] = bool(d["success"])
-        out.append(d)
-    return {"history": out}
@@ -1,108 +0,0 @@
-"""FlowDeck — /api/v2/sync endpoints (v6.0.0 PWA offline sync, Bearer v6.4.0).
-
-Auth: ``Authorization: Bearer <token>`` (scopes ``read`` for delta/status,
-``write`` for batch). The legacy ``flowdeck_session`` cookie is still accepted
-as a fallback so the installed PWA/service worker keeps syncing.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Header, HTTPException, Query, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.services.api_v2_helpers import get_bearer_user, has_scope
-from app.services.sync_engine import SyncEngine
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/api/v2/sync", tags=["sync"])
-
-_engine = SyncEngine()
-
-
-def _user(request: Request, authorization: str | None = None,
-          *, required_scope: str = "read") -> dict:
-    """Bearer-first auth with session-cookie fallback (offline.js compat)."""
-    auth = authorization or request.headers.get("authorization") or ""
-    if auth and auth.lower().startswith("bearer "):
-        try:
-            user = get_bearer_user(request, authorization)
-        except HTTPException:
-            raise HTTPException(
-                status_code=401, detail="Invalid or expired API token"
-            ) from None
-        if not has_scope(user.get("_token_scopes"), required_scope):
-            raise HTTPException(
-                status_code=403,
-                detail=f"Insufficient scope. Required: {required_scope}",
-            )
-        return user
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-@router.get("/delta")
-async def sync_delta(
-    request: Request,
-    since: float = Query(default=0, description="Epoch seconds (ou ms) du dernier sync"),
-    workspace_id: int = Query(default=None),
-    authorization: str | None = Header(default=None),
-):
-    """Pull server-side changes since `since` (for the given workspace)."""
-    user = _user(request, authorization, required_scope="read")
-    if workspace_id is None:
-        raise HTTPException(status_code=400, detail="workspace_id is required")
-    result = await _engine.get_delta(user["id"], since, workspace_id)
-    if result.get("error") == "forbidden":
-        return JSONResponse({"detail": "Forbidden"}, status_code=403)
-    return result
-
-
-@router.post("/batch")
-async def sync_batch(request: Request, authorization: str | None = Header(default=None)):
-    """Apply a batch of offline mutations and return per-mutation results."""
-    user = _user(request, authorization, required_scope="write")
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(status_code=400, detail="Invalid JSON body") from None
-
-    mutations = body.get("mutations") or []
-    device_id = body.get("device_id") or "unknown"
-    if not isinstance(mutations, list) or not mutations:
-        return {"results": [], "conflicts": [], "server_time": SyncEngine._now_epoch()}
-
-    result = await _engine.apply_batch(user["id"], mutations, device_id)
-    result["server_time"] = SyncEngine._now_epoch()
-    return result
-
-
-@router.get("/status")
-def sync_status(request: Request, workspace_id: int = Query(default=None),
-                      authorization: str | None = Header(default=None)):
-    """Synchronization status for the workspace (pending server queue, last sync)."""
-    user = _user(request, authorization, required_scope="read")
-    from app.db import get_conn
-    with get_conn() as conn:
-        if not SyncEngine._can_access(conn, user["id"], workspace_id):
-            return JSONResponse({"detail": "Forbidden"}, status_code=403)
-        pending = conn.execute(
-            "SELECT COUNT(*) AS n FROM offline_sync_queue WHERE user_id=? AND status='pending'",
-            (user["id"],),
-        ).fetchone()["n"]
-        last = conn.execute(
-            "SELECT MAX(created_at) AS last FROM offline_sync_queue "
-            "WHERE user_id=? AND status='synced'",
-            (user["id"],),
-        ).fetchone()["last"]
-        return {
-            "pending_count": pending,
-            "last_sync": last,
-            "is_syncing": False,
-            "server_time": SyncEngine._now_epoch(),
-            "workspace_id": workspace_id,
-        }
@@ -1,307 +0,0 @@
-"""FlowDeck — Web Clipper router (v6.0.0).
-
-Endpoints:
-  GET  /api/v2/web-clipper/status
-  POST /api/v2/web-clipper/auth/verify
-  POST /api/v2/web-clipper/clip
-  GET  /api/v2/web-clipper/devices
-  DELETE /api/v2/web-clipper/devices/{id}
-  GET  /extensions  (HTML download page)
-
-Auth: session cookie OR Bearer api_token OR Bearer extension device token.
-"""
-from __future__ import annotations
-
-import hashlib
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.web_clipper import (
-    MAX_CLIP_BYTES,
-    _check_rate_limit,
-    create_page_from_clip,
-    list_devices,
-    log_clip,
-    register_device,
-    revoke_device,
-    sanitize_html,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["web-clipper"])
-api_router = APIRouter(prefix="/api/v2/web-clipper", tags=["web-clipper"])
-
-
-def _hash(token: str) -> str:
-    return hashlib.sha256(token.encode()).hexdigest()
-
-
-def _user_from_request(request: Request) -> dict | None:
-    # 1) session cookie
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if user:
-        return user
-    # 2) Authorization Bearer
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        token = auth[7:].strip()
-        if not token:
-            return None
-        th = _hash(token)
-        with get_conn() as conn:
-            # api_tokens (Settings → API tokens)
-            row = conn.execute(
-                "SELECT user_id FROM api_tokens WHERE token_hash=? AND revoked=0", (th,)
-            ).fetchone()
-            if row:
-                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
-                if u:
-                    return dict(u)
-            # extension_devices
-            row = conn.execute(
-                "SELECT user_id FROM extension_devices WHERE token_hash=? AND revoked=0", (th,)
-            ).fetchone()
-            if row:
-                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
-                if u:
-                    return dict(u)
-            # legacy user_tokens
-            row = conn.execute("SELECT gitea_user_id FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
-            if row:
-                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["gitea_user_id"],)).fetchone()
-                if u:
-                    return dict(u)
-    return None
-
-
-def _require_user(request: Request) -> dict:
-    user = _user_from_request(request)
-    if not user:
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-# ── API: status ──
-
-@api_router.get("/status")
-def clipper_status(request: Request):
-    user = _user_from_request(request)
-    if not user:
-        return {"authenticated": False}
-    with get_conn() as conn:
-        dev_cnt = conn.execute("SELECT COUNT(*) FROM extension_devices WHERE user_id=? AND revoked=0", (user["id"],)).fetchone()[0]
-        clip_cnt = conn.execute("SELECT COUNT(*) FROM extension_clips WHERE user_id=?", (user["id"],)).fetchone()[0]
-    return {"authenticated": True, "user": {"id": user["id"], "login": user.get("login")}, "devices": dev_cnt, "clips": clip_cnt}
-
-
-# ── API: auth verify / device registration ──
-
-@api_router.post("/auth/verify")
-def auth_verify(request: Request, body: dict = Body(default={})):
-    user = _require_user(request)
-    device_id = (body.get("device_id") or request.headers.get("x-device-id") or "").strip()
-    device_name = (body.get("device_name") or body.get("deviceName") or "").strip()[:200]
-    extension_name = (body.get("extension_name") or body.get("extensionName") or "chrome").strip()[:20].lower()
-    if not device_id:
-        raise HTTPException(status_code=400, detail="device_id required")
-    if len(device_id) > 128:
-        raise HTTPException(status_code=400, detail="device_id too long")
-    try:
-        res = register_device(user["id"], device_id, device_name, extension_name)
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e)) from None
-    if res["existing"]:
-        return {"status": "ok", "device_id": device_id, "existing": True, "message": "Device already registered"}
-    return {"status": "ok", "device_id": device_id, "token": res["token"], "note": "Copy token now — shown once. Use as Authorization: Bearer <token>"}
-
-
-@api_router.post("/clip")
-def clip_page(request: Request, body: dict = Body(...)):
-    user = _require_user(request)
-    # Enforce max body size early (10 MB)
-    clen = request.headers.get("content-length")
-    if clen:
-        try:
-            if int(clen) > MAX_CLIP_BYTES + 1024:
-                raise HTTPException(status_code=413, detail="Clip too large (max 10 MB)")
-        except ValueError:
-            pass
-
-    # Device identification for rate limiting and logging
-    device_id = (body.get("device_id") or request.headers.get("x-device-id") or "web").strip()[:128] or "web"
-    # Rate limit 50/hour per device
-    if not _check_rate_limit(f"{user['id']}:{device_id}"):
-        raise HTTPException(status_code=429, detail="Rate limit: max 50 clips/hour per device")
-
-    url = (body.get("url") or body.get("source_url") or "").strip()
-    title = (body.get("title") or "").strip()
-    content = body.get("content") or body.get("html") or ""
-    clip_type = (body.get("content_type") or body.get("clip_type") or "article").strip().lower()
-    if clip_type not in ("article", "selection", "bookmark", "screenshot"):
-        clip_type = "article"
-
-    if not url and not title and not content:
-        raise HTTPException(status_code=400, detail="url, title or content required")
-
-    # Validate url if present
-    if url:
-        if not (url.startswith("http://") or url.startswith("https://")):
-            # allow bare domain? reject javascript:
-            if url.lower().startswith("javascript:") or url.lower().startswith("data:"):
-                raise HTTPException(status_code=400, detail="Invalid URL")
-
-    # Cap content bytes
-    if content and len(content.encode("utf-8")) > MAX_CLIP_BYTES:
-        raise HTTPException(status_code=413, detail="Content too large (max 10 MB)")
-
-    # Sanitize HTML content if present
-    if content and "<" in content:
-        # sanitize but keep structure for blocks converter
-        content = sanitize_html(content)[: MAX_CLIP_BYTES]
-
-    # Prepare payload for service
-    _img_b64 = body.get("image_base64") or body.get("screenshot") or ""
-    if not _img_b64 and body.get("images"):
-        try:
-            _imgs = body.get("images")
-            if isinstance(_imgs, list) and _imgs:
-                _img_b64 = _imgs[0].get("base64") or _imgs[0].get("src") or ""
-        except Exception:
-            logger.exception("clip_page")
-    clip_data = {
-        "url": url,
-        "title": title[:200],
-        "content": content,
-        "content_type": clip_type,
-        "selection_html": body.get("selection_html") or body.get("selection") or "",
-        "image_base64": _img_b64,
-        "tags": body.get("tags") or [],
-        "target_workspace_id": body.get("target_workspace_id") or body.get("workspace_id"),
-        "target_page_id": body.get("target_page_id") or body.get("parent_page_id"),
-        "metadata": body.get("metadata") or {},
-    }
-
-    try:
-        result = create_page_from_clip(clip_data, user["id"])
-    except Exception as e:
-        logger.exception("clip creation failed: %s", e)
-        raise HTTPException(status_code=500, detail="Failed to create page") from None
-
-    # Log clip
-    try:
-        log_clip(user["id"], device_id, clip_type, url, result["page_id"], result["workspace_id"], result["title"])
-    except Exception:
-        logger.exception("clip_page")
-
-    return {"status": "ok", "page_id": result["page_id"], "title": result["title"], "workspace_id": result["workspace_id"], "url": f"/pages/{result['page_id']}"}
-
-
-@api_router.get("/devices")
-def list_extension_devices(request: Request):
-    user = _require_user(request)
-    devices = list_devices(user["id"])
-    return {"devices": devices}
-
-
-@api_router.delete("/devices/{device_id}")
-def revoke_extension_device(device_id: int, request: Request):
-    user = _require_user(request)
-    ok = revoke_device(user["id"], device_id)
-    if not ok:
-        raise HTTPException(status_code=404, detail="Device not found")
-    return {"status": "revoked"}
-
-
-# ── HTML: /extensions download page ──
-
-@router.get("/extensions", response_class=HTMLResponse)
-def extensions_page(request: Request):
-    from app.routers.dashboard import _sidebar_data
-    from app.templating import ENV
-
-    env = ENV
-    try:
-        sidebar = _sidebar_data(request, [])
-    except Exception:
-        sidebar = {}
-    # Simple standalone page reusing base.html
-    block_tpl = env.from_string(
-        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
-    )
-    user = _user_from_request(request)
-    # Count for auth user
-    devices = []
-    clips = 0
-    if user:
-        try:
-            devices = list_devices(user["id"])
-            clips = sum(d.get("clips_count", 0) for d in devices)
-        except Exception:
-            logger.exception("extensions_page")
-    content_html = f"""
-<style>
-.ext-page{{max-width:900px;margin:0 auto;padding:32px 24px 80px;}}
-.ext-hero{{text-align:center;padding:28px 0 8px;}}
-.ext-hero h1{{font-size:30px;font-weight:800;margin:0 0 6px;}}
-.ext-hero p{{color:var(--text-dim);font-size:14px;max-width:560px;margin:0 auto;line-height:1.6;}}
-.ext-grid{{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:14px;margin:28px 0;}}
-.ext-card{{border:1px solid var(--border);border-radius:12px;padding:18px;background:var(--bg-card);}}
-.ext-card h3{{font-size:15px;margin:0 0 6px;display:flex;align-items:center;gap:8px;}}
-.ext-card p{{font-size:12.5px;color:var(--text-dim);line-height:1.5;margin:0 0 10px;}}
-.ext-card a{{font-size:13px;color:var(--accent);text-decoration:none;}}
-.ext-card a:hover{{text-decoration:underline;}}
-.ext-section{{margin:28px 0;}}
-.ext-section h2{{font-size:18px;font-weight:700;margin:0 0 10px;}}
-.ext-steps{{counter-reset:step;list-style:none;padding:0;margin:0;}}
-.ext-steps li{{display:flex;gap:12px;padding:10px 0;border-bottom:1px solid var(--border);font-size:13px;color:var(--text-dim);}}
-.ext-steps li::before{{counter-increment:step;content:counter(step);flex:0 0 26px;height:26px;display:flex;align-items:center;justify-content:center;background:var(--accent);color:#fff;border-radius:50%;font-size:12px;font-weight:600;}}
-.ext-dev-list{{margin-top:12px;}}
-.ext-dev-item{{display:flex;align-items:center;justify-content:space-between;padding:10px 12px;border:1px solid var(--border);border-radius:8px;margin-bottom:6px;background:var(--bg-tertiary);}}
-.ext-badge{{font-size:10px;padding:2px 8px;border-radius:99px;background:rgba(46,160,67,.14);color:#2ea043;font-weight:600;}}
-</style>
-<div class="ext-page">
-  <div class="ext-hero">
-    <h1>🧩 FlowDeck Web Clipper</h1>
-    <p>Capture any web page — article, selection, bookmark or screenshot — directly into FlowDeck. Install the browser extension, connect it once, then clip in one click.</p>
-  </div>
-  <div class="ext-grid">
-    <div class="ext-card">
-      <h3>🟢 Chrome / Edge</h3>
-      <p>Manifest V3 — Chrome 88+, Edge 88+.</p>
-      <a href="/static/extension/flowdeck-clipper.zip" download>Download .zip</a> · <span style="font-size:11px;color:var(--text-dim);">load unpacked in chrome://extensions</span>
-    </div>
-    <div class="ext-card">
-      <h3>🟠 Firefox</h3>
-      <p>Firefox 109+ (Manifest V2 compat).</p>
-      <a href="/static/extension/flowdeck-clipper.zip" download>Download .zip</a> · <span style="font-size:11px;color:var(--text-dim);">load temporary add-on</span>
-    </div>
-    <div class="ext-card">
-      <h3>⌨️ Sans extension</h3>
-      <p>API directe — <code>POST /api/v2/web-clipper/clip</code> avec Bearer token.</p>
-      <a href="/help">Docs /help</a>
-    </div>
-  </div>
-  <div class="ext-section">
-    <h2>How it works</h2>
-    <ol class="ext-steps">
-      <li>Install the extension (.zip) → enable in your browser.</li>
-      <li>Open FlowDeck, go to <b>Settings → Extensions</b> and copy a Bearer token (or the clipper verifies via your session cookie).</li>
-      <li>On any web page, click <b>📌 Clip to FlowDeck</b> (floating button, right-click selection, or extension popup).</li>
-      <li>Choose type: Article (full), Selection, Bookmark or Screenshot — the page is created instantly in your workspace.</li>
-    </ol>
-  </div>
-  <div class="ext-section">
-    <h2>Captures on this account</h2>
-    <p style="font-size:12px;color:var(--text-dim);">{len(devices)} device(s) · {clips} clip(s) total</p>
-    <div class="ext-dev-list">
-      {"".join(f'<div class="ext-dev-item"><span><b>{d.get("device_name") or d.get("extension_name")}</b> <code style="font-size:11px;color:var(--text-dim);">{d.get("device_id")[:24]}</code></span><span><span class="ext-badge">{d.get("clips_count",0)} clips</span> <span style="font-size:11px;color:var(--text-dim);">{d.get("last_clip_at") or ""}</span></span></div>' for d in devices[:10]) or '<p style="font-size:13px;color:var(--text-dim);">No devices yet — clip your first page from the extension to appear here.</p>'}
-    </div>
-    <p style="margin-top:10px;"><a href="/accounts/settings" style="font-size:13px;color:var(--accent);">Manage in Settings → Extensions</a></p>
-  </div>
-</div>
-"""
-    return HTMLResponse(block_tpl.render(**sidebar, request=request, page_title="Extensions", title_prefix="Extensions", page_icon="🧩", content_html=content_html))
@@ -1,214 +0,0 @@
-"""FlowDeck — Passkeys / WebAuthn (v7.2.0).
-
-Registration + passwordless login via the ``webauthn`` package (pinned in
-requirements). Challenges live in a short-lived in-memory store (5 min,
-single-process — same tradeoff as the SSE rooms). RP ID is derived from the
-request host. See ``docs/V72_Enterprise_SCIM_2FA.md``.
-"""
-from __future__ import annotations
-
-import secrets
-import time
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-router = APIRouter(tags=["webauthn"], prefix="/auth/webauthn")
-
-# key -> (challenge bytes, expires_at). key = f"reg:{user_id}" | f"login:{login}".
-_challenges: dict[str, tuple[bytes, float]] = {}
-_CHALLENGE_TTL = 300.0
-
-
-def _require_lib():
-    try:
-        import webauthn  # noqa: F401
-        return True
-    except ImportError:
-        return False
-
-
-def _store_challenge(key: str, challenge: bytes) -> None:
-    _challenges[key] = (challenge, time.time() + _CHALLENGE_TTL)
-
-
-def _take_challenge(key: str) -> bytes | None:
-    item = _challenges.pop(key, None)
-    if not item:
-        return None
-    challenge, exp = item
-    return challenge if exp > time.time() else None
-
-
-def _rp(request: Request) -> tuple[str, str]:
-    host = (request.url.hostname or "localhost").split(":")[0]
-    return host, f"{request.url.scheme}://{request.headers.get('host', host)}"
-
-
-def _session_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user
-
-
-@router.post("/register/begin")
-def register_begin(request: Request):
-    if not _require_lib():
-        raise HTTPException(501, "WebAuthn library not installed")
-    from webauthn import generate_registration_options, options_to_json
-    user = _session_user(request)
-    rp_id, _origin = _rp(request)
-    with get_conn() as conn:
-        existing = conn.execute("SELECT credential_id FROM webauthn_credentials WHERE user_id=?",
-                                (user["id"],)).fetchall()
-    from webauthn.helpers.structs import PublicKeyCredentialDescriptor
-    exclude = [PublicKeyCredentialDescriptor(id=_b64url_to_bytes(r["credential_id"]))
-               for r in existing]
-    options = generate_registration_options(
-        rp_id=rp_id, rp_name="FlowDeck", user_name=user.get("login", f"user{user['id']}"),
-        user_id=str(user["id"]).encode(), exclude_credentials=exclude or None)
-    _store_challenge(f"reg:{user['id']}", options.challenge)
-    return JSONResponse(content=__import__("json").loads(options_to_json(options)))
-
-
-@router.post("/register/finish")
-def register_finish(request: Request, body: dict = Body(default={})):
-    if not _require_lib():
-        raise HTTPException(501, "WebAuthn library not installed")
-    from webauthn import verify_registration_response
-    user = _session_user(request)
-    challenge = _take_challenge(f"reg:{user['id']}")
-    if not challenge:
-        raise HTTPException(400, "Challenge expired — begin again")
-    rp_id, origin = _rp(request)
-    try:
-        verified = verify_registration_response(
-            credential=body.get("credential") or {},
-            expected_challenge=challenge, expected_rp_id=rp_id, expected_origin=origin,
-            require_user_verification=False)
-    except Exception as exc:  # noqa: BLE001 — invalid attestation → 400, never 500
-        raise HTTPException(400, f"Registration rejected: {exc}") from None
-    import base64
-    cred_id = base64.urlsafe_b64encode(verified.credential_id).decode().rstrip("=")
-    pubkey = base64.b64encode(bytes(verified.credential_public_key)).decode()
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                """INSERT INTO webauthn_credentials
-                   (user_id, credential_id, public_key, sign_count, name)
-                   VALUES (?,?,?,?,?)""",
-                (user["id"], cred_id, pubkey, verified.sign_count,
-                 str(body.get("name") or "Passkey")[:80]))
-            conn.commit()
-        except Exception:
-            raise HTTPException(409, "Credential already registered") from None
-        kid = cur.lastrowid
-    return {"id": kid, "status": "registered"}
-
-
-@router.post("/login/begin")
-def login_begin(request: Request, body: dict = Body(default={})):
-    if not _require_lib():
-        raise HTTPException(501, "WebAuthn library not installed")
-    from webauthn import generate_authentication_options, options_to_json
-    login = (body.get("login") or "").strip()
-    if not login:
-        raise HTTPException(400, "login required")
-    with get_conn() as conn:
-        user = conn.execute("SELECT * FROM users WHERE login=?", (login,)).fetchone()
-        if not user or not user["is_active"]:
-            raise HTTPException(401, "Invalid credentials")
-        creds = conn.execute("SELECT credential_id FROM webauthn_credentials WHERE user_id=?",
-                             (user["id"],)).fetchall()
-    if not creds:
-        raise HTTPException(400, "No passkeys for this account")
-    rp_id, _origin = _rp(request)
-    from webauthn.helpers.structs import PublicKeyCredentialDescriptor
-    allow = [PublicKeyCredentialDescriptor(id=_b64url_to_bytes(r["credential_id"]))
-             for r in creds]
-    options = generate_authentication_options(rp_id=rp_id, allow_credentials=allow)
-    _store_challenge(f"login:{login}", options.challenge)
-    return JSONResponse(content=__import__("json").loads(options_to_json(options)))
-
-
-@router.post("/login/finish")
-def login_finish(request: Request, body: dict = Body(default={})):
-    if not _require_lib():
-        raise HTTPException(501, "WebAuthn library not installed")
-    from webauthn import verify_authentication_response
-    login = (body.get("login") or "").strip()
-    challenge = _take_challenge(f"login:{login}")
-    if not login or not challenge:
-        raise HTTPException(400, "Challenge expired — begin again")
-    with get_conn() as conn:
-        user = conn.execute("SELECT * FROM users WHERE login=?", (login,)).fetchone()
-        if not user or not user["is_active"]:
-            raise HTTPException(401, "Invalid credentials")
-        stored = conn.execute("SELECT * FROM webauthn_credentials WHERE user_id=?",
-                              (user["id"],)).fetchall()
-    rp_id, origin = _rp(request)
-    credential = body.get("credential") or {}
-    cred_id = (credential.get("id") or "").rstrip("=")
-    match = next((dict(r) for r in stored if r["credential_id"].rstrip("=") == cred_id), None)
-    if not match:
-        raise HTTPException(401, "Unknown credential")
-    import base64
-    try:
-        verified = verify_authentication_response(
-            credential=credential, expected_challenge=challenge,
-            expected_origin=origin, expected_rp_id=rp_id,
-            credential_public_key=base64.b64decode(match["public_key"]),
-            credential_current_sign_count=match["sign_count"],
-            require_user_verification=False)
-    except Exception as exc:  # noqa: BLE001
-        raise HTTPException(401, f"Authentication rejected: {exc}") from None
-    with get_conn() as conn:
-        conn.execute("UPDATE webauthn_credentials SET sign_count=? WHERE id=?",
-                     (verified.new_sign_count, match["id"]))
-        conn.execute("UPDATE users SET last_login=? WHERE id=?",
-                     (str(time.time()), user["id"]))
-        conn.commit()
-        ud = dict(conn.execute("SELECT * FROM users WHERE id=?", (user["id"],)).fetchone())
-    session = SessionManager.create_session(ud, request)
-    response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
-    response.set_cookie("flowdeck_session", session, httponly=True,
-                        max_age=86400 * 7, samesite="lax", path="/")
-    return response
-
-
-@router.get("/keys")
-def list_keys(request: Request):
-    user = _session_user(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, name, sign_count, created_at FROM webauthn_credentials"
-                            " WHERE user_id=? ORDER BY id", (user["id"],)).fetchall()
-    return {"keys": [dict(r) for r in rows]}
-
-
-@router.delete("/keys/{key_id}")
-def delete_key(key_id: int, request: Request):
-    user = _session_user(request)
-    with get_conn() as conn:
-        cur = conn.execute("DELETE FROM webauthn_credentials WHERE id=? AND user_id=?",
-                           (key_id, user["id"]))
-        conn.commit()
-        if not cur.rowcount:
-            raise HTTPException(404, "Key not found")
-    return {"status": "deleted", "id": key_id}
-
-
-def _b64url_to_bytes(data: str) -> bytes:
-    import base64
-    padded = data + "=" * (-len(data) % 4)
-    return base64.urlsafe_b64decode(padded)
-
-
-def reset_challenges() -> None:
-    _challenges.clear()
-
-
-__all__ = ["router", "reset_challenges", "secrets"]
@@ -1,12 +1,12 @@
 """FlowDeck — Webhook receiver for real-time Gitea sync."""
 from __future__ import annotations

