merge: main → develop (sync)

2026-07-20 11:02:42 -04:00
501 changed files with 11982 additions and 140351 deletions
@@ -14,10 +14,3 @@ build/
 node_modules/
 Dockerfile
 .dockerignore
-
-# A9 — jamais de DB ni de fichiers de test dans l'image
-*.db
-*.db-*
-test-commit.md
-upload_test.txt
-e2e/
@@ -1,10 +1,6 @@
 # ── Gitea ──
 GITEA_URL=https://git.dracodev.net
 GITEA_TOKEN=change-me
-# Laissez VIDES pour activer le login local seul : depuis v7.46.0 les valeurs de
-# substitution (`test-id`, `test-secret`, `change-me`) comptent comme « provider
-# non configuré » — avant, /auth/login redirigeait vers Gitea avec un client_id
-# invalide (authentification OAuth impossible).
 GITEA_OAUTH_CLIENT_ID=
 GITEA_OAUTH_CLIENT_SECRET=
 GITEA_WEBHOOK_SECRET=
@@ -13,23 +9,6 @@ GITEA_WEBHOOK_SECRET=
 GITHUB_OAUTH_CLIENT_ID=
 GITHUB_OAUTH_CLIENT_SECRET=

-# ── OAuth2 ──
-# Laisser VIDE = redirect URI dynamique (dérivée du Host/X-Forwarded-* de la requête).
-# Ne définir QUE si on veut forcer une URI exacte — elle DOIT être enregistrée
-# dans l'application OAuth2 côté Gitea/GitHub (Settings → Applications).
-# Exemple : OAUTH_REDIRECT_URI=https://flowdeck.dracodev.net/auth/callback
-OAUTH_REDIRECT_URI=
-
-# ── Connecteurs OAuth (v7.56.0) — Google / Microsoft 365 ──
-# Vidés = connecteur « non configuré » (le menu + affiche la raison).
-# Le redirect URI à enregistrer est dérivé d'APP_BASE_URL :
-#   {APP_BASE_URL}/api/agent/connectors/oauth/google/callback
-#   {APP_BASE_URL}/api/agent/connectors/oauth/ms365/callback
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-MS_CLIENT_ID=
-MS_CLIENT_SECRET=
-
 # ── App ──
 APP_SECRET_KEY=change-me-to-random
 APP_HOST=0.0.0.0
@@ -38,73 +17,10 @@ LOG_LEVEL=INFO
 DEFAULT_LANG=fr

 # ── Database ──
-# SQLite UNIQUEMENT (le code ne lit que le préfixe sqlite:///, tout autre
-# schéma retombe silencieusement sur /data/flowdeck.db).
+# SQLite (default): sqlite:////data/flowdeck.db
+# PostgreSQL (optional): postgresql://user:pass@host:5432/flowdeck
 DATABASE_URL=sqlite:////data/flowdeck.db

 # ── Sync ──
 SYNC_INTERVAL=60
 GITEA_CACHE_TTL=30
-
-# ── Backups (v5.2.0) ──
-# Sauvegarde automatique quotidienne du fichier SQLite (fichiers datés).
-BACKUP_ENABLED=true
-BACKUP_DIR=/data/backups
-BACKUP_INTERVAL_HOURS=24
-BACKUP_KEEP=30
-
-# ── Forge projects sync (v5.2.0) ──
-# Rafraîchissement périodique de la table `projects` depuis les forges connectées.
-PROJECT_SYNC_ENABLED=true
-PROJECT_SYNC_INTERVAL_HOURS=1
-
-# ── Public API v2 (v6.3.0) ──
-# PUBLIC_API_INSECURE_OK=true autorise le token de dev fd-public-key (jamais en prod).
-PUBLIC_API_INSECURE_OK=false
-API_V2_RATE_LIMIT_PER_TOKEN=300
-
-# ── Email notifications (v4.9.0) ──
-# Laisser SMTP_HOST vide = pas d'envoi d'email (seulement les notifications in-app).
-SMTP_HOST=
-SMTP_PORT=587
-SMTP_USER=
-SMTP_PASSWORD=
-SMTP_FROM=FlowDeck <[email protected]>
-SMTP_USE_TLS=true
-APP_BASE_URL=http://localhost:8080
-
-# ── SSO / Enterprise (v6.7.0) ──
-# Fallback de démarrage uniquement : dès qu'un admin enregistre une configuration
-# dans Settings → Admin → SSO / Enterprise, la table `sso_config` prime sur le .env.
-# Le bouton SSO n'apparaît sur la page de connexion que si une config est active.
-# SSO_PROVIDER=saml           # saml | oidc  (vide = SSO désactivé)
-# SSO_NAME=Company SSO        # libellé du bouton
-# SSO_ONLY=false              # true = refuser le login local (les admins gardent le leur)
-# SSO_AUTO_PROVISION=true     # créer le compte au premier login SSO
-# SAML :
-# SSO_ENTITY_ID=https://idp.example.com/saml/metadata
-# SSO_SSO_URL=https://idp.example.com/saml/sso
-# SSO_SLO_URL=https://idp.example.com/saml/slo
-# SSO_X509_CERTIFICATE=-----BEGIN CERTIFICATE-----
-# SSO_SIGN_REQUESTS=false     # signer les AuthnRequests / LogoutRequest
-# OIDC :
-# SSO_ISSUER_URL=https://auth.example.com/realms/flowdeck
-# SSO_CLIENT_ID=
-# SSO_CLIENT_SECRET=
-# SSO_SCOPE=openid profile email
-# Mapping (JSON) :
-# SSO_ATTRIBUTE_MAPPING={"email":"email","full_name":"name","groups":"groups"}
-# SSO_GROUPS_MAPPING=[{"sso_group":"FlowDeck Admins","workspace_role":"admin","workspace_id":1}]
-# SSO_DEFAULT_WORKSPACE_ID=0
-
-# ── Web tools de l'agent (v7.46.0) ──
-# Skills « recherche-marche », « veille-techno », « debug-web ».
-#   web_search  → EXA (recherche sémantique + extraits, ~10 $/mois offerts)
-#   fetch_url   → aucune config : lecture d'une page, garde-fou SSRF actif
-#   search_code → GitHub public (10 req/min sans jeton, 30 avec)
-# Sans EXA_API_KEY, web_search bascule sur DuckDuckGo (repli dégradé, sans
-# compte mais parsé au HTML) : utilisable, moins fiable.
-WEB_SEARCH_PROVIDER=exa
-EXA_API_KEY=
-GITHUB_TOKEN=
-WEB_FETCH_MAX_CHARS=20000
@@ -1,57 +1,28 @@
 name: FlowDeck CI

 on:
-  # Run on every pushed branch so feature branches are validated before the PR.
  push:
+    branches: [main]
  pull_request:
-    branches: [main, develop]
+    branches: [main]

 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-      - name: Install lint tools
-        run: pip install -r requirements-dev.txt
-      - name: Ruff (Python)
-        run: ruff check app tests
-      - name: ESLint (JavaScript)
-        run: npx --yes eslint static/js
-
  test:
    runs-on: ubuntu-latest
-    # NOTE: no `container:` here. A `python:*-slim` image ships no Node.js, so the
-    # JavaScript `actions/checkout` action could not run and every job failed at
-    # the first step. The runner's default image already provides Node; we install
-    # the Python toolchain explicitly with actions/setup-python.
+    container: python:3.12-slim
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-      - name: Install system dependencies (WeasyPrint / emoji fonts)
-        run: |-
-          SUDO=""
-          if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends \
-            libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libffi-dev \
-            libjpeg-dev libopenjp2-7 libcairo2 fonts-noto-color-emoji
-      - name: Install Python dependencies
-        run: pip install -r requirements-dev.txt pytest-cov
-      - name: Run tests (parallel) with coverage
+      - name: Install dependencies
+        run: pip install -r requirements.txt pytest pytest-cov
+      - name: Run tests with coverage
        env:
          GITEA_URL: https://git.dracodev.net
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          APP_SECRET_KEY: ci-test-key
-        # `-n auto` needs pytest-xdist, provided by requirements-dev.txt.
-        run: python -m pytest tests/ -v --tb=short -n auto --cov=app --cov-report=term
+        run: python -m pytest tests/ -v --tb=short --cov=app --cov-report=term
      - name: Coverage summary
-        if: always()
-        run: coverage report -m || true
+        run: |
+          python -m pytest tests/ --cov=app --cov-report=term 2>&1 | tail -20

  docker:
    runs-on: ubuntu-latest
@@ -4,7 +4,6 @@ __pycache__/
 /data/
 .venv/
 venv/
-.venv*/
 *.egg-info/
 dist/
 .pytest_cache/
@@ -16,13 +15,3 @@ dist/
 .ua/tmp/
 .ua/.trash-*/
 .ua/.understandignore
-uv.lock
-
-# A9 — jamais de DB ni de fichiers de test dans git
-*.db
-*.db-*
-test-commit.md
-upload_test.txt
-e2e/node_modules/
-e2e/shots/
-e2e/test-results/
@@ -1,8 +1,7 @@
-# Architecture FlowDeck — Document Complet v4.0
+# Architecture FlowDeck — Document Complet v3.0

-> **Version:** 4.0 · **Date:** 2026-07-20 · **Auteur:** Hermes-Deepin
+> **Version:** 3.0 · **Date:** 2026-07-14 · **Auteur:** Hermes-Deepin
 > **Cible:** Clone Notion intégré à Gitea/GitHub — multi-comptes, multi-intégrations
-> **Version déployée:** v4.0.x (production : https://flowdeck.dracodev.net)