-import hashlib
-import hmac
 import json
+import hmac
+import hashlib
 import logging

-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException

 from app.config import settings
 from app.db import get_conn
@@ -162,7 +162,7 @@ async def register_webhook(owner: str, repo: str, request: Request):
        return {"status": "ok", "webhook": result}
    except Exception as e:
        logger.error("Failed to register webhook: %s", e)
-        raise HTTPException(status_code=500, detail=str(e)) from e
+        raise HTTPException(status_code=500, detail=str(e))


@router.get("/status/{owner}/{repo}")
@@ -1,513 +0,0 @@
-"""FlowDeck — teamspaces, verified pages, wiki home, collab polish (v7.3.0).
-
-Routes under ``/api/v2/wiki`` plus the guest entry point ``/g/{token}``.
-Design : ``docs/V73_Wiki_Teamspaces_Polish.md``.
-"""
-from __future__ import annotations
-
-import html
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import wiki
-from app.services.api_v2_helpers import audit_log
-from app.services.notifications import create_notification
-from app.templating import ENV
-
-router = APIRouter(tags=["wiki"])
-
-
-def _esc(value) -> str:
-    return html.escape(str(value))
-
-
-def _user(request: Request) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not sess or not sess.get("id"):
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_admin, is_active FROM users WHERE id=?",
-                           (sess["id"],)).fetchone()
-    if not row or not row["is_active"]:
-        raise HTTPException(403, "Account disabled")
-    return sess
-
-
-def _workspace_id(request: Request) -> int:
-    wid = request.query_params.get("workspace_id")
-    if not wid:
-        raise HTTPException(400, "workspace_id required")
-    try:
-        wid = int(wid)
-    except (TypeError, ValueError):
-        raise HTTPException(400, "invalid workspace_id") from None
-    with get_conn() as conn:
-        if not conn.execute("SELECT 1 FROM workspaces WHERE id=?", (wid,)).fetchone():
-            raise HTTPException(404, "Workspace not found")
-    return wid
-
-
-def _teamspace_or_404(teamspace_id: int, user_id: int) -> dict:
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM teamspaces WHERE id=?", (teamspace_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Teamspace not found")
-    if not wiki.can_read_teamspace(user_id, teamspace_id):
-        # private teamspace → 404 (not 403), same as restricted collections
-        raise HTTPException(404, "Teamspace not found")
-    return dict(row)
-
-
-def _page_or_404(page_id: int) -> dict:
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, workspace_id, teamspace_id, deleted_at FROM pages WHERE id=?",
-            (page_id,)).fetchone()
-    if not row or row["deleted_at"]:
-        raise HTTPException(404, "Page not found")
-    return dict(row)
-
-
-def _is_admin(user: dict) -> bool:
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
-    return bool(row and row["is_admin"])
-
-
-def _can_verify(user: dict, page: dict) -> bool:
-    """Admin, or an editor/owner of the teamspace / workspace holding the page."""
-    if _is_admin(user):
-        return True
-    if page.get("teamspace_id"):
-        return wiki.can_write_teamspace(user["id"], page["teamspace_id"])
-    wid = page.get("workspace_id")
-    if not wid:
-        return False
-    with get_conn() as conn:
-        owner = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (wid,)).fetchone()
-        if owner and owner["owner_id"] == user["id"]:
-            return True
-        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
-                              (wid, user["id"])).fetchone()
-    return bool(member and member["role"] in ("owner", "admin", "editor"))
-
-
-# ── teamspaces ─────────────────────────────────────────────────────────────
-
-@router.get("/api/v2/wiki/teamspaces")
-def list_teamspaces(request: Request):
-    user = _user(request)
-    wid = request.query_params.get("workspace_id")
-    if wid:
-        try:
-            wid = int(wid)
-        except (TypeError, ValueError):
-            raise HTTPException(400, "invalid workspace_id") from None
-    else:
-        wid = None
-    return {"teamspaces": wiki.list_teamspaces(user["id"], wid)}
-
-
-@router.get("/wiki/teamspaces/{teamspace_id}", response_class=HTMLResponse)
-def teamspace_page(teamspace_id: int, request: Request):
-    """Teamspace detail HTML page — sidebar entry point."""
-    user = _user(request)
-    ts = _teamspace_or_404(teamspace_id, user["id"])
-    ts["role"] = wiki.get_teamspace_role(user["id"], teamspace_id)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT name FROM workspaces WHERE id=?",
-                          (ts["workspace_id"],)).fetchone()
-    pages = wiki.teamspace_pages(teamspace_id)
-    collections = wiki.teamspace_collections(teamspace_id)
-    page_rows = "\n".join(
-        f'<a class="ts-row" href="/pages/{p["id"]}" style="display:flex;align-items:center;gap:8px;'
-        f'padding:8px 10px;border-radius:6px;color:inherit;text-decoration:none;">'
-        f'<span>📄</span><span>{_esc(p["title"] or "Untitled")}</span></a>'
-        for p in pages)
-    coll_rows = "\n".join(
-        f'<a class="ts-row" href="/db/{c["id"]}" style="display:flex;align-items:center;gap:8px;'
-        f'padding:8px 10px;border-radius:6px;color:inherit;text-decoration:none;">'
-        f'<span>{_esc(c["icon"] or "🗄️")}</span><span>{_esc(c["name"] or "Untitled")}</span></a>'
-        for c in collections)
-    content_html = f"""
-<div style="max-width:860px;margin:0 auto;padding:40px 24px;">
-  <h1 style="font-size:26px;display:flex;align-items:center;gap:10px;">
-    {_esc(ts['name'])}{' <span style="font-size:13px;padding:2px 8px;border-radius:10px;background:rgba(76,154,255,.15);color:#4c9aff;">🔒 private</span>' if ts['private'] else ''}
-  </h1>
-  <p style="color:var(--text-dim);">{_esc(ts.get('description') or '')}</p>
-  <div style="display:flex;gap:10px;font-size:12px;color:var(--text-dim);margin-bottom:24px;flex-wrap:wrap;">
-    <span>Workspace: {_esc((ws["name"]) if ws else '')}</span>
-    <span>·</span><span>Role: {_esc(ts['role'])}</span>
-    <span>·</span><span>{len(pages) + len(collections)} items</span>
-  </div>
-  <h2 style="font-size:16px;margin:20px 0 8px;">Pages</h2>
-  <div style="display:flex;flex-direction:column;gap:4px;">
-    {page_rows or '<p style="color:var(--text-dim);font-size:13px;">No pages yet.</p>'}
-  </div>
-  <h2 style="font-size:16px;margin:24px 0 8px;">Databases</h2>
-  <div style="display:flex;flex-direction:column;gap:4px;">
-    {coll_rows or '<p style="color:var(--text-dim);font-size:13px;">No databases yet.</p>'}
-  </div>
-</div>
-<style>
-.ts-row:hover{{background:var(--bg-hover);}}
-</style>"""
-    from app.routers.dashboard import _sidebar_data
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    block_tpl = env.from_string(
-        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
-    )
-    return block_tpl.render(
-        **sidebar,
-        request=request,
-        content_html=content_html,
-        page_title=ts["name"],
-        title_prefix="Teamspace",
-        page_icon="🏛️",
-    )
-
-
-@router.post("/api/v2/wiki/teamspaces")
-def create_teamspace(request: Request, body: dict = Body(default={})):
-    user = _user(request)
-    name = (body.get("name") or "").strip()
-    if not name or len(name) > 120:
-        raise HTTPException(400, "name required (max 120 chars)")
-    wid = int(body.get("workspace_id") or 0)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (wid,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        admin = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
-        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
-                              (wid, user["id"])).fetchone()
-        allowed = (ws["owner_id"] == user["id"] or (admin and admin["is_admin"])
-                   or (member and member["role"] in ("admin", "editor", "owner")))
-    if not allowed:
-        raise HTTPException(403, "Editor role required in the workspace")
-    try:
-        tsid = wiki.create_teamspace(wid, name, user["id"],
-                                     description=body.get("description") or "",
-                                     private=bool(body.get("private")))
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from None
-    audit_log(user, "teamspace.create", "teamspace", tsid, name, request)
-    return JSONResponse(status_code=201, content={"id": tsid, "name": name})
-
-
-@router.get("/api/v2/wiki/teamspaces/{teamspace_id}")
-def get_teamspace(teamspace_id: int, request: Request):
-    user = _user(request)
-    ts = _teamspace_or_404(teamspace_id, user["id"])
-    ts["role"] = wiki.get_teamspace_role(user["id"], teamspace_id)
-    ts["member_count"] = len(wiki.teamspace_member_ids(teamspace_id))
-    return ts
-
-
-@router.get("/api/v2/wiki/teamspaces/{teamspace_id}/members")
-def list_members(teamspace_id: int, request: Request):
-    user = _user(request)
-    _teamspace_or_404(teamspace_id, user["id"])
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT m.user_id, m.role, u.login, u.full_name FROM teamspace_members m
-               JOIN users u ON u.id = m.user_id WHERE m.teamspace_id=? ORDER BY u.login""",
-            (teamspace_id,)).fetchall()
-    return {"members": [dict(r) for r in rows]}
-
-
-@router.put("/api/v2/wiki/teamspaces/{teamspace_id}/members/{member_id}")
-def set_member(teamspace_id: int, member_id: int, request: Request, body: dict = Body(default={})):
-    user = _user(request)
-    _teamspace_or_404(teamspace_id, user["id"])
-    if not wiki.can_write_teamspace(user["id"], teamspace_id):
-        raise HTTPException(403, "Editor role required")
-    role = body.get("role")
-    if role not in wiki.TEAMSPACE_ROLES:
-        raise HTTPException(400, f"role must be one of {', '.join(wiki.TEAMSPACE_ROLES)}")
-    with get_conn() as conn:
-        if not conn.execute("SELECT 1 FROM users WHERE id=?", (member_id,)).fetchone():
-            raise HTTPException(404, "User not found")
-        conn.execute(
-            """INSERT INTO teamspace_members (teamspace_id, user_id, role) VALUES (?,?,?)
-               ON CONFLICT(teamspace_id, user_id) DO UPDATE SET role=excluded.role""",
-            (teamspace_id, member_id, role))
-        conn.commit()
-    audit_log(user, "teamspace.member.set", "teamspace", teamspace_id,
-              f"u{member_id}={role}", request)
-    return {"status": "ok", "user_id": member_id, "role": role}
-
-
-@router.delete("/api/v2/wiki/teamspaces/{teamspace_id}/members/{member_id}")
-def remove_member(teamspace_id: int, member_id: int, request: Request):
-    user = _user(request)
-    _teamspace_or_404(teamspace_id, user["id"])
-    if not wiki.can_write_teamspace(user["id"], teamspace_id):
-        raise HTTPException(403, "Editor role required")
-    with get_conn() as conn:
-        cur = conn.execute("DELETE FROM teamspace_members WHERE teamspace_id=? AND user_id=?",
-                           (teamspace_id, member_id))
-        conn.commit()
-        if not cur.rowcount:
-            raise HTTPException(404, "Not a member")
-    return {"status": "removed", "user_id": member_id}
-
-
-# ── verified pages ─────────────────────────────────────────────────────────
-
-@router.get("/api/v2/wiki/pages/{page_id}/verification")
-def get_verification(page_id: int, request: Request):
-    _user(request)
-    _page_or_404(page_id)
-    return {"verification": wiki.verification(page_id)}
-
-
-@router.post("/api/v2/wiki/pages/{page_id}/verify")
-def verify_page(page_id: int, request: Request, body: dict = Body(default={})):
-    user = _user(request)
-    page = _page_or_404(page_id)
-    if not _can_verify(user, page):
-        raise HTTPException(403, "Editor role required to verify a page")
-    out = wiki.verify_page(page_id, user["id"],
-                           days=body.get("days") or wiki.VERIFICATION_DAYS_DEFAULT,
-                           note=body.get("note") or "")
-    audit_log(user, "page.verify", "page", page_id, out.get("expires_at") or "", request)
-    return {"verification": out}
-
-
-@router.delete("/api/v2/wiki/pages/{page_id}/verify")
-def unverify_page(page_id: int, request: Request):
-    user = _user(request)
-    _page_or_404(page_id)
-    if not wiki.unverify_page(page_id):
-        raise HTTPException(404, "Page is not verified")
-    audit_log(user, "page.unverify", "page", page_id, "", request)
-    return {"status": "unverified", "page_id": page_id}
-
-
-@router.get("/api/v2/wiki/verified")
-def list_verified(request: Request):
-    """Verified (non-expired) pages of a workspace — the ✅ wiki index."""
-    user = _user(request)
-    wid = _workspace_id(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT p.id, p.title, p.page_icon, p.teamspace_id,
-                      v.verified_at, v.expires_at, v.note, u.login
-               FROM page_verifications v
-               JOIN pages p ON p.id = v.page_id
-               LEFT JOIN users u ON u.id = v.verified_by
-               WHERE p.workspace_id=? AND p.deleted_at IS NULL""",
-            (wid,)).fetchall()
-    out = []
-    for r in rows:
-        item = dict(r)
-        if wiki.is_expired(r):
-            continue  # badge lapsed → not listed
-        if item["teamspace_id"] and not wiki.can_read_teamspace(user["id"],
-                                                                item["teamspace_id"]):
-            continue  # private teamspace → hidden
-        item["active"] = True
-        out.append(item)
-    return {"pages": out}
-
-
-# ── follows ────────────────────────────────────────────────────────────────
-
-@router.post("/api/v2/wiki/pages/{page_id}/follow")
-def follow_page(page_id: int, request: Request):
-    user = _user(request)
-    _page_or_404(page_id)
-    now = wiki.toggle_follow(page_id, user["id"])
-    return {"page_id": page_id, "following": now}
-
-
-@router.get("/api/v2/wiki/pages/{page_id}/followers")
-def list_followers(page_id: int, request: Request):
-    _user(request)
-    _page_or_404(page_id)
-    ids = wiki.followers(page_id)
-    if not ids:
-        return {"followers": []}
-    with get_conn() as conn:
-        rows = conn.execute(
-            f"SELECT id, login, full_name FROM users WHERE id IN ({','.join('?' * len(ids))})",
-            ids).fetchall()
-    return {"followers": [dict(r) for r in rows]}
-
-
-# ── comment reactions ──────────────────────────────────────────────────────
-
-@router.post("/api/v2/wiki/comments/{comment_id}/reactions")
-def react(comment_id: int, request: Request, body: dict = Body(default={})):
-    user = _user(request)
-    emoji = (body.get("emoji") or "").strip()
-    if not emoji:
-        raise HTTPException(400, "emoji required")
-    try:
-        counts = wiki.toggle_reaction(comment_id, user["id"], emoji)
-    except LookupError:
-        raise HTTPException(404, "Comment not found") from None
-    return {"comment_id": comment_id, "reactions": counts}
-
-
-@router.get("/api/v2/wiki/comments/{comment_id}/reactions")
-def list_reactions(comment_id: int, request: Request):
-    _user(request)
-    return {"comment_id": comment_id, "reactions": wiki.reactions(comment_id)}
-
-
-# ── guest shares ───────────────────────────────────────────────────────────
-
-@router.post("/api/v2/wiki/pages/{page_id}/guests")
-def create_guest(page_id: int, request: Request, body: dict = Body(default={})):
-    user = _user(request)
-    page = _page_or_404(page_id)
-    if page.get("teamspace_id") and not wiki.can_write_teamspace(user["id"], page["teamspace_id"]):
-        raise HTTPException(403, "Editor role required to share")
-    try:
-        share = wiki.create_guest_share(page_id, body.get("email") or "",
-                                        body.get("role") or "viewer",
-                                        user["id"], days=body.get("days", 30))
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    audit_log(user, "page.guest_share", "page", page_id, share["email"], request)
-    return JSONResponse(status_code=201, content={
-        "id": share["id"], "token": share["token"], "role": share["role"],
-        "expires_at": share["expires_at"], "url": f"/g/{share['token']}"})
-
-
-@router.get("/api/v2/wiki/pages/{page_id}/guests")
-def list_guests(page_id: int, request: Request):
-    _user(request)
-    _page_or_404(page_id)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, email, role, expires_at, revoked, created_at FROM guest_shares"
-            " WHERE page_id=? ORDER BY id DESC", (page_id,)).fetchall()
-    return {"guests": [dict(r) for r in rows]}
-
-
-@router.delete("/api/v2/wiki/guests/{share_id}")
-def revoke_guest(share_id: int, request: Request):
-    user = _user(request)
-    with get_conn() as conn:
-        if not conn.execute("SELECT 1 FROM guest_shares WHERE id=?", (share_id,)).fetchone():
-            raise HTTPException(404, "Guest share not found")
-        conn.execute("UPDATE guest_shares SET revoked=1 WHERE id=?", (share_id,))
-        conn.commit()
-    audit_log(user, "page.guest_revoke", "guest_share", share_id, "", request)
-    return {"status": "revoked", "id": share_id}
-
-
-_GUEST_404 = """<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Link unavailable — FlowDeck</title>
-<style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:520px;
-margin:80px auto;padding:0 20px;color:#1f2328;text-align:center}
-h1{font-size:20px} p{color:#656d76;line-height:1.6}</style></head><body>
-<h1>This link is unavailable</h1>
-<p>It may have expired, been revoked, or never existed.<br>
-Ask the person who shared it with you for a new link.</p></body></html>"""
-
-
-@router.get("/g/{token}", response_class=HTMLResponse)
-def guest_page(token: str, request: Request):
-    """Account-less page access (read-only or commenter). 404 if inactive."""
-    share = wiki.resolve_guest_share(token)
-    if not share:
-        return HTMLResponse(_GUEST_404, status_code=404)
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title, content, created_at, updated_at, deleted_at"
-                            " FROM pages WHERE id=?", (share["page_id"],)).fetchone()
-    if not page or page["deleted_at"]:
-        return HTMLResponse(_GUEST_404, status_code=404)
-    wiki.record_view(share["page_id"])
-    return f"""<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>{page['title']} — FlowDeck guest</title>
-<style>body{{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:760px;
-margin:40px auto;padding:0 20px;line-height:1.6;color:#1f2328}}
-.guest-banner{{background:#fff4e5;border:1px solid #ffd8a8;padding:10px 14px;
-border-radius:8px;margin-bottom:24px;font-size:14px}}
-pre{{background:#f6f8fa;padding:14px;border-radius:8px;overflow:auto;
-white-space:pre-wrap;word-break:break-word}}</style></head><body>
-<div class="guest-banner">You are viewing this page as a guest
-({share['role']}{' — expires ' + str(share['expires_at']) if share['expires_at'] else ''}).
-Editing is disabled.</div>
-<h1>{page['title']}</h1><pre>{page['content'] or ''}</pre></body></html>"""
-
-
-# ── page views ─────────────────────────────────────────────────────────────
-
-@router.get("/api/v2/wiki/pages/{page_id}/views")
-def page_views(page_id: int, request: Request):
-    user = _user(request)
-    page = _page_or_404(page_id)
-    if page.get("teamspace_id") and not wiki.can_write_teamspace(user["id"], page["teamspace_id"]):
-        raise HTTPException(403, "Editor role required to read analytics")
-    return wiki.view_stats(page_id, days=request.query_params.get("days", 30))
-
-
-# ── wiki home ──────────────────────────────────────────────────────────────
-
-@router.get("/api/v2/wiki/home")
-def wiki_home(request: Request):
-    """Aggregated knowledge home: verified pages + recents + teamspaces."""
-    user = _user(request)
-    wid = _workspace_id(request)
-    with get_conn() as conn:
-        recents = conn.execute(
-            """SELECT id, title, page_icon, updated_at FROM pages
-               WHERE workspace_id=? AND deleted_at IS NULL
-               ORDER BY updated_at DESC LIMIT 20""", (wid,)).fetchall()
-        verified = conn.execute(
-            """SELECT v.page_id, v.verified_at, v.expires_at FROM page_verifications v
-               JOIN pages p ON p.id = v.page_id
-               WHERE p.workspace_id=? AND p.deleted_at IS NULL
-                 AND (v.expires_at IS NULL OR v.expires_at > ?)""",
-            (wid, __import__("datetime").datetime.now(
-                __import__("datetime").timezone.utc).replace(microsecond=0).isoformat()),
-        ).fetchall()
-    return {"workspace_id": wid,
-            "teamspaces": wiki.list_teamspaces(user["id"], wid),
-            "verified": [dict(r) for r in verified],
-            "recents": [dict(r) for r in recents]}
-
-
-@router.post("/api/v2/wiki/verify-expiry-sweep")
-def sweep_expiry(request: Request):
-    """Notify verifiers whose ✅ expires within 7 days (idempotent-ish job)."""
-    user = _user(request)
-    with get_conn() as conn:
-        if not conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()[0]:
-            raise HTTPException(403, "Admin required")
-    sent = 0
-    for row in wiki.expiring_verifications(days=7):
-        create_notification(row["owner_id"], None, "page.verification_expiring",
-                            "Verification expiring soon",
-                            f"“{row['title']}” loses its verified badge on {row['expires_at']}.",
-                            resource_type="page", resource_id=row["page_id"])
-        sent += 1
-    return {"notified": sent}
-
-
-# ── blocks (mermaid / equation_inline / progress) ───────────────────────────
-
-@router.post("/api/v2/wiki/blocks/preview")
-def preview_blocks(request: Request, body: dict = Body(default={})):
-    """Render v7.3 blocks to HTML (same renderer used by the export pipeline)."""
-    _user(request)
-    blocks = body.get("blocks")
-    if not isinstance(blocks, list):
-        raise HTTPException(400, "blocks must be a list")
-    if len(blocks) > 200:
-        raise HTTPException(400, "max 200 blocks per preview")
-    from app.services.wiki_blocks import mmdc_available, render_block
-    out = [{"type": b.get("type"), "html": render_block(b)} for b in blocks
-           if isinstance(b, dict) and b.get("type") in ("mermaid", "equation_inline", "progress")]
-    return {"rendered": out, "mmdc_available": mmdc_available()}
@@ -1,208 +0,0 @@
-"""FlowDeck — Workers API (v7.0.0): CRUD, manual run, history, fork, usage."""
-from __future__ import annotations
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import workers as worker_service
-from app.services.api_v2_helpers import (
-    audit_log,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    resolve_bearer_token,
-    row_to_dict,
-)
-
-router = APIRouter(tags=["workers"])
-
-
-def _auth_user(request: Request, *, require_write: bool = False) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        return sess
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if not user:
-            raise HTTPException(401, "Invalid or expired API token")
-        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
-            raise HTTPException(403, "Insufficient scope. Required: write")
-        return user
-    raise HTTPException(401, "Authentication required")
-
-
-def _row_to_api(row) -> dict:
-    d = row_to_dict(row)
-    d.pop("code_py", None)  # code only via ?include_code=1 or owner fetch
-    return d
-
-
-@router.post("/api/v2/workers")
-def create_worker(request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    name = (body.get("name") or "Untitled worker").strip()[:200]
-    code = body.get("code_py") or ""
-    try:
-        worker_service.validate_code(code)
-    except worker_service.WorkerRejected as exc:
-        raise HTTPException(400, f"code rejected: {exc}") from None
-    slug = worker_service.unique_slug(body.get("slug") or name)
-    with get_conn() as conn:
-        cur = conn.execute(
-            """INSERT INTO workers (slug, workspace_id, name, code_py, schedule_cron,
-                                    shared, daily_budget_s, created_by)
-               VALUES (?,?,?,?,?,?,?,?)""",
-            (slug, body.get("workspace_id"), name, code,
-             (body.get("schedule_cron") or "")[:60],
-             1 if body.get("shared") else 0,
-             max(1, min(int(body.get("daily_budget_s") or 60), 3600)),
-             user["id"]))
-        conn.commit()
-        wid = cur.lastrowid
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (wid,)).fetchone()
-    audit_log(user, "worker.create", "worker", wid, slug, request)
-    return JSONResponse(status_code=201, content={**_row_to_api(row), "code_py": code})
-
-
-@router.get("/api/v2/workers")
-def list_workers(request: Request):
-    _auth_user(request)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM workers").fetchone()[0]
-        rows = conn.execute(
-            "SELECT * FROM workers ORDER BY id DESC LIMIT ? OFFSET ?",
-            (limit, offset)).fetchall()
-    resp = JSONResponse([_row_to_api(r) for r in rows])
-    for k, v in paginate_headers(total).items():
-        resp.headers[k] = v
-    return resp
-
-
-@router.get("/api/v2/workers/{worker_id}")
-def get_worker(worker_id: int, request: Request):
-    user = _auth_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Worker not found")
-    out = _row_to_api(row)
-    if (request.query_params.get("include_code") == "1" or row["created_by"] == user["id"]
-            or user.get("is_admin")):
-        out["code_py"] = row["code_py"]
-    return out
-
-
-@router.patch("/api/v2/workers/{worker_id}")
-def update_worker(worker_id: int, request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Worker not found")
-        if row["created_by"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Only the owner can update this worker")
-        updates: dict = {}
-        if "name" in body:
-            updates["name"] = str(body["name"] or "")[:200]
-        if "code_py" in body:
-            try:
-                worker_service.validate_code(body["code_py"] or "")
-            except worker_service.WorkerRejected as exc:
-                raise HTTPException(400, f"code rejected: {exc}") from None
-            updates["code_py"] = body["code_py"] or ""
-        if "schedule_cron" in body:
-            updates["schedule_cron"] = str(body["schedule_cron"] or "")[:60]
-        if "shared" in body:
-            updates["shared"] = 1 if body["shared"] else 0
-        if "daily_budget_s" in body:
-            updates["daily_budget_s"] = max(1, min(int(body["daily_budget_s"] or 60), 3600))
-        if "slug" in body and body["slug"] != row["slug"]:
-            if not worker_service._SLUG_RE.match(str(body["slug"] or "")):
-                raise HTTPException(400, "Invalid slug")
-            if conn.execute("SELECT id FROM workers WHERE slug=? AND id!=?",
-                            (body["slug"], worker_id)).fetchone():
-                raise HTTPException(409, "Slug already taken")
-            updates["slug"] = body["slug"]
-        if updates:
-            sets = ", ".join(f"{k}=?" for k in updates)
-            conn.execute(f"UPDATE workers SET {sets}, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                         (*updates.values(), worker_id))
-            conn.commit()
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
-    audit_log(user, "worker.update", "worker", worker_id, ",".join(updates), request)
-    return _row_to_api(row)
-
-
-@router.delete("/api/v2/workers/{worker_id}")
-def delete_worker(worker_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Worker not found")
-        if row["created_by"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Only the owner can delete this worker")
-        conn.execute("DELETE FROM workers WHERE id=?", (worker_id,))
-        conn.commit()
-    audit_log(user, "worker.delete", "worker", worker_id, "", request)
-    return {"status": "deleted", "id": worker_id}
-
-
-@router.post("/api/v2/workers/{worker_id}/run")
-async def run_worker_endpoint(worker_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    try:
-        body = await request.json() if request.headers.get("content-type") else {}
-    except Exception:
-        body = {}
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Worker not found")
-        if (row["created_by"] != user["id"] and not row["shared"]
-                and not user.get("is_admin")):
-            raise HTTPException(403, "Worker is private")
-    import asyncio
-    loop = asyncio.get_running_loop()
-    try:
-        out = await loop.run_in_executor(
-            None, worker_service.run_worker, worker_id, body.get("ctx") or {})
-    except HTTPException:
-        raise
-    audit_log(user, "worker.run", "worker", worker_id, out.get("status", ""), request)
-    return out
-
-
-@router.get("/api/v2/workers/{worker_id}/runs")
-def worker_runs(worker_id: int, request: Request):
-    _auth_user(request)
-    limit, _offset = parse_pagination(request, default_limit=20)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM workers WHERE id=?", (worker_id,)).fetchone():
-            raise HTTPException(404, "Worker not found")
-        rows = conn.execute(
-            "SELECT * FROM worker_runs WHERE worker_id=? ORDER BY id DESC LIMIT ?",
-            (worker_id, limit)).fetchall()
-    return {"worker_id": worker_id, "runs": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/api/v2/workers/{worker_id}/fork")
-def fork_worker_endpoint(worker_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    out = worker_service.fork_worker(worker_id, user["id"])
-    audit_log(user, "worker.fork", "worker", worker_id, "", request)
-    return JSONResponse(status_code=201, content=out)
-
-
-@router.get("/api/v2/workers-usage")
-def workers_usage(request: Request):
-    user = _auth_user(request)
-    ws_raw = request.query_params.get("workspace_id")
-    wid = int(ws_raw) if ws_raw and str(ws_raw).isdigit() else None
-    return {"workspace_id": wid,
-            "used_seconds_today": round(worker_service.daily_usage_s(wid), 2),
-            "user_id": user.get("id")}
@@ -2,18 +2,15 @@
 from __future__ import annotations

 import csv
-import html
 import io
 import json
 import logging
-import sqlite3

-from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException
 from fastapi.responses import HTMLResponse, StreamingResponse

-from app.auth.session import SessionManager
 from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["workspace"], prefix="/workspace")
@@ -26,38 +23,18 @@ def _current_user(request: Request) -> dict:
    return SessionManager.decode_session(s) or {"login": "admin", "id": 1}


-def _require_admin(request: Request) -> dict:
-    """A15 : webhooks sortants = admin — le serveur POSTe le contenu des pages."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    if not user.get("is_admin"):
-        raise HTTPException(403, "Admin only")
-    return user
-
-
-def _require_ws_admin(request: Request, ws_id: int) -> None:
-    """A5 — CRUD des membres : session obligatoire + rôle admin de l'espace
-    (ou admin global). Un anonymous ne peut plus s'ajouter lui-même ni se
-    promouvoir admin."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        if conn.execute("SELECT 1 FROM users WHERE id=? AND is_admin=1", (user["id"],)).fetchone():
-            return
-        row = conn.execute(
-            "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
-            (ws_id, user["id"]),
-        ).fetchone()
-    if not row or row["role"] != "admin":
-        raise HTTPException(403, "Workspace admin role required")
-
-
 # ── Workspaces ──

+@router.get("")
+async def list_workspaces(request: Request):
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM workspaces ORDER BY name").fetchall()
+    return {"workspaces": [dict(r) for r in rows]}
+
+
@router.post("")
-def create_workspace(request: Request, body: dict = Body(default={})):
+async def create_workspace(request: Request):
+    body = await request.json() if request.headers.get("content-type") else {}
    name = body.get("name", "Default Workspace")
    user = _current_user(request)
    uid = user.get("id", 1)
@@ -78,9 +55,7 @@ def create_workspace(request: Request, body: dict = Body(default={})):
 # ── Members ──

@router.get("/{ws_id}/members")
-def list_members(request: Request, ws_id: int):
-    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        raise HTTPException(401, "Authentication required")
+async def list_members(request: Request, ws_id: int):
    with get_conn() as conn:
        rows = conn.execute(
            "SELECT wm.*, u.login, u.full_name, u.avatar_url FROM workspace_members wm JOIN users u ON wm.user_id=u.id WHERE wm.workspace_id=?",
@@ -90,14 +65,14 @@ def list_members(request: Request, ws_id: int):


@router.post("/{ws_id}/members")
-def add_member(request: Request, ws_id: int, body: dict = Body(default={})):
-    _require_ws_admin(request, ws_id)
+async def add_member(request: Request, ws_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    user_id = body.get("user_id")
    role = body.get("role", "editor")
    if role not in ROLES:
        raise HTTPException(400, f"Invalid role: {role}")
    with get_conn() as conn:
-        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,0)",
+        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
                     (user_id, f"user_{user_id}", f"User {user_id}"))
        conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?,?,?)",
                     (ws_id, user_id, role))
@@ -106,8 +81,8 @@ def add_member(request: Request, ws_id: int, body: dict = Body(default={})):


@router.put("/{ws_id}/members/{user_id}")
-def update_member_role(request: Request, ws_id: int, user_id: int, body: dict = Body(default={})):
-    _require_ws_admin(request, ws_id)
+async def update_member_role(request: Request, ws_id: int, user_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    role = body.get("role", "editor")
    if role not in ROLES:
        raise HTTPException(400, f"Invalid role: {role}")
@@ -119,8 +94,7 @@ def update_member_role(request: Request, ws_id: int, user_id: int, body: dict =


@router.delete("/{ws_id}/members/{user_id}")
-def remove_member(request: Request, ws_id: int, user_id: int):
-    _require_ws_admin(request, ws_id)
+async def remove_member(request: Request, ws_id: int, user_id: int):
    with get_conn() as conn:
        conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (ws_id, user_id))
        conn.commit()
@@ -130,7 +104,7 @@ def remove_member(request: Request, ws_id: int, user_id: int):
 # ── Comments ──

@router.get("/pages/{page_id}/comments")
-def list_comments(request: Request, page_id: int):
+async def list_comments(request: Request, page_id: int):
    with get_conn() as conn:
        rows = conn.execute(
            "SELECT c.*, u.login, u.avatar_url FROM comments c JOIN users u ON c.user_id=u.id WHERE c.page_id=? ORDER BY c.created_at",
@@ -140,7 +114,8 @@ def list_comments(request: Request, page_id: int):


@router.post("/pages/{page_id}/comments")
-def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
+async def add_comment(request: Request, page_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    b = body.get("body", "").strip()
    if not b:
        raise HTTPException(400, "body required")
@@ -153,36 +128,27 @@ def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
        cur = conn.execute("INSERT INTO comments (page_id, user_id, body, parent_id) VALUES (?,?,?,?)",
                           (page_id, uid, b, parent_id))
        conn.commit()
-    try:
-        run_event_sync(fire_event("comment.added", {"comment_id": cur.lastrowid, "page_id": page_id, "user_id": uid}))
-    except Exception:
-        logger.exception("add_comment")
    return {"id": cur.lastrowid, "status": "created"}


@router.put("/comments/{comment_id}")
-def update_comment(request: Request, comment_id: int, body: dict = Body(default={})):
+async def update_comment(request: Request, comment_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    b = body.get("body")
    resolved = body.get("resolved")
    with get_conn() as conn:
-        row = conn.execute("SELECT page_id, resolved FROM comments WHERE id=?", (comment_id,)).fetchone()
        if b is not None:
            conn.execute("UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (b, comment_id))
        if resolved is not None:
            conn.execute("UPDATE comments SET resolved=? WHERE id=?", (int(resolved), comment_id))
        conn.commit()
-    if resolved and row and not int(row["resolved"] or 0):
-        try:
-            run_event_sync(fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
-        except Exception:
-            logger.exception("update_comment")
    return {"status": "updated"}


 # ── Page History ──

@router.get("/pages/{page_id}/history")
-def page_history(request: Request, page_id: int):
+async def page_history(request: Request, page_id: int):
    with get_conn() as conn:
        rows = conn.execute(
            "SELECT * FROM page_history WHERE page_id=? ORDER BY created_at DESC LIMIT 50",
@@ -192,7 +158,8 @@ def page_history(request: Request, page_id: int):


@router.post("/pages/{page_id}/history")
-def record_history(request: Request, page_id: int, body: dict = Body(default={})):
+async def record_history(request: Request, page_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    user = _current_user(request)
    uid = user.get("id", 1)
    with get_conn() as conn:
@@ -208,7 +175,7 @@ def record_history(request: Request, page_id: int, body: dict = Body(default={})
 # ── Favorites ──

@router.get("/favorites")
-def list_favorites(request: Request):
+async def list_favorites(request: Request):
    user = _current_user(request)
    uid = user.get("id", 1)
    with get_conn() as conn:
@@ -224,7 +191,8 @@ def list_favorites(request: Request):


@router.post("/favorites")
-def add_favorite(request: Request, body: dict = Body(default={})):
+async def add_favorite(request: Request):
+    body = await request.json() if request.headers.get("content-type") else {}
    user = _current_user(request)
    uid = user.get("id", 1)
    page_id = body.get("page_id")
@@ -236,15 +204,11 @@ def add_favorite(request: Request, body: dict = Body(default={})):
            (uid, page_id, collection_id),
        )
        conn.commit()
-    try:
-        run_event_sync(fire_event("favorite.added", {"page_id": page_id, "collection_id": collection_id, "user_id": uid}))
-    except Exception:
-        logger.exception("add_favorite")
    return {"status": "favorited"}


@router.delete("/favorites/{fav_id}")
-def remove_favorite(request: Request, fav_id: int):
+async def remove_favorite(request: Request, fav_id: int):
    with get_conn() as conn:
        conn.execute("DELETE FROM favorites WHERE id=?", (fav_id,))
        conn.commit()
@@ -254,40 +218,47 @@ def remove_favorite(request: Request, fav_id: int):
 # ── Templates ──

@router.get("/templates/database")
-def list_db_templates(request: Request):
+async def list_db_templates(request: Request):
    with get_conn() as conn:
        rows = conn.execute("SELECT * FROM database_templates ORDER BY name").fetchall()
    return {"templates": [dict(r) for r in rows]}


@router.post("/templates/database")
-def create_db_template(request: Request, body: dict = Body(default={})):
+async def create_db_template(request: Request):
+    body = await request.json() if request.headers.get("content-type") else {}
    cur = None
    with get_conn() as conn:
        cur = conn.execute(
-            "INSERT INTO database_templates (name, description, icon, schema_json) VALUES (?,?,?,?)",
-            (body.get("name", "Template"), body.get("description", ""),
-             body.get("icon", "📋"), json.dumps(body.get("schema", []))),
+            "INSERT INTO database_templates (name, description, schema_json) VALUES (?,?,?)",
+            (body.get("name", "Template"), body.get("description", ""), json.dumps(body.get("schema", []))),
        )
        conn.commit()
    return {"id": cur.lastrowid, "status": "created"}


@router.post("/templates/database/{tid}/apply")
-def apply_db_template(request: Request, tid: int, body: dict = Body(default={})):
-    from app.services.db_templates import create_from_template
+async def apply_db_template(request: Request, tid: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    name = body.get("name", "New Database")
    with get_conn() as conn:
        tmpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (tid,)).fetchone()
        if not tmpl:
            raise HTTPException(404, "Template not found")
-        collection_id = create_from_template(conn, name, dict(tmpl))
+        cur = conn.execute(
+            "INSERT INTO collections (name, description, icon, schema_json) VALUES (?,?,?,?)",
+            (name, tmpl["description"], "📋", tmpl["schema_json"]),
+        )
+        conn.execute(
+            "INSERT INTO collection_views (collection_id, name, view_type, config_json) VALUES (?,?,?,?)",
+            (cur.lastrowid, "Default View", "table", "{}"),
+        )
        conn.commit()
-    return {"collection_id": collection_id, "name": name, "status": "created"}
+    return {"collection_id": cur.lastrowid, "name": name, "status": "created"}


@router.get("/collections/{collection_id}/templates/page")
-def list_page_templates(request: Request, collection_id: int):
+async def list_page_templates(request: Request, collection_id: int):
    with get_conn() as conn:
        rows = conn.execute(
            "SELECT * FROM page_templates WHERE collection_id=? ORDER BY name", (collection_id,)
@@ -296,7 +267,8 @@ def list_page_templates(request: Request, collection_id: int):


@router.post("/collections/{collection_id}/templates/page")
-def create_page_template(request: Request, collection_id: int, body: dict = Body(default={})):
+async def create_page_template(request: Request, collection_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    with get_conn() as conn:
        cur = conn.execute(
            "INSERT INTO page_templates (collection_id, name, property_values_json) VALUES (?,?,?)",
@@ -307,7 +279,8 @@ def create_page_template(request: Request, collection_id: int, body: dict = Body


@router.post("/collections/{collection_id}/templates/page/{tid}/apply")
-def apply_page_template(request: Request, collection_id: int, tid: int, body: dict = Body(default={})):
+async def apply_page_template(request: Request, collection_id: int, tid: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    with get_conn() as conn:
        tmpl = conn.execute("SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)).fetchone()
        if not tmpl:
@@ -320,304 +293,14 @@ def apply_page_template(request: Request, collection_id: int, tid: int, body: di
            (collection_id, body.get("title", "New Page"), max_pos, tmpl["property_values_json"]),
        )
        conn.commit()
-    run_event_sync(fire_event("page.created", {
-        "page_id": cur.lastrowid,
-        "collection_id": collection_id,
-        "title": body.get("title", "New Page"),
-        "properties": json.loads(tmpl["property_values_json"]) if tmpl["property_values_json"] else {},
-    }))
    return {"id": cur.lastrowid, "status": "created"}


-@router.put("/collections/{collection_id}/templates/page/{tid}")
-def update_page_template(request: Request, collection_id: int, tid: int, body: dict = Body(default={})):
-    """Update a page template — name, properties, content, recurrence."""
-    with get_conn() as conn:
-        tmpl = conn.execute(
-            "SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)
-        ).fetchone()
-        if not tmpl:
-            raise HTTPException(404, "Template not found")
-
-        name = body.get("name", tmpl["name"])
-        tmpl_dict = dict(tmpl)
-        description = body.get("description", tmpl_dict.get("description", ""))
-        property_values_json = json.dumps(body.get("properties", json.loads(tmpl["property_values_json"])))
-        content_json = json.dumps(body.get("content", json.loads(tmpl_dict.get("content_json", "[]"))))
-        is_recurring = int(body.get("is_recurring", tmpl_dict.get("is_recurring", 0)))
-        recurrence_rule = body.get("recurrence_rule", tmpl_dict.get("recurrence_rule", ""))
-
-        conn.execute(
-            """UPDATE page_templates SET name=?, description=?, property_values_json=?,
-               content_json=?, is_recurring=?, recurrence_rule=? WHERE id=?""",
-            (name, description, property_values_json, content_json, is_recurring, recurrence_rule, tid),
-        )
-        conn.commit()
-    return {"id": tid, "status": "updated"}
-
-
-@router.delete("/collections/{collection_id}/templates/page/{tid}")
-def delete_page_template(request: Request, collection_id: int, tid: int):
-    """Delete a page template."""
-    with get_conn() as conn:
-        tmpl = conn.execute(
-            "SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)
-        ).fetchone()
-        if not tmpl:
-            raise HTTPException(404, "Template not found")
-        conn.execute("DELETE FROM page_templates WHERE id=?", (tid,))
-        conn.commit()
-    return {"id": tid, "status": "deleted"}
-
-
-# ── v4.2.0: Dashboards ──
-
-@router.get("/collections/{collection_id}/dashboards")
-def list_dashboards(request: Request, collection_id: int):
-    """List all dashboards for a collection."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM collection_dashboards WHERE collection_id=? ORDER BY name", (collection_id,)
-        ).fetchall()
-    return {"dashboards": [dict(r) for r in rows]}
-
-
-@router.post("/collections/{collection_id}/dashboards")
-def create_dashboard(request: Request, collection_id: int, body: dict = Body(default={})):
-    """Create a new dashboard for a collection."""
-    name = body.get("name", "Dashboard").strip()
-    layout = json.dumps(body.get("layout", {"columns": 1, "widgets": []}))
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(404, "Collection not found")
-        cur = conn.execute(
-            "INSERT INTO collection_dashboards (collection_id, name, layout_json) VALUES (?,?,?)",
-            (collection_id, name, layout),
-        )
-        conn.commit()
-    return {"id": cur.lastrowid, "name": name, "status": "created"}
-
-
-@router.put("/collections/{collection_id}/dashboards/{did}")
-def update_dashboard(request: Request, collection_id: int, did: int, body: dict = Body(default={})):
-    """Update a dashboard — name or layout (widgets grid)."""
-    with get_conn() as conn:
-        dash = conn.execute(
-            "SELECT * FROM collection_dashboards WHERE id=? AND collection_id=?", (did, collection_id)
-        ).fetchone()
-        if not dash:
-            raise HTTPException(404, "Dashboard not found")
-
-        name = body.get("name", dash["name"])
-        layout = json.dumps(body.get("layout", json.loads(dash["layout_json"])))
-
-        conn.execute(
-            "UPDATE collection_dashboards SET name=?, layout_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (name, layout, did),
-        )
-        conn.commit()
-    return {"id": did, "status": "updated"}
-
-
-@router.delete("/collections/{collection_id}/dashboards/{did}")
-def delete_dashboard(request: Request, collection_id: int, did: int):
-    """Delete a dashboard."""
-    with get_conn() as conn:
-        dash = conn.execute(
-            "SELECT * FROM collection_dashboards WHERE id=? AND collection_id=?", (did, collection_id)
-        ).fetchone()
-        if not dash:
-            raise HTTPException(404, "Dashboard not found")
-        conn.execute("DELETE FROM collection_dashboards WHERE id=?", (did,))
-        conn.commit()
-    return {"id": did, "status": "deleted"}
-
-
-# ── v4.5.0: Sprints ──
-
-@router.get("/collections/{collection_id}/sprints")
-def list_sprints(request: Request, collection_id: int):
-    """List all sprints for a collection."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM sprints WHERE collection_id=? ORDER BY start_date DESC", (collection_id,)
-        ).fetchall()
-        sprints = []
-        for r in rows:
-            s = dict(r)
-            # Count pages in sprint
-            count = conn.execute(
-                "SELECT COUNT(*) as cnt FROM sprint_pages WHERE sprint_id=?", (r["id"],)
-            ).fetchone()["cnt"]
-            s["page_count"] = count
-            sprints.append(s)
-    return {"sprints": sprints}
-
-
-@router.post("/collections/{collection_id}/sprints")
-def create_sprint(request: Request, collection_id: int, body: dict = Body(default={})):
-    """Create a new sprint."""
-    name = body.get("name", "").strip()
-    start_date = body.get("start_date", "")
-    end_date = body.get("end_date", "")
-    if not name or not start_date or not end_date:
-        raise HTTPException(400, "name, start_date, end_date are required")
-
-    goal = body.get("goal", "")
-    status = body.get("status", "planning")
-    auto_complete = int(body.get("auto_complete", 1))
-
-    with get_conn() as conn:
-        cur = conn.execute(
-            "INSERT INTO sprints (collection_id, name, start_date, end_date, goal, status, auto_complete) VALUES (?,?,?,?,?,?,?)",
-            (collection_id, name, start_date, end_date, goal, status, auto_complete),
-        )
-        conn.commit()
-    try:
-        run_event_sync(fire_event("sprint.created", {"sprint_id": cur.lastrowid, "collection_id": collection_id, "name": name}))
-    except Exception:
-        logger.exception("create_sprint")
-    return {"id": cur.lastrowid, "name": name, "status": "created"}
-
-
-@router.put("/collections/{collection_id}/sprints/{sid}")
-def update_sprint(request: Request, collection_id: int, sid: int, body: dict = Body(default={})):
-    """Update a sprint."""
-    with get_conn() as conn:
-        sprint = conn.execute(
-            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
-        ).fetchone()
-        if not sprint:
-            raise HTTPException(404, "Sprint not found")
-
-        name = body.get("name", sprint["name"])
-        start_date = body.get("start_date", sprint["start_date"])
-        end_date = body.get("end_date", sprint["end_date"])
-        goal = body.get("goal", sprint["goal"])
-        status = body.get("status", sprint["status"])
-        auto_complete = int(body.get("auto_complete", sprint["auto_complete"]))
-
-        conn.execute(
-            "UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=?, auto_complete=? WHERE id=?",
-            (name, start_date, end_date, goal, status, auto_complete, sid),
-        )
-        conn.commit()
-    try:
-        run_event_sync(fire_event("sprint.updated", {"sprint_id": sid, "collection_id": collection_id, "name": name, "status": status}))
-    except Exception:
-        logger.exception("update_sprint")
-    return {"id": sid, "status": "updated"}
-
-
-@router.delete("/collections/{collection_id}/sprints/{sid}")
-def delete_sprint(request: Request, collection_id: int, sid: int):
-    """Delete a sprint."""
-    with get_conn() as conn:
-        sprint = conn.execute(
-            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
-        ).fetchone()
-        if not sprint:
-            raise HTTPException(404, "Sprint not found")
-        conn.execute("DELETE FROM sprints WHERE id=?", (sid,))
-        conn.commit()
-    return {"id": sid, "status": "deleted"}
-
-
-@router.post("/collections/{collection_id}/sprints/{sid}/assign")
-def assign_page_to_sprint(request: Request, collection_id: int, sid: int, body: dict = Body(default={})):
-    """Assign a page to a sprint."""
-    page_id = body.get("page_id")
-    if not page_id:
-        raise HTTPException(400, "page_id is required")
-
-    velocity_points = body.get("velocity_points", 1)
-    status_at_start = body.get("status_at_start", "")
-
-    with get_conn() as conn:
-        sprint = conn.execute("SELECT id FROM sprints WHERE id=?", (sid,)).fetchone()
-        if not sprint:
-            raise HTTPException(404, "Sprint not found")
-        page = conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-
-        try:
-            conn.execute(
-                "INSERT INTO sprint_pages (sprint_id, page_id, status_at_start, velocity_points) VALUES (?,?,?,?)",
-                (sid, page_id, status_at_start, velocity_points),
-            )
-            conn.commit()
-        except sqlite3.IntegrityError:
-            raise HTTPException(409, "Page already assigned to this sprint") from None
-    return {"sprint_id": sid, "page_id": page_id, "status": "assigned"}
-
-
-@router.delete("/collections/{collection_id}/sprints/{sid}/assign/{page_id}")
-def remove_page_from_sprint(request: Request, collection_id: int, sid: int, page_id: int):
-    """Remove a page from a sprint."""
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sid, page_id)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(404, "Assignment not found")
-        conn.execute("DELETE FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sid, page_id))
-        conn.commit()
-    return {"sprint_id": sid, "page_id": page_id, "status": "removed"}
-
-
-@router.get("/collections/{collection_id}/sprints/burndown/{sid}")
-def sprint_burndown(request: Request, collection_id: int, sid: int):
-    """Calculate burndown data for a sprint."""
-    with get_conn() as conn:
-        sprint = conn.execute(
-            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
-        ).fetchone()
-        if not sprint:
-            raise HTTPException(404, "Sprint not found")
-
-        pages = conn.execute(
-            """SELECT sp.velocity_points, cp.property_values_json
-               FROM sprint_pages sp JOIN collection_pages cp ON sp.page_id=cp.id
-               WHERE sp.sprint_id=?""", (sid,)
-        ).fetchall()
-
-    total_points = sum(p["velocity_points"] for p in pages)
-    completed = 0
-    for p in pages:
-        props = json.loads(p["property_values_json"])
-        for v in props.values():
-            if isinstance(v, str) and v.lower() in ("done", "complete", "completed", "terminé"):
-                completed += p["velocity_points"]
-                break
-
-    from datetime import date
-    today = date.today()
-    start = date.fromisoformat(sprint["start_date"]) if sprint["start_date"] else today
-    end = date.fromisoformat(sprint["end_date"]) if sprint["end_date"] else today
-    total_days = max((end - start).days, 1)
-    elapsed = max((today - start).days, 0)
-    ideal_burn = total_points - (total_points * elapsed / total_days)
-
-    return {
-        "sprint": sprint["name"],
-        "total_points": total_points,
-        "completed_points": completed,
-        "remaining_points": total_points - completed,
-        "ideal_remaining": round(ideal_burn, 1),
-        "start_date": sprint["start_date"],
-        "end_date": sprint["end_date"],
-        "days_elapsed": elapsed,
-        "days_total": total_days,
-    }
-
-
 # ── CSV Import/Export ──