 ---

@@ -48,31 +47,34 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  Templates Jinja2 (SSR)                                   │    │
-│  │  ├─ base.html            — Layout Notion commun (sidebar)  │    │
-│  │  ├─ _header.html         — Topbar + breadcrumbs            │    │
-│  │  ├─ _workspace_tree_macro.html — Macro arbre sidebar       │    │
-│  │  ├─ landing.html         — Landing page non-auth           │    │
-│  │  ├─ workspaces.html      — Page Workspaces (locale/Gitea)  │    │
-│  │  ├─ library.html         — Bibliothèque multi-onglets      │    │
-│  │  ├─ local_workspace.html — Workspace local (explorer)      │    │
-│  │  ├─ page_editor.html     — Éditeur de blocs                │    │
-│  │  ├─ trash.html           — Corbeille (local only)          │    │
-│  │  ├─ settings.html        — Settings / My Account / Admin    │    │
-│  │  ├─ accounts.html        — Gestion comptes admin           │    │
-│  │  ├─ board.html           — Kanban (wrapper)                │    │
-│  │  ├─ board_fragment.html  — Cartes Kanban                   │    │
-│  │  ├─ table_view.html      — Vue table                       │    │
-│  │  ├─ login.html           — Login/Register (local + OAuth)   │    │
-│  │  ├─ public_page.html     — Page publiée (/p/slug)          │    │
-│  │  └─ (legacy: dashboard, detailed_board, card_detail, etc.) │    │
+│  │  ├─ dashboard.html     — Projets + sidebar                │    │
+│  │  ├─ board.html         — Kanban (wrapper)                 │    │
+│  │  ├─ board_fragment.html— Cartes Kanban                    │    │
+│  │  ├─ table_view.html    — Vue table                        │    │
+│  │  ├─ calendar_view.html — Vue calendrier (v1.6)            │    │
+│  │  ├─ timeline_view.html — Vue Gantt (v1.6)                 │    │
+│  │  ├─ gallery_view.html  — Vue galerie (v1.6)               │    │
+│  │  ├─ list_view.html     — Vue liste (v1.6)                 │    │
+│  │  ├─ status_overview.html — Donut SVG                      │    │
+│  │  ├─ team_load.html     — Barres stacked                   │    │
+│  │  ├─ detailed_board.html— Board détaillé                   │    │
+│  │  ├─ card_detail.html   — Modale détail carte              │    │
+│  │  ├─ card.html          — Carte individuelle               │    │
+│  │  ├─ page_editor.html   — Éditeur de blocs                 │    │
+│  │  ├─ my_tasks.html      — Dashboard unifié (v1.9)          │    │
+│  │  ├─ library.html       — Bibliothèque de pages            │    │
+│  │  ├─ trash.html         — Corbeille                        │    │
+│  │  ├─ accounts.html      — Gestion comptes                  │    │
+│  │  ├─ notes.html         — Notes Markdown                   │    │
+│  │  └─ base.html          — Layout commun                    │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
-│  │  JavaScript (servi localement, pas de CDN externe)        │    │
+│  │  JavaScript (CDN, pas de build step)                      │    │
+│  │  ├─ HTMX 1.9          — AJAX sans JS                      │    │
 │  │  ├─ Alpine.js 3.14    — Interactivité légère              │    │
-│  │  ├─ HTMX 1.9          — AJAX sans JS (legacy)             │    │
 │  │  ├─ SortableJS 1.15   — Drag & drop                       │    │
-│  │  └─ Prism.js          — Syntax highlighting               │    │
+│  │  └─ highlight.js      — Syntax highlighting (v2.0)        │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -93,30 +95,17 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  ROUTERS                                                  │    │
-│  │  ├─ main.py           — FastAPI app, lifespan, CORS, 404   │    │
-│  │  ├─ dashboard.py      — /, /workspaces, /library, /help    │    │
-│  │  │                    — /trash, /settings, /accounts        │    │
-│  │  │                    — /p/{slug} (pages publiques)         │    │
-│  │  │                    — _sidebar_data() — données sidebar   │    │
-│  │  ├─ board.py          — /board/{o}/{r}       Board + vues   │    │
-│  │  │                    — /board/api/pages     CRUD pages     │    │
-│  │  │                    — /board/api/trash     Trash          │    │
-│  │  ├─ api.py            — /api/...             CRUD + sync    │    │
-│  │  ├─ auth.py           — /auth/...            OAuth2 + local │    │
-│  │  ├─ local_workspace.py— /api/local-workspace CRUD + upload  │    │
-│  │  ├─ my_tasks.py       — /my-tasks            Dashboard      │    │
-│  │  ├─ library.py        — /api/library/*       API bibliothèque│    │
-│  │  ├─ pages.py          — /pages/...           Pages CRUD     │    │
-│  │  ├─ collections.py    — /db/...              Collections    │    │
-│  │  ├─ editor.py         — /api/editor/...      Block editor   │    │
-│  │  ├─ public_api.py     — /api/v1              Public API v1  │    │
-│  │  ├─ api_v2.py         — /api/v2              Public API v2  │    │
-│  │  │                    — Bearer + scopes, CRUD complet        │    │
-│  │  ├─ web_clipper.py    — /api/v2/web-clipper  Web Clipper     │    │
-│  │  ├─ permissions.py    — /api/v2 (ACL)        Permissions     │    │
-│  │  ├─ workspace.py      — Workspaces API + Gitea projets     │    │
-│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks    │    │
-│  │  └─ admin.py          — /api/admin/*         Admin users    │    │
+│  │  ├─ dashboard.py      — /                    Dashboard   │    │
+│  │  ├─ board.py          — /board/{o}/{r}       Board + vues │    │
+│  │  │                    — /board/api/...       APIs board   │    │
+│  │  ├─ api.py            — /api/...             CRUD + sync  │    │
+│  │  ├─ notes.py          — /notes/{o}/{r}       Notes        │    │
+│  │  ├─ auth.py           — /auth/...            OAuth2       │    │
+│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks  │    │
+│  │  ├─ my_tasks.py       — /my-tasks            (v1.9)       │    │
+│  │  ├─ pages.py          — /pages/...           Pages CRUD   │    │
+│  │  ├─ collections.py    — /db/...              Collections  │    │
+│  │  └─ editor.py         — /api/editor/...      Block editor │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -149,11 +138,6 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │  │  │  ├─ property_values    (legacy → collection_pages)      │
 │  │  │  ├─ ai_keywords                                 │    │    │
 │  │  │  ├─ pages                                       │    │    │
-│  │  │  ├─ page_shares          (v4.0)                  │    │    │
-│  │  │  ├─ recents              (v4.0)                  │    │    │
-│  │  │  ├─ tags                 (v4.0)                  │    │    │
-│  │  │  ├─ page_tags            (v4.0)                  │    │    │
-│  │  │  ├─ gitea_private_pages  (v4.0)                  │    │    │
 │  │  │  ├─ users                                       │    │    │
 │  │  │  ├─ user_tokens                                 │    │    │
 │  │  │  ├─ workspaces            (v2.0)                │    │    │
@@ -701,146 +685,42 @@ POST   /favorites                                   → Ajouter favori
 DELETE /favorites/{id}                              → Retirer favori
 ```

-### 4.6 Routes Sidebar & Library (v4.0)
-
-```
-GET    /library                                     → Bibliothèque dynamique
-GET    /api/library/recents                         → Pages récentes
-GET    /api/library/favorites                       → Favoris
-GET    /api/library/shared                          → Pages partagées
-GET    /api/library/published                       → Pages publiées
-GET    /api/library/private                         → Pages privées
-GET    /api/library/workspace                       → Pages du workspace
-
-GET    /api/local-workspace/items                   → Arborescence workspace
-POST   /api/local-workspace/items                   → Créer page/dossier
-PUT    /api/local-workspace/items/{id}              → Renommer
-DELETE /api/local-workspace/items/{id}              → Soft delete
-POST   /api/local-workspace/upload                  → Upload fichier
-GET    /api/files/{ws_id}/{filename}                → Servir fichier uploadé
-
-GET    /help                                        → Page d'aide complète
-GET    /api/public/pages/{slug}                     → Page publique
-```
-
-### 4.7 Routes Share & Publish (v4.0)
-
-```
-POST   /api/pages/{id}/share                        → Partager une page
-DELETE /api/pages/{id}/share/{share_id}             → Retirer partage
-GET    /api/pages/{id}/shares                       → Liste partages
-POST   /api/pages/{id}/publish                      → Publier page
-DELETE /api/pages/{id}/publish                      → Dépublier
-```
-
 ---

-## 5. Système d'authentification (v4.0)
-
-FlowDeck supporte **3 méthodes d'authentification** et la **connexion d'intégrations multiples** à un même compte local.
-
-### 5.1 Types de comptes
-
-| Type | Auth | Workspaces | Intégrations |
-|------|------|------------|--------------|
-| **Local pur** | email + password | Locaux uniquement | Aucune |
-| **Local + intégrations** | email + password | Locaux + distants | Gitea et/ou GitHub |
-| **OAuth pur** | Gitea ou GitHub | Distants uniquement | Non-déconnectable |
-
-### 5.2 Comportement du sidebar selon le type de compte
-
-```
-LOCAL PUR:
-  ├─ 📁 [nom workspace local]
-  ├─ 📅 Meetings
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 🤖 Agents
-  ├─ 👥 Shared        ← visible si pages partagées
-  ├─ 🌐 Published     ← visible si pages publiées
-  ├─ (Private caché)
-  └─ 📚 Library / ✅ My Tasks / 🗑️ Trash / ❓ Help
-
-LOCAL + GITEA/GITHUB:
-  ├─ 🔗 [owner/repo]  ← workspace distant actif
-  ├─ 📅 Meetings
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 🤖 Agents
-  ├─ 👥 Shared
-  ├─ 🌐 Published
-  ├─ 🔒 Private        ← visible (fichiers locaux liés au projet distant)
-  └─ 📚 / ✅ / 🗑️ / ❓
-
-OAUTH PUR (GITEA/GITHUB):
-  ├─ 🔗 [owner/repo]  ← identité = compte Gitea/GitHub
-  ├─ 🕒 Recents
-  ├─ ⭐ Favorites
-  ├─ 👥 Shared
-  ├─ 🌐 Published
-  ├─ (Private caché)
-  └─ 📚 / ✅ / ❓ (Trash caché — pas de workspace local)
-```
-
-### 5.3 Règles d'affichage
-
- **Section Private** : visible UNIQUEMENT si compte local + workspace distant actif
- **Trash** : visible si `auth_method == 'local'` ou si des pages locales existent
- **Boutons New File/New Folder** : cachés si `has_active_workspace == False`
- **Message "No workspace open"** : affiché dans la section Workspace si aucun workspace actif
- **Header sidebar** : toujours le compte local si auth_method=local, même avec intégrations
-
-### 5.4 cookie `flowdeck_workspace`
-
- `""` → aucun workspace actif
- `"42"` → workspace local ID 42
- `"gitea:owner:repo"` → workspace distant Gitea
- Nettoyage automatique si cookie invalide (workspace supprimé ou autre user)
-
---
-
-## 6. Frontend
+## 5. Frontend

 ### 5.1 Layout

-```ascii
+```
 ┌──────────────────────────────────────────────────────────────┐
-│ TOPBAR (unified-header)                                      │
-│ ┌──────┬───────────────────────────────────────┬───────────┐ │
-│ │ «»   │ Breadcrumbs: 🏠 Workspaces           │ Share ⚙    │ │
-│ └──────┴───────────────────────────────────────┴───────────┘ │
+│ TOPBAR (44px, sticky)                                        │
+│ ┌──────────┬──────────────────────────────────┬────────────┐ │
+│ │ Logo     │ Breadcrumbs: WS > Collection     │ Share...   │ │
+│ │ FlowDeck │ (ou WS > Collection > Page)     │ Settings   │ │
+│ └──────────┴──────────────────────────────────┴────────────┘ │
 ├────────────┬─────────────────────────────────────────────────┤
 │ SIDEBAR    │ CONTENU PRINCIPAL                               │
 │ (240px)    │                                                 │
-│            │  ┌─ Help Page ────────────────────────────────┐│
-│ ┌────────┐ │  │ ┌──────────────┐ ┌──────────────┐          ││
-│ │ Header │ │  │ │ 🚀 Getting   │ │ 📝 Pages     │  (...)   ││
-│ │ [D]    │ │  │ │   Started    │ │   & Editor   │          ││
-│ │ Draco  │ │  │ └──────────────┘ └──────────────┘          ││
-│ └────────┘ │  └─────────────────────────────────────────────┘│
-│            │                                                 │
-│ 🏠 💬 📨 🔍│  ┌─ Library ─────────────────────────────────┐│
-│            │  │ [Recents|Favorites|Shared|Published|...]    ││
-│ 📁 Worksp. │  │ ┌──────┬──────────┬──────────┬───────────┐ ││
-│  📄 New Pg │  │ │Name  │Created by│Source    │Last edited│ ││
-│  📁 New Fl │  │ ├──────┼──────────┼──────────┼───────────┤ ││
-│  📄 page 1 │  │ │doc A │Draco     │Local     │10 min ago │ ││
-│  📄 page 2 │  │ │doc B │bruno     │Gitea     │2 hours ago│ ││
-│            │  │ └──────┴──────────┴──────────┴───────────┘ ││
-│ 📅 Meeting │  └─────────────────────────────────────────────┘│
-│ 🕒 Recents │                                                 │
-│ ⭐ Favoris │  ┌─ Workspaces ───────────────────────────────┐│
-│ 🤖 Agents  │  │ ┌──────────┐ ┌──────────┐ ┌───┐ ┌───┐     ││
-│ 👥 Shared  │  │ │Project A │ │Project B │ │ + │ │ + │     ││
-│ 🌐 Publ.   │  │ │3 pages   │ │12 pages  │ │   │ │   │     ││
-│            │  │ └──────────┘ └──────────┘ └───┘ └───┘     ││
-│ ══════════ │  └─────────────────────────────────────────────┘│
-│ 📚 Library │                                                 │
-│ ✅ My Task │  ┌─ Settings ─────────────────────────────────┐│
-│ 🗑️ Trash  │  │ My Account | Admin | Integrations            ││
-│ ❓ Help    │  │ [Upload photo] [Full Name] [Email] [...]    ││
+│            │  ┌─────────────────────────────────────────────┐│
+│ Workspace  │  │  DATABASE VIEW                               ││
+│ header     │  │  ┌──────┬──────┬──────┬──────┬──────────┐   ││
+│            │  │  │Title │Statut│Priori│Assign│Due Date  │   ││
+│ 🔍 Search  │  │  ├──────┼──────┼──────┼──────┼──────────┤   ││
+│            │  │  │Tâche1│Todo  │ P1   │Bruno │15 juil   │   ││
+│ ▼ Recents  │  │  │Tâche2│Doing │ P2   │ —    │20 juil   │   ││
+│  · Proj A  │  │  │Tâche3│Done  │ P3   │Marie │10 juil   │   ││
+│  · Proj B  │  │  └──────┴──────┴──────┴──────┴──────────┘   ││
+│            │  │  [+ New]  [Filter]  [Sort]  [Search]  [...]  ││
+│ ▼ Private  │  └─────────────────────────────────────────────┘│
+│  · Notes   │                                                 │
+│            │  ┌─ Barre d'outils ────────────────────────────┐│
+│ ▼ Shared   │  │  [Table▼] [Kanban] [Calendar] [Gallery] ... ││
+│  · ...     │  │  [Group▼] [Filter▼] [Sort▼] [Properties▼]  ││
 │            │  └─────────────────────────────────────────────┘│
-│ 💬 [+📄]   │                                                 │
+│ ────────── │                                                 │
+│ [+New page]│  ┌─ Contenu de la vue ─────────────────────────┐│
+│ (sticky    │  │  (table / board / calendar / gallery / ...)  ││
+│  footer)   │  └─────────────────────────────────────────────┘│
 └────────────┴─────────────────────────────────────────────────┘
 ```

@@ -1673,43 +1553,7 @@ docker compose restart flowdeck
 - [Notion Help — Databases](https://www.notion.com/help/intro-to-databases)
 - [Notion Help — Tasks & Dependencies](https://www.notion.com/help/tasks-and-dependencies)
 - [Notion Help — Relations & Rollups](https://www.notion.com/help/relations-and-rollups)
+- [Notion Data Sources (2025)](https://www.notionapps.com/blog/notion-data-sources-update-2025/)
+- [react-notion-x](https://github.com/NotionX/react-notion-x)
 - [FlowDeck — NOTION_DATABASE_TASKS_GUIDE.md](docs/NOTION_DATABASE_TASKS_GUIDE.md)
 - [FlowDeck — ROADMAP.md](ROADMAP.md)
-
---
-
-## 16. Versions à venir
-
-### v4.1.0 — Content Blocks enrichis (priorité standard)
-
- **Callout boxes** — Blocs d'alerte (info, warning, tip, danger)
- **Table of Contents** — Auto-généré depuis les headings
- **LaTeX / KaTeX** — Formules mathématiques
- **Toggle lists** — Listes pliables/dépliables
- **Multi-columns** — Mise en page 2-3 colonnes
-
-### v4.2.0 — Export (priorité standard)
-
- Export **Markdown** avec images
- Export **PDF** (via WeasyPrint ou headless Chrome)
- Export **HTML** standalone (page auto-suffisante)
-
-### v4.3.0 — Collaboration (priorité basse)
-
- **Commentaires inline** sur les pages
- **@mentions** pour notifier des utilisateurs
- **Notifications email** (changements, mentions)
- **Permissions par workspace** (viewer, editor, admin)
-
-### v5.0.0 — Plateforme avancée (futur)
-
- **AI Assistants** — Génération de contenu, résumés, suggestions
- **Embeds** — Vidéos, PDF, Figma, Google Docs
- **Automatisations** — Règles déclenchées sur événements (Notion-style)
- **Base de données avancée** — Relations inter-collections, rollups
- **Kanban flexible** — Colonnes custom, WIP limits
- **API publique REST v2** — `/api/v2` (v6.3.0) : Bearer + scopes `read/write/admin`, CRUD complet, pagination, RFC 7807, idempotence, audit, OpenAPI (`/docs`, `docs/openapi-v2.json`) ; `/api/v1` lecture seule (compat)
- **API agent publique** — `/api/v2/agents/*` + `/api/v2/skills/*` (v6.6.0, agent phase 5) : wrappers Bearer sur `AgentEngine` (run synchrone JSON, journal + rollback, trigger externe) et marketplace de skills (export/import portable, galerie de presets) — `app/routers/api_v2_agent.py`, `app/services/skill_gallery.py`
- **SSO / SAML + OIDC entreprise** — v6.7.0 (Enterprise Auth, dernière feature v6.0.0) : SP SAML (`python3-saml`) + OIDC PKCE (`authlib`), auto-provisioning + mapping groupes IdP → rôles workspace, mode « SSO only », onglet admin « SSO / Enterprise », migration 23 (`sso_config`, `sso_login_history`, `sso_requests`), `/help` section SSO — `app/routers/sso.py`, `app/services/sso_provisioning.py`, `app/auth/providers/{saml,oidc}_provider.py`
- **Volume Docker persistant** — `/data` monté pour survie des données
- **PostgreSQL** — Migration optionnelle pour scaling
@@ -1,44 +1,19 @@
-# ═══════════════════════════════════════════════════════════
-# FlowDeck — multi-stage Docker build (v5.2.0)
-# Stage 1 "builder": build Python wheels once.
-# Stage 2 "runtime": minimal image with WeasyPrint system libs.
-# ═══════════════════════════════════════════════════════════
-FROM python:3.13-slim AS builder
+FROM python:3.12-slim

 WORKDIR /app

+RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+
 COPY requirements.txt .
-RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
-
-# ── runtime stage ───────────────────────────────────────────
-FROM python:3.13-slim AS runtime
-
-WORKDIR /app
-
-# WeasyPrint PDF: text layout (pango/harfbuzz), image decoding, fonts,
-# colour emoji support. curl = healthcheck.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    libpango-1.0-0 \
-    libpangoft2-1.0-0 \
-    libharfbuzz0b \
-    libffi-dev \
-    libgdk-pixbuf-2.0-0 \
-    shared-mime-info \
-    fonts-dejavu-core \
-    fonts-noto-color-emoji \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /wheels /wheels
-RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
+RUN pip install --no-cache-dir -r requirements.txt

 COPY . .

-RUN mkdir -p /data /data/backups
+RUN mkdir -p /data

 EXPOSE 8080

 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/api/health || exit 1

-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
@@ -2,7 +2,7 @@

 Clone complet de **Notion** intégré nativement à **Gitea** — Databases, Pages, Kanban, Calendar, Gallery, Timeline, List, Multi-Users.

-> **7.3.9** — audit sécurité P0→P2 (A1–A26, A33–A36, A43 : auth 401 partout, CSRF sans exemption cookie-auth, SSRF, autoescape, logs d'exceptions) · avant : v6.7.x SSO/SAML + OIDC, v6.6.x agent API, v6.5.x synced blocks, v6.4.0 realtime, PWA offline
+> **v2.1.0** — API publique, Webhooks sortants, PWA

 ## Quick Start

@@ -49,14 +49,10 @@ docker compose up -d
 - **CSV Import/Export**
 - **Public Sharing**: lien de partage lecture seule

-### API & Intégrations (v6.3–v6.6)
- **API publique REST v2**: `/api/v2` — CRUD complet, Bearer + scopes `read/write/admin`, pagination, filtres, erreurs RFC 7807, idempotence, audit — [guide](docs/API_GUIDE_V6.md) · OpenAPI `/docs`
- **API agent publique (v6.6)**: `/api/v2/agents/*` — agents, conversations, **run synchrone JSON**, journal d'actions + rollback, `trigger` externe
- **Marketplace de skills (v6.6)**: export/import portable + galerie de 6 presets installables (`/api/v2/skills/*`), section « Galerie » dans la palette `/` de l'agent
- **API publique v1**: `/api/v1` (lecture seule, compat)
- **Webhooks sortants**: gestion + dispatcher d'événements (CRUD v2)
- **Web Clipper**: extension navigateur Manifest V3 (article/sélection/bookmark/screenshot)
- **PWA**: manifest.json + service worker, offline support
+### API & Intégrations (v2.1)
+- **API publique REST**: `/api/v1` avec token auth
+- **Webhooks sortants**: gestion + dispatcher d'événements
+- **PWA**: manifest.json, prêt pour installation mobile

 ### UI Notion-Style (v1.1–v1.2)
 - Sidebar gauche avec sections hiérarchiques
@@ -73,9 +69,9 @@ docker compose up -d
 | Couche | Techno |
 |--------|--------|
 | Frontend | Jinja2 + HTMX + Alpine.js + SortableJS + CSS |
-| Backend | Python 3.13 + FastAPI + httpx |
+| Backend | Python 3.12 + FastAPI + httpx |
 | BDD | SQLite (WAL, 21 tables) — `/data/flowdeck.db` |
-| Déploiement | Docker (python:3.13-slim), docker-compose |
+| Déploiement | Docker (python:3.12-slim), docker-compose |

 ## Configuration

@@ -89,7 +85,7 @@ DATABASE_URL=sqlite:////data/flowdeck.db
 ## Tests

 ```bash
-python3 -m pytest tests/ -v   # 764/764 passent (0 skip)
+python3 -m pytest tests/ -v   # 73/73 passent
 ```

 ## Roadmap
@@ -1 +0,0 @@
-7.56.0
@@ -1,7 +1,7 @@
 # WORKLOAD — FlowDeck Notion Clone

-> **Début**: 2026-07-08 | **Version**: v7.50.2 (peek de Library nu — iframe pleine, comme local-workspace) | **Statut**: EN COURS 🔄
-> **Cible**: parité Notion + intégration forge · **Follow-ups v7.3 livrés**: sidebar teamspaces, notif `page.updated`, charts `number` + dashboards multi-DB, unfurl forge, UI Settings → Audit — voir `ROADMAP.md § v7.3.0`
+> **Début**: 2026-07-08 | **Version**: v2.2.0 | **Statut**: EN COURS 🔄
+> **Cible v3.0**: Multi-User, Multi-Forge (Gitea/GitHub), Standalone

 ## Avancement Global

@@ -21,22 +21,7 @@
 | v2.0 | Multi-User + Editor Complete | ✅ | 67/67 |
 | v2.1 | Public API, Webhooks, PWA | ✅ | 73/73 |
 | v2.2 | Share/Publish, Favorites, Library | ✅ | 73/73 |
-| v3.0 | Auth locale, Multi-Forge, Standalone | ✅ | — |
-| v4.x–v5.x | MVP → Agent IA, palette, automations, import, calendrier, wiki-links, synced blocks | ✅ | 523+ |
-| v6.0–v6.3 | PWA offline, permissions granulaires, web clipper, API publique v2 | ✅ | 668+ |
-| **v6.4.0** | **Realtime production (merge 3-voix, broadcast non bloquant)** | ✅ | **749+** |
-| **v6.5.0–v6.5.1** | **Synced blocks production (databases/vues) + webhooks v2 complets** | ✅ | **749** |
-| **v6.6.0** | **Agent phase 5 — API publique agent & skill marketplace** | ✅ | **764+** |
-| **v6.7.0** | **SSO / SAML + OIDC entreprise (Enterprise Auth)** | ✅ | **802** |
-| v6.8.0 | Sites multi-pages + Forms publics ([doc](docs/V68_Sites_Forms.md)) | ✅ | 20 |
-| v6.9.0 | Recherche hybride + Ask AI RAG ([doc](docs/V69_Search_Ask_AI.md)) | ✅ | 24 |
-| v7.0.0 | Automations multi-étapes + Workers lite ([doc](docs/V70_Automations_Workers.md)) | ✅ | 31 |
-| v7.1.0 | Calendar sync + Meeting Notes ([doc](docs/V71_Calendar_Meetings.md)) | ✅ | 15 |
-| v7.2.0 | SCIM + 2FA + Audit UI + gouvernance agents ([doc](docs/V72_Enterprise_SCIM_2FA.md)) | ✅ | 52 |
-| v7.3.0 | Teamspaces + Verified + Polish + follow-ups ([doc](docs/V73_Wiki_Teamspaces_Polish.md)) | ✅ | 72 |
-
-> **Suites de régression** : `test_v72_enterprise.py` (52) + `test_v73_wiki_polish.py` (72) = **124 verts** · suite complète `-n auto` = **1016 passed**.
-> **Follow-ups v7.3 livrés** (voir § v7.3.0 du `ROADMAP.md`): sidebar par teamspace, charts `number`/multi-DB, notif `page.updated` aux followers, unfurl `gitea:`/`github:`, page Settings → Audit — + 21 casses SSO corrigées (install `python3-saml`/`authlib`).
+| v3.0 | **Auth locale, Multi-Forge, Standalone** | 🔲 | — |

 ## Blocs Complétés

@@ -73,5 +58,5 @@ CRUD collections/pages, 5 vues HTML, relations/rollups/formulas, sub-items/depen
 - **BDD**: SQLite WAL mode, 21 tables, foreign keys ON
 - **Auth**: OAuth2 Gitea + sessions signed (itsdangerous) + token API
 - **Déploiement**: Docker (python:3.12-slim), docker-compose, port 8080
- **Tests**: pytest, 764+ tests, TestClient avec SQLite temporaire
+- **Tests**: pytest, 73 tests, TestClient avec SQLite temporaire
 - **CI/CD**: Gitea Actions (.gitea/workflows/ci.yml)
@@ -1,5 +1,3 @@
 """FlowDeck — Auth module: session, OAuth2, dependencies."""
 from app.auth.oauth import GiteaOAuth
 from app.auth.session import SessionManager, get_current_user
-
-__all__ = ["GiteaOAuth", "SessionManager", "get_current_user"]
@@ -4,8 +4,9 @@ from __future__ import annotations
 import logging
 from urllib.parse import urlencode

+import httpx
+
 from app.config import settings
-from app.services.http_client import shared_client

 logger = logging.getLogger(__name__)

@@ -38,7 +39,7 @@ class GiteaOAuth:
    async def exchange_code(self, code: str) -> dict | None:
        """Exchange authorization code for access token."""
        try:
-            async with shared_client(timeout=15) as client:
+            async with httpx.AsyncClient(timeout=15) as client:
                resp = await client.post(
                    self.TOKEN_URL,
                    data={
@@ -60,7 +61,7 @@ class GiteaOAuth:
    async def get_user(self, access_token: str) -> dict | None:
        """Get user info from Gitea API."""
        try:
-            async with shared_client(timeout=10) as client:
+            async with httpx.AsyncClient(timeout=10) as client:
                resp = await client.get(
                    self.USER_URL,
                    headers={"Authorization": f"token {access_token}"},
@@ -7,21 +7,10 @@ import time
 from abc import ABC, abstractmethod
 from urllib.parse import urlencode

-from app.services.http_client import shared_client
+import httpx

 logger = logging.getLogger(__name__)

-# Valeurs de substitution livrées dans app/config.py : elles sont NON VIDES,
-# donc un simple `bool(client_id and client_secret)` les considérait comme
-# configurées et /auth/login redirigeait vers Gitea avec client_id=test-id
-# (échec d'authentification garanti). Un placeholder == provider non configuré.
-_PLACEHOLDER_CREDS = {"test-id", "test-secret", "change-me", "changeme", "your-client-id"}
-
-
-def _real(value: str | None) -> bool:
-    """True when ``value`` is a real credential (not empty, not a placeholder)."""
-    return bool(value) and value.strip().lower() not in _PLACEHOLDER_CREDS
-

 class OAuthProvider(ABC):
    """Abstract OAuth2 provider interface."""
@@ -63,7 +52,7 @@ class GiteaProvider(OAuthProvider):
        self.redirect_uri = redirect_uri

    def is_enabled(self) -> bool:
-        return _real(self.client_id) and _real(self.client_secret)
+        return bool(self.client_id and self.client_secret)

    def get_authorize_url(self, state: str, redirect_uri: str | None = None, force_login: bool = False) -> str:
        params = {
@@ -87,7 +76,7 @@ class GiteaProvider(OAuthProvider):
            "grant_type": "authorization_code",
            "redirect_uri": redirect_uri or self.redirect_uri,
        }
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.post(url, json=data, headers={"Accept": "application/json"})
            if r.status_code != 200:
                logger.error("Gitea token exchange failed: %s", r.text)
@@ -96,7 +85,7 @@ class GiteaProvider(OAuthProvider):

    async def get_user(self, access_token: str) -> dict | None:
        url = f"{self.base}/api/v1/user"
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.get(url, headers={"Authorization": f"token {access_token}"})
            if r.status_code != 200:
                return None
@@ -111,7 +100,7 @@ class GiteaProvider(OAuthProvider):

    async def list_repositories(self, access_token: str) -> list[dict]:
        repos = []
-        async with shared_client(timeout=30) as client:
+        async with httpx.AsyncClient(timeout=30) as client:
            for page in range(1, 6):
                r = await client.get(
                    f"{self.base}/api/v1/user/repos",
@@ -155,7 +144,7 @@ class GitHubProvider(OAuthProvider):
        self.api_url = "https://api.github.com"

    def is_enabled(self) -> bool:
-        return _real(self.client_id) and _real(self.client_secret)
+        return bool(self.client_id and self.client_secret)

    def get_authorize_url(self, state: str, redirect_uri: str | None = None, force_login: bool = False) -> str:
        return (
@@ -169,14 +158,14 @@ class GitHubProvider(OAuthProvider):
        )

    async def exchange_code(self, code: str, redirect_uri: str | None = None) -> dict | None:
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.post(
                self.token_url,
                data={
                    "client_id": self.client_id,
                    "client_secret": self.client_secret,
                    "code": code,
-                    "redirect_uri": redirect_uri or self.redirect_uri,
+                    "redirect_uri": self.redirect_uri,
                },
                headers={"Accept": "application/json"},
            )
@@ -190,7 +179,7 @@ class GitHubProvider(OAuthProvider):

    async def get_user(self, access_token: str) -> dict | None:
        url = f"{self.api_url}/user"
-        async with shared_client(timeout=15) as client:
+        async with httpx.AsyncClient(timeout=15) as client:
            r = await client.get(
                url,
                headers={"Authorization": f"Bearer {access_token}", "Accept": "application/vnd.github.v3+json"},
@@ -208,7 +197,7 @@ class GitHubProvider(OAuthProvider):