@router.post("/collections/{collection_id}/import/csv")
-def import_csv(request: Request, collection_id: int, body: dict = Body(default={})):
+async def import_csv(request: Request, collection_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
    csv_data = body.get("csv", "")
    if not csv_data:
        raise HTTPException(400, "csv field required")
@@ -642,7 +325,7 @@ def import_csv(request: Request, collection_id: int, body: dict = Body(default={


@router.get("/collections/{collection_id}/export/csv")
-def export_csv(request: Request, collection_id: int):
+async def export_csv(request: Request, collection_id: int):
    with get_conn() as conn:
        pages = conn.execute(
            "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position", (collection_id,)
@@ -672,28 +355,20 @@ def export_csv(request: Request, collection_id: int):
 # ── Webhooks Outbound Management ──

@router.get("/webhooks")
-def list_webhooks(request: Request):
-    _require_admin(request)
+async def list_webhooks(request: Request):
    with get_conn() as conn:
        rows = conn.execute("SELECT * FROM webhook_subscriptions ORDER BY created_at DESC").fetchall()
    return {"webhooks": [dict(r) for r in rows]}


@router.post("/webhooks")
-def create_webhook(request: Request, body: dict = Body(default={})):
-    _require_admin(request)
+async def create_webhook(request: Request):
+    body = await request.json() if request.headers.get("content-type") else {}
    url = body.get("url", "").strip()
    event = body.get("event", "page.created")
    secret = body.get("secret", "")
    if not url:
        raise HTTPException(400, "url required")
-    # A15 : SSRF — le scheduler POSTe le contenu des pages vers cette URL.
-    from urllib.parse import urlparse
-
-    from app.services.importers.url_fetch import _is_public_host
-    parsed = urlparse(url)
-    if parsed.scheme not in ("http", "https") or not parsed.hostname or not _is_public_host(parsed.hostname):
-        raise HTTPException(400, f"url non autorisée: {parsed.hostname}")
    with get_conn() as conn:
        cur = conn.execute(
            "INSERT INTO webhook_subscriptions (url, event, secret) VALUES (?,?,?)",
@@ -704,8 +379,7 @@ def create_webhook(request: Request, body: dict = Body(default={})):


@router.delete("/webhooks/{wh_id}")
-def delete_webhook(request: Request, wh_id: int):
-    _require_admin(request)
+async def delete_webhook(request: Request, wh_id: int):
    with get_conn() as conn:
        conn.execute("DELETE FROM webhook_subscriptions WHERE id=?", (wh_id,))
        conn.commit()
@@ -715,40 +389,23 @@ def delete_webhook(request: Request, wh_id: int):
 # ── Public Sharing ──

@router.get("/public/{collection_id}")
-def public_view(request: Request, collection_id: int):
-    """Simple public read-only view — no auth required.
-
-    A18 : les bases ``restricted``/``private`` (``permission_type``) restent
-    masquées (404) et toute interpolation part dans ``html.escape`` (XSS stocké
-    sur le titre de la base ou d'une ligne).
-    """
+async def public_view(request: Request, collection_id: int):
+    """Simple public read-only view — no auth required."""
    with get_conn() as conn:
        coll = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
        if not coll:
            raise HTTPException(404, "Collection not found")
-        ptype = coll["permission_type"] if "permission_type" in coll.keys() else "inherit"
-        if ptype in ("restricted", "private"):
-            # 404 explicite : le handler global transformerait un HTTPException(404)
-            # en redirection 302 → login pour un chemin HTML.
-            return HTMLResponse(
-                "<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>404</title></head>"
-                "<body><h1>404 — Not found</h1></body></html>",
-                status_code=404,
-            )
        pages = conn.execute(
            "SELECT id, title, icon, property_values_json FROM collection_pages WHERE collection_id=? ORDER BY position",
            (collection_id,),
        ).fetchall()