    async def list_repositories(self, access_token: str) -> list[dict]:
        repos = []
-        async with shared_client(timeout=30) as client:
+        async with httpx.AsyncClient(timeout=30) as client:
            for page in range(1, 6):
                r = await client.get(
                    f"{self.api_url}/user/repos",
@@ -1,217 +0,0 @@
-"""OIDC provider — authorization code flow with PKCE (v6.7.0).
-
-Discovery (``.well-known/openid-configuration``) is cached for an hour, the
-ID token signature is verified against the issuer JWKS via authlib's JOSE
-implementation, and ``iss`` / ``aud`` / ``exp`` / ``nonce`` are checked here
-explicitly so the rules are visible and unit-testable.
-"""
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-import logging
-import secrets
-import time
-import warnings
-
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-
-#: Default attribute mapping (design doc §3.2) — OIDC claim names.
-DEFAULT_OIDC_MAPPING: dict[str, str] = {
-    "login": "sub",
-    "email": "email",
-    "full_name": "name",
-    "avatar_url": "picture",
-    "groups": "groups",
-}
-
-_DISCOVERY_TTL = 3600.0
-_discovery_cache: dict[str, tuple[float, dict]] = {}
-
-
-class OIDCError(Exception):
-    """OIDC processing failure — ``message`` is user-facing."""
-
-
-def pkce_pair() -> tuple[str, str]:
-    """Return ``(code_verifier, code_challenge)`` for the S256 method."""
-    verifier = secrets.token_urlsafe(64)
-    digest = hashlib.sha256(verifier.encode("ascii")).digest()
-    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
-    return verifier, challenge
-
-
-
-
-def _b64url_decode(data: str) -> bytes:
-    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
-
-
-async def discover(issuer_url: str) -> dict:
-    """Fetch (and cache) the issuer's OIDC discovery document."""
-    issuer = issuer_url.rstrip("/")
-    url = f"{issuer}/.well-known/openid-configuration"
-    now = time.time()
-    hit = _discovery_cache.get(issuer)
-    if hit and now - hit[0] < _DISCOVERY_TTL:
-        return hit[1]
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.get(url)
-            r.raise_for_status()
-            doc = r.json()
-    except Exception as err:
-        raise OIDCError(f"OIDC discovery failed ({url}): {err}") from err
-    if not doc.get("authorization_endpoint") or not doc.get("token_endpoint"):
-        raise OIDCError("OIDC discovery document is missing authorization/token endpoints")
-    _discovery_cache[issuer] = (now, doc)
-    return doc
-
-
-def build_authorize_url(
-    doc: dict,
-    *,
-    client_id: str,
-    redirect_uri: str,
-    scope: str,
-    state: str,
-    nonce: str,
-    code_challenge: str,
-) -> str:
-    from urllib.parse import urlencode
-
-    params = {
-        "client_id": client_id,
-        "redirect_uri": redirect_uri,
-        "response_type": "code",
-        "scope": scope or "openid profile email",
-        "state": state,
-        "nonce": nonce,
-        "code_challenge": code_challenge,
-        "code_challenge_method": "S256",
-    }
-    sep = "&" if "?" in doc["authorization_endpoint"] else "?"
-    return doc["authorization_endpoint"] + sep + urlencode(params)
-
-
-async def exchange_code(
-    doc: dict, *, client_id: str, client_secret: str, code: str, redirect_uri: str, code_verifier: str
-) -> dict:
-    """Exchange the authorization code for tokens (PKCE, confidential client)."""
-    data = {
-        "grant_type": "authorization_code",
-        "code": code,
-        "redirect_uri": redirect_uri,
-        "client_id": client_id,
-        "code_verifier": code_verifier,
-    }
-    auth = None
-    if client_secret:
-        auth = (client_id, client_secret)
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.post(doc["token_endpoint"], data=data, auth=auth)
-    except Exception as err:
-        raise OIDCError(f"OIDC token request failed: {err}") from err
-    if r.status_code != 200:
-        raise OIDCError(f"OIDC token endpoint returned {r.status_code}: {r.text[:300]}")
-    try:
-        tokens = r.json()
-    except Exception as err:
-        raise OIDCError(f"OIDC token endpoint returned a non-JSON body: {err}") from err
-    if "error" in tokens:
-        raise OIDCError(f"OIDC error: {tokens.get('error')} {tokens.get('error_description', '')}".strip())
-    return tokens
-
-
-async def fetch_userinfo(doc: dict, access_token: str) -> dict:
-    """Best-effort userinfo fetch (groups often only live there)."""
-    endpoint = doc.get("userinfo_endpoint")
-    if not endpoint or not access_token:
-        return {}
-    try:
-        async with shared_client(timeout=15) as client:
-            r = await client.get(endpoint, headers={"Authorization": f"Bearer {access_token}"})
-        if r.status_code != 200:
-            return {}
-        data = r.json()
-        return data if isinstance(data, dict) else {}
-    except Exception as err:  # userinfo is optional enrichment
-        logger.debug("userinfo fetch failed: %s", err)
-        return {}
-
-
-def validate_id_token(
-    id_token: str, *, issuer: str, client_id: str, nonce: str, jwks: dict
-) -> dict:
-    """Verify the ID token signature and claims. Returns the claims dict."""
-    with warnings.catch_warnings():
-        warnings.simplefilter("ignore", DeprecationWarning)
-        from authlib.jose import JsonWebKey
-        from authlib.jose import jwt as jose_jwt
-
-    if isinstance(id_token, bytes):
-        # authlib's jose.jwt.encode() returns bytes; IdP token endpoints send
-        # str — accept both instead of crashing on ``bytes.count(".")``.
-        id_token = id_token.decode()
-    if not id_token or id_token.count(".") != 2:
-        raise OIDCError("Missing or malformed ID token")
-
-    try:
-        keyset = JsonWebKey.import_key_set(jwks)
-    except Exception as err:
-        raise OIDCError(f"Invalid issuer JWKS: {err}") from err
-
-    try:
-        # Pick the key matching the token header (kid) when several are offered.
-        header = json.loads(_b64url_decode(id_token.split(".")[0]))
-        kid = header.get("kid")
-        key = keyset.get_by_kid(kid) if kid and hasattr(keyset, "get_by_kid") else None
-        token_obj = jose_jwt.decode(id_token, key or keyset)
-    except Exception as err:
-        raise OIDCError(f"ID token signature verification failed: {err}") from err
-
-    claims = dict(token_obj)  # authlib's JWTClaims is a dict subclass
-    now = int(time.time())
-
-    if claims.get("iss") != issuer.rstrip("/") and claims.get("iss") != issuer:
-        raise OIDCError(f"ID token issuer mismatch: {claims.get('iss')!r}")
-    aud = claims.get("aud")
-    aud_list = aud if isinstance(aud, list) else [aud]
-    if client_id not in aud_list:
-        raise OIDCError("ID token audience does not include this client")
-    exp = claims.get("exp")
-    if not isinstance(exp, int) or exp < now:
-        raise OIDCError("ID token expired")
-    iat = claims.get("iat")
-    if isinstance(iat, int) and iat > now + 300:
-        raise OIDCError("ID token issued in the future")
-    if nonce and claims.get("nonce") != nonce:
-        raise OIDCError("ID token nonce mismatch")
-    if not claims.get("sub"):
-        raise OIDCError("ID token has no subject")
-    return claims
-
-
-def claims_to_identity(claims: dict, mapping: dict | None = None) -> dict:
-    """Map OIDC claims onto the shared ``{login, email, full_name, avatar_url, groups}`` shape."""
-    mapping = mapping or DEFAULT_OIDC_MAPPING
-    identity: dict = {"_raw": claims}
-    for field in ("login", "email", "full_name", "avatar_url"):
-        source = mapping.get(field) or field
-        value = claims.get(source, "")
-        if isinstance(value, list):
-            value = value[0] if value else ""
-        identity[field] = str(value or "").strip()
-    groups = claims.get(mapping.get("groups", "groups"), [])
-    if isinstance(groups, str):
-        groups = [groups]
-    identity["groups"] = [str(g) for g in groups if g]
-    if not identity["email"]:
-        identity["email"] = claims.get("email", "") or ""
-    if not identity["full_name"]:
-        identity["full_name"] = claims.get("name", "") or identity["email"]
-    return identity
@@ -1,279 +0,0 @@
-"""SAML 2.0 Service Provider — wrapper around python3-saml (OneLogin toolkit).
-
-v6.7.0. Adapts FastAPI's ``Request`` to the toolkit's flat ``request_data``
-dict and builds the SP settings from the ``sso_config`` row.
-
-What the toolkit validates in strict mode (all covered by tests):
-XML schema, signature of the assertion and/or the message against the IdP
-certificate, ``Conditions`` timestamps, ``Audience``, ``Destination``,
-``Issuer``, ``Status``, "exactly one assertion", and ``InResponseTo``
-against the AuthnRequest id we pass to ``process_response()`` — combined
-with the single-use ``sso_requests`` store that makes replay impossible.
-"""
-from __future__ import annotations
-
-import logging
-from dataclasses import dataclass, field
-
-from fastapi import Request
-
-logger = logging.getLogger(__name__)
-
-BINDING_HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-BINDING_HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-NAMEID_FORMAT_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
-
-#: Default attribute mapping (design doc §3.2). ``nameid`` = the assertion's
-#: NameID; every other value is matched against attribute Name / FriendlyName
-#: / URI local part (so ``email`` finds both ``email`` and
-#: ``http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress``).
-DEFAULT_SAML_MAPPING: dict[str, str] = {
-    "login": "nameid",
-    "email": "nameid",
-    "full_name": "displayName",
-    "avatar_url": "avatar",
-    "groups": "groups",
-}
-
-
-class SAMLError(Exception):
-    """SAML processing failure — ``message`` is user-facing, ``reason`` is logged."""
-
-
-@dataclass
-class SAMLIdentity:
-    """What a validated assertion tells us about the user."""
-
-    name_id: str
-    name_id_format: str = ""
-    session_index: str = ""
-    attributes: dict[str, list[str]] = field(default_factory=dict)
-    friendly_attributes: dict[str, list[str]] = field(default_factory=dict)
-
-    def resolve(self, source: str) -> str:
-        """Resolve one mapped source (``nameid`` or an attribute name) → first value."""
-        if not source or source == "nameid":
-            return self.name_id or ""
-        if source in self.attributes and self.attributes[source]:
-            return (self.attributes[source][0] or "").strip()
-        # FriendlyName match (case-insensitive)
-        lower = {k.lower(): v for k, v in self.friendly_attributes.items()}
-        if source.lower() in lower and lower[source.lower()]:
-            return (lower[source.lower()][0] or "").strip()
-        # URI local part match: ".../claims/emailaddress" ~ "emailaddress", and
-        # a mapping of "email" must still find ".../claims/emailaddress".
-        want = source.lower().lstrip("./")
-        for name, values in self.attributes.items():
-            if not values:
-                continue
-            local = name.rsplit("/", 1)[-1].rsplit("}", 1)[-1].lower()
-            if local == want or local.endswith(want) or want.endswith(local):
-                return (values[0] or "").strip()
-        return ""
-
-
-def external_base_url(request: Request) -> str:
-    """Scheme://host the user actually used (proxy-aware, like OAuth redirects)."""
-    proto = request.headers.get("x-forwarded-proto", "")
-    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
-    fwd_host = request.headers.get("x-forwarded-host", "")
-    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
-    return f"{scheme}://{host}"
-
-
-def saml_endpoints(request: Request) -> dict[str, str]:
-    """SP entity id + ACS/SLO/metadata URLs derived from the incoming request."""
-    base = external_base_url(request)
-    return {
-        "entity_id": f"{base}/auth/saml/metadata",
-        "acs": f"{base}/auth/saml/callback",
-        "slo": f"{base}/auth/saml/logout",
-        "metadata": f"{base}/auth/saml/metadata",
-    }
-
-
-def build_settings(cfg: dict, endpoints: dict[str, str]) -> dict:
-    """python3-saml settings dict built from a ``sso_config`` row."""
-    sign_requests = bool(cfg.get("sign_requests"))
-    sp: dict = {
-        "entityId": endpoints["entity_id"],
-        "assertionConsumerService": {
-            "url": endpoints["acs"],
-            "binding": BINDING_HTTP_POST,
-        },
-        "singleLogoutService": {
-            "url": endpoints["slo"],
-            "binding": BINDING_HTTP_REDIRECT,
-        },
-        "NameIDFormat": NAMEID_FORMAT_EMAIL,
-    }
-    if cfg.get("sp_private_key") and cfg.get("sp_certificate"):
-        sp["privateKey"] = cfg["sp_private_key"]
-        sp["x509cert"] = cfg["sp_certificate"]
-
-    idp: dict = {
-        "entityId": cfg.get("entity_id") or "",
-        "singleSignOnService": {
-            "url": cfg.get("sso_url") or "",
-            "binding": BINDING_HTTP_REDIRECT,
-        },
-        "x509cert": cfg.get("x509_certificate") or "",
-    }
-    if cfg.get("slo_url"):
-        idp["singleLogoutService"] = {"url": cfg["slo_url"], "binding": BINDING_HTTP_REDIRECT}
-
-    return {
-        "strict": True,
-        "debug": False,
-        "sp": sp,
-        "idp": idp,
-        "security": {
-            "authnRequestsSigned": sign_requests,
-            "logoutRequestSigned": sign_requests,
-            "logoutResponseSigned": False,
-            "wantMessagesSigned": False,
-            "wantAssertionsSigned": True,
-            "wantNameIdEncrypted": False,
-            "wantAssertionsEncrypted": False,
-            "wantXmlValidation": True,
-            "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
-            "digestAlgorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
-            "rejectDeprecatedAlgorithm": True,
-            # FlowDeck is self-hosted: LAN/homelab deploys commonly reach the
-            # SP through single-label hosts (http://flowdeck/, docker service
-            # names). python3-saml rejects those URLs unless this is on.
-            "allowSingleLabelDomains": True,
-        },
-    }
-
-
-def _request_data(request: Request, script_name: str, post_data: dict | None = None) -> dict:
-    """Flat request dict expected by ``OneLogin_Saml2_Auth``."""
-    https = "on" if external_base_url(request).startswith("https") else "off"
-    return {
-        "https": https,
-        "http_host": request.headers.get("host", "localhost:8080"),
-        "script_name": script_name,
-        "request_uri": request.url.path,
-        "query_string": str(request.url.query or ""),
-        "get_data": dict(request.query_params),
-        "post_data": post_data or {},
-    }
-
-
-def _auth(request: Request, cfg: dict, script_name: str, post_data: dict | None = None):
-    from onelogin.saml2.auth import OneLogin_Saml2_Auth
-
-    settings = build_settings(cfg, saml_endpoints(request))
-    try:
-        return OneLogin_Saml2_Auth(
-            _request_data(request, script_name, post_data=post_data), old_settings=settings
-        )
-    except Exception as err:  # malformed IdP/SP config (bad cert, missing URL…)
-        raise SAMLError(f"Invalid SAML configuration: {err}") from err
-
-
-def create_login(request: Request, cfg: dict, relay_state: str) -> tuple[str, str]:
-    """Build the AuthnRequest. Returns ``(redirect_url, authn_request_id)``."""
-    auth = _auth(request, cfg, "/auth/saml/login")
-    try:
-        url = auth.login(return_to=relay_state)
-    except Exception as err:
-        raise SAMLError(f"Could not build the SAML AuthnRequest: {err}") from err
-    request_id = auth.get_last_request_id() or ""
-    if not request_id:
-        raise SAMLError("AuthnRequest was built without an id")
-    return url, request_id
-
-
-def process_response(request: Request, cfg: dict, post_data: dict, request_id: str) -> SAMLIdentity:
-    """Validate the IdP's SAMLResponse and extract the identity.
-
-    ``request_id`` is the id of the AuthnRequest we issued (from the
-    single-use ``sso_requests`` row): the toolkit rejects any response whose
-    ``InResponseTo`` does not match it.
-    """
-    auth = _auth(request, cfg, "/auth/saml/callback", post_data=post_data)
-    try:
-        auth.process_response(request_id=request_id or None)
-    except Exception as err:
-        raise SAMLError(f"SAML response could not be processed: {err}") from err
-
-    errors = auth.get_errors()
-    if errors:
-        raise SAMLError(auth.get_last_error_reason() or f"SAML errors: {', '.join(errors)}")
-    if not auth.is_authenticated():
-        raise SAMLError("SAML response did not authenticate the user")
-
-    name_id = auth.get_nameid() or ""
-    if not name_id:
-        raise SAMLError("SAML assertion carries no NameID")
-    return SAMLIdentity(
-        name_id=name_id,
-        name_id_format=auth.get_nameid_format() or "",
-        session_index=auth.get_session_index() or "",
-        attributes=auth.get_attributes() or {},
-        friendly_attributes=auth.get_friendlyname_attributes() or {},
-    )
-
-
-def metadata_xml(request: Request, cfg: dict) -> str:
-    """SP metadata XML (for the IdP configuration screen)."""
-    from onelogin.saml2.settings import OneLogin_Saml2_Settings
-
-    settings = OneLogin_Saml2_Settings(
-        build_settings(cfg, saml_endpoints(request)), custom_base_path=None
-    )
-    try:
-        xml = settings.get_sp_metadata()
-    except Exception as err:
-        raise SAMLError(f"Could not build the SP metadata: {err}") from err
-    if isinstance(xml, bytes):
-        xml = xml.decode("utf-8")
-    return xml
-
-
-def build_logout_url(request: Request, cfg: dict, return_to: str, name_id: str, session_index: str) -> str:
-    """SP-initiated Single Logout (HTTP-Redirect LogoutRequest to the IdP)."""
-    auth = _auth(request, cfg, "/auth/saml/logout")
-    if not cfg.get("slo_url"):
-        raise SAMLError("The IdP has no Single Logout URL configured")
-    try:
-        return auth.logout(
-            return_to=return_to,
-            name_id=name_id or None,
-            session_index=session_index or None,
-        )
-    except Exception as err:
-        raise SAMLError(f"Could not build the SAML LogoutRequest: {err}") from err
-
-
-def process_slo_form(request: Request, cfg: dict, form: dict, query: dict) -> tuple[str | None, list[str]]:
-    """Process a LogoutRequest / LogoutResponse received from the IdP.
-
-    ``form`` holds the POSTed fields, ``query`` the GET parameters (the
-    HTTP-Redirect binding delivers LogoutRequest/LogoutResponse there).
-    Returns ``(redirect_url, errors)``.
-    """
-    from onelogin.saml2.auth import OneLogin_Saml2_Auth
-
-    settings = build_settings(cfg, saml_endpoints(request))
-    https = "on" if external_base_url(request).startswith("https") else "off"
-    post_data = {k: v for k, v in form.items() if k in ("SAMLRequest", "SAMLResponse", "RelayState")}
-    if not post_data:
-        post_data = {"SAMLResponse": query["SAMLResponse"]} if "SAMLResponse" in query else {}
-    req_data = {
-        "https": https,
-        "http_host": request.headers.get("host", "localhost:8080"),
-        "script_name": "/auth/saml/logout",
-        "request_uri": request.url.path,
-        "query_string": str(request.url.query or ""),
-        "get_data": dict(query),
-        "post_data": post_data,
-    }
-    auth = OneLogin_Saml2_Auth(req_data, old_settings=settings)
-    try:
-        url = auth.process_slo(keep_local_session=True)
-    except Exception as err:
-        raise SAMLError(f"SAML logout could not be processed: {err}") from err
-    return url, auth.get_errors()
@@ -1,56 +1,26 @@
 """FlowDeck — Session management with signed cookies."""
 from __future__ import annotations

-import logging
-from datetime import UTC, datetime
-from uuid import uuid4
+import json
+from datetime import datetime, timedelta

-from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+from itsdangerous import URLSafeTimedSerializer, BadSignature, SignatureExpired

 from app.config import settings

-logger = logging.getLogger(__name__)
-
 _serializer = URLSafeTimedSerializer(settings.app_secret_key)

-# Colonnes de la table ``users`` qui ne doivent JAMAIS quitter le serveur :
-# le cookie de session est signé (HMAC) mais pas chiffré — son payload est
-# lisible en base64 par quiconque détient le cookie, et ``/auth/user`` le
-# renvoyait tel quel au client.
-_SECRET_USER_FIELDS = ("password_hash",)
-
-
-def public_user(user_data: dict | None) -> dict | None:
-    """Return a copy of ``user_data`` stripped of credential material."""
-    if user_data is None:
-        return None
-    return {k: v for k, v in user_data.items() if k not in _SECRET_USER_FIELDS}
-

 class SessionManager:
-    """Manages user sessions via signed cookies (v5.2.0: revocable).
-
-    Each cookie embeds a ``sid`` referencing a row in ``user_sessions``.
-    Revoking that row instantly invalidates the cookie (checked in
-    ``decode_session``). Legacy cookies without a ``sid`` stay valid.
-    """
+    """Manages user sessions via signed cookies."""

    @staticmethod
-    def create_session(user_data: dict, request=None) -> str:
-        """Create a signed session cookie value.
-
-        ``request`` is optional — when provided the session is recorded in the
-        ``user_sessions`` table (ip + user agent) and becomes revocable.
-        """
+    def create_session(user_data: dict) -> str:
+        """Create a signed session cookie value."""
        payload = {
-            "user": public_user(user_data),
-            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
+            "user": user_data,
+            "created_at": datetime.utcnow().isoformat(),
        }
-        user_id = user_data.get("id")
-        if user_id:
-            sid = str(uuid4())
-            payload["sid"] = sid
-            _record_session(sid, user_id, request)
        return _serializer.dumps(payload)

    @staticmethod
@@ -58,65 +28,10 @@ class SessionManager:
        """Decode and validate a session cookie. Returns user data or None."""
        try:
            payload = _serializer.loads(cookie, max_age=86400 * 7)  # 7 days
+            return payload.get("user")
        except (BadSignature, SignatureExpired):
            return None

-        sid = payload.get("sid") or ""
-        if sid and not _session_active(sid):
-            # Revoked or deleted session → treat as logged out.
-            return None
-        if sid:
-            _touch_session(sid)
-        return payload.get("user")
-
-    @staticmethod
-    def session_id(cookie: str) -> str | None:
-        """Return the session id embedded in a cookie (or None)."""
-        try:
-            payload = _serializer.loads(cookie, max_age=86400 * 7)
-            return payload.get("sid")
-        except (BadSignature, SignatureExpired):
-            return None
-
-    @staticmethod
-    def list_sessions(user_id: int) -> list[dict]:
-        """All recorded sessions for a user (for the Settings UI)."""
-        from app.db import get_conn
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, ip_address, user_agent, created_at, last_seen_at, revoked "
-                "FROM user_sessions WHERE user_id=? ORDER BY last_seen_at DESC",
-                (user_id,),
-            ).fetchall()
-        return [dict(r) for r in rows]
-
-    @staticmethod
-    def revoke_session(sid: str) -> bool:
-        """Revoke a session row. Returns True if a row was updated."""
-        from app.db import get_conn
-        with get_conn() as conn:
-            cur = conn.execute(
-                "UPDATE user_sessions SET revoked=1 WHERE id=? AND revoked=0", (sid,)
-            )
-            conn.commit()
-            return cur.rowcount > 0
-
-    @staticmethod
-    def refresh_session(cookie: str, user_data: dict, request=None) -> str:
-        """Re-sign a cookie keeping its session id (used after profile edits)."""
-        sid = SessionManager.session_id(cookie) if cookie else None
-        payload = {
-            "user": public_user(user_data),
-            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
-        }
-        user_id = user_data.get("id")
-        if user_id:
-            if sid is None:
-                sid = str(uuid4())
-                _record_session(sid, user_id, request)
-            payload["sid"] = sid
-        return _serializer.dumps(payload)
-
    @staticmethod
    def store_token(user_id: int, gitea_token: str) -> None:
        """Store a user's Gitea OAuth token in SQLite."""
@@ -143,53 +58,10 @@ class SessionManager:
        return row["gitea_token"] if row else None


-def _record_session(sid: str, user_id: int, request) -> None:
-    ip = ""
-    ua = ""
-    if request is not None:
-        ip = request.client.host if getattr(request, "client", None) else ""
-        ua = (request.headers.get("user-agent", "") or "")[:500]
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            conn.execute(
-                "INSERT INTO user_sessions (id, user_id, ip_address, user_agent) VALUES (?, ?, ?, ?)",
-                (sid, user_id, ip, ua),
-            )
-            conn.commit()
-    except Exception as exc:  # table may not exist in very old installs
-        logger.debug("session record skipped: %s", exc)
-
-
-def _session_active(sid: str) -> bool:
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT revoked FROM user_sessions WHERE id=?", (sid,)
-            ).fetchone()
-        return bool(row and not row["revoked"])
-    except Exception:
-        # No table / DB unavailable → keep the cookie valid (fail-open-safe).
-        return True
-
-
-def _touch_session(sid: str) -> None:
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            conn.execute(
-                "UPDATE user_sessions SET last_seen_at=CURRENT_TIMESTAMP WHERE id=? AND revoked=0",
-                (sid,),
-            )
-            conn.commit()
-    except Exception:
-        logger.exception("_touch_session")
-
-
 # FastAPI dependency
-def get_current_user(request) -> dict | None:
+async def get_current_user(request) -> dict | None:
    """FastAPI dependency: extract current user from session cookie."""
+    from fastapi import Request
    session = request.cookies.get("flowdeck_session")
    if session:
        return SessionManager.decode_session(session)
@@ -1,22 +1,11 @@
 """FlowDeck — Configuration via pydantic-settings."""
 from __future__ import annotations

-import os
 from pathlib import Path
-
 from pydantic_settings import BaseSettings, SettingsConfigDict


 class Settings(BaseSettings):
-    @property
-    def data_dir(self) -> str:
-        """Racine des fichiers (avatars, uploads…).
-
-        Pas un champ : la lecture est faite à chaque accès parce que les tests
-        monkeypatchent `FLOWDECK_DATA_DIR` en cours de vie (A42 — les 9 copies
-        de `Path(os.environ.get("FLOWDECK_DATA_DIR", "/data"))` vont ici).
-        """
-        return os.environ.get("FLOWDECK_DATA_DIR", "/data")
    model_config = SettingsConfigDict(
        env_file=".env", env_file_encoding="utf-8", extra="ignore"
    )
@@ -32,9 +21,11 @@ class Settings(BaseSettings):
    github_oauth_client_id: str = ""
    github_oauth_client_secret: str = ""

-    # OAuth2 — empty = dynamic per-request redirect URI (Host + X-Forwarded-*),
-    # set this ONLY to pin an exact URI (must be registered in Gitea/GitHub)
-    oauth_redirect_uri: str = ""
+    # Standalone mode
+    standalone: bool = False  # FLOWDECK_STANDALONE=true in .env
+
+    # OAuth2
+    oauth_redirect_uri: str = "http://localhost:8080/auth/callback"

    # Webhook
    webhook_base_url: str = "http://localhost:8080"
@@ -50,10 +41,6 @@ class Settings(BaseSettings):
    rate_limit_enabled: bool = True
    rate_limit_requests: int = 60  # per minute

-    # Public API v2 (v6.3.0)
-    public_api_insecure_ok: bool = False  # if True, fd-public-key is accepted (dev only)
-    api_v2_rate_limit_per_token: int = 300  # req/min per token for /api/v2
-
    # Database
    database_url: str = "sqlite:////data/flowdeck.db"

@@ -61,92 +48,6 @@ class Settings(BaseSettings):
    sync_interval: int = 60
    gitea_cache_ttl: int = 30

-    # Backup (v5.2.0) — scheduled daily snapshot of the SQLite file
-    backup_enabled: bool = True
-    backup_dir: str = "/data/backups"
-    backup_interval_hours: int = 24
-    backup_keep: int = 30
-
-    # Forge projects sync (v5.2.0) — periodic refresh of `projects` table
-    project_sync_enabled: bool = True
-    project_sync_interval_hours: int = 1
-
-    # Reminders (v5.8.0) — background scan for due date reminders
-    reminders_enabled: bool = True
-    reminder_scan_interval_seconds: int = 60
-
-    # Webhooks outbound (v6.4.0) — retry of failed deliveries
-    webhook_retry_enabled: bool = True
-    webhook_retry_interval_seconds: int = 60
-
-    # Email / SMTP notifications (v4.9.0) — optional. If smtp_host is empty,
-    # email notifications are skipped (only in-app notifications are delivered).
-    smtp_host: str = ""
-    smtp_port: int = 587
-    smtp_user: str = ""
-    smtp_password: str = ""
-    smtp_from: str = "FlowDeck <[email protected]>"
-    smtp_use_tls: bool = True
-    app_base_url: str = "http://localhost:8080"
-
-    # SSO / SAML + OIDC (v6.7.0) — bootstrap fallback ONLY: as soon as an admin
-    # saves a configuration in Settings → Admin → SSO / Enterprise, the
-    # `sso_config` table wins (see app/services/sso_provisioning.py).
-    sso_provider: str = ""               # 'saml' | 'oidc' | '' (disabled)
-    sso_name: str = "Company SSO"         # button label on the login page
-    sso_entity_id: str = ""               # SAML: IdP entity id
-    sso_sso_url: str = ""                 # SAML: IdP SSO URL (HTTP-Redirect)
-    sso_slo_url: str = ""                 # SAML: IdP Single Logout URL
-    sso_x509_certificate: str = ""        # SAML: IdP signing certificate (PEM)
-    sso_issuer_url: str = ""              # OIDC: issuer identifier
-    sso_client_id: str = ""               # OIDC: client id
-    sso_client_secret: str = ""           # OIDC: client secret (env only)
-    sso_scope: str = "openid profile email"
-    sso_attribute_mapping: str = ""       # JSON, defaults per provider
-    sso_groups_mapping: str = "[]"        # JSON [{sso_group, workspace_role, workspace_id}]
-    sso_auto_provision: bool = True
-    sso_only: bool = False                # refuse local login when true
-    sso_sign_requests: bool = False       # sign AuthnRequest / LogoutRequest
-    sso_default_workspace_id: int = 0
-
-    # FlowDeck Agent (v4.10.0) — multi-LLM. Empty keys → offline/mock mode
-    # (deterministic rule-based planner so the agent works without any API key).
-    agent_enabled: bool = True
-    llm_provider: str = "offline"      # any id from llm_client.PROVIDERS
-                                       # (openai, anthropic, mistral, cohere,
-                                       #  google, groq, deepseek, openrouter,
-                                       #  nvidia, together, perplexity, xai,
-                                       #  qwencloud, minimax, morph, fireworks,
-                                       #  cerebras, sambanova, chutes, xiaomi,
-                                       #  sealion, sensenova, ollama, offline)
-    llm_model: str = "gpt-4o"
-    llm_api_key: str = ""
-    llm_api_base: str = ""             # custom base URL (Ollama, OpenRouter, ...)
-    agent_max_iterations: int = 12
-    agent_max_tokens_budget: int = 500000
-    agent_run_timeout_seconds: int = 300
-
-    # ── Connecteurs OAuth (v7.56.0) — Google / Microsoft 365 ──
-    # Client OAuth2 à créer dans les consoles : Google Cloud (OAuth client web)
-    # et Entra ID (application web). Le redirect URI est dérivé d'APP_BASE_URL.
-    google_client_id: str = ""
-    google_client_secret: str = ""
-    ms_client_id: str = ""
-    ms_client_secret: str = ""
-
-    # ── Mémoire de l'agent (v7.54.0) ──
-    # État initial du toggle « Mémoire » à la création d'une conversation ;
-    # le basculement se fait ensuite par PATCH /api/agent/conversations/{id}.
-    agent_memory_default: bool = True
-
-    # ── Web tools de l'agent (web_search / fetch_url / search_code) ──
-    # `web_search_provider` : « exa » (recherche sémantique + snippets, clé
-    # requise) ou « duckduckgo » (repli sans compte, parsing HTML — dégradé).
-    web_search_provider: str = "exa"
-    exa_api_key: str = ""
-    github_token: str = ""             # PAT GitHub : 30 req/min au lieu de 10
-    web_fetch_max_chars: int = 20000   # texte renvoyé par fetch_url
-
    @property
    def db_path(self) -> Path:
        if self.database_url == "sqlite:///:memory:":
@@ -157,9 +58,7 @@ class Settings(BaseSettings):
            import re
            if re.match(r'^[a-zA-Z]:', p):
                return Path(p)
-            # A26 : `sqlite:////data/flowdeck.db` donne p='/data/…' — un simple
-            # concat '/'+'/' → '//data/…' = chemin UNC sous Windows. On normalise.
-            return Path("/" + p.lstrip("/"))
+            return Path("/" + p)
        return Path("/data/flowdeck.db")