-    esc = html.escape
-    name = esc(str(coll["name"] or ""))
-    icon = esc(str(coll["icon"] or ""))
    items = "".join(
-        f"<li>{esc(str(p['icon'] or ''))} <b>{esc(str(p['title'] or ''))}</b></li>"
+        f"<li>{p['icon']} <b>{p['title']}</b></li>"
        for p in pages
    )
    return HTMLResponse(f"""<!DOCTYPE html>
-<html><head><meta charset="utf-8"><title>{name} — FlowDeck Public</title>
+<html><head><meta charset="utf-8"><title>{coll['name']} — FlowDeck Public</title>
 <style>body{{font-family:system-ui;background:#191919;color:#fff;padding:20px}}
 h1{{font-size:24px}} li{{padding:8px;border-bottom:1px solid #333}}</style></head>
-<body><h1>{icon} {name}</h1><ul>{items}</ul><p>{len(pages)} items</p></body></html>""")
+<body><h1>{coll['icon']} {coll['name']}</h1><ul>{items}</ul><p>{len(pages)} items</p></body></html>""")
@@ -1,513 +0,0 @@
-"""FlowDeck — AgentEngine: ReAct orchestrator (v4.14.0).
-
-`objective → comprehension → context → reasoning ↔ action → result`.
-
-The engine drives the LLM (which only emits tool intentions), gates each call
-through PermissionManager, executes it via ToolRegistry, journals every action
-to `agent_actions` with an undo snapshot, and yields a stream of SSE events so
-the UI can render reasoning + actions live. Since v4.14.0 a freshly created
-conversation is automatically renamed with a descriptive title derived from its
-content so the history stays easy to browse.
-"""
-from __future__ import annotations
-
-import asyncio
-import json
-import logging
-import re
-
-from app.config import settings
-from app.db import get_conn
-from app.services.agent_policies import check_tool, get_policy
-from app.services.context_builder import ContextBuilder
-from app.services.llm_client import LLMClient
-from app.services.permission_manager import WRITE_TOOLS, PermissionManager
-from app.services.tool_registry import ToolRegistry
-
-logger = logging.getLogger(__name__)
-
-MAX_ITERATIONS = 12
-
-
-async def _fire_agent_webhook(event: str, payload: dict) -> None:
-    """Dispatch an outbound agent lifecycle event (never raises).
-
-    Lifecycle: ``agent.run.started`` → ``agent.run.finished`` | ``agent.run.failed``.
-    All three are in the webhook_outbound catalogue, so integrations can subscribe
-    to `agent.*` and drive FlowDeck Agent from outside (Agent phase 5).
-    """
-    try:
-        from app.services.webhook_outbound import fire_event as _fire_wh
-        await _fire_wh(event, payload)
-    except Exception:  # noqa: BLE001
-        logger.debug("%s webhook dispatch failed", event)
-
-# Compact in-app guide so the LLM can answer « comment faire… ? » questions even
-# when no document is attached to the conversation (generic help / onboarding).
-APP_GUIDE = """## Guide de l'utilisateur FlowDeck (sert à répondre aux questions « comment … ? »)
- **Pages** : le contenu est organisé en blocs (paragraphes, titres, listes, to-do, tableaux, images, formules, bases embarquées). La barre latérale liste les pages récentes, favoris, agents, partagées et publiées.
- **Documents & espaces de travail** : un « document » est une page éditeur (type Notion) qui vit dans un espace de travail. Pour créer un document dans un espace : appelle `read_workspaces` (reprends le `workspace_name` ou l'id exact), puis `create_document`. Pour modifier un document existant : `read_document` puis `write_blocks` (blocs et/ou titre). Pour supprimer : `delete_document` (corbeille). `search_workspace` retrouve aussi les documents et les espaces par titre.
- **Format des blocs** (pour `write_blocks`) : chaque bloc est un objet `{"type": "...", "content": "texte"}`. Le champ du texte s'appelle **`content`** (jamais `text`). Un script / code s'écrit dans un bloc `{"type": "code", "content": "...", "language": "powershell"}`. Les titres sont `heading_1`, `heading_2`, `heading_3`, `heading_4`. Autres types : paragraph, bulleted_list, numbered_list, to_do, quote, divider, toggle, callout.
- **Collections (bases de données)** : des ensembles de pages structurées avec des propriétés (texte, nombre, sélection, dates…). Chaque collection peut avoir plusieurs vues : tableau, board (kanban), calendrier, galerie, liste, timeline, graphique, formulaire, carte, flux, gantt. Ajouter une propriété ou une vue = outils add_property / create_view.
- **Créer du contenu** : « crée une collection X », « crée une page », « ajoute une propriété Statut à la collection Y » sont des actions que l'agent peut exécuter directement avec ses outils.
- **Espaces de travail** : FlowDeck gère des espaces locaux et des dépôts Gitea/GitHub (pages privées dans un dépôt, issues reliées via read_gitea_issues). On change d'espace depuis le menu en bas à gauche (« Switch workspace »).
- **Recherche** : la commande Ctrl+K / la barre de recherche du haut permet de retrouver pages et collections.
- **Corbeille & Bibliothèque** : les pages supprimées vont dans la Corbeille ; Favoris / Récents / Partagés / Publiés se consultent dans la Bibliothèque.
- **Réglages** : Paramètres (en bas à gauche → Settings) pour le compte, les notifications, les tags, les intégrations et la section « Agent & IA » (clés API, fournisseurs, modèle global).
- **Agent IA** : ouvrable via le bouton 🤖 en bas à droite ou la section « Agents » du sidebar. On peut lui parler de la page ouverte, ou lui poser des questions générales sur l'utilisation de l'application.
-Quand la question est générale (« comment créer un kanban ? », « où sont mes favoris ? »), réponds de façon concise et guidée à partir de ces informations, sans inventer de fonctionnalités absentes."""
-
-# Deterministic auto-title heuristics (used when no real LLM is configured, and
-# as a fallback when the generated title is unusable). Ordered by priority: the
-# first matching intent wins.
-_TITLE_INTENTS = (
-    ("Création", ("créer", "crée", "crées", "création", "nouveau", "nouvelle",
-                  "create", "creation")),
-    ("Ajout", ("ajouter", "ajoute", "ajout d", "ajoutons", "add")),
-    ("Renommage", ("renommer", "renomme", "renommage", "rename")),
-    ("Suppression", ("supprimer", "supprime", "suppression", "delete")),
-    ("Déplacement", ("déplacer", "déplace", "déplacement", "move")),
-    ("Mise à jour", ("modifier", "modifie", "modification", "mets à jour",
-                     "met à jour", "mettre à jour", "update", "éditer")),
-    ("Analyse", ("analyser", "analyse")),
-    ("Résumé", ("résumer", "résume", "résumé", "resume")),
-    ("Traduction", ("traduire", "traduis", "traduit", "traduction", "translate")),
-    ("Planification", ("planifier", "planifie", "préparer", "prépare", "organiser",
-                       "organise", "sprint", "agenda")),
-    ("Recherche", ("chercher", "cherche", "rechercher", "recherche", "trouver",
-                   "trouve", "liste", "lister", "search", "find")),
-)
-
-_TITLE_TYPES = (
-    ("collection", "collection", ("collection", "base de données", "database", "db")),
-    ("propriété", "propriété", ("propriété", "property")),
-    ("vue", "vue", (" vue", "view")),
-    ("board", "board", ("board", "kanban")),
-    ("sprint", "sprint", ("sprint",)),
-    ("document", "document", ("document", "note de réunion", "compte-rendu", "compte rendu")),
-    ("tâche", "tâche", ("tâche", "task", "tache")),
-    ("issue", "issue", ("issue",)),
-)
-
-
-class AgentEngine:
-    def __init__(self, user_id: int, workspace_id: int | None = None,
-                 llm: LLMClient | None = None):
-        self.user_id = user_id
-        self.workspace_id = workspace_id
-        self.llm = llm or LLMClient()
-        self.tools = ToolRegistry()
-        self.ctx = ContextBuilder(user_id, workspace_id)
-        self.perms = PermissionManager(user_id)
-        self._tokens = 0
-
-    # ── Helpers ──
-
-    def _load_agent(self, conversation_id: int) -> dict:
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT a.* FROM agents a JOIN agent_conversations c ON c.agent_id=a.id WHERE c.id=?",
-                (conversation_id,),
-            ).fetchone()
-        if not row:
-            row = {"id": None, "name": "FlowDeck Agent", "icon": "🤖", "agent_type": "personal",
-                   "system_instructions": "", "model": settings.llm_model,
-                   "scope_json": "{}", "approval_mode": "auto"}
-        return dict(row)
-
-    def _build_system_prompt(self, agent: dict, skills=None) -> str:
-        if skills is None:
-            skills = []
-        if isinstance(skills, dict):
-            skills = [skills]
-        lines = [
-            "Tu es FlowDeck Agent, un agent IA qui réalise des tâches dans le workspace FlowDeck.",
-            "Tu réfléchis (reasoning) puis agis en appelant les outils disponibles.",
-            "Appelle UN ou PLUSIEURS outils pour atteindre l'objectif, puis conclus avec une réponse finale.",
-            "N'invente jamais d'IDs : utilise ceux fournis dans le contexte.",
-            f"Workspace courant : {self.workspace_id}.",
-        ]
-        if agent.get("system_instructions"):
-            lines.append(f"\nInstructions de l'agent {agent.get('name','')}:\n{agent['system_instructions']}")
-        # Plusieurs skills peuvent être appliqués au même post : chacun injecte
-        # son prompt dans les instructions système.
-        for skill in skills:
-            if skill:
-                lines.append(f"\nSkill appliquée « {skill.get('name','')} »:\n{skill.get('prompt_template','')}")
-        # L'utilisateur peut poser des questions d'aide sans contexte de document ;
-        # le guide intégré permet d'y répondre (aucun outil requis).
-        lines.append("\n" + APP_GUIDE)
-        return "\n".join(lines)
-
-    # ── Main run (async generator of SSE events) ──
-
-    async def run(self, conversation_id: int, objective: str, *, model: str | None = None,
-                  mentions: list[str] | None = None, files: list[dict] | None = None,
-                  skill_id: int | None = None, skill_ids: list[int] | None = None,
-                  extra_context: str | None = None):
-        agent = self._load_agent(conversation_id)
-        scope = json.loads(agent.get("scope_json") or "{}")
-        approval_mode = agent.get("approval_mode") or "auto"
-        model = model or agent.get("model") or settings.llm_model
-
-        ids = list(skill_ids or [])
-        if skill_id and skill_id not in ids:
-            ids.append(skill_id)
-        skills = [s for s in (self._load_skill(i, scope) for i in ids) if s]
-        system = self._build_system_prompt(agent, skills)
-        context = self.ctx.build(mentions=mentions, files=files)
-        if extra_context and extra_context.strip():
-            context += "\n\n## Document / contexte fourni par l'utilisateur\n" + extra_context.strip()
-
-        messages = [
-            {"role": "system", "content": system},
-            {"role": "user", "content": f"{objective}\n\n# Contexte\n{context}"},
-        ]
-
-        self._persist_message(conversation_id, "user", objective)
-        self._update_conversation(conversation_id, status="running")
-        await _fire_agent_webhook("agent.run.started", {
-            "conversation_id": conversation_id,
-            "objective": objective[:500],
-            "model": model or "",
-        })
-
-        # Update the history title right away (before the run finishes) and
-        # refine it once we have the final answer (_autotitle below).
-        try:
-            suggested = self._suggest_title(objective, None)
-            if suggested:
-                self._update_conversation(conversation_id, title=suggested[:80])
-        except Exception:  # noqa: BLE001 — never break a run because of the title
-            logger.exception("Auto-title failed for conversation #%s", conversation_id)
-
-        tool_schema = self.tools.schema(scope)
-        final_text = None
-        used_model = model or ""  # peut être ajusté par un repli de modèle (404/410)
-
-        try:
-            # v7.2.0 — the workspace policy may cap iterations below the global max.
-            policy_max = get_policy(self.workspace_id).get("max_steps") or MAX_ITERATIONS
-            iterations = min(settings.agent_max_iterations or MAX_ITERATIONS, policy_max)
-            for _step in range(iterations):
-                if self._tokens >= settings.agent_max_tokens_budget:
-                    yield self._event("error", {"message": "Budget de tokens dépassé"})
-                    break
-
-                response = await asyncio.wait_for(
-                    self.llm.complete(messages, model=model, tools=tool_schema, stream=True),
-                    timeout=settings.agent_run_timeout_seconds,
-                )
-                self._tokens += response.usage.get("total_tokens", 0) or 0
-
-                if getattr(response, "notice", ""):
-                    yield self._event("notice", {"message": response.notice})
-
-                used_model = getattr(response, "model", "") or used_model
-
-                if response.text and response.text.strip():
-                    yield self._event("reasoning", {"content": response.text})
-
-                if not response.tool_calls:
-                    messages.append({"role": "assistant", "content": response.text or ""})
-                    final_text = response.text or self._no_tool_message(response)
-                    yield self._event("final", {"content": final_text})
-                    break
-
-                # L'API de chat exige que le message assistant qui *annonce* les appels
-                # d'outils porte les `tool_calls` (avec id), puis que chaque résultat
-                # d'outil soit fourni avec le `tool_call_id` correspondant. Sans cela
-                # la passe suivante est refusée par le fournisseur (et l'agent retombait
-                # silencieusement sur le mock hors-ligne).
-                tool_specs = []
-                for idx, call in enumerate(response.tool_calls):
-                    call_id = call.get("id") or f"call_{conversation_id}_{idx}_{self._tokens}"
-                    tool_specs.append({
-                        "id": call_id,
-                        "type": "function",
-                        "function": {
-                            "name": call["name"],
-                            "arguments": call.get("arguments_raw")
-                                or json.dumps(call.get("arguments") or {}, ensure_ascii=False),
-                        },
-                    })
-                assistant_msg = {"role": "assistant", "content": response.text or ""}
-                assistant_msg["tool_calls"] = tool_specs
-                messages.append(assistant_msg)
-
-                for idx, call in enumerate(response.tool_calls):
-                    tool, args = call["name"], call.get("arguments") or {}
-                    call_id = tool_specs[idx]["id"]
-                    denied = False
-                    # v7.2.0 — workspace tool scope + human approval gate, checked
-                    # *before* permissions so a scoped-out tool never reaches ACLs.
-                    gov = check_tool(self.user_id, self.workspace_id, tool,
-                                     is_write=tool in WRITE_TOOLS,
-                                     conversation_id=conversation_id)
-                    if not gov.get("allowed"):
-                        detail = gov.get("reason") or "Refusé par la politique agent"
-                        if gov.get("approval_id"):
-                            detail = (f"Approbation requise (demande #{gov['approval_id']}) "
-                                      f"— action suspendue")
-                        yield self._event("action", {
-                            "tool": tool, "status": "approval_required" if gov.get("approval_id")
-                            else "error", "detail": detail,
-                            "approval_id": gov.get("approval_id")})
-                        self._log_action(conversation_id, tool, args, {}, "error", detail=detail)
-                        messages.append({
-                            "role": "tool", "tool_call_id": call_id,
-                            "content": json.dumps({"status": "error", "message": detail},
-                                                   ensure_ascii=False),
-                        })
-                        denied = True
-                    try:
-                        if not denied:
-                            self.perms.assert_can(tool, args, self.workspace_id, approval_mode)
-                    except Exception as exc:  # permission / approval guard
-                        detail = self._exc_detail(exc)
-                        yield self._event("action", {"tool": tool, "status": "error", "detail": detail})
-                        self._log_action(conversation_id, tool, args, {}, "error", detail=detail)
-                        messages.append({
-                            "role": "tool", "tool_call_id": call_id,
-                            "content": json.dumps({"status": "error", "message": f"Permission refusée: {detail}"}, ensure_ascii=False),
-                        })
-                        denied = True
-
-                    if not denied:
-                        result = await self.tools.execute(tool, args, user_id=self.user_id)
-
-                        if result.status == "success":
-                            yield self._event("action", {
-                                "tool": tool, "status": result.status,
-                                "target_type": result.target_type, "target_id": result.target_id,
-                                "message": result.message,
-                            })
-                            self._log_action(conversation_id, tool, args, result.data, "success",
-                                             target_type=result.target_type, target_id=result.target_id,
-                                             undo=result.undo)
-                            messages.append({
-                                "role": "tool", "tool_call_id": call_id,
-                                "content": json.dumps({"status": "ok", "result": result.data, "target_id": result.target_id}, ensure_ascii=False),
-                            })
-                        else:
-                            yield self._event("action", {"tool": tool, "status": "error", "detail": result.message})
-                            self._log_action(conversation_id, tool, args, {}, "error", detail=result.message)
-                            messages.append({
-                                "role": "tool", "tool_call_id": call_id,
-                                "content": json.dumps({"status": "error", "message": result.message}, ensure_ascii=False),
-                            })
-
-            if final_text is None:
-                final_text = "Objectif traité. Consultez le journal des actions pour le détail."
-                yield self._event("final", {"content": final_text})
-
-            self._persist_message(conversation_id, "assistant", final_text,
-                                  model=used_model, tokens=self._tokens)
-            await self._autotitle(conversation_id, objective, final_text)
-            # v6.4.0: emit agent.run.finished (outbound webhooks only).
-            await _fire_agent_webhook("agent.run.finished", {
-                "conversation_id": conversation_id,
-                "objective": objective[:500],
-                "model": used_model,
-                "tokens": self._tokens,
-            })
-
-        except Exception as exc:  # noqa: BLE001
-            logger.exception("AgentEngine run failed")
-            await _fire_agent_webhook("agent.run.failed", {
-                "conversation_id": conversation_id,
-                "objective": objective[:500],
-                "error": str(exc)[:500],
-            })
-            yield self._event("error", {"message": f"Erreur interne: {exc}"})
-        finally:
-            self._update_conversation(conversation_id, status="idle")
-
-    # ── Skills ──
-
-    def _load_skill(self, skill_id: int, scope: dict | None) -> dict | None:
-        with get_conn() as conn:
-            row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-        if not row:
-            return None
-        skill = dict(row)
-        allowed = json.loads(skill.get("allowed_tools_json") or "[]")
-        if allowed:
-            skill["prompt_template"] = (skill.get("prompt_template") or "") + \
-                "\nOutils autorisés: " + ", ".join(allowed)
-        return skill
-
-    # ── Audit & persistence ──
-
-    def _log_action(self, conversation_id, tool, args, result, status,
-                    *, target_type="", target_id=None, undo=None, detail=""):
-        with get_conn() as conn:
-            conn.execute(
-                """INSERT INTO agent_actions
-                   (conversation_id, tool_name, target_type, target_id, payload_json,
-                    result_json, status, undo_snapshot_json, executed_by)
-                   VALUES (?,?,?,?,?,?,?,?,?)""",
-                (conversation_id, tool, target_type,
-                 str(target_id) if target_id is not None else None,
-                 json.dumps(args, ensure_ascii=False),
-                 json.dumps(result, ensure_ascii=False, default=str),
-                 status,
-                 json.dumps(undo or {}, ensure_ascii=False),
-                 self.user_id),
-            )
-            conn.commit()
-
-    def _persist_message(self, conversation_id, role, content, *, model="", tokens=0):
-        with get_conn() as conn:
-            conn.execute(
-                "INSERT INTO agent_messages (conversation_id, role, content, model, tokens_used) VALUES (?,?,?,?,?)",
-                (conversation_id, role, content, model, tokens),
-            )
-            conn.commit()
-
-    def _update_conversation(self, conversation_id, *, status=None, title=None):
-        with get_conn() as conn:
-            sets, params = ["updated_at=CURRENT_TIMESTAMP"], []
-            if status:
-                sets.append("status=?")
-                params.append(status)
-            if title:
-                sets.append("title=?")
-                params.append(title)
-            params.append(conversation_id)
-            conn.execute(f"UPDATE agent_conversations SET {', '.join(sets)} WHERE id=?", params)
-            conn.commit()
-
-    # ── Misc ──
-
-    @staticmethod
-    def _event(etype: str, data: dict) -> dict:
-        return {"type": etype, **data}
-
-    @staticmethod
-    def _no_tool_message(response) -> str:
-        return "Je n'ai pas d'action à proposer pour cet objectif. Posez-moi une question plus précise ou demandez-moi de créer un élément."
-
-    @staticmethod
-    def _exc_detail(exc: Exception) -> str:
-        detail = getattr(exc, "detail", None)
-        return detail if isinstance(detail, str) else str(exc)
-
-    # ── Auto-title (v4.14.0) ──
-
-    async def _autotitle(self, conversation_id: int, objective: str, final_text: str | None):
-        """Rename the conversation with a descriptive title derived from the
-        *latest* user request. Runs after every AI call so the history list
-        always reflects the current topic and stays easy to browse."""
-        try:
-            suggested = self._suggest_title(objective, final_text)
-            if suggested:
-                self._update_conversation(conversation_id, title=suggested[:80])
-        except Exception:  # noqa: BLE001 — never break a run because of the title
-            logger.exception("Auto-title failed for conversation #%s", conversation_id)
-
-    @classmethod
-    def _suggest_title(cls, objective: str | None, final_text: str | None) -> str:
-        """Produce a short descriptive title from the user objective (offline-safe)."""
-        text = (objective or "").split("\n# Contexte", 1)[0].strip() or (final_text or "").strip()
-        if not text:
-            return "Conversation"
-        # Strip the composer prefixes ("Contexte « X »", "Skill « Y »") that the
-        # frontend prepends before the real user text.
-        text = re.sub(
-            r"(?:Contexte\s*«[^»]*»|Skill\s*«[^»]*»|Skill\s+«[^»]*»)(?:\s*[,;\n.])+\s*",
-            "", text,
-        ).strip()
-        if not text:
-            return "Conversation"
-        low = text.lower()
-
-        intent = None
-        for label, words in _TITLE_INTENTS:
-            if any(w in low for w in words):
-                intent = label
-                break
-
-        type_label = next(
-            (t for t, _noun, words in _TITLE_TYPES if any(w in low for w in words)), None
-        )
-        has_workspace = any(w in low for w in ("workspace", "espace de travail"))
-        quotes = [q.strip() for q in re.findall(r'[«"]([^«»"]{1,80})[»"]', text) if q.strip()]
-        subject = quotes[0] if quotes else None
-        ws = quotes[-1] if (has_workspace and len(quotes) > 1) else None
-
-        def _clean(s: str) -> str:
-            return re.sub(r"\s+", " ", s).strip(" .;:-")
-
-        if not subject and type_label:
-            noun = next((n for t, n, _w in _TITLE_TYPES if t == type_label), type_label)
-            m = re.search(
-                rf"\b{noun}\b\s*(?:nomm[ée]e?\s+|appel[ée]e?\s+|intitul[ée]e?\s+)?"
-                r'[«"]?\s*([A-Za-zÀ-ÿ0-9][A-Za-zÀ-ÿ0-9_ \-]{1,60}?)\s*[»"]?',
-                text, re.IGNORECASE,
-            )
-            if m:
-                subject = m.group(1).strip()
-
-        if intent and subject:
-            core = f"{intent} {type_label or 'élément'} « {subject} »" \
-                if type_label else f"{intent} « {subject} »"
-            if ws:
-                core += f" (dans {ws})"
-            return _clean(core)
-
-        generic = _clean(text)
-        return generic[:70] if generic else "Conversation"
-
-
-def undo_action(action_id: int) -> bool:
-    """Reverse a single agent action using its stored undo snapshot.
-
-    Returns True on success. Marks the action row `reverted`.
-    """
-    with get_conn() as conn:
-        action = conn.execute("SELECT * FROM agent_actions WHERE id=?", (action_id,)).fetchone()
-        if not action:
-            raise ValueError(f"Action #{action_id} introuvable")
-        undo = json.loads(action["undo_snapshot_json"] or "{}")
-        op, table, rid = undo.get("action"), undo.get("table"), undo.get("id")
-        if not op or not table or rid is None:
-            raise ValueError(f"Action #{action_id} n'a pas de snapshot annulable")
-
-        if op == "delete":
-            conn.execute(f"DELETE FROM {table} WHERE id=?", (rid,))
-        elif op == "softdelete":
-            conn.execute(f"UPDATE {table} SET deleted_at=NULL WHERE id=?", (rid,))
-        elif op == "insert":
-            snapshot = undo.get("snapshot")
-            if not snapshot:
-                raise ValueError("Snapshot manquant pour insert")
-            cols = ", ".join(snapshot.keys())
-            ph = ", ".join("?" for _ in snapshot)
-            conn.execute(f"INSERT INTO {table} ({cols}) VALUES ({ph})", list(snapshot.values()))
-        elif op == "update":
-            snapshot = undo.get("snapshot")
-            if table == "collection_pages":
-                conn.execute(
-                    "UPDATE collection_pages SET property_values_json=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                    (json.dumps(snapshot, ensure_ascii=False), undo.get("title", ""), rid),
-                )
-            elif table == "pages":
-                if isinstance(snapshot, dict):
-                    conn.execute(
-                        "UPDATE pages SET content=?, content_format=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                        (snapshot.get("content", ""),
-                         snapshot.get("content_format", "markdown"),
-                         snapshot.get("title", ""), rid),
-                    )
-                else:
-                    conn.execute("UPDATE pages SET content=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                                 (snapshot, rid))
-            else:
-                raise ValueError(f"Table non gérée pour rollback: {table}")
-        else:
-            raise ValueError(f"Opération de rollback inconnue: {op}")
-
-        conn.execute("UPDATE agent_actions SET status='reverted' WHERE id=?", (action_id,))
-        conn.commit()
-    return True
@@ -1,89 +0,0 @@
-"""FlowDeck — agent governance (v7.2.0): workspace tool scope + approval gate.
-
-``agent_policies``: ``allowed_tools_json`` (null = all tools), ``max_steps``,
-``require_approval`` (write tools pause for a human). ``check_tool()`` is
-consulted by ``AgentEngine`` before ``PermissionManager.assert_can``.
-``agent.run.approval_requested`` is emitted on the outbound webhook bus so
-external systems can subscribe. See ``docs/V72_Enterprise_SCIM_2FA.md``.
-"""
-from __future__ import annotations
-
-import json
-
-from app.db import get_conn
-
-
-def get_policy(workspace_id: int | None) -> dict:
-    """Effective policy (workspace row, else global row, else defaults)."""
-    with get_conn() as conn:
-        row = None
-        if workspace_id is not None:
-            row = conn.execute("SELECT * FROM agent_policies WHERE workspace_id=?",
-                               (workspace_id,)).fetchone()
-        if row is None:
-            row = conn.execute("SELECT * FROM agent_policies WHERE workspace_id IS NULL"
-                               ).fetchone()
-    if not row:
-        return {"allowed_tools": None, "max_steps": 12, "require_approval": False}
-    d = dict(row)
-    try:
-        allowed = json.loads(d.get("allowed_tools_json")) if d.get("allowed_tools_json") else None
-    except (TypeError, ValueError):
-        allowed = None
-    return {"allowed_tools": allowed, "max_steps": d.get("max_steps") or 12,
-            "require_approval": bool(d.get("require_approval"))}
-
-
-def check_tool(user_id: int, workspace_id: int | None, tool: str,
-               is_write: bool, conversation_id: int = 0) -> dict:
-    """Policy gate for one tool call.
-
-    Returns {allowed: bool, approval_id: int|None}. Denied tools and gated
-    writes (pending approval) return allowed=False; the engine renders both
-    as action errors without executing.
-    """
-    from app.services.permission_manager import WRITE_TOOLS
-    policy = get_policy(workspace_id)
-    allowed = policy["allowed_tools"]
-    if allowed is not None and tool not in set(allowed):
-        return {"allowed": False, "approval_id": None, "reason": "tool not in policy scope"}
-    if is_write or tool in WRITE_TOOLS:
-        if policy["require_approval"]:
-            with get_conn() as conn:
-                cur = conn.execute(
-                    """INSERT INTO agent_approvals
-                       (conversation_id, tool, args_json, status, requester_id)
-                       VALUES (?,?,?,?,?)""",
-                    (conversation_id, tool, "{}", "pending", user_id))
-                conn.commit()
-                approval_id = cur.lastrowid
-            try:
-                import asyncio
-
-                from app.services.webhook_outbound import fire_event as _fire
-                try:
-                    loop = asyncio.get_running_loop()
-                except RuntimeError:
-                    loop = None
-                if loop is not None:
-                    loop.create_task(_fire("agent.run.approval_requested", {
-                        "approval_id": approval_id, "tool": tool,
-                        "conversation_id": conversation_id}))
-            except Exception:  # noqa: BLE001 — webhook never blocks policy
-                pass
-            return {"allowed": False, "approval_id": approval_id,