@@ -192,7 +192,7 @@ def init_db():
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
                title TEXT NOT NULL DEFAULT '',
-                icon TEXT DEFAULT 'file',
+                icon TEXT DEFAULT '📄',
                position INTEGER NOT NULL DEFAULT 0,
                parent_id INTEGER REFERENCES collection_pages(id),
                gitea_issue_id INTEGER,
@@ -348,16 +348,6 @@ def init_db():
            conn.execute("ALTER TABLE pages ADD COLUMN deleted_at TEXT")
        except sqlite3.OperationalError:
            pass
-        # v7.45.5 : réparation des pages restaurées marquées 'Trash' — l'ancien
-        # soft-delete (éditeur) réécrivait parent_section='Trash' et la
-        # restauration ne le remettait pas → page invisible en Library/Recents/
-        # Private. Idempotent (WHERE restrictif), rejoué à chaque boot.
-        # ponytail: un dossier restauré repasse en 'Private' (l'état d'origine
-        # n'est pas stocké) → icône/dossier à remettre à 'Workspace' si besoin.
-        conn.execute(
-            "UPDATE pages SET parent_section='Private' "
-            "WHERE parent_section='Trash' AND deleted_at IS NULL"
-        )
        try:
            conn.execute("ALTER TABLE pages ADD COLUMN share_mode TEXT DEFAULT 'private'")
        except sqlite3.OperationalError:
@@ -452,18 +442,12 @@ def init_db():
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                page_id INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
                shared_with_user_id INTEGER REFERENCES users(id),
-                shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE,
                shared_with_email TEXT DEFAULT '',
                permission TEXT NOT NULL DEFAULT 'view',
                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                created_by INTEGER REFERENCES users(id)
            )
        """)
-        # v5.x: migration — partage par groupes (colonne manquante sur DB existantes)
-        try:
-            conn.execute("ALTER TABLE page_shares ADD COLUMN shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE")
-        except sqlite3.OperationalError:
-            pass
        # 4) recents table
        conn.execute("""
            CREATE TABLE IF NOT EXISTS recents (
@@ -478,366 +462,6 @@ def init_db():
        """)
        conn.commit()

-        # v4.1.0: Data Sources & Linked Databases
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS collection_data_sources (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                source_collection_id INTEGER NOT NULL REFERENCES collections(id),
-                source_name TEXT DEFAULT '',
-                is_linked BOOLEAN NOT NULL DEFAULT 0,
-                position INTEGER NOT NULL DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(collection_id, source_collection_id)
-            )
-        """)
-        # Add workspace_id to collections if missing (v4.1.0 migration)
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN workspace_id INTEGER REFERENCES workspaces(id)")
-        except sqlite3.OperationalError:
-            pass
-        # Add created_by to collections if missing
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN created_by INTEGER REFERENCES users(id)")
-        except sqlite3.OperationalError:
-            pass
-        conn.commit()
-
-        # v4.6.0: Add collection_id to pages (page ↔ collection link for full-page DBs)
-        try:
-            conn.execute("ALTER TABLE pages ADD COLUMN collection_id INTEGER REFERENCES collections(id)")
-        except sqlite3.OperationalError:
-            pass
-
-        # v4.2.0: Collection Templates (enhanced) + Dashboards
-        # Add description, is_recurring, recurrence_rule to page_templates
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN description TEXT DEFAULT ''")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN is_recurring BOOLEAN NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-        try:
-            conn.execute("ALTER TABLE page_templates ADD COLUMN recurrence_rule TEXT DEFAULT ''")
-        except sqlite3.OperationalError:
-            pass
-
-        # Dashboard: combinaison de vues/widgets sur une page
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS collection_dashboards (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                name TEXT NOT NULL DEFAULT 'Dashboard',
-                layout_json TEXT NOT NULL DEFAULT '{"columns":1,"widgets":[]}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.commit()
-
-        # v4.4.0: Tasks & Dependencies
-        # Add is_task flag to collections
-        try:
-            conn.execute("ALTER TABLE collections ADD COLUMN is_task BOOLEAN NOT NULL DEFAULT 0")
-        except sqlite3.OperationalError:
-            pass
-
-        # Dependencies table: bloque/bloqué par with auto-shift config
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS page_dependencies (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                dependency_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                dependency_type TEXT NOT NULL DEFAULT 'blocks',
-                auto_shift TEXT DEFAULT 'overlap',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(page_id, dependency_id, dependency_type)
-            )
-        """)
-        conn.commit()
-
-        # v4.5.0: Sprints
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS sprints (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
-                name TEXT NOT NULL,
-                start_date TEXT NOT NULL,
-                end_date TEXT NOT NULL,
-                goal TEXT DEFAULT '',
-                status TEXT NOT NULL DEFAULT 'planning',
-                auto_complete BOOLEAN NOT NULL DEFAULT 1,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS sprint_pages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                sprint_id INTEGER NOT NULL REFERENCES sprints(id) ON DELETE CASCADE,
-                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
-                status_at_start TEXT DEFAULT '',
-                velocity_points INTEGER DEFAULT 1,
-                UNIQUE(sprint_id, page_id)
-            )
-        """)
-        conn.commit()
-
-        # v4.6.0: Sidebar customization config per user
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN sidebar_config TEXT DEFAULT '{}'")
-        except sqlite3.OperationalError:
-            pass
-        conn.commit()
-
-        # ═══════════ v4.9.0: Collaboration — notifications, inline comments, prefs ═══════════
-        # Notifications table (mentions, comments, page changes)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS notifications (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-                actor_id INTEGER REFERENCES users(id),
-                ntype TEXT NOT NULL DEFAULT 'mention',   -- 'mention' | 'comment' | 'page'
-                title TEXT NOT NULL DEFAULT '',
-                message TEXT NOT NULL DEFAULT '',
-                resource_type TEXT NOT NULL DEFAULT 'page',
-                resource_id INTEGER NOT NULL DEFAULT 0,
-                url TEXT NOT NULL DEFAULT '',
-                is_read INTEGER NOT NULL DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute(
-            "CREATE INDEX IF NOT EXISTS idx_notif_user_read ON notifications(user_id, is_read)"
-        )
-
-        # Notification email preferences (JSON: {"comments": true, "mentions": true})
-        try:
-            conn.execute("ALTER TABLE users ADD COLUMN notification_prefs TEXT DEFAULT '{}'")
-        except sqlite3.OperationalError:
-            pass
-
-        # Inline comments on pages: the v2.0.0 `comments` table had a NOT NULL FK to
-        # collection_pages, which prevents using page-editor (pages) ids. Rebuild it so
-        # it can hold page comments with optional inline anchors, while preserving data.
-        # target_type='collection_page' (legacy) or 'page' (editor); target_id = resource id.
-        # anchor_block_id = block id; anchor_start/anchor_end = text selection offsets.
-        _cols = [r[1] for r in conn.execute("PRAGMA table_info(comments)").fetchall()]
-        if "target_type" not in _cols:
-            try:
-                conn.execute("""
-                    CREATE TABLE comments_new (
-                        id INTEGER PRIMARY KEY AUTOINCREMENT,
-                        page_id INTEGER,
-                        user_id INTEGER NOT NULL REFERENCES users(id),
-                        body TEXT NOT NULL DEFAULT '',
-                        parent_id INTEGER,
-                        resolved BOOLEAN NOT NULL DEFAULT 0,
-                        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                        target_type TEXT NOT NULL DEFAULT 'page',
-                        target_id INTEGER NOT NULL DEFAULT 0,
-                        anchor_block_id TEXT,
-                        anchor_start INTEGER,
-                        anchor_end INTEGER
-                    )
-                """)
-                conn.execute(
-                    """INSERT INTO comments_new
-                       (id, page_id, user_id, body, parent_id, resolved, created_at, updated_at, target_type, target_id)
-                       SELECT id, page_id, user_id, body, parent_id, resolved, created_at, updated_at,
-                              'collection_page', COALESCE(page_id, 0)
-                       FROM comments"""
-                )
-                conn.execute("DROP TABLE comments")
-                conn.execute("ALTER TABLE comments_new RENAME TO comments")
-            except sqlite3.OperationalError:
-                pass
-        conn.commit()
-
-        # ═══════════ v4.10.0: FlowDeck Agent — agents, conversations, audit ═══════════
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agents (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                workspace_id INTEGER REFERENCES workspaces(id),
-                name TEXT NOT NULL DEFAULT 'FlowDeck Agent',
-                icon TEXT DEFAULT '🤖',
-                agent_type TEXT NOT NULL DEFAULT 'personal',
-                description TEXT DEFAULT '',
-                system_instructions TEXT DEFAULT '',
-                model TEXT DEFAULT 'gpt-4o',
-                scope_json TEXT NOT NULL DEFAULT '{}',
-                trigger_json TEXT NOT NULL DEFAULT '{}',
-                approval_mode TEXT NOT NULL DEFAULT 'auto',
-                is_active BOOLEAN NOT NULL DEFAULT 1,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                created_by INTEGER REFERENCES users(id),
-                UNIQUE(workspace_id, name)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_conversations (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
-                user_id INTEGER NOT NULL REFERENCES users(id),
-                title TEXT DEFAULT 'New conversation',
-                status TEXT NOT NULL DEFAULT 'idle',
-                context_json TEXT NOT NULL DEFAULT '{}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_messages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
-                role TEXT NOT NULL,
-                content TEXT NOT NULL DEFAULT '',
-                tool_calls_json TEXT DEFAULT '[]',
-                model TEXT,
-                tokens_used INTEGER DEFAULT 0,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_actions (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
-                tool_name TEXT NOT NULL,
-                target_type TEXT,
-                target_id TEXT,
-                payload_json TEXT NOT NULL DEFAULT '{}',
-                result_json TEXT NOT NULL DEFAULT '{}',
-                status TEXT NOT NULL DEFAULT 'success',
-                undo_snapshot_json TEXT DEFAULT '{}',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                executed_by INTEGER REFERENCES users(id)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_skills (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                workspace_id INTEGER REFERENCES workspaces(id),
-                name TEXT NOT NULL,
-                description TEXT DEFAULT '',
-                prompt_template TEXT NOT NULL,
-                allowed_tools_json TEXT NOT NULL DEFAULT '[]',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                created_by INTEGER REFERENCES users(id),
-                UNIQUE(workspace_id, name)
-            )
-        """)
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_triggers (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
-                trigger_type TEXT NOT NULL DEFAULT 'manual',
-                config_json TEXT NOT NULL DEFAULT '{}',
-                is_active BOOLEAN NOT NULL DEFAULT 1,
-                last_fired_at TIMESTAMP,
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        # ─── v4.15.0: feedback des réponses de l'agent (👍 / 👎) ───────────────
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS agent_feedback (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                conversation_id INTEGER REFERENCES agent_conversations(id) ON DELETE SET NULL,
-                message_id INTEGER REFERENCES agent_messages(id) ON DELETE SET NULL,
-                user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
-                rating TEXT NOT NULL CHECK (rating IN ('up', 'down')),
-                snippet TEXT DEFAULT '',
-                comment TEXT DEFAULT '',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_conv ON agent_feedback(conversation_id)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_user ON agent_feedback(user_id)")
-
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_user ON agent_conversations(user_id, updated_at)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_msg_conv ON agent_messages(conversation_id, created_at)")
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_action_conv ON agent_actions(conversation_id)")
-
-        # ─── v4.10.1: LLM runtime config (single row id=1) ─────────────────────
-        # Created lazily (no seed) so .env stays the default until an admin saves
-        # the LLM settings from the UI. Precedence: DB row > settings.llm_*.
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS llm_config (
-                id INTEGER PRIMARY KEY CHECK (id = 1),
-                provider TEXT NOT NULL DEFAULT 'offline',
-                model TEXT DEFAULT '',
-                api_key TEXT DEFAULT '',
-                api_base TEXT DEFAULT '',
-                verified INTEGER NOT NULL DEFAULT 0,
-                verified_model TEXT DEFAULT '',
-                verified_at TIMESTAMP,
-                last_error TEXT DEFAULT '',
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-            )
-        """)
-        # ─── v4.10.2: per-user provider API keys ──────────────────────────────
-        # Each user can save several providers with their own key/base + the
-        # live model list fetched from the provider (models_json cache).
-        conn.execute("""
-            CREATE TABLE IF NOT EXISTS user_llm_keys (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-                provider TEXT NOT NULL,
-                api_key TEXT NOT NULL DEFAULT '',
-                api_base TEXT NOT NULL DEFAULT '',
-                default_model TEXT DEFAULT '',
-                models_json TEXT NOT NULL DEFAULT '[]',
-                verified INTEGER NOT NULL DEFAULT 0,
-                verified_model TEXT DEFAULT '',
-                verified_at TIMESTAMP,
-                last_error TEXT DEFAULT '',
-                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(user_id, provider)
-            )
-        """)
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_user_llm_keys_user ON user_llm_keys(user_id)")
-        # v4.12: provider activation/verification — a provider is only offered in
-        # the Agent UI once it is configured AND its connection test succeeded.
-        for col, ddl in (
-            ("verified", "INTEGER NOT NULL DEFAULT 0"),
-            ("verified_model", "TEXT DEFAULT ''"),
-            ("verified_at", "TIMESTAMP"),
-            ("last_error", "TEXT DEFAULT ''"),
-        ):
-            try:
-                conn.execute(f"ALTER TABLE user_llm_keys ADD COLUMN {col} {ddl}")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        for col, ddl in (
-            ("verified", "INTEGER NOT NULL DEFAULT 0"),
-            ("verified_model", "TEXT DEFAULT ''"),
-            ("verified_at", "TIMESTAMP"),
-            ("last_error", "TEXT DEFAULT ''"),
-        ):
-            try:
-                conn.execute(f"ALTER TABLE llm_config ADD COLUMN {col} {ddl}")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        # Migration: per-conversation provider/model override columns
-        for col in ("provider", "model"):
-            try:
-                conn.execute(f"ALTER TABLE agent_conversations ADD COLUMN {col} TEXT DEFAULT ''")
-            except sqlite3.OperationalError:
-                pass  # column already exists
-        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_llm ON agent_conversations(provider, model)")
-        conn.commit()
-
-        # ── v5.2.0: apply any pending VERSIONED migrations (schema_version) ──
-        from app.migrations import apply_migrations
-        apply_migrations(conn)
-
-    # Webhook subscriptions (v2.1.0) — created here (idempotent) so the full
-    # schema exists without depending on the FastAPI lifespan startup.
-    from app.services.webhook_outbound import init_webhook_tables
-    init_webhook_tables()
-

@contextmanager
 def get_conn():
@@ -847,11 +471,6 @@ def get_conn():
    conn.row_factory = sqlite3.Row
    conn.execute("PRAGMA journal_mode=WAL")
    conn.execute("PRAGMA foreign_keys=ON")
-    # A21 (partiel) : un seul writer par DB — sans timeout la requête concurrente
-    # échoue immédiatement avec « database is locked » (tests xdist, schedulers).
-    # ponytail: le reste d'A21 (wrapper async + 510 call sites synchrones sur
-    # l'event loop) reste à migrer module par module.
-    conn.execute("PRAGMA busy_timeout=5000")
    try:
        yield conn
    finally:
@@ -1,67 +1,22 @@
 """FlowDeck — Kanban léger intégré à Gitea."""
 from __future__ import annotations

-import asyncio
 import logging
 from contextlib import asynccontextmanager

 from fastapi import FastAPI, Request
-from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
-from starlette.exceptions import HTTPException as _StarHTTPException
+from fastapi.middleware.cors import CORSMiddleware
 from starlette.middleware.sessions import SessionMiddleware