-                    "reason": "approval requested"}
-    return {"allowed": True, "approval_id": None, "reason": ""}
-
-
-def decide_approval(approval_id: int, approver_id: int, approve: bool) -> dict | None:
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agent_approvals WHERE id=?",
-                           (approval_id,)).fetchone()
-        if not row or row["status"] != "pending":
-            return None
-        conn.execute("UPDATE agent_approvals SET status=?, approver_id=? WHERE id=?",
-                     ("approved" if approve else "rejected", approver_id, approval_id))
-        conn.commit()
-        return dict(conn.execute("SELECT * FROM agent_approvals WHERE id=?",
-                                 (approval_id,)).fetchone())
@@ -1,330 +0,0 @@
-"""FlowDeck — AI Writing Assist (v5.9.0).
-
-Headless, tool-free writing helpers used by the editor (slash commands,
-inline autocomplete) and the database table (AI property suggestions).
-
-All actions share one entry point, :meth:`AIWritingService.run`, which builds a
-tight prompt, calls the configured LLM (or the deterministic offline mock) and
-returns plain Markdown. `properties` additionally returns a structured
-``suggestions`` mapping so the caller can fill collection properties.
-
-The service never talks to the DB directly — the router resolves the caller's
-provider/key and the page context before delegating here.
-"""
-from __future__ import annotations
-
-import json
-import logging
-import re
-
-from app.services.llm_client import LLMClient
-
-logger = logging.getLogger(__name__)
-
-WRITING_ACTIONS = ("write", "summarize", "translate", "continue", "autocomplete", "properties")
-
-_MAX_CONTEXT = 20000
-
-# Property name → (type, offline default) used by the deterministic fallback so
-# the feature stays useful without a connected provider.
-_OFFLINE_PROPERTY_DEFAULTS = (
-    (("status", "état", "etat", "stage"), "select", "To do"),
-    (("priority", "priorité", "priorite"), "select", "Medium"),
-    (("done", "terminé", "termine", "complété", "complete"), "checkbox", False),
-    (("summary", "résumé", "resume", "description", "notes"), "text", ""),
-)
-
-_SYSTEM_WRITING = (
-    "Tu es l'assistant d'écriture de FlowDeck. "
-    "Réponds UNIQUEMENT avec le contenu demandé, en Markdown léger "
-    "(paragraphes, listes à puces, titres si utile). "
-    "N'ajoute aucun préambule, aucun commentaire, aucun bloc de code autour du texte."
-)
-
-
-class AIWritingService:
-    """Deterministic, provider-agnostic writing assistant."""
-
-    def __init__(self, user_id: int | None = None, provider: str | None = None,
-                 model: str | None = None, api_key: str | None = None,
-                 api_base: str | None = None):
-        self.user_id = user_id
-        self.provider = (provider or "").strip().lower() or None
-        self.model = (model or "").strip() or None
-        self._api_key = api_key
-        self._api_base = api_base
-
-    # ── LLM plumbing ──
-
-    def _client(self) -> LLMClient:
-        provider = self.provider
-        api_key = self._api_key
-        api_base = self._api_base
-        if provider and self.user_id:
-            try:
-                from app.services.llm_config import get_user_llm_key
-                row = get_user_llm_key(self.user_id, provider)
-                if row and row.get("api_key"):
-                    api_key = row["api_key"]
-                    api_base = (row.get("api_base") or "").strip() or api_base
-            except Exception:  # noqa: BLE001 — never fail on key lookup
-                pass
-        return LLMClient(provider=provider, api_key=api_key, api_base=api_base)
-
-    async def _complete(self, prompt: str, context: str = "") -> tuple[str, str, bool]:
-        llm = self._client()
-        offline = llm.provider == "offline" or not llm._has_credentials()
-        user_content = prompt
-        if context and context.strip():
-            user_content += "\n\n# Contexte\n" + context.strip()[:_MAX_CONTEXT]
-        messages = [
-            {"role": "system", "content": _SYSTEM_WRITING},
-            {"role": "user", "content": user_content},
-        ]
-        resp = await llm.complete(messages, model=self.model, tools=None, stream=False)
-        return (resp.text or "").strip(), (resp.model or self.model or ""), offline
-
-    # ── Public API ──
-
-    async def run(self, action: str, *, prompt: str = "", context: str = "",
-                  target_language: str = "English", prefix: str = "",
-                  title: str = "", properties: list | None = None) -> dict:
-        action = (action or "").strip().lower()
-        if action not in WRITING_ACTIONS:
-            raise ValueError(f"Action inconnue: {action or '(vide)'}")
-
-        if action == "properties":
-            suggestions = await self.suggest_properties(
-                context=context, title=title, properties=properties or [])
-            return {"ok": True, "action": action, "text": "", "suggestions": suggestions,
-                    "model": self.model or "", "offline": self._offline_hint()}
-
-        prompt_text = self._build_prompt(
-            action, prompt=prompt, context=context,
-            target_language=target_language, prefix=prefix, title=title)
-
-        # No connected provider → deterministic, dependency-free output (the raw
-        # offline planner echoes the prompt, which is wrong for continue/autocomplete).
-        if self._offline_hint():
-            return {"ok": True, "action": action, "model": "",
-                    "offline": True,
-                    "text": self._offline_text(action, prompt=prompt, context=context,
-                                               target_language=target_language,
-                                               prefix=prefix, title=title)}
-        try:
-            text, model, offline = await self._complete(prompt_text, context=context)
-        except Exception as exc:  # noqa: BLE001 — surface provider errors to the UI
-            logger.warning("AI writing '%s' failed: %s", action, exc)
-            return {"ok": False, "action": action, "error": str(exc),
-                    "text": "", "model": self.model or "", "offline": False}
-        if not text:
-            text = self._offline_text(action, prompt=prompt, context=context,
-                                      target_language=target_language,
-                                      prefix=prefix, title=title)
-            offline = True
-        return {"ok": True, "action": action, "text": text,
-                "model": model, "offline": offline}
-
-    # ── Prompt building ──
-
-    def _build_prompt(self, action: str, *, prompt: str, context: str,
-                      target_language: str, prefix: str, title: str) -> str:
-        if action == "write":
-            subject = (prompt or title or "ce document").strip()
-            return (f"Rédige le contenu demandé : {subject}. "
-                    "Fournis un texte structuré et directement utilisable.")
-        if action == "summarize":
-            return ("Résume le contenu fourni de façon structurée et concise : "
-                    "un court paragraphe d'introduction puis 3 à 5 points clés à puces.")
-        if action == "translate":
-            lang = (target_language or "English").strip()
-            return (f"Traduis l'intégralité du contenu fourni en {lang}, "
-                    "en conservant fidèlement sa structure (titres, listes, paragraphes). "
-                    "Ne traduis pas les noms propres et les termes techniques.")
-        if action == "continue":
-            return ("Poursuis naturellement le texte fourni. "
-                    "Écris un à trois paragraphes cohérents avec le style et le sujet, "
-                    "sans répéter ce qui précède et sans introduction.")
-        if action == "autocomplete":
-            return (f"Complète la phrase en cours par une suite courte et pertinente "
-                    f"(maximum 20 mots). Ne répète pas le texte déjà écrit, ne mets "
-                    f"aucun préambule. Texte en cours : {prefix!r}")
-        return prompt
-
-    # ── Offline deterministic fallbacks ──
-
-    def _offline_hint(self) -> bool:
-        try:
-            llm = self._client()
-            return llm.provider == "offline" or not llm._has_credentials()
-        except Exception:  # noqa: BLE001
-            return True
-
-    def _offline_text(self, action: str, *, prompt: str, context: str,
-                      target_language: str, prefix: str, title: str) -> str:
-        if action == "summarize":
-            return self._offline_summary(context)
-        if action == "translate":
-            return (f"⚠️ **Traduction hors-ligne indisponible** — aucun modèle d'IA connecté.\n\n"
-                    f"Connectez un fournisseur dans **Paramètres → Agent & IA** pour traduire "
-                    f"ce document en {target_language or 'English'}.")
-        if action == "autocomplete":
-            return self._offline_autocomplete(prefix)
-        if action == "continue":
-            return ("Suite du contenu : développez ici le point précédent avec un exemple "
-                    "concret, puis ouvrez la prochaine idée en une phrase de transition.")
-        subject = (prompt or title or "ce document").strip()
-        return (f"## {subject}\n"
-                "\n"
-                "Présentation générale du sujet : objectif, contexte et public visé en "
-                "quelques phrases. (Contenu généré hors-ligne — connectez une clé API "
-                "pour une rédaction complète.)\n"
-                "\n"
-                "## Points clés\n"
-                "• Idée principale 1 et son argument.\n"
-                "• Idée principale 2 avec un exemple concret.\n"
-                "\n"
-                "## Prochaines étapes\n"
-                "• Relire, compléter et mettre en forme ce contenu.")
-
-    @staticmethod
-    def _offline_summary(context: str) -> str:
-        text = (context or "").strip()
-        if not text:
-            return "Résumé : aucun contenu fourni à résumer."
-        headings = re.findall(r"^#{1,4}\s+(.+)$", text, flags=re.MULTILINE)
-        sentences = re.split(r"(?<=[.!?])\s+", re.sub(r"\s+", " ", text))
-        lead = next((s.strip() for s in sentences if len(s.strip()) > 40), sentences[0].strip())
-        out = ["**Résumé**", "", lead[:400], ""]
-        bullets = []
-        if headings:
-            bullets = [f"• {h.strip()}" for h in headings[:5]]
-        else:
-            for s in sentences[1:6]:
-                s = s.strip()
-                if len(s) > 30:
-                    bullets.append(f"• {s[:180]}")
-        if bullets:
-            out.append("**Points clés**")
-            out.extend(bullets)
-        return "\n".join(out)
-
-    @staticmethod
-    def _offline_autocomplete(prefix: str) -> str:
-        prefix = (prefix or "").strip()
-        if len(prefix) < 8:
-            return ""
-        return " Cette section détaille les points clés à retenir."
-
-    # ── AI properties ──
-
-    async def suggest_properties(self, *, context: str = "", title: str = "",
-                                 properties: list | None = None) -> dict:
-        """Return ``{property_name: value}`` suggestions for a collection page.
-
-        ``properties`` is a list of ``{name, type}`` dicts. With a connected
-        provider the model is asked for a JSON object; offline we derive
-        deterministic defaults from the property names so the UI stays useful.
-        """
-        properties = properties or []
-        if not properties:
-            return {}
-        names = [str(p.get("name", "")).strip() for p in properties if isinstance(p, dict)]
-        names = [n for n in names if n]
-
-        llm = self._client()
-        offline = llm.provider == "offline" or not llm._has_credentials()
-        if not offline:
-            schema = {str(p.get("name")): str(p.get("type", "text")) for p in properties if isinstance(p, dict)}
-            prompt = (
-                "À partir du titre et du contenu du document, propose une valeur pour "
-                "chaque propriété. Réponds STRICTEMENT par un objet JSON "
-                "{\"nom_propriété\": valeur} sans texte autour.\n"
-                f"Propriétés attendues : {json.dumps(schema, ensure_ascii=False)}\n"
-                f"Titre : {title or '(sans titre)'}"
-            )
-            try:
-                text, _, _ = await self._complete(prompt, context=context)
-                parsed = self._parse_json_object(text)
-                if parsed:
-                    return self._coerce_suggestions(parsed, properties)
-            except Exception as exc:  # noqa: BLE001
-                logger.warning("AI properties failed: %s", exc)
-            # fall through to deterministic defaults
-        return self._offline_suggestions(title, context, properties)
-
-    @staticmethod
-    def _parse_json_object(text: str) -> dict:
-        text = (text or "").strip()
-        if not text:
-            return {}
-        m = re.search(r"\{.*\}", text, flags=re.DOTALL)
-        if not m:
-            return {}
-        try:
-            data = json.loads(m.group(0))
-        except json.JSONDecodeError:
-            return {}
-        return data if isinstance(data, dict) else {}
-
-    def _coerce_suggestions(self, parsed: dict, properties: list) -> dict:
-        out: dict = {}
-        by_name = {str(p.get("name", "")).strip().lower(): p for p in properties if isinstance(p, dict)}
-        for key, value in parsed.items():
-            prop = by_name.get(str(key).strip().lower())
-            if not prop:
-                continue
-            out[str(prop.get("name"))] = self._coerce_value(value, prop.get("type", "text"))
-        return out
-
-    @staticmethod
-    def _coerce_value(value, prop_type: str):
-        ptype = (prop_type or "text").lower()
-        if ptype == "checkbox":
-            if isinstance(value, bool):
-                return value
-            return str(value).strip().lower() in ("1", "true", "yes", "oui", "vrai", "x")
-        if ptype == "number":
-            try:
-                num = float(value)
-                return int(num) if num.is_integer() else num
-            except (TypeError, ValueError):
-                return value
-        if isinstance(value, (dict, list)):
-            return json.dumps(value, ensure_ascii=False)
-        return value
-
-    @staticmethod
-    def _offline_suggestions(title: str, context: str, properties: list) -> dict:
-        out: dict = {}
-        summary_text = ""
-        if context:
-            summary_text = re.sub(r"\s+", " ", context).strip()
-            first = re.split(r"(?<=[.!?])\s+", summary_text)
-            summary_text = next((s for s in first if len(s) > 40), summary_text)[:180]
-        for prop in properties:
-            if not isinstance(prop, dict):
-                continue
-            name = str(prop.get("name", "")).strip()
-            if not name:
-                continue
-            low = name.lower()
-            ptype = (prop.get("type") or "text").lower()
-            matched = False
-            for keys, _ptype, default in _OFFLINE_PROPERTY_DEFAULTS:
-                if any(k in low for k in keys):
-                    if "summary" in keys or "résumé" in keys or "resume" in keys or "description" in keys or "notes" in keys:
-                        out[name] = summary_text or (title or "")
-                    else:
-                        out[name] = default
-                    matched = True
-                    break
-            if not matched and ptype in ("text", "title"):
-                if "name" in low or "titre" in low or "title" in low:
-                    out[name] = title or ""
-        return out
-
-
-async def run_action(action: str, **kwargs) -> dict:
-    """Module-level convenience wrapper (used by tests and simple callers)."""
-    return await AIWritingService().run(action, **kwargs)
@@ -1,317 +0,0 @@
-"""FlowDeck — helpers for API v2 (v6.3.0).
-
-Pagination, ISO-8601, RFC7807 errors, hierarchical scopes, Bearer auth.
-No duplication: thin wrappers over existing services.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import logging
-import time
-from datetime import UTC, datetime
-from typing import Any
-
-from fastapi import Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.config import settings
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-
-# ── ISO-8601 ──────────────────────────────────────────────────────────────
-
-def to_iso8601(value: str | None) -> str | None:
-    if not value:
-        return None
-    # SQLite stores "YYYY-MM-DD HH:MM:SS" or with T; convert to UTC Z
-    try:
-        # try with seconds
-        for fmt in ("%Y-%m-%d %H:%M:%S", "%Y-%m-%dT%H:%M:%S", "%Y-%m-%d %H:%M:%S.%f", "%Y-%m-%dT%H:%M:%S.%f"):
-            try:
-                dt = datetime.strptime(value[:19], fmt[:8] if "." in value else fmt)
-                # SQLite has no tz => assume UTC
-                dt = dt.replace(tzinfo=UTC)
-                return dt.isoformat().replace("+00:00", "Z")
-            except ValueError:
-                continue
-        # fallback: if already ISO with T/Z, return as-is
-        if "T" in value:
-            return value
-        return value
-    except Exception:
-        return value
-
-def row_to_dict(row, *, iso_fields: tuple[str, ...] = ("created_at", "updated_at", "created_at_ts", "last_login", "joined_at", "accessed_at", "fired_at", "start_date", "end_date", "logged_at", "last_seen_at", "last_used_at", "verified_at", "last_login_at")) -> dict:
-    if row is None:
-        return {}
-    d = dict(row)
-    for k in list(d.keys()):
-        if k in iso_fields and d[k]:
-            iso = to_iso8601(str(d[k]))
-            if iso:
-                d[k] = iso
-        # parse *_json columns
-        if k.endswith("_json") and isinstance(d[k], str):
-            try:
-                d[k] = json.loads(d[k] or "{}" if d[k].strip().startswith("{") or d[k].strip().startswith("[") else d[k])
-            except Exception:
-                logger.exception("row_to_dict")
-    return d
-
-# ── Pagination ────────────────────────────────────────────────────────────
-
-def parse_pagination(request: Request, default_limit: int = 30, max_limit: int = 100) -> tuple[int, int]:
-    try:
-        limit = int(request.query_params.get("limit", str(default_limit)))
-    except ValueError:
-        limit = default_limit
-    try:
-        offset = int(request.query_params.get("offset", "0"))
-    except ValueError:
-        offset = 0
-    limit = max(1, min(limit, max_limit))
-    offset = max(0, offset)
-    return limit, offset
-
-def paginate_headers(total: int) -> dict[str, str]:
-    return {"X-Total-Count": str(total)}
-
-# ── Scopes (hierarchical: read < write < admin) ──────────────────────────
-
-SCOPE_RANK = {"read": 1, "write": 2, "admin": 3}
-VALID_SCOPES = set(SCOPE_RANK.keys())
-
-def normalize_scopes(raw: str | None) -> set[str]:
-    if not raw:
-        return set()
-    parts = [p.strip().lower() for p in raw.split(",") if p.strip()]
-    return {p for p in parts if p in VALID_SCOPES}
-
-def has_scope(token_scopes: str | None, required: str) -> bool:
-    req_rank = SCOPE_RANK.get(required, 99)
-    # token with higher rank satisfies lower requirement
-    # admin => write => read
-    token_set = normalize_scopes(token_scopes)
-    if not token_set:
-        return False
-    # effective rank = max rank among token scopes
-    eff = max((SCOPE_RANK.get(s, 0) for s in token_set), default=0)
-    return eff >= req_rank
-
-def validate_scopes_input(scopes_raw: str | None) -> str:
-    if not scopes_raw:
-        return "read"
-    parts = [p.strip().lower() for p in scopes_raw.split(",") if p.strip()]
-    for p in parts:
-        if p not in VALID_SCOPES:
-            raise HTTPException(status_code=400, detail=f"Invalid scope: {p}. Valid: read, write, admin")
-    if not parts:
-        return "read"
-    # dedup preserve order
-    seen = []
-    for p in parts:
-        if p not in seen:
-            seen.append(p)
-    return ",".join(seen)
-
-# ── Bearer auth (unified) ─────────────────────────────────────────────────
-
-def _hash_token(token: str) -> str:
-    return hashlib.sha256(token.encode()).hexdigest()
-
-def resolve_bearer_token(token: str) -> dict | None:
-    """Resolve Bearer token to user dict. Returns None if invalid/expired/revoked.
-    Supports api_tokens (hashed), extension_devices (hashed), and legacy user_tokens (plain).
-    """
-    if not token:
-        return None
-    # dev-only fallback
-    if token == "fd-public-key":
-        if not settings.public_api_insecure_ok:
-            return None
-        # return a synthetic admin-like user? Use first admin or id 1
-        with get_conn() as conn:
-            row = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE is_admin=1 ORDER BY id LIMIT 1").fetchone()
-            if row:
-                d = dict(row)
-                d["_token_id"] = None
-                d["_token_scopes"] = "read,write,admin"
-                d["_token_hash"] = None
-                return d
-            row = conn.execute("SELECT id, login, full_name, email, is_admin FROM users ORDER BY id LIMIT 1").fetchone()
-            if row:
-                d = dict(row)
-                d["_token_id"] = None
-                d["_token_scopes"] = "read,write,admin"
-                d["_token_hash"] = None
-                return d
-        return None
-    th = _hash_token(token)
-    with get_conn() as conn:
-        # 1) api_tokens
-        row = conn.execute("SELECT id, user_id, scopes, expires_at, revoked FROM api_tokens WHERE token_hash=?", (th,)).fetchone()
-        if row:
-            if row["revoked"]:
-                return None
-            exp = row["expires_at"]
-            if exp:
-                try:
-                    # compare as timestamp; SQLite format "YYYY-MM-DD HH:MM:SS"
-                    # parse to epoch
-                    dt = datetime.fromisoformat(str(exp).replace("Z", "+00:00")) if "T" in str(exp) else datetime.strptime(str(exp)[:19], "%Y-%m-%d %H:%M:%S")
-                    if dt.tzinfo is None:
-                        dt = dt.replace(tzinfo=UTC)
-                    if dt.timestamp() < time.time():
-                        return None
-                except Exception:
-                    logger.exception("resolve_bearer_token")
-            u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
-            if u:
-                d = dict(u)
-                d["_token_id"] = row["id"]
-                d["_token_scopes"] = row["scopes"] or "read,write"
-                d["_token_hash"] = th
-                # touch last_used_at best-effort
-                try:
-                    conn.execute("UPDATE api_tokens SET last_used_at=CURRENT_TIMESTAMP WHERE id=?", (row["id"],))
-                    conn.commit()
-                except Exception:
-                    logger.exception("resolve_bearer_token")
-                return d
-        # 2) extension_devices
-        row = conn.execute("SELECT user_id, scopes FROM extension_devices WHERE token_hash=? AND revoked=0", (th,)).fetchone()
-        if row:
-            u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
-            if u:
-                d = dict(u)
-                d["_token_id"] = None
-                d["_token_scopes"] = row["scopes"] or "read,write"
-                d["_token_hash"] = th
-                return d
-        # 3) legacy user_tokens (plain storage)
-        row = conn.execute("SELECT gitea_user_id FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
-        if row:
-            u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["gitea_user_id"],)).fetchone()
-            if u:
-                d = dict(u)
-                d["_token_id"] = None
-                d["_token_scopes"] = "read,write"
-                d["_token_hash"] = th
-                return d
-    return None
-
-def get_bearer_user(request: Request, authorization: str | None = Header(default=None)) -> dict:
-    # Prefer explicit Authorization header, fallback to lowercase
-    auth = authorization or request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if not auth or not auth.lower().startswith("bearer "):
-        raise HTTPException(status_code=401, detail="API token required. Use Authorization: Bearer <token>")
-    token = auth[7:].strip()
-    user = resolve_bearer_token(token)
-    if not user:
-        raise HTTPException(status_code=401, detail="Invalid or expired API token")
-    return user
-
-def require_scope(required: str):
-    """A30 : la factory de scopes, AVOIR utilisée — les handlers faisaient
-    `has_scope(...)` à la main (69 sites dans api_v2.py)."""
-    def _dep(request: Request, authorization: str | None = Header(default=None)) -> dict:
-        user = get_bearer_user(request, authorization)
-        # Pas de default "read" : identique au contrôle manuel des handlers
-        # (un jeton sans scope est refusé, quel que soit le scope demandé).
-        scopes = user.get("_token_scopes")
-        if not has_scope(scopes, required):
-            raise HTTPException(status_code=403, detail=f"Insufficient scope. Required: {required}, token scopes: {scopes}")
-        return user
-    return _dep
-
-# ── RFC 7807 ──────────────────────────────────────────────────────────────
-
-def problem_response(request: Request, exc: HTTPException) -> JSONResponse:
-    title_map = {
-        400: "Bad Request",
-        401: "Unauthorized",
-        403: "Forbidden",
-        404: "Not Found",
-        409: "Conflict",
-        422: "Unprocessable Entity",
-        429: "Too Many Requests",
-        500: "Internal Server Error",
-    }
-    status = exc.status_code
-    detail = exc.detail if isinstance(exc.detail, str) else str(exc.detail)
-    body = {
-        "type": f"https://flowdeck/api/errors/{status}",
-        "title": title_map.get(status, "Error"),
-        "status": status,
-        "detail": detail,
-        "instance": str(request.url.path),
-    }
-    return JSONResponse(status_code=status, content=body, media_type="application/problem+json")
-
-# ── Audit ─────────────────────────────────────────────────────────────────
-
-def audit_log(user: dict, action: str, resource_type: str = "", resource_id: str | int = "", detail: str = "", request: Request | None = None) -> None:
-    try:
-        ip = ""
-        if request and request.client:
-            ip = request.client.host or ""
-        with get_conn() as conn:
-            conn.execute(
-                "INSERT INTO api_audit_log (user_id, token_id, action, resource_type, resource_id, ip_address, detail) VALUES (?, ?, ?, ?, ?, ?, ?)",
-                (user.get("id"), user.get("_token_id"), action, resource_type, str(resource_id), ip, detail[:1000]),
-            )
-            conn.commit()
-    except Exception:
-        logger.exception("audit_log")
-
-# ── Rate limit per token (in-memory) ─────────────────────────────────────
-
-_v2_rate_store: dict[str, tuple[float, int]] = {}
-def check_v2_rate_limit(token_hash: str | None, ip: str) -> bool:
-    """Return True if allowed, False if 429. Uses api_v2_rate_limit_per_token."""
-    key = token_hash or f"ip:{ip}"
-    now = time.time()
-    window = 60.0
-    max_req = settings.api_v2_rate_limit_per_token
-    start, count = _v2_rate_store.get(key, (now, 0))
-    if now - start > window:
-        _v2_rate_store[key] = (now, 1)
-        return True
-    if count >= max_req:
-        return False
-    _v2_rate_store[key] = (start, count + 1)
-    return True
-
-# ── Idempotency ───────────────────────────────────────────────────────────
-
-def check_idempotency(request: Request, user_id: int) -> dict | None:
-    key = request.headers.get("Idempotency-Key") or request.headers.get("idempotency-key")
-    if not key:
-        return None
-    key = key.strip()[:200]
-    if not key:
-        return None
-    with get_conn() as conn:
-        row = conn.execute("SELECT response_json, status_code FROM idempotency_keys WHERE key=? AND user_id=?", (key, user_id)).fetchone()
-        if row:
-            try:
-                data = json.loads(row["response_json"])
-                return {"data": data, "status": row["status_code"], "key": key}
-            except Exception:
-                return None
-    return None
-
-def store_idempotency(key: str, user_id: int, data: Any, status_code: int = 200) -> None:
-    if not key:
-        return
-    try:
-        with get_conn() as conn:
-            conn.execute(
-                "INSERT OR IGNORE INTO idempotency_keys (key, user_id, response_json, status_code) VALUES (?, ?, ?, ?)",
-                (key.strip()[:200], user_id, json.dumps(data), status_code),
-            )
-            conn.commit()
-    except Exception:
-        logger.exception("store_idempotency")
@@ -1,847 +0,0 @@
-"""FlowDeck — Automations engine (v5.1.0).
-
-Implements the "if-this-then-that" rule engine: automations match an event (or a
-cron schedule, or a clickable button), optionally guard on a condition, then run
-a list of actions.
-
-Condition clauses (``condition_json``), all combined with AND:
-    {"property": "Status", "op": "eq", "value": "Done"}
-    {"property": "Priority", "op": "not_contains", "value": "Low"}
-    {"property": "Assignee", "op": "is_empty"}
-    {"property": "Estimate", "op": "changed"}          (only event triggers)
-Flags:
-    op in {eq, neq, contains, not_contains, is_empty, is_not_empty, changed}
-
-Actions (``actions_json``), executed sequentially:
-    {"type": "webhook", "url": "...", "secret": "..."}
-    {"type": "set_property", "property": "Status", "value": "Done"}
-    {"type": "create_page", "collection_id": 3, "title": "...", "properties": {...}}
-    {"type": "notify", "message": "Automation fired"}
-"""
-from __future__ import annotations
-
-import asyncio
-import json
-import logging
-import time
-from datetime import UTC, datetime, timedelta
-
-from app.db import get_conn
-from app.services import notifications
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-
-COND_OPS = {"eq", "neq", "contains", "not_contains", "is_empty", "is_not_empty", "changed"}
-# Events that fire on collection pages (payload carries a `properties` dict).
-PAGE_PROP_EVENTS = {"page.created", "page.updated", "page.deleted"}
-
-
-def _prop_value(props: dict, key) -> tuple[bool, object]:
-    """Resolve a property value by id or name. Returns ``(found, value)``.
-
-    ``props`` may be keyed by property id (FlowDeckDB UI) or name (agent / API).
-    """
-    if props is None:
-        return False, None
-    if key is None:
-        return True, None
-    skey = str(key)
-    if skey in props:
-        return True, props[skey]
-    if isinstance(key, int) and str(key) in props:
-        return True, props[str(key)]
-    return False, None
-
-
-def match_condition_props(props: dict, before_props: dict | None, clause: dict) -> bool:
-    """Evaluate a single condition clause against page property values."""
-    op = clause.get("op", "eq")
-    if op not in COND_OPS:
-        return False
-    if op == "changed":
-        key = clause.get("property")
-        if before_props is None:
-            return False
-        found_before, before_val = _prop_value(before_props, key)
-        found_after, after_val = _prop_value(props, key)
-        return found_before and found_after and before_val != after_val
-
-    found, val = _prop_value(props, clause.get("property"))
-
-    if op == "is_empty":
-        if not found:
-            return True
-        return val is None or str(val).strip() == ""
-    if op == "is_not_empty":
-        return found and val is not None and str(val).strip() != ""
-
-    if not found:
-        return False
-    want = clause.get("value")
-    if op == "eq":
-        return _norm(val) == _norm(want)
-    if op == "neq":
-        return _norm(val) != _norm(want)
-    if op == "contains":
-        return _norm(want) in _norm(val) if _norm(val) else False
-    if op == "not_contains":
-        return _norm(want) not in _norm(val) if _norm(val) else True
-    return False
-
-
-def _norm(v) -> str:
-    if v is None:
-        return ""
-    if isinstance(v, (list, dict)):
-        return json.dumps(v)
-    return str(v)
-
-
-def evaluate_conditions(condition_json, props: dict | None, before_props: dict | None = None) -> bool:
-    """Evaluate the stored condition list (AND of all clauses). Empty list → True."""
-    try:
-        clauses = json.loads(condition_json) if isinstance(condition_json, str) else (condition_json or [])
-    except (TypeError, json.JSONDecodeError):
-        clauses = []
-    for clause in clauses or []:
-        if not match_condition_props(props, before_props, clause):
-            return False
-    return True
-
-
-def get_page_context(page_id: int, collection_id: int) -> dict:
-    """Load a collection page's property values for condition evaluation."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, icon, property_values_json FROM collection_pages WHERE id=?",
-            (page_id,),
-        ).fetchone()
-        if not row:
-            return {"page_id": page_id, "collection_id": collection_id,
-                    "title": "", "properties": {}, "icon": "file"}
-        try:
-            props = json.loads(row["property_values_json"])
-        except (TypeError, json.JSONDecodeError):
-            props = {}
-        return {"page_id": page_id, "collection_id": collection_id,
-                "title": row["title"], "icon": row["icon"], "properties": props}
-
-
-def _save_run(automation_id: int, trigger_source: str, status: str, detail: str,
-              collection_id: int | None = None, page_id: int | None = None) -> None:
-    with get_conn() as conn:
-        conn.execute(
-            """INSERT INTO automation_runs
-               (automation_id, trigger_source, status, detail, collection_id, page_id)
-               VALUES (?,?,?,?,?,?)""",
-            (automation_id, trigger_source, status, detail, collection_id, page_id),
-        )
-        conn.execute(
-            "UPDATE automations SET run_count=run_count+1, last_run_at=CURRENT_TIMESTAMP WHERE id=?",
-            (automation_id,),
-        )
-        conn.commit()
-
-
-def _maybe_convert_prediction(value, props: dict) -> tuple[bool, object]:
-    """Allow action values to interpolate other page properties: e.g. [[Assignee]] or {{title}}."""
-    if not isinstance(value, str):
-        return True, value
-    replaced = value
-    for key in props:
-        if "[[" + str(key) + "]]" in replaced:
-            replaced = replaced.replace("[[" + str(key) + "]]", str(props[key]))
-    if "{{title}}" in replaced:
-        replaced = replaced.replace("{{title}}", str(props.get("title", "")))
-    if "{{id}}" in replaced:
-        replaced = replaced.replace("{{id}}", str(props.get("page_id", "")))
-    return True, replaced
-
-
-async def _run_action(action: dict, context: dict, trigger_source: str) -> str:
-    """Execute a single action. Returns a human summary. Raises on failure."""
-    atype = action.get("type")
-
-    if atype == "webhook":
-        url = action.get("url", "").strip()
-        if not url:
-            raise ValueError("webhook action requires a url")
-        # A13 : SSRF — même garde que l'importer URL (loopback/privé refusé).
-        from urllib.parse import urlparse as _urlparse
-
-        from app.services.importers.url_fetch import _is_public_host
-        _parsed = _urlparse(url)
-        if _parsed.scheme not in ("http", "https") or not _parsed.hostname or not _is_public_host(_parsed.hostname):
-            raise ValueError(f"webhook url non autorisée: {_parsed.hostname!r}")
-        secret = action.get("secret", "")
-        headers = {"Content-Type": "application/json", "X-FlowDeck-Event": context.get("event", "")}
-        if secret:
-            headers["X-FlowDeck-Secret"] = secret
-        async with shared_client(timeout=10) as client:
-            resp = await client.post(url, json=context, headers=headers)
-        if resp.status_code >= 400:
-            raise RuntimeError(f"webhook returned HTTP {resp.status_code}")
-        return f"webhook → {url} ({resp.status_code})"
-
-    if atype == "set_property":
-        prop = action.get("property")
-        value = action.get("value")
-        page_id = context.get("page_id")
-        if not prop or not page_id:
-            raise ValueError("set_property requires property + page context")
-        _, resolved = _maybe_convert_prediction(value, context)
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT property_values_json, collection_id FROM collection_pages WHERE id=?",
-                (page_id,),
-            ).fetchone()
-            if not row:
-                raise ValueError(f"page {page_id} not found")
-            try:
-                props = json.loads(row["property_values_json"])
-            except (TypeError, json.JSONDecodeError):
-                props = {}
-            props[prop] = resolved
-            from app.routers.collections import _validate_page_properties
-            _validate_page_properties(conn, row["collection_id"], props, exclude_page_id=page_id)
-            conn.execute(
-                "UPDATE collection_pages SET property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (json.dumps(props), page_id),
-            )
-            conn.commit()
-        return f"set property {prop} = {resolved}"
-
-    if atype == "create_page":
-        coll_id = action.get("collection_id")
-        title = action.get("title", "Automation page")
-        properties = action.get("properties", {}) or {}
-        if not coll_id:
-            raise ValueError("create_page requires a collection_id")
-        _, resolved_title = _maybe_convert_prediction(title, context)
-        resolved_props = {}
-        for k, v in properties.items():
-            _, pv = _maybe_convert_prediction(v, context)
-            resolved_props[k] = pv
-        with get_conn() as conn:
-            max_pos = conn.execute(
-                "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE collection_id=?",
-                (coll_id,),
-            ).fetchone()[0]
-            cur = conn.execute(
-                "INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?,?,?,?)",
-                (coll_id, resolved_title, max_pos, json.dumps(resolved_props)),
-            )
-            conn.commit()
-        return f"created page {cur.lastrowid} in collection {coll_id}"
-
-    if atype == "notify":
-        message = action.get("message", "Automation fired")
-        user_id = action.get("user_id")
-        if not user_id:
-            user_id = context.get("created_by") or 1
-        _, resolved = _maybe_convert_prediction(message, context)
-        notifications.create_notification(
-            user_id=user_id,
-            actor_id=context.get("created_by") or 1,
-            ntype="page",
-            title=context.get("automation_name", "Automation"),
-            message=resolved,
-            resource_type="collection_page" if context.get("page_id") else "page",
-            resource_id=context.get("page_id") or context.get("collection_id") or 0,
-            url=context.get("url", ""),
-        )
-        return f"notified user {user_id}"
-
-    if atype == "slack":
-        url = _secret_value(action.get("webhook_url") or action.get("url") or "")
-        if not url:
-            raise ValueError("slack action requires a webhook_url")
-        _, text = _maybe_convert_prediction(
-            action.get("text") or action.get("message") or "Automation fired", context)
-        return await _post_slack(url, text)
-
-    if atype == "email":
-        to = action.get("to", "")
-        _, subject = _maybe_convert_prediction(action.get("subject", "FlowDeck automation"), context)
-        _, body = _maybe_convert_prediction(action.get("body", action.get("message", "")), context)
-        return await _send_email_action(to, subject, body, context)
-
-    if atype == "forge_issue":
-        provider = (action.get("provider") or "gitea").lower()
-        owner = action.get("owner", "")
-        repo = action.get("repo", "")
-        if not owner or not repo:
-            raise ValueError("forge_issue requires owner + repo")
-        _, title = _maybe_convert_prediction(action.get("title", "Automation issue"), context)
-        _, body = _maybe_convert_prediction(action.get("body", ""), context)
-        return await _create_forge_issue(
-            provider, owner, repo, title, body,
-            labels=action.get("labels") or [],
-            user_id=context.get("created_by"),
-        )
-
-    if atype == "agent_trigger":
-        agent_id = action.get("agent_id")
-        if not agent_id:
-            raise ValueError("agent_trigger requires an agent_id")
-        _, message = _maybe_convert_prediction(action.get("message", ""), context)
-        return await _run_linked_agent(
-            int(agent_id), context.get("created_by") or 1,
-            context.get("workspace_id"), message, context)
-
-    raise ValueError(f"unknown action type: {atype!r}")
-
-
-async def run_automation(automation_id: int, trigger_source: str, context: dict) -> dict:
-    """Load, condition-check and execute an automation. Records a run row."""
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automations WHERE id=?", (automation_id,)).fetchone()
-        if not row:
-            return {"status": "skipped", "detail": "automation not found"}
-        auto = dict(row)
-
-    if not auto["enabled"]:
-        return {"status": "skipped", "detail": "automation disabled"}
-
-    # v7.0.0: chained steps take over when present (legacy path otherwise).
-    stepped = await _maybe_run_stepped(auto, trigger_source, context)
-    if stepped is not None:
-        return stepped
-
-    props = context.get("properties")
-    before = context.get("before_properties")
-    if not evaluate_conditions(auto["condition_json"], props, before):
-        _save_run(automation_id, trigger_source, "skipped", "condition not met",
-                  context.get("collection_id"), context.get("page_id"))
-        return {"status": "skipped", "detail": "condition not met"}
-
-    try:
-        actions = json.loads(auto["actions_json"]) if auto["actions_json"] else []
-    except (TypeError, json.JSONDecodeError):
-        actions = []
-
-    ctx = dict(context)
-    ctx["automation_name"] = auto["name"]
-    ctx["created_by"] = auto["created_by"] or ctx.get("created_by")
-
-    results = []
-    try:
-        for action in actions or []:
-            results.append(await _run_action(action, ctx, trigger_source))
-        detail = "; ".join(results)
-        _save_run(automation_id, trigger_source, "fired", detail,
-                  ctx.get("collection_id"), ctx.get("page_id"))
-        # v6.4.0: emit automation.fired (goes through fire_event → outbound
-        # webhooks, but NOT back through automations to avoid recursion).
-        try:
-            from app.services.webhook_outbound import fire_event as _fire_wh
-            await _fire_wh("automation.fired", {
-                "automation_id": automation_id,
-                "name": auto["name"],
-                "trigger": trigger_source,
-                "collection_id": ctx.get("collection_id"),
-                "page_id": ctx.get("page_id"),
-                "detail": detail,
-            })
-        except Exception:  # noqa: BLE001
-            logger.debug("automation.fired webhook dispatch failed")
-        return {"status": "fired", "detail": detail}
-    except Exception as exc:  # noqa: BLE001 — record every failure in history
-        logger.warning("Automation %s failed: %s", automation_id, exc)
-        _save_run(automation_id, trigger_source, "error", str(exc),
-                  ctx.get("collection_id"), ctx.get("page_id"))
-        return {"status": "error", "detail": str(exc)}
-
-
-def run_event_sync(coro, timeout: float = 60.0):
-    """A21 phase 2b : exécute une coroutine d'événement depuis un handler synchrone.
-
-    Bloque le worker threadpool (jamais la boucle d'event) et attend la fin —
-    déterministe, exactement ce que faisait l'await avant la conversion des
-    routes en `def`.
-    ponytail: les clients httpx des services sont créés à chaque appel (aucun
-    lien de boucle) ; si un jour un client/queue est lié à la boucle de l'app,
-    passer à `asyncio.run_coroutine_threadsafe` + boucle capturée au lifespan.
-    """
-    return asyncio.run(asyncio.wait_for(coro, timeout))
-
-
-async def fire_event(event: str, payload: dict):
-    """Dispatch an event to outbound webhooks and matching automations."""
-    # v7.3.0: page.updated → in-app notification to followers (throttled).
-    if event == "page.updated":
-        try:
-            from app.services.wiki import notify_followers_of_page_update
-            notify_followers_of_page_update(
-                payload.get("page_id"), payload.get("actor_id"),
-                payload.get("title") or "")
-        except Exception:  # noqa: BLE001 — notifications are best-effort
-            logger.debug("followers notification failed for page.updated")
-    # Outbound webhooks (v2.1.0 machinery, previously called nowhere).
-    try:
-        from app.services.webhook_outbound import fire_event as fire_webhooks
-        await fire_webhooks(event, payload)
-    except Exception:  # noqa: BLE001
-        logger.debug("Webhook dispatch failed for %s", event)
-
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT * FROM automations
-               WHERE trigger_type='event' AND event=? AND enabled=1""",
-            (event,),
-        ).fetchall()
-    stepped_ids: set[int] = set()
-    try:
-        with get_conn() as _c:
-            stepped_ids = {r[0] for r in _c.execute(
-                "SELECT DISTINCT automation_id FROM automation_steps").fetchall()}
-    except Exception:  # noqa: BLE001 — table missing on very old DBs
-        pass
-    for row in rows:
-        auto = dict(row)
-        if auto["id"] in stepped_ids:
-            continue  # v7.0.0: handled by fire_stepped_event below (no double run)
-        if auto["collection_id"] and payload.get("collection_id") != auto["collection_id"]:
-            continue
-        context = dict(payload)
-        context["event"] = event
-        await run_automation(auto["id"], "event", context)
-
-    # v7.0.0: step-based automations (multi-trigger any/all, chains).
-    try:
-        await fire_stepped_event(event, payload)
-    except Exception:  # noqa: BLE001
-        logger.debug("stepped dispatch failed for %s", event)
-
-
-# ═══════════ Cron scheduling (trigger_type='cron') ═══════════
-
-_SUPPORTED_CRON = {
-    "*/1": 1, "*/5": 5, "*/10": 10, "*/15": 15, "*/30": 30,
-    "*/2": 2, "*/3": 3, "*/6": 6, "*/12": 12, "*/20": 20, "*/45": 45,
-}
-
-
-def cron_due(expression: str, last_run_at: str | None, now: datetime | None = None) -> bool:
-    """True when a ``*/N`-style or fixed-minute cron expression is due.
-
-    Supports ``*/15 * * * *`` (every N minutes) and ``*/N`` alone, plus exact
-    ``H * * * *`` at minute H of every hour. ``@hourly`` / ``@daily`` also work.
-    """
-    expr = (expression or "").strip().lower()
-    if not expr:
-        return False
-    now = now or datetime.now(UTC).replace(tzinfo=None)
-    minute = now.minute
-    fields = expr.split()
-
-    if expr in ("@hourly", "hourly"):
-        if last_run_at is None:
-            return True
-        try:
-            last = datetime.fromisoformat(str(last_run_at).replace("Z", ""))
-        except Exception:
-            return True
-        return (now - last.replace(tzinfo=None)) >= timedelta(minutes=60)
-
-    if expr in ("@daily", "daily"):
-        if last_run_at is None:
-            return True
-        try:
-            last = datetime.fromisoformat(str(last_run_at).replace("Z", ""))
-        except Exception:
-            return True
-        return (now - last.replace(tzinfo=None)) >= timedelta(hours=24)
-
-    # "*/N * * * *" → every N minutes
-    if fields and fields[0].startswith("*/"):
-        val = fields[0][2:]
-        if not val.isdigit() or int(val) not in _SUPPORTED_CRON.values():
-            return False
-        n = int(val)
-        if last_run_at is None:
-            return True
-        try:
-            last = datetime.fromisoformat(str(last_run_at).replace("Z", ""))
-        except Exception:
-            return True
-        return (now - last.replace(tzinfo=None)) >= timedelta(minutes=n)
-
-    # "H * * * *" → at a fixed minute of each hour
-    if len(fields) == 5 and fields[0].isdigit():
-        return int(fields[0]) == minute
-
-    return False
-
-
-async def automation_scheduler():
-    """Background loop: fire due cron automations (checked every 60s)."""
-    while True:
-        try:
-            with get_conn() as conn:
-                rows = conn.execute(
-                    "SELECT * FROM automations WHERE trigger_type='cron' AND enabled=1"
-                ).fetchall()
-            for row in rows:
-                auto = dict(row)
-                try:
-                    if cron_due(auto["cron_expression"], auto["last_run_at"]):
-                        context = {
-                            "collection_id": auto["collection_id"] or 0,
-                            "page_id": None,
-                            "properties": None,
-                        }
-                        await run_automation(auto["id"], "cron", context)
-                except Exception:  # noqa: BLE001
-                    logger.warning("Cron automation %s errored", auto["id"])
-            # v7.0.0: workers on a cron schedule share the same 60s loop.
-            try:
-                from app.services.workers import run_due_workers
-                await run_due_workers()
-            except Exception:  # noqa: BLE001
-                logger.warning("worker cron iteration failed")
-        except Exception:  # noqa: BLE001
-            logger.warning("automation_scheduler iteration failed")
-        await asyncio.sleep(60)
-
-
-# ═══════════ v7.0.0 — multi-step automations (triggers/conditions/delay) ══
-
-STEP_KINDS = ("trigger", "condition", "delay", "action")
-STEP_ACTION_TYPES = ("webhook", "set_property", "create_page", "notify",
-                     "slack", "email", "forge_issue", "agent_trigger")
-ALL_MODE_WINDOW_S = 300.0
-
-# mode=all bookkeeping (single-process): automation_id -> {event: timestamp}.
-_ALL_PENDING: dict[int, dict[str, float]] = {}
-
-
-def reset_all_pending() -> None:
-    """Test helper: clear the mode=all arrival window."""
-    _ALL_PENDING.clear()
-
-
-def _secret_value(stored: str | None) -> str:
-    """Decrypt a Fernet secret, falling back to raw plaintext (legacy/tests)."""
-    if not stored:
-        return ""
-    try:
-        from app.services.sso_provisioning import decrypt_secret
-        decrypted = decrypt_secret(stored)
-        if decrypted:
-            return decrypted
-    except Exception:  # noqa: BLE001
-        pass
-    if isinstance(stored, str) and not stored.startswith("gAAAAA"):
-        return stored
-    return ""
-
-
-def validate_step(kind: str, config: dict) -> None:
-    """Validate a step payload. Raises ValueError with a human message."""
-    from fastapi import HTTPException
-    if kind not in STEP_KINDS:
-        raise HTTPException(400, f"invalid kind: {kind!r} (want trigger|condition|delay|action)")
-    config = config or {}
-    if kind == "trigger":
-        if not config.get("event"):
-            raise HTTPException(400, "trigger step requires an event")
-    elif kind == "condition":
-        if config.get("op", "eq") not in COND_OPS:
-            raise HTTPException(400, f"invalid op: {config.get('op')!r}")
-    elif kind == "delay":
-        try:
-            seconds = int(config.get("seconds", 0))
-        except (TypeError, ValueError):
-            raise HTTPException(400, "delay step requires integer seconds") from None
-        if seconds < 0 or seconds > 86400:
-            raise HTTPException(400, "delay seconds must be 0..86400")
-    elif kind == "action":
-        if config.get("type") not in STEP_ACTION_TYPES:
-            raise HTTPException(400, f"invalid action type: {config.get('type')!r}")
-
-
-def get_steps(automation_id: int) -> list[dict]:
-    """Ordered steps of an automation (empty when legacy single-mode)."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM automation_steps WHERE automation_id=? ORDER BY position, id",
-            (automation_id,),
-        ).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        try:
-            d["config"] = json.loads(d.get("config_json") or "{}")
-        except (TypeError, json.JSONDecodeError):
-            d["config"] = {}
-        out.append(d)
-    return out
-
-
-def _steps_by_kind(steps: list[dict]) -> dict[str, list[dict]]:
-    grouped: dict[str, list[dict]] = {"trigger": [], "condition": [],
-                                      "delay": [], "action": []}
-    for s in steps:
-        if s.get("kind") in grouped:
-            grouped[s["kind"]].append(s)
-    return grouped
-
-
-def _step_trigger_matches(step_cfg: dict, event: str, payload: dict,
-                           automation_collection_id: int | None) -> bool:
-    if step_cfg.get("event") != event:
-        return False
-    want_coll = step_cfg.get("collection_id") or automation_collection_id
-    if want_coll and payload.get("collection_id") != want_coll:
-        return False
-    return True
-
-
-async def _run_with_steps(auto: dict, steps: list[dict], trigger_source: str,
-                          context: dict) -> dict:
-    """Execute a chained automation. Records one run row with per-step detail."""
-    grouped = _steps_by_kind(steps)
-    props = context.get("properties")
-    before = context.get("before_properties")
-    # Legacy single condition still applies on top of step conditions.
-    if not evaluate_conditions(auto.get("condition_json") or "[]", props, before):
-        _save_run(auto["id"], trigger_source, "skipped", "condition not met",
-                  context.get("collection_id"), context.get("page_id"))
-        return {"status": "skipped", "detail": "condition not met"}
-    for cond in grouped["condition"]:
-        cfg = cond.get("config") or {}
-        if not match_condition_props(props, before, {
-                "property": cfg.get("property"), "op": cfg.get("op", "eq"),
-                "value": cfg.get("value")}):
-            _save_run(auto["id"], trigger_source, "skipped",
-                      f"step condition not met: {cfg.get('property')}",
-                      context.get("collection_id"), context.get("page_id"))
-            return {"status": "skipped", "detail": "step condition not met"}
-
-    ctx = dict(context)
-    ctx["automation_name"] = auto["name"]
-    ctx["created_by"] = auto["created_by"] or ctx.get("created_by")
-    ordered = sorted(steps, key=lambda s: (s.get("position", 0), s.get("id", 0)))
-    results = []
-    try:
-        for step in ordered:
-            kind = step.get("kind")
-            cfg = step.get("config") or {}
-            if kind in ("trigger", "condition"):
-                continue
-            if kind == "delay":
-                seconds = max(0, min(int(cfg.get("seconds", 0)), 300))
-                if seconds:
-                    await asyncio.sleep(seconds)
-                results.append(f"delay {cfg.get('seconds', 0)}s")
-            elif kind == "action":
-                summary = await _run_action({"type": cfg.get("type"), **cfg}, ctx,
-                                            trigger_source)
-                results.append(summary)
-        detail = "; ".join(results) or "no steps executed"
-        _save_run(auto["id"], trigger_source, "fired", detail,
-                  ctx.get("collection_id"), ctx.get("page_id"))
-        try:
-            from app.services.webhook_outbound import fire_event as _fire_wh
-            await _fire_wh("automation.fired", {
-                "automation_id": auto["id"], "name": auto["name"],
-                "trigger": trigger_source, "collection_id": ctx.get("collection_id"),
-                "page_id": ctx.get("page_id"), "detail": detail})
-        except Exception:  # noqa: BLE001
-            logger.debug("automation.fired webhook dispatch failed")
-        return {"status": "fired", "detail": detail}
-    except Exception as exc:  # noqa: BLE001
-        logger.warning("Automation %s (steps) failed: %s", auto["id"], exc)
-        _save_run(auto["id"], trigger_source, "error", str(exc),
-                  ctx.get("collection_id"), ctx.get("page_id"))
-        return {"status": "error", "detail": str(exc)}
-
-
-async def _maybe_run_stepped(auto: dict, trigger_source: str, context: dict) -> dict | None:
-    """Run via steps when the automation has any; None → use legacy path."""
-    steps = get_steps(auto["id"])
-    if not steps:
-        return None
-    return await _run_with_steps(auto, steps, trigger_source, context)
-
-
-def _match_stepped_automations(event: str, payload: dict) -> list[tuple[dict, list[dict]]]:
-    """Automations (enabled) whose trigger steps match ``event`` + collection."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT a.* FROM automations a
-               JOIN automation_steps s ON s.automation_id = a.id
-               WHERE a.enabled=1 AND s.kind='trigger' GROUP BY a.id"""
-        ).fetchall()
-    matched = []
-    for row in rows:
-        auto = dict(row)
-        steps = get_steps(auto["id"])
-        triggers = [s for s in steps if s.get("kind") == "trigger"]
-        if any(_step_trigger_matches(t.get("config") or {}, event, payload,
-                                     auto.get("collection_id")) for t in triggers):
-            matched.append((auto, triggers))
-    return matched
-
-
-async def fire_stepped_event(event: str, payload: dict) -> None:
-    """Dispatch ``event`` to step-based automations (mode any/all).
-
-    Called from :func:`fire_event` after the legacy matcher. Unknown events
-    (not in the webhook catalogue) still work here — steps are independent
-    from outbound webhooks.
-    """
-    now = time.time()
-    for auto, triggers in _match_stepped_automations(event, payload):
-        # Skip automations already handled by the legacy matcher to avoid
-        # double runs (legacy = trigger_type event + no steps).
-        if not get_steps(auto["id"]):
-            continue
-        mode = (auto.get("trigger_mode") or "any").lower()
-        if mode == "all":
-            pending = _ALL_PENDING.setdefault(auto["id"], {})
-            pending[event] = now
-            # Expire arrivals outside the window.
-            for ev in [e for e, ts in pending.items() if now - ts > ALL_MODE_WINDOW_S]:
-                del pending[ev]
-            wanted = {t.get("config", {}).get("event") for t in triggers}
-            if not wanted <= set(pending):
-                continue
-            _ALL_PENDING.pop(auto["id"], None)
-        context = dict(payload)
-        context["event"] = event
-        await run_automation(auto["id"], "event", context)
-
-
-# ── v7.0.0 action backends (module-level = monkeypatchable in tests) ───────
-
-async def _post_slack(webhook_url: str, text: str) -> str:
-    async with shared_client(timeout=10) as client:
-        resp = await client.post(webhook_url, json={"text": text})
-    if resp.status_code >= 400:
-        raise RuntimeError(f"slack webhook returned HTTP {resp.status_code}")
-    return f"slack → ({resp.status_code})"
-
-
-async def _send_email_action(to: str, subject: str, body: str, context: dict) -> str:
-    from app.services import mailer
-    address = (to or "").strip()
-    if address.startswith("user:"):
-        try:
-            uid = int(address.split(":", 1)[1])
-        except ValueError:
-            raise ValueError(f"bad email target: {to!r}") from None
-        with get_conn() as conn:
-            row = conn.execute("SELECT email FROM users WHERE id=?", (uid,)).fetchone()
-        address = (row["email"] if row and row["email"] else "")
-        if not address:
-            raise ValueError(f"user {uid} has no email")
-    if not address:
-        address = None
-        with get_conn() as conn:
-            row = conn.execute("SELECT email FROM users WHERE id=?",
-                               (context.get("created_by") or 1,)).fetchone()
-            if row and row["email"]:
-                address = row["email"]
-    if not address:
-        return "email skipped (no recipient)"
-    ok = mailer.send_email(address, subject or "FlowDeck automation", body or "")
-    return f"email → {address}" if ok else "email skipped (SMTP not configured)"
-
-
-async def _create_forge_issue(provider: str, owner: str, repo: str, title: str,
-                              body: str, labels: list | None = None,
-                              user_id: int | None = None) -> str:
-    token = ""
-    if user_id:
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider=?",
-                (user_id, provider)).fetchone()
-        token = (row["access_token"] if row else "") or ""
-    if provider == "github":
-        if not token:
-            raise ValueError("github action needs a linked GitHub account (token)")
-        async with shared_client(timeout=15) as client:
-            resp = await client.post(
-                f"https://api.github.com/repos/{owner}/{repo}/issues",
-                headers={"Authorization": f"Bearer {token}",
-                         "Accept": "application/vnd.github+json"},
-                json={"title": title, "body": body,
-                      "labels": labels or []} if labels else {"title": title, "body": body},
-            )
-        if resp.status_code >= 400:
-            raise RuntimeError(f"github returned HTTP {resp.status_code}")
-        return f"github issue #{resp.json().get('number')} in {owner}/{repo}"
-    # gitea (default)
-    from app.services.gitea_client import GiteaClient
-    gitea = GiteaClient(user_token=token or None)
-    issue = await gitea.create_issue(owner, repo, title, body)
-    return f"gitea issue #{issue.get('number')} in {owner}/{repo}"
-
-
-async def _run_linked_agent(agent_id: int, user_id: int, workspace_id: int | None,
-                            message: str, context: dict) -> str:
-    from app.services.agent_engine import AgentEngine
-    with get_conn() as conn:
-        agent = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        if not agent:
-            raise ValueError(f"agent {agent_id} not found")
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
-               VALUES (?,?,?,?)""",
-            (agent_id, user_id,
-             f"Automation: {context.get('automation_name', 'run')}",
-             json.dumps({"workspace_id": workspace_id})),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-    objective = ((agent["system_instructions"] or "").strip()
-                 or f"Exécute l'agent « {agent['name']} ».")
-    if message:
-        objective = f"{objective}\n\n{message}"
-    engine = AgentEngine(user_id, workspace_id, agent["model"] or None)
-    final = ""
-    async for _ev in engine.run(conv_id, objective, model=agent["model"]):
-        pass
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT content FROM agent_messages WHERE conversation_id=? AND role='assistant'"
-            " ORDER BY id DESC LIMIT 1", (conv_id,)).fetchone()
-        final = (row["content"][:300] if row and row["content"] else "")
-    return f"agent « {agent['name']} » ran (conversation {conv_id})" + (f": {final}" if final else "")
-
-
-# ── v7.0.0 native DB button ────────────────────────────────────────────────
-
-async def press_button(collection_id: int, row_id: int, prop_ref: str | int,
-                       user_id: int) -> dict:
-    """Run the automation linked to a ``button`` property cell."""
-    with get_conn() as conn:
-        if isinstance(prop_ref, int) or str(prop_ref).isdigit():
-            prop = conn.execute(
-                "SELECT * FROM collection_properties WHERE id=? AND collection_id=?",
-                (int(prop_ref), collection_id)).fetchone()
-        else:
-            prop = conn.execute(
-                "SELECT * FROM collection_properties WHERE collection_id=? AND name=?",
-                (collection_id, prop_ref)).fetchone()
-        if not prop:
-            raise ValueError("button property not found")
-        prop = dict(prop)
-        if prop.get("prop_type") != "button":
-            raise ValueError("property is not a button")
-        auto_id = prop.get("button_automation_id")
-        if not auto_id:
-            raise ValueError("button has no linked automation")
-        row = conn.execute(
-            "SELECT id FROM collection_pages WHERE id=? AND collection_id=?",
-            (row_id, collection_id)).fetchone()
-        if not row:
-            raise ValueError("row not found")
-    context = get_page_context(row_id, collection_id)
-    context["created_by"] = user_id
-    return await run_automation(auto_id, "button", context)
-
@@ -1,111 +0,0 @@
-"""FlowDeck — v5.2.0 Automatic backups (daily SQLite snapshot)."""
-from __future__ import annotations
-
-import logging
-import shutil
-import time
-from datetime import datetime
-from pathlib import Path
-
-from app.config import settings
-
-logger = logging.getLogger(__name__)
-
-
-def _backup_dir() -> Path:
-    d = Path(settings.backup_dir)
-    d.mkdir(parents=True, exist_ok=True)
-    return d
-
-
-def _db_path() -> Path:
-    return settings.db_path
-
-
-def backup_db(now: datetime | None = None) -> str | None:
-    """Snapshot the SQLite database into ``backup_dir`` (WAL-safe).
-
-    Returns the backup filename, or None when backup is disabled or the
-    database file does not exist.
-    """
-    if not settings.backup_enabled:
-        return None
-    db_path = _db_path()
-    if str(db_path) == ":memory:" or not Path(db_path).is_file():
-        return None
-
-    now = now or datetime.now()
-    # Checkpoint the WAL so the backup is consistent.
-    try:
-        import sqlite3
-        with sqlite3.connect(str(db_path)) as conn:
-            conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
-    except Exception:
-        logger.exception("backup_db")
-
-    dest_dir = _backup_dir()
-    filename = f"flowdeck-{now:%Y%m%d-%H%M%S}.db"
-    dest = dest_dir / filename
-    shutil.copy2(db_path, dest)
-
-    # Prune old backups, keeping ``backup_keep`` most recent files.
-    prune_old_backups()
-    logger.info("Backup created: %s", dest)
-    return filename
-
-
-def list_backups() -> list[dict]:
-    """List existing backup files (name, size bytes, mtime)."""
-    files = []
-    for p in _backup_dir().glob("flowdeck-*.db"):
-        stat = p.stat()
-        files.append({
-            "filename": p.name,
-            "size": stat.st_size,
-            "modified_at": datetime.fromtimestamp(stat.st_mtime).isoformat(),
-        })
-    files.sort(key=lambda f: f["filename"], reverse=True)
-    return files
-
-
-def prune_old_backups(keep: int | None = None) -> int:
-    """Delete the oldest backup files beyond ``keep``. Returns count removed."""
-    keep = keep if keep is not None else settings.backup_keep
-    files = sorted(_backup_dir().glob("flowdeck-*.db"), reverse=True)
-    removed = 0
-    for p in files[keep:]:
-        try:
-            p.unlink()
-            removed += 1
-        except OSError:
-            logger.warning("Could not prune backup %s", p)
-    return removed
-
-
-def last_backup_age_hours() -> float | None:
-    """Hours since the most recent backup (None if none exists)."""
-    files = list(_backup_dir().glob("flowdeck-*.db"))
-    if not files:
-        return None
-    newest = max(files, key=lambda p: p.stat().st_mtime)
-    age = time.time() - newest.stat().st_mtime
-    return age / 3600
-
-
-def backup_due() -> bool:
-    """True when a backup should run now (interval elapsed since last one)."""
-    age = last_backup_age_hours()
-    if age is None:
-        return True
-    return age >= settings.backup_interval_hours
-
-
-async def backup_scheduler():
-    """Background loop: run a backup once per interval (default daily)."""
-    while True:
-        try:
-            if backup_due():
-                backup_db()
-        except Exception as exc:  # never let the loop die
-            logger.warning("backup_scheduler error: %s", exc)
-        await __import__("asyncio").sleep(3600)  # re-check hourly
@@ -1,103 +0,0 @@
-"""FlowDeck — Built-in page (block) templates (v5.12.0).
-
-Global page templates used by the « + New page » picker. Built-ins live here
-(code, versioned); user templates live in the ``page_global_templates``
-table. Block shapes match the editor's storage format (see
-``app/routers/board.py::save_page_blocks``) — ids are assigned client-side.
-"""
-from __future__ import annotations
-
-import json
-
-
-def _b(btype: str, content: str = "", **extra) -> dict:
-    out = {"type": btype, "content": content}
-    out.update(extra)
-    return out
-
-
-BUILTIN_TEMPLATES: dict[str, dict] = {
-    "empty": {
-        "name": "Empty",
-        "icon": "📄",
-        "description": "A blank page.",
-        "blocks": [_b("paragraph")],
-    },
-    "meeting_notes": {
-        "name": "Meeting notes",
-        "icon": "🗒️",
-        "description": "Attendees, agenda, notes, action items.",
-        "blocks": [
-            _b("heading_1", "Meeting notes"),
-            _b("callout", "Date: · Time: · Attendees: ", icon="📅"),
-            _b("heading_2", "Agenda"),
-            _b("bulleted_list", "Topic 1"),
-            _b("bulleted_list", "Topic 2"),
-            _b("heading_2", "Notes"),
-            _b("paragraph"),
-            _b("heading_2", "Decisions"),
-            _b("bulleted_list"),
-            _b("heading_2", "Action items"),
-            _b("to_do", "Owner — due date", checked=False),
-            _b("to_do", "", checked=False),
-        ],
-    },
-    "weekly_report": {
-        "name": "Weekly report",
-        "icon": "📊",
-        "description": "Wins, in progress, blockers, next week.",
-        "blocks": [
-            _b("heading_1", "Week of [[fddate:2026-01-05]]"),
-            _b("heading_2", "🎉 Wins"),
-            _b("bulleted_list"),
-            _b("heading_2", "🚧 In progress"),
-            _b("bulleted_list"),
-            _b("heading_2", "⛔ Blockers"),
-            _b("bulleted_list"),
-            _b("heading_2", "🗓️ Next week"),
-            _b("to_do", "", checked=False),
-        ],
-    },
-    "todo_list": {
-        "name": "To-do list",
-        "icon": "✅",
-        "description": "A simple checklist.",
-        "blocks": [
-            _b("heading_1", "To-do"),
-            _b("to_do", "", checked=False),
-            _b("to_do", "", checked=False),
-            _b("to_do", "", checked=False),
-        ],
-    },
-    "project_doc": {
-        "name": "Project doc",
-        "icon": "🚀",
-        "description": "Goals, status, team, links.",
-        "blocks": [
-            _b("heading_1", "Project title"),
-            _b("callout", "One-line description of the project.", icon="💡"),
-            _b("heading_2", "Goals"),
-            _b("numbered_list"),
-            _b("heading_2", "Status"),
-            _b("toggle", "This week", expanded=True, children=[_b("paragraph")]),
-            _b("heading_2", "Team"),
-            _b("bulleted_list"),
-            _b("heading_2", "Resources"),
-            _b("bulleted_list"),
-        ],
-    },
-}
-
-
-def template_list() -> list[dict]:
-    """Public shape of the built-in templates for the picker UI."""
-    return [
-        {"key": key, "name": t["name"], "icon": t["icon"],
-         "description": t["description"], "builtin": True}
-        for key, t in BUILTIN_TEMPLATES.items()
-    ]
-
-
-def blocks_json_for(key: str) -> str | None:
-    t = BUILTIN_TEMPLATES.get(key)
-    return json.dumps(t["blocks"]) if t else None
@@ -1,527 +0,0 @@
-"""FlowDeck — external calendar sync (v7.1.0).
-
-Bidirectional sync between a collection (date property) and an external
-calendar: Google Calendar (REST) or any CalDAV server (raw REPORT/PUT, no
-extra dependency). Tokens are Fernet-encrypted at rest.
-
-Matching: ``collection_pages.external_event_id`` ↔ remote event id.
-Conflicts (both sides changed since ``last_sync``): last-write-wins +
-in-app ``calendar.conflict`` notification (manual edit resolves).
-
-See ``docs/V71_Calendar_Meetings.md``.
-"""
-from __future__ import annotations
-
-import asyncio
-import json
-import logging
-import time
-import uuid
-from datetime import UTC, datetime, timedelta
-
-from app.db import get_conn
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-
-PROVIDERS = ("google", "caldav")
-SYNC_LOOKBACK_DAYS = 30
-SYNC_LOOKAHEAD_DAYS = 90
-
-
-class SyncError(RuntimeError):
-    """Raised when the remote calendar cannot be reached/authorized."""
-
-
-# ── links ──────────────────────────────────────────────────────────────────
-
-def _encrypt_tokens(creds: dict) -> str:
-    from app.services.sso_provisioning import encrypt_secret
-    return encrypt_secret(json.dumps(creds or {}))
-
-
-def _decrypt_tokens(tokens_enc: str) -> dict:
-    if not tokens_enc:
-        return {}
-    try:
-        from app.services.sso_provisioning import decrypt_secret
-        raw = decrypt_secret(tokens_enc)
-        if raw:
-            return json.loads(raw)
-    except Exception:  # noqa: BLE001
-        pass
-    try:  # legacy plaintext (tests)
-        data = json.loads(tokens_enc)
-        return data if isinstance(data, dict) else {}
-    except Exception:  # noqa: BLE001
-        return {}
-
-
-def save_link(user_id: int, provider: str, collection_id: int,
-              credentials: dict, calendar_id: str = "primary",
-              date_property: str = "") -> dict:
-    if provider not in PROVIDERS:
-        raise ValueError(f"provider must be google|caldav, got {provider!r}")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?",
-                            (collection_id,)).fetchone():
-            raise ValueError("collection not found")
-        cur = conn.execute(
-            """INSERT INTO calendar_links
-               (user_id, provider, tokens_enc, calendar_id, collection_id, date_property)
-               VALUES (?,?,?,?,?,?)
-               ON CONFLICT(user_id, provider, calendar_id) DO UPDATE SET
-                 tokens_enc=excluded.tokens_enc, collection_id=excluded.collection_id,
-                 date_property=excluded.date_property""",
-            (user_id, provider, _encrypt_tokens(credentials),
-             calendar_id or "primary", collection_id, date_property or ""))
-        conn.commit()
-        row = conn.execute(
-            "SELECT * FROM calendar_links WHERE user_id=? AND provider=? AND calendar_id=?",
-            (user_id, provider, calendar_id or "primary")).fetchone()
-        _ = cur
-    out = dict(row)
-    out.pop("tokens_enc", None)
-    return out
-
-
-def list_links(user_id: int) -> list[dict]:
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, user_id, provider, calendar_id, collection_id,"
-            " date_property, last_sync, created_at FROM calendar_links WHERE user_id=?"
-            " ORDER BY id", (user_id,)).fetchall()
-    return [dict(r) for r in rows]
-
-
-def delete_link(user_id: int, link_id: int) -> bool:
-    with get_conn() as conn:
-        cur = conn.execute("DELETE FROM calendar_links WHERE id=? AND user_id=?",
-                           (link_id, user_id))
-        conn.commit()
-        return cur.rowcount > 0
-
-
-def _load_link(link_id: int) -> dict | None:
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM calendar_links WHERE id=?", (link_id,)).fetchone()
-    return dict(row) if row else None
-
-
-# ── remote I/O (module-level = monkeypatchable) ────────────────────────────
-
-def _remote_event(eid: str, title: str, start: str, description: str = "",
-                  updated: str = "") -> dict:
-    return {"id": str(eid), "title": title or "Untitled", "start": start,
-            "description": description or "", "updated": updated or ""}
-
-
-async def google_list_events(tokens: dict, calendar_id: str,
-                             time_min: str, time_max: str) -> list[dict]:
-    access = tokens.get("access_token", "")
-    if not access:
-        raise SyncError("google link has no access_token — relink the calendar")
-    url = (f"https://www.googleapis.com/calendar/v3/calendars/{calendar_id}"
-           f"/events?singleEvents=true&orderBy=startTime"
-           f"&timeMin={time_min}&timeMax={time_max}")
-    async with shared_client(timeout=15) as client:
-        resp = await client.get(url, headers={"Authorization": f"Bearer {access}"})
-    if resp.status_code == 401:
-        raise SyncError("google token expired — relink the calendar")
-    if resp.status_code >= 400:
-        raise SyncError(f"google returned HTTP {resp.status_code}")
-    out = []
-    for item in resp.json().get("items", []):
-        start = (item.get("start") or {}).get("dateTime") or (item.get("start") or {}).get("date") or ""
-        out.append(_remote_event(item.get("id", ""), item.get("summary", ""),
-                                 start, item.get("description", ""),
-                                 item.get("updated", "")))
-    return out
-
-
-async def google_push_event(tokens: dict, calendar_id: str, event: dict,
-                            remote_id: str = "") -> str:
-    access = tokens.get("access_token", "")
-    if not access:
-        raise SyncError("google link has no access_token — relink the calendar")
-    body = {"summary": event.get("title", ""),
-            "description": event.get("description", ""),
-            "start": {"date": event.get("start", "")[:10]},
-            "end": {"date": event.get("start", "")[:10]}}
-    base = f"https://www.googleapis.com/calendar/v3/calendars/{calendar_id}/events"
-    async with shared_client(timeout=15) as client:
-        if remote_id:
-            resp = await client.patch(f"{base}/{remote_id}",
-                                      headers={"Authorization": f"Bearer {access}"}, json=body)
-        else:
-            resp = await client.post(base, headers={"Authorization": f"Bearer {access}"},
-                                     json=body)
-    if resp.status_code == 401:
-        raise SyncError("google token expired — relink the calendar")
-    if resp.status_code >= 400:
-        raise SyncError(f"google returned HTTP {resp.status_code}")
-    return str(resp.json().get("id", remote_id or ""))
-
-
-_CALDAV_REPORT = """<?xml version="1.0" encoding="utf-8" ?>
-<C:calendar-query xmlns:D="DAV:" xmlns:C="urn:ietf:params:xml:ns:caldav">
-  <D:prop><D:getetag/><C:calendar-data/></D:prop>
-  <C:filter><C:comp-filter name="VCALENDAR"><C:comp-filter name="VEVENT">
-    <C:time-range start="{start}" end="{end}"/>
-  </C:comp-filter></C:comp-filter></C:filter>
-</C:calendar-query>"""
-
-
-def _parse_caldav_events(xml_text: str) -> list[dict]:
-    """Minimal multistatus → event parser (UID/SUMMARY/DTSTART/DESCRIPTION)."""
-    import re
-    import xml.etree.ElementTree as ET
-    events = []
-    try:
-        root = ET.fromstring(xml_text)
-    except ET.ParseError:
-        return []
-    ns = {"D": "DAV:", "C": "urn:ietf:params:xml:ns:caldav"}
-    for resp in root.findall("D:response", ns):
-        href = resp.findtext("D:href", default="", namespaces=ns)
-        data_el = resp.find(".//{urn:ietf:params:xml:ns:caldav}calendar-data")
-        if data_el is None or not data_el.text:
-            continue
-        ics = data_el.text
-        uid = re.search(r"^UID:(.+)$", ics, re.M)
-        summary = re.search(r"^SUMMARY:(.+)$", ics, re.M)
-        dtstart = re.search(r"^DTSTART(?:;[^:]*)?:(.+)$", ics, re.M)
-        desc = re.search(r"^DESCRIPTION:(.+)$", ics, re.M)
-        events.append(_remote_event(
-            (uid.group(1).strip() if uid else href.strip("/").split("/")[-1]),
-            summary.group(1).strip() if summary else "Untitled",
-            _ics_to_date(dtstart.group(1).strip()) if dtstart else "",
-            desc.group(1).strip() if desc else ""))
-    return events
-
-
-def _ics_to_date(value: str) -> str:
-    value = value.strip()
-    if len(value) >= 8 and value[:8].isdigit():
-        return f"{value[:4]}-{value[4:6]}-{value[6:8]}"
-    return value[:10]
-
-
-def _event_to_ics(uid: str, title: str, date: str, description: str = "") -> str:
-    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
-    day = (date or "")[:10].replace("-", "")
-    return (f"BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//FlowDeck//Sync//EN\r\n"
-            f"BEGIN:VEVENT\r\nUID:{uid}\r\nDTSTAMP:{stamp}\r\nDTSTART;VALUE=DATE:{day}\r\n"
-            f"SUMMARY:{title}\r\nDESCRIPTION:{description}\r\nEND:VEVENT\r\nEND:VCALENDAR\r\n")
-
-
-async def caldav_list_events(creds: dict, time_min: str, time_max: str) -> list[dict]:
-    url = creds.get("url", "")
-    if not url:
-        raise SyncError("caldav link needs a calendar url")
-    auth = (creds.get("username", ""), creds.get("password", ""))
-    body = _CALDAV_REPORT.format(
-        start=time_min.replace("-", "").split("T")[0] + "T000000Z",
-        end=time_max.replace("-", "").split("T")[0] + "T000000Z")
-    async with shared_client(timeout=15, auth=auth if auth[0] else None) as client:
-        resp = await client.request("REPORT", url, content=body,
-                                    headers={"Depth": "1",
-                                             "Content-Type": "application/xml"})
-    if resp.status_code == 401:
-        raise SyncError("caldav rejected credentials")
-    if resp.status_code >= 400:
-        raise SyncError(f"caldav returned HTTP {resp.status_code}")
-    return _parse_caldav_events(resp.text)
-
-
-async def caldav_push_event(creds: dict, event: dict, remote_id: str = "") -> str:
-    url = (creds.get("url", "") or "").rstrip("/")
-    if not url:
-        raise SyncError("caldav link needs a calendar url")
-    auth = (creds.get("username", ""), creds.get("password", ""))
-    uid = remote_id or f"flowdeck-{uuid.uuid4().hex}@flowdeck"
-    href = f"{url}/{uid}.ics" if not remote_id else (
-        remote_id if remote_id.startswith("http") else f"{url}/{remote_id}")
-    ics = _event_to_ics(uid.split("@")[0], event.get("title", ""),
-                        event.get("start", ""), event.get("description", ""))
-    async with shared_client(timeout=15, auth=auth if auth[0] else None) as client:
-        resp = await client.put(href, content=ics, headers={"Content-Type": "text/calendar"})
-    if resp.status_code >= 400:
-        raise SyncError(f"caldav returned HTTP {resp.status_code}")
-    return uid
-
-
-# ── mapping + sync ─────────────────────────────────────────────────────────
-
-def _date_prop_id(conn, collection_id: int, wanted: str = "") -> tuple[str, str] | None:
-    props = conn.execute(
-        "SELECT id, name FROM collection_properties WHERE collection_id=? ORDER BY position",
-        (collection_id,)).fetchall()
-    if wanted:
-        for p in props:
-            if str(p["id"]) == str(wanted) or p["name"] == wanted:
-                return str(p["id"]), p["name"]
-        return None
-    for p in props:
-        # prop_type lives in the row; fetch full rows only when needed
-        full = conn.execute("SELECT prop_type FROM collection_properties WHERE id=?",
-                            (p["id"],)).fetchone()
-        if full and full["prop_type"] == "date":
-            return str(p["id"]), p["name"]
-    return None
-
-
-def _row_date(values: dict, prop_id: str, prop_name: str) -> str:
-    raw = values.get(prop_id, values.get(prop_name, ""))
-    if isinstance(raw, dict):
-        raw = raw.get("date") or raw.get("value") or ""
-    return str(raw or "")
-
-
-def _to_epoch(value: str | None) -> float:
-    if not value:
-        return 0.0
-    text = str(value).strip()
-    try:
-        if text.endswith("Z"):
-            dt = datetime.fromisoformat(text.replace("Z", "+00:00"))
-        else:
-            dt = datetime.fromisoformat(text[:19] if "T" in text else text[:19])
-            if dt.tzinfo is None:
-                dt = dt.replace(tzinfo=UTC)
-        return dt.timestamp()
-    except Exception:  # noqa: BLE001
-        try:
-            return time.mktime(time.strptime(text[:10], "%Y-%m-%d"))
-        except Exception:  # noqa: BLE001
-            return 0.0
-
-
-def _window() -> tuple[str, str]:
-    now = datetime.now(UTC)
-    start = (now - timedelta(days=SYNC_LOOKBACK_DAYS)).strftime("%Y-%m-%dT00:00:00Z")
-    end = (now + timedelta(days=SYNC_LOOKAHEAD_DAYS)).strftime("%Y-%m-%dT00:00:00Z")
-    return start, end
-
-
-async def sync_link(link_id: int) -> dict:
-    """One bidirectional sync pass. Returns {pulled, pushed, conflicts}."""
-    link = _load_link(link_id)
-    if not link:
-        raise ValueError("link not found")
-    creds = _decrypt_tokens(link.get("tokens_enc") or "")
-    collection_id = link.get("collection_id")
-    if not collection_id:
-        raise ValueError("link has no collection")
-    with get_conn() as conn:
-        date_prop = _date_prop_id(conn, collection_id, link.get("date_property") or "")
-    if not date_prop:
-        raise ValueError("collection has no date property")
-    prop_id, prop_name = date_prop
-
-    tmin, tmax = _window()
-    if link["provider"] == "google":
-        remote = await google_list_events(creds, link.get("calendar_id") or "primary",
-                                          tmin, tmax)
-    else:
-        remote = await caldav_list_events(creds, tmin, tmax)
-
-    last_sync = _to_epoch(link.get("last_sync"))
-    pulled = pushed = conflicts = 0
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title, property_values_json, updated_at,"
-            " COALESCE(external_event_id, '') AS xid FROM collection_pages"
-            " WHERE collection_id=?", (collection_id,)).fetchall()
-        local = {r["xid"]: dict(r) for r in rows if r["xid"]}
-        seen_remote: set[str] = set()
-        touched: set[int] = set()  # rows written by this pull pass — never push back
-
-        for ev in remote:
-            eid = ev.get("id", "")
-            if not eid:
-                continue
-            seen_remote.add(eid)
-            day = (ev.get("start") or "")[:10]
-            if eid not in local:
-                values: dict = {}
-                values[prop_id] = day
-                max_pos = conn.execute(
-                    "SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages"
-                    " WHERE collection_id=?", (collection_id,)).fetchone()[0]
-                conn.execute(
-                    """INSERT INTO collection_pages
-                       (collection_id, title, position, property_values_json, external_event_id)
-                       VALUES (?,?,?,?,?)""",
-                    (collection_id, ev.get("title") or "Untitled", max_pos,
-                     json.dumps(values), eid))
-                pulled += 1
-                continue
-            row = local[eid]
-            try:
-                values = json.loads(row["property_values_json"] or "{}")
-            except (TypeError, json.JSONDecodeError):
-                values = {}
-            local_day = _row_date(values, prop_id, prop_name)[:10]
-            remote_newer = _to_epoch(ev.get("updated")) > _to_epoch(row["updated_at"])
-            local_dirty = _to_epoch(row["updated_at"]) > last_sync and local_day != day
-            if remote_newer and local_dirty and local_day and day and local_day != day:
-                # Conflict: both sides moved → last-write-wins + notify.
-                if _to_epoch(ev.get("updated")) >= _to_epoch(row["updated_at"]):
-                    values[prop_id] = day
-                    conn.execute(
-                        "UPDATE collection_pages SET property_values_json=?,"
-                        " updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                        (json.dumps(values), row["id"]))
-                    touched.add(row["id"])
-                conflicts += 1
-                _notify_conflict(conn, link, row, ev)
-            elif day and day != local_day:
-                values[prop_id] = day
-                conn.execute(
-                    "UPDATE collection_pages SET property_values_json=?,"
-                    " updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                    (json.dumps(values), row["id"]))
-                touched.add(row["id"])
-                pulled += 1
-
-        # Push local changes (created locally or edited after last_sync).
-        for xid, row in local.items():
-            if row["id"] in touched:
-                continue
-            if xid in seen_remote:
-                # Edited locally since last sync and remote unchanged → push.
-                if last_sync and _to_epoch(row["updated_at"]) > last_sync:
-                    await _push(link, creds, row, prop_id, prop_name, xid)
-                    pushed += 1
-                continue
-            # Remote deleted the event → drop the local id (keep the row).
-            conn.execute("UPDATE collection_pages SET external_event_id='' WHERE id=?",
-                         (row["id"],))
-        # Rows never linked and recently touched → create remotely.
-        fresh = conn.execute(
-            "SELECT id, title, property_values_json, updated_at FROM collection_pages"
-            " WHERE collection_id=? AND COALESCE(external_event_id, '')=''",
-            (collection_id,)).fetchall()
-        for row in fresh:
-            try:
-                values = json.loads(row["property_values_json"] or "{}")
-            except (TypeError, json.JSONDecodeError):
-                values = {}
-            day = _row_date(values, prop_id, prop_name)[:10]
-            if not day:
-                continue
-            new_id = await _push(link, creds, dict(row), prop_id, prop_name, "")
-            conn.execute("UPDATE collection_pages SET external_event_id=? WHERE id=?",
-                         (new_id, row["id"]))
-            pushed += 1
-
-        conn.execute("UPDATE calendar_links SET last_sync=CURRENT_TIMESTAMP WHERE id=?",
-                     (link_id,))
-        conn.commit()
-    return {"pulled": pulled, "pushed": pushed, "conflicts": conflicts}
-
-
-async def _push(link: dict, creds: dict, row: dict, prop_id: str,
-               prop_name: str, remote_id: str) -> str:
-    try:
-        values = json.loads(row.get("property_values_json") or "{}")
-    except (TypeError, json.JSONDecodeError):
-        values = {}
-    event = {"title": row.get("title") or "Untitled",
-             "start": _row_date(values, prop_id, prop_name),
-             "description": ""}
-    if link["provider"] == "google":
-        return await google_push_event(creds, link.get("calendar_id") or "primary",
-                                       event, remote_id)
-    return await caldav_push_event(creds, event, remote_id)
-
-
-def _notify_conflict(conn, link: dict, row: dict, ev: dict) -> None:
-    try:
-        from app.services.notifications import create_notification
-        create_notification(
-            link["user_id"], link["user_id"], "calendar",
-            "Calendar sync conflict",
-            f"« {row.get('title') or 'Untitled'} » changed on both sides;"
-            f" kept the newest ({ev.get('start', '')[:10]}). Edit the row to resolve.",
-            resource_type="collection", resource_id=link.get("collection_id") or 0,
-            url=f"/db/{link.get('collection_id')}", conn=conn, commit=False)
-    except Exception:  # noqa: BLE001 — notify must never break sync
-        pass
-
-
-async def calendar_sync_scheduler(interval_seconds: int = 900) -> None:
-    """Background loop: sync every link with a collection (15 min default)."""
-    while True:
-        try:
-            with get_conn() as conn:
-                ids = [r["id"] for r in conn.execute(
-                    "SELECT id FROM calendar_links WHERE collection_id IS NOT NULL"
-                ).fetchall()]
-            for link_id in ids:
-                try:
-                    await sync_link(link_id)
-                except Exception as exc:  # noqa: BLE001 — one link must not kill the loop
-                    logger.debug("calendar sync link %s failed: %s", link_id, exc)
-        except Exception as exc:  # noqa: BLE001
-            logger.warning("calendar_sync_scheduler: %s", exc)
-        await asyncio.sleep(interval_seconds)
-
-
-# ── free/busy ──────────────────────────────────────────────────────────────
-
-def freebusy(collection_id: int, date_from: str, date_to: str,
-             date_property: str = "") -> dict:
-    """Busy/free weekdays in [date_from, date_to] (day granularity).
-
-    Expands recurrence rules server-side (``recurrence.expand_rule``).
-    """
-    from app.services import recurrence as _rec
-    try:
-        start = datetime.strptime(date_from[:10], "%Y-%m-%d").date()
-        end = datetime.strptime(date_to[:10], "%Y-%m-%d").date()
-    except ValueError:
-        raise ValueError("use YYYY-MM-DD dates") from None
-    if end < start or (end - start).days > 370:
-        raise ValueError("range must be 1..370 days")
-    with get_conn() as conn:
-        date_prop = _date_prop_id(conn, collection_id, date_property)
-        if not date_prop:
-            raise ValueError("collection has no date property")
-        prop_id, prop_name = date_prop
-        rows = conn.execute(
-            "SELECT property_values_json FROM collection_pages WHERE collection_id=?",
-            (collection_id,)).fetchall()
-    busy: set[str] = set()
-    for r in rows:
-        try:
-            values = json.loads(r["property_values_json"] or "{}")
-        except (TypeError, json.JSONDecodeError):
-            continue
-        base = _row_date(values, prop_id, prop_name)
-        if not base:
-            continue
-        rec = (values.get("__recurrence__") or {})
-        rule = rec.get(prop_id) or rec.get(prop_name)
-        if rule:
-            try:
-                for occ in _rec.expand_rule(
-                        base, rule, start.isoformat(), end.isoformat()):
-                    busy.add(occ[:10])
-            except Exception:  # noqa: BLE001 — bad rule, use base date only
-                busy.add(base[:10])
-        else:
-            if start.isoformat() <= base[:10] <= end.isoformat():
-                busy.add(base[:10])
-    days, free = [], []
-    day = start
-    while day <= end:
-        iso = day.isoformat()
-        days.append({"date": iso, "busy": iso in busy,
-                     "weekend": day.weekday() >= 5})
-        if iso not in busy and day.weekday() < 5:
-            free.append(iso)
-        day += timedelta(days=1)
-    return {"collection_id": collection_id, "from": start.isoformat(),
-            "to": end.isoformat(), "days": days, "free_weekdays": free}
--- a/Show More
+++ b/Show More