 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
 from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
-from app.routers import (
-    admin,
-    agent,
-    api,
-    auth,
-    board,
-    collections,
-    dashboard,
-    export,
-    library,
-    my_tasks,
-    notes,
-    onboarding,
-    projects,
-    public_api,
-    search,
-    security,
-    sharing,
-    sidebar_config,
-    sync,
-    webhooks,
-    workspace,
-)
-from app.routers.api_v2 import router as api_v2_router
-from app.routers.api_v2_agent import router as api_v2_agent_router
-from app.routers.audit import router as audit_router
-from app.routers.automations import router as automations_router
-from app.routers.collaboration import router as collaboration_router
-from app.routers.emoji import router as emoji_router
+from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace, library, public_api, admin, sharing
 from app.routers.gitea import router as gitea_router
 from app.routers.github_routes import router as github_router
-from app.routers.governance import router as governance_router
-from app.routers.imports import page_router as import_page_router
-from app.routers.imports import router as imports_router
-from app.routers.meetings import router as meetings_router
-from app.routers.notifications import router as notifications_router
-from app.routers.permissions import router as permissions_router
-from app.routers.realtime import router as realtime_router
-from app.routers.scim import router as scim_router
-from app.routers.search_ai import router as search_ai_router
-from app.routers.sites import router as sites_router
-from app.routers.sso import router as sso_router
-from app.routers.web_clipper import api_router as web_clipper_api_router
-from app.routers.web_clipper import router as web_clipper_router
-from app.routers.webauthn import router as webauthn_router
-from app.routers.wiki import router as wiki_router
-from app.routers.workers import router as workers_router
+from app.services.gitea_client import gitea
 from app.services.webhook_outbound import init_webhook_tables

 logging.basicConfig(
@@ -71,123 +26,28 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)


-def _spawn(name: str, factory):
-    """A34 : une tâche scheduler meurt en silence (aucun done_callback).
-
-    Loggue l'exception puis recrée la coroutine 10 s plus tard.
-    ponytail: pas de backoff exponentiel — un scheduler qui replante à chaque
-    tick reste visible (1 cycle / 10 s) dans les logs ; ajouter un backoff si
-    le bruit devient un problème.
-    """
-
-    async def _guard():
-        while True:
-            try:
-                await factory()
-            except asyncio.CancelledError:
-                raise
-            except Exception:
-                logger.exception("scheduler %s plante - redemarrage dans 10 s", name)
-                await asyncio.sleep(10)
-            else:
-                logger.warning("scheduler %s termine - redemarrage dans 10 s", name)
-                await asyncio.sleep(10)
-
-    return asyncio.create_task(_guard())
-
-
@asynccontextmanager
 async def lifespan(_app: FastAPI):
    init_db()
    init_webhook_tables()
-    import os
-    import secrets
-
    from app.db import get_conn
    from app.password_utils import hash_password
-
-    # A26 : secret de session par défaut refusé (il signe `flowdeck_session`).
-    if settings.app_secret_key == "change-me-to-random":
-        raise RuntimeError(
-            "APP_SECRET_KEY non défini — générer une valeur : "
-            'python -c "import secrets;print(secrets.token_hex(32))" puis la mettre dans .env'
-        )
-
-    # A8 : plus de mot de passe admin codé en dur — mot de passe aléatoire au
-    # premier boot (affiché une fois) ou FLOWDECK_ADMIN_PASSWORD ; re-seed si absent.
+    admin_hash = hash_password("FlowDeck2026!")
    with get_conn() as conn:
-        if not conn.execute("SELECT 1 FROM users WHERE login='admin'").fetchone():
-            admin_pw = os.environ.get("FLOWDECK_ADMIN_PASSWORD") or secrets.token_urlsafe(12)
-            conn.execute(
-                "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES ('admin', 'Admin', '', ?, 1)",
-                (hash_password(admin_pw),),
-            )
-            conn.commit()
-            logger.warning(
-                "Premier démarrage : compte admin créé, mot de passe = %s "
-                "(définir FLOWDECK_ADMIN_PASSWORD pour le fixer)",
-                admin_pw,
-            )
-
-    # ── FlowDeck Agent (v4.10.0): scheduled custom-agent triggers ──
-    from app.routers.agent import agent_scheduler
-    scheduler_task = _spawn("agent_scheduler", agent_scheduler)
-
-    # ── Automations (v5.1.0): cron trigger scheduler ──
-    from app.services.automations import automation_scheduler
-    automation_task = _spawn("automation_scheduler", automation_scheduler)
-
-    # ── Backups (v5.2.0): automatic daily SQLite snapshot ──
-    from app.services.backup import backup_scheduler
-    backup_task = _spawn("backup_scheduler", backup_scheduler)
-
-    # ── Forge projects sync (v5.2.0): hourly refresh of `projects` ──
-    from app.services.projects import project_sync_scheduler
-    projects_task = _spawn("project_sync_scheduler", project_sync_scheduler)
-
-    # ── Global trash purge (v5.4.0): daily cleanup of 30-day-old pages ──
-    from app.services.trash import trash_purge_scheduler
-    trash_task = _spawn("trash_purge_scheduler", trash_purge_scheduler)
-
-    # ── Reminders (v5.8.0): due-reminder scan for database rows ──
-    from app.services.reminders import reminder_scheduler
-    reminder_task = _spawn("reminder_scheduler", reminder_scheduler)
-
-    # ── Semantic search (v6.9.0): incremental vector indexing ──
-    from app.services.semantic_search import semantic_index_scheduler
-    semantic_task = _spawn("semantic_index_scheduler", semantic_index_scheduler)
-
-    # ── Calendar sync (v7.1.0): external calendars every 15 min ──
-    from app.services.calendar_sync import calendar_sync_scheduler
-    calendar_task = _spawn("calendar_sync_scheduler", calendar_sync_scheduler)
-
-    # ── Webhooks outbound (v6.4.0): retry failed deliveries ──
-    from app.services.webhook_outbound import webhook_retry_scheduler
-    webhook_task = None
-    if settings.webhook_retry_enabled:
-        webhook_task = _spawn("webhook_retry_scheduler", webhook_retry_scheduler)
-
-    logger.info("FlowDeck v%s started on port %d", dashboard._get_app_version(), settings.app_port)
-    try:
-        yield
-    finally:
-        _tasks = (scheduler_task, automation_task, backup_task, projects_task, trash_task, reminder_task, semantic_task, calendar_task)
-        if webhook_task is not None:
-            _tasks = _tasks + (webhook_task,)
-        for task in _tasks:
-            task.cancel()
-        for task in _tasks:
-            try:
-                await task
-            except asyncio.CancelledError:
-                pass
+        conn.execute(
+            "INSERT OR IGNORE INTO users (login, full_name, email, password_hash, is_admin) VALUES ('admin', 'Admin', '', ?, 1)",
+            (admin_hash,)
+        )
+        conn.commit()
+    logger.info("FlowDeck v4.0.0 started on port %d", settings.app_port)
+    yield


 app = FastAPI(
    title="FlowDeck",
-    version="7.56.0",
-    docs_url="/docs",
-    redoc_url="/redoc",
+    version="4.0.0",
+    docs_url="/docs" if settings.log_level == "DEBUG" else None,
+    redoc_url=None,
    lifespan=lifespan,
 )

@@ -195,111 +55,45 @@ app.add_middleware(SessionMiddleware, secret_key=settings.app_secret_key, max_ag
 app.add_middleware(CSRFMiddleware)
 app.add_middleware(ContentSecurityPolicyMiddleware)
 app.add_middleware(RateLimitMiddleware)
-# A37 : origines explicites (l'auth est un cookie de session ; le front est
-# servi par le même hôte). `*` + credentials est la combinaison interdite par la
-# spec CORS — ici ni les deux ni l'un : liste fermée, méthodes/entêtes minutées.
-_CORS_ORIGINS = sorted(
-    {o.rstrip("/") for o in (settings.app_base_url or "").split() if o.startswith(("http://", "https://"))}
-)
-# Hors prod : dev local + origines d'extension (Web Clipper, Bearer uniquement —
-# pas de cookie → `allow_credentials` ne s'applique pas à ces origines).
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=_CORS_ORIGINS,
-    allow_origin_regex=r"https?://(localhost|127\.0\.0\.1)(:\d+)?|\w+-extension://.*",
-    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
-    allow_headers=["Authorization", "Content-Type", "X-CSRF-Token", "Idempotency-Key"],
-    allow_credentials=True,
-)
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])

 app.include_router(auth.router)
-app.include_router(sso_router)
 app.include_router(dashboard.router)
 app.include_router(board.router)
 app.include_router(notes.router)
-app.include_router(projects.router)
-app.include_router(projects.backups_router)
 app.include_router(api.router)
 app.include_router(webhooks.router)
 app.include_router(collections.router)
 app.include_router(my_tasks.router)
 app.include_router(workspace.router)
-# Partage public :-exempt de la dépendance d'authentification du router.
-app.include_router(workspace.public_router)
 app.include_router(library.router)
 app.include_router(admin.router)
 app.include_router(gitea_router)
 app.include_router(github_router)
 app.include_router(public_api.router)
 app.include_router(sharing.router)
-app.include_router(sidebar_config.router)
-app.include_router(export.router)
-app.include_router(notifications_router)
-app.include_router(automations_router)
-app.include_router(collaboration_router)
-app.include_router(emoji_router)
-app.include_router(realtime_router)
-app.include_router(agent.router)
-app.include_router(search.router)
-app.include_router(security.router)
-app.include_router(onboarding.router)
-app.include_router(sync.router)
-app.include_router(imports_router)
-app.include_router(import_page_router)
-app.include_router(permissions_router)
-app.include_router(web_clipper_api_router)
-app.include_router(web_clipper_router)
-app.include_router(api_v2_router)
-app.include_router(api_v2_agent_router)
-app.include_router(sites_router)
-app.include_router(search_ai_router)
-app.include_router(workers_router)
-app.include_router(meetings_router)
-# v7.2.0 — enterprise admin
-app.include_router(scim_router)
-app.include_router(webauthn_router)
-app.include_router(audit_router)
-app.include_router(governance_router)
-# v7.3.0 — teamspaces + verified wiki
-app.include_router(wiki_router)

 app.mount("/static", StaticFiles(directory="static"), name="static")


@app.get("/manifest.json")
-def pwa_manifest():
-    """Serve the static web manifest from disk (same URL as before v6.0.0)."""
-    from fastapi.responses import FileResponse
-    return FileResponse("static/manifest.json", media_type="application/manifest+json")
-
-
-@app.get("/sw.js")
-def service_worker():
-    """Serve the PWA service worker at top-level scope (/)."""
-    from fastapi.responses import FileResponse
-    return FileResponse("static/sw.js", media_type="application/javascript")
+async def pwa_manifest():
+    return {
+        "name": "FlowDeck",
+        "short_name": "FlowDeck",
+        "start_url": "/",
+        "display": "standalone",
+        "background_color": "#191919",
+        "theme_color": "#191919",
+        "icons": [{"src": "/static/icon-192.png", "sizes": "192x192", "type": "image/png"}],
+    }


 # ═══════════ API aliases (v4.0.1) ═══════════


-@app.get("/api/csrf-token")
-def csrf_token_endpoint(request: Request):
-    """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
-    import secrets
-
-    from fastapi.responses import JSONResponse
-    token = secrets.token_hex(32)
-    response = JSONResponse({"csrf_token": token})
-    response.set_cookie(
-        "csrf_token", token,
-        httponly=False, samesite="lax", max_age=86400, path="/",
-    )
-    return response
-
-
@app.get("/api/pages")
-def api_pages_alias(request: Request):
+async def api_pages_alias(request: Request):
    """Alias /api/pages → /board/api/pages for API path consistency."""
    from fastapi.responses import RedirectResponse
    qs = str(request.url.query)
@@ -308,7 +102,7 @@ def api_pages_alias(request: Request):


@app.post("/api/pages")
-def api_pages_post_alias(request: Request):
+async def api_pages_post_alias(request: Request):
    """Alias POST /api/pages → /board/api/pages for API path consistency."""
    from fastapi.responses import RedirectResponse
    return RedirectResponse(url="/board/api/pages", status_code=307)
@@ -342,41 +136,12 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 </html>"""


-@app.exception_handler(_StarHTTPException)
-def http_exception_handler(request: Request, exc: _StarHTTPException):
-    """Unified handler: RFC7807 for /api/v2, JSON for other /api, redirect for HTML.
-
-    Registered on Starlette's HTTPException (the base class) so it catches both
-    raised exceptions and route-miss 404s.
-    """
-    status = getattr(exc, "status_code", 500)
-    detail = getattr(exc, "detail", str(exc))
-    is_api_v2 = request.url.path.startswith("/api/v2")
-    # Programmatic API prefixes that must always answer JSON errors instead of
-    # being redirected to the HTML shell (SCIM 2.0 clients, WebAuthn fetch).
-    JSON_ERROR_PREFIXES = ("/api/v2", "/scim/v2", "/auth/webauthn")
-    is_json_api = request.url.path.startswith(JSON_ERROR_PREFIXES)
-    if status == 404:
-        if is_api_v2:
-            from app.services.api_v2_helpers import problem_response
-            return problem_response(request, exc)
-        if is_json_api and request.url.path.startswith("/scim/v2"):
-            from fastapi.responses import JSONResponse
-            return JSONResponse(
-                {"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
-                 "detail": detail if isinstance(detail, str) else "Not found",
-                 "status": "404"},
-                status_code=404,
-                headers={"Content-Type": "application/scim+json"},
-            )
-        if "/api" in request.url.path or is_json_api:
-            from fastapi.responses import JSONResponse
-            return JSONResponse({"detail": detail if isinstance(detail, str) else "Not found"}, status_code=404)
-        from fastapi.responses import RedirectResponse
-        return RedirectResponse("/workspaces", status_code=302)
-    # Non-404: RFC7807 for /api/v2
-    if is_api_v2:
-        from app.services.api_v2_helpers import problem_response
-        return problem_response(request, exc)
-    from fastapi.responses import JSONResponse
-    return JSONResponse({"detail": detail if isinstance(detail, str) else str(detail)}, status_code=status)
+@app.exception_handler(404)
+async def not_found_handler(request: Request, exc):
+    """Styled 404 page matching the FlowDeck dark theme."""
+    from fastapi.responses import HTMLResponse
+    # API routes should get JSON, not HTML
+    if request.url.path.startswith("/api/") or request.url.path.startswith("/board/api/"):
+        from fastapi.responses import JSONResponse
+        return JSONResponse({"detail": "Not found"}, status_code=404)
+    return HTMLResponse(NOT_FOUND_HTML, status_code=404)
@@ -1,4 +1,2 @@
 """FlowDeck — Custom middleware."""
 from app.middleware.csrf import CSRFMiddleware
-
-__all__ = ["CSRFMiddleware"]
@@ -4,10 +4,8 @@ from __future__ import annotations
 import secrets

 from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.requests import Request
 from starlette.responses import JSONResponse
-
-from app.templating import CSRF_TOKEN
+from starlette.requests import Request


 class CSRFMiddleware(BaseHTTPMiddleware):
@@ -18,28 +16,9 @@ class CSRFMiddleware(BaseHTTPMiddleware):
    """

    SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    # NOTE: ``/scim/v2`` is Bearer-token only (no cookie auth), so CSRF does not
-    # apply — IdP SCIM clients (Okta, Entra) cannot send an X-CSRF-Token.
-    # A19 — LISTE FINALE : plus aucun préfixe cookie-auth n'est exempté.
-    # Tous les appels non-GET du front envoient désormais `X-CSRF-Token`
-    # (46 sites équipés en v7.3.6 : agent_panel, settings, local_workspace,
-    # library, gitea_workspace, workspace, workspaces, welcome).
-    # Ne restent que du machine-to-machine / hors session :
-    #   - Bearer      : /api/webhook, /api/v1, /api/v2, /scim/v2
-    #   - callbacks    : /auth/* (login, register, SSO, 2FA, WebAuthn)
-    #   - publics      : /s/ (sites), /f/ (forms)
-    #   - infra/diag   : /api/csrf-token (le jeton lui-même), /api/frontend-error
-    EXCLUDED_PATHS = {
-        "/api/webhook", "/api/v1", "/api/v2", "/scim/v2",
-        "/auth/callback", "/auth/register", "/auth/local-login", "/auth/local-verify",
-        "/auth/2fa", "/auth/saml", "/auth/oidc", "/auth/webauthn",
-        "/s/", "/f/", "/api/csrf-token", "/api/frontend-error",
-    }
+    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea", "/api/github", "/api/pages", "/api/recents"}

    async def dispatch(self, request: Request, call_next):
-        # A43 : jeton expose aux templates (base.html hx-headers) — posé AVANT
-        # call_next, comme le nonce CSP (meme mecanisme ContextVar).
-        CSRF_TOKEN.set(request.cookies.get("csrf_token", ""))
        # Webhook receiver, OAuth callback, and internal API are exempt
        if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS):
            return await call_next(request)
@@ -1,9 +1,6 @@
 """FlowDeck — Security middleware: CSP headers + rate limiting."""
 from __future__ import annotations

-import ipaddress
-import re
-import secrets
 import time
 from collections import defaultdict

@@ -11,8 +8,6 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
 from starlette.responses import JSONResponse

-from app.templating import CSP_NONCE
-
 # ── Constants ────────────────────────────────────────────────

 # Allowed extensions for file uploads
@@ -67,32 +62,13 @@ class ContentSecurityPolicyMiddleware(BaseHTTPMiddleware):
    """

    CSP_HEADER = "Content-Security-Policy"
-    # A20 : `unsafe-inline` sort de script-src (remplacé par un nonce par
-    # requête — un XSS injecté dans une page ne tourne plus). Les 74 handlers
-    # inline `onclick=` restent couverts par `script-src-attr`, explicitement
-    # détaché de script-src (sinon le nonce les désactiverait aussi).
-    # A20 TERMINÉ : `unsafe-eval` retiré — Alpine tourne en build CSP
-    # (static/js/alpine.csp.min.js, 0 eval) ; htmx allowEval=false.
-    # 15 surfaces en csp_preview vert + scan statique 0 (board/gitea/cards
-    # = props propres, gitea down empêche un gate dédié).
    CSP_VALUE = (
        "default-src 'self'; "
-        # A20 phase 2 : chart.js/leaflet vendorisés dans /static/js/vendor
-        # (test_csp_no_cdn_and_vendor), plus aucun hôte CDN tiers.
-        "script-src 'self' 'nonce-{nonce}'; "
-        "script-src-attr 'unsafe-inline'; "
-        # ponytail: aucun @font-face Google (grep négatif) → les deux
-        # hôtes fonts étaient morts, supprimés.
-        "style-src 'self' 'unsafe-inline'; "
-        # ponytail: `https:` reste ouvert — unfurls (YouTube/Vimeo/…) et
-        # tuiles OSM sont inénumérables ; plafond assumé, à resserrer si
-        # un proxy d'images local arrive.
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
        "img-src 'self' data: blob: https:; "
-        "font-src 'self' data:; "
-        # connect-src fermé : plus de `https:` (aucun fetch cross-origin
-        # côté front — grep négatif) et websockets scopés à l'hôte de la
-        # requête ({host}) → plus de canal d'exfil vers un tiers.
-        "connect-src 'self' ws://{host} wss://{host}; "
+        "font-src 'self' data: https://fonts.gstatic.com; "
+        "connect-src 'self' https: wss:; "
        "media-src 'self' blob:; "
        "frame-src 'self'; "
        "object-src 'none'; "
@@ -101,22 +77,11 @@ class ContentSecurityPolicyMiddleware(BaseHTTPMiddleware):
    )

    async def dispatch(self, request: Request, call_next):
-        nonce = secrets.token_urlsafe(16)
-        # Posé AVANT call_next : BaseHTTPMiddleware exécute le aval dans une
-        # tâche créée maintenant → le contexte (donc le nonce) y est copié,
-        # exactement ce que les templates liront via `csp_nonce()`.
-        CSP_NONCE.set(nonce)
        response = await call_next(request)
        # Only set CSP on HTML responses
        content_type = response.headers.get("content-type", "")
        if "text/html" in content_type:
-            # Host du navigateur (uvicorn rejette les Host invalides) ;
-            # on retire quand même tout caractère hors base URL par sécurité.
-            host = re.sub(r"[^0-9A-Za-z.\-:\[\]]", "",
-                          request.headers.get("host", ""))
-            response.headers[self.CSP_HEADER] = self.CSP_VALUE.format(
-                nonce=nonce, host=host
-            )
+            response.headers[self.CSP_HEADER] = self.CSP_VALUE
        return response


@@ -132,16 +97,8 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
    # Paths that should be rate-limited
    RATE_LIMITED_PREFIXES: tuple[str, ...] = (
        "/api/", "/board/api/", "/auth/",
-        # A33 : préfixes qui manquaient — SCIM (brute force de jetons/IdP),
-        # API workspace + collections (les endpoints mutants du legacy).
-        "/scim/v2/", "/workspace/", "/db/",
    )

-    # Pages publiques : seul le non-GET est plafonné (brute force de
-    # /s/<slug>/auth et spam de /f/<token>) — la lecture reste libre pour les
-    # visiteurs d'un site publié qui partagent une IP.
-    RATE_LIMITED_NON_GET_PREFIXES: tuple[str, ...] = ("/s/", "/f/")
-
    # Paths exempt from rate limiting even under an API prefix
    EXEMPT_PATHS: frozenset[str] = frozenset({
        "/api/health",
@@ -149,82 +106,36 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
        "/api/frontend-errors",
    })

-    def __init__(self, app, max_requests: int | None = None, window_seconds: int = 60):
+    def __init__(self, app, max_requests: int = 100, window_seconds: int = 60):
        super().__init__(app)
-        # A33 : None = lire `settings.rate_limit_requests` à chaque requête (la
-        # valeur de config n'était jamais lue — 100 codé en dur contre 60 annoncé).
        self.max_requests = max_requests
        self.window_seconds = window_seconds
        self._store: dict[str, tuple[float, int]] = defaultdict(lambda: (0.0, 0))
-        self._last_prune = 0.0
-        self._max_keys = 5000

    async def dispatch(self, request: Request, call_next):
        path = request.url.path

-        # Respect the global rate-limit toggle (disabled in tests/local).
-        from app.config import settings
-        if not settings.rate_limit_enabled:
-            return await call_next(request)
-
-        # Only rate-limit API routes (+ non-GET sur les pages publiques)
-        method = request.method.upper()
-        limited = any(path.startswith(p) for p in self.RATE_LIMITED_PREFIXES) or (
-            method not in ("GET", "HEAD", "OPTIONS")
-            and any(path.startswith(p) for p in self.RATE_LIMITED_NON_GET_PREFIXES)
-        )
-        if not limited:
+        # Only rate-limit API routes
+        if not any(path.startswith(p) for p in self.RATE_LIMITED_PREFIXES):
            return await call_next(request)

        # Exempt health check and error capture
        if path in self.EXEMPT_PATHS:
            return await call_next(request)

-        limit = self.max_requests or settings.rate_limit_requests
-        ip = self._client_key(request)
+        ip = request.client.host if request.client else "unknown"
        now = time.time()

-        # A33 : le store n'était jamais épuré → croissance mémoire par IP.
-        if len(self._store) > self._max_keys and now - self._last_prune > self.window_seconds:
-            self._prune(now)
-
        window_start, count = self._store[ip]
        if now - window_start > self.window_seconds:
            self._store[ip] = (now, 1)
            return await call_next(request)

-        if count >= limit:
+        if count >= self.max_requests:
            return JSONResponse(
-                {"error": "Rate limit exceeded", "detail": f"Max {limit} req/min per IP"},
+                {"error": "Rate limit exceeded", "detail": f"Max {self.max_requests} req/min per IP"},
                status_code=429,
            )

        self._store[ip] = (window_start, count + 1)
        return await call_next(request)
-
-    def _client_key(self, request: Request) -> str:
-        """A33 : X-Forwarded-For uniquement derrière un proxy local.
-
-        Le test porte sur `is_private` (Python ≥ 3.13 : toutes les plages non
-        globales, pas seulement RFC1918) — un pair non-global n'est pas un
-        internaute, donc le XFF du proxy fait foi.
-        ponytail: si un jour plusieurs proxies se chaînent (ou si l'app est
-        exposée directement), prendre la dernière adresse non privée de la
-        chaîne plutôt que la première.
-        """
-        host = request.client.host if request.client else "unknown"
-        fwd = request.headers.get("x-forwarded-for", "")
-        if fwd:
-            try:
-                direct = ipaddress.ip_address(host)
-                if direct.is_private or direct.is_loopback:
-                    return fwd.split(",")[0].strip() or host
-            except ValueError:
-                pass  # hôte non-IP (testserver…) → on garde la clé d'origine
-        return host
-
-    def _prune(self, now: float) -> None:
-        expired = [k for k, (start, _) in self._store.items() if now - start > self.window_seconds]
-        for k in expired:
-            del self._store[k]
-        self._last_prune = now
@@ -1,9 +1,13 @@
 """FlowDeck — Pydantic request models for API validation."""
 from __future__ import annotations

+from typing import Optional
+
+from fastapi import UploadFile
 from pydantic import BaseModel, Field, model_validator

-from app.middleware.security import ALLOWED_EXTENSIONS, _ext
+from app.middleware.security import ALLOWED_EXTENSIONS, MAX_UPLOAD_SIZE, _ext
+

 # ── File Save ────────────────────────────────────────────────

@@ -12,7 +16,7 @@ class FileSaveRequest(BaseModel):
    path: str = Field(..., min_length=1, description="File path in the repository")
    content: str = Field(..., description="File content (UTF-8 encoded)")
    message: str = Field(default="Update via FlowDeck", description="Commit message")
-    sha: str | None = Field(default=None, description="SHA of the file being updated (required for updates)")
+    sha: Optional[str] = Field(default=None, description="SHA of the file being updated (required for updates)")

    @model_validator(mode="after")
    def validate_path_extension(self):
@@ -30,10 +34,26 @@ class UploadValidationResult(BaseModel):
    size: int
    extension: str
    valid: bool
-    error: str | None = None
+    error: Optional[str] = None


+def validate_upload_request(file: UploadFile) -> Optional[str]:
+    """Validate an uploaded file (size + extension). Returns error message or None."""
+    # Size check — we can't read the full file without a size attribute,
+    # but Starlette's UploadFile has a size property from Content-Length
+    if hasattr(file, 'size') and file.size is not None and file.size > MAX_UPLOAD_SIZE:
+        return f"File '{file.filename}' exceeds maximum size of 10 MB"

+    # Extension check
+    if file.filename:
+        ext = _ext(file.filename)
+        if ext and ext not in ALLOWED_EXTENSIONS:
+            return f"File extension '{ext}' is not allowed"
+
+    return None
+
+
+# ── Issue Create / Update ────────────────────────────────────

 class IssueCreateRequest(BaseModel):
    """Request model for creating a Gitea issue."""
@@ -46,12 +66,12 @@ class IssueCreateRequest(BaseModel):

 class IssueUpdateRequest(BaseModel):
    """Request model for updating a Gitea issue (partial update)."""
-    title: str | None = Field(default=None, max_length=500)
-    body: str | None = Field(default=None)
-    state: str | None = Field(default=None, pattern=r"^(open|closed)$")
-    labels: str | None = Field(default=None, description="Comma-separated label IDs")
-    milestone: str | None = Field(default=None)
-    assignee: str | None = Field(default=None)
+    title: Optional[str] = Field(default=None, max_length=500)
+    body: Optional[str] = Field(default=None)
+    state: Optional[str] = Field(default=None, pattern=r"^(open|closed)$")
+    labels: Optional[str] = Field(default=None, description="Comma-separated label IDs")
+    milestone: Optional[str] = Field(default=None)
+    assignee: Optional[str] = Field(default=None)


 # ── Card Move ────────────────────────────────────────────────
@@ -1,7 +1,7 @@
 """FlowDeck — Standardized response models."""
 from __future__ import annotations

-from typing import Any
+from typing import Any, Optional

 from pydantic import BaseModel

@@ -13,7 +13,7 @@ class ErrorResponse(BaseModel):
        ErrorResponse(error="Rate limit exceeded", detail="Max 100 req/min per IP")
    """
    error: str
-    detail: str | None = None
+    detail: Optional[str] = None

    model_config = {
        "json_schema_extra": {
@@ -29,7 +29,7 @@ class SuccessResponse(BaseModel):
        SuccessResponse(status="ok", data={"issue_id": 42})
    """
    status: str = "ok"
-    data: dict[str, Any] | None = None
+    data: Optional[dict[str, Any]] = None

    model_config = {
        "json_schema_extra": {
@@ -1,5 +1,5 @@
 """FlowDeck — Admin API: users, roles, stats, audit."""
-from fastapi import APIRouter, Body, Depends, HTTPException, Request
+from fastapi import APIRouter, Request, Depends, HTTPException
 from fastapi.responses import JSONResponse

 router = APIRouter(tags=["admin"], prefix="/api/admin")
@@ -8,7 +8,7 @@ router = APIRouter(tags=["admin"], prefix="/api/admin")
 # ── Dependency ──
 async def admin_required(request: Request):
    from app.auth.session import get_current_user
-    user = get_current_user(request)
+    user = await get_current_user(request)
    if not user:
        raise HTTPException(status_code=403, detail="Admin access required")
    # Also check DB directly (session cookie may be stale)
@@ -23,7 +23,7 @@ async def admin_required(request: Request):

 # ── Users ──
@router.get("/users")
-def list_users(_admin=Depends(admin_required)):
+async def list_users(_admin=Depends(admin_required)):
    """List all users with workspace/file/folder counts and storage usage."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -46,11 +46,15 @@ def list_users(_admin=Depends(admin_required)):


@router.post("/users")
-def create_user(request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+async def create_user(request: Request, _admin=Depends(admin_required)):
    """Create a new user (admin only)."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    login = body.get("login", "").strip()
    name = body.get("name", login)
    email = body.get("email", login)
@@ -74,11 +78,15 @@ def create_user(request: Request, _admin=Depends(admin_required), body: dict = B


@router.put("/users/{user_id:int}")
-def update_user(user_id: int, request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+async def update_user(user_id: int, request: Request, _admin=Depends(admin_required)):
    """Update a user: name, email, password, admin status, active status."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    with get_conn() as conn:
        user = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
        if not user:
@@ -101,13 +109,9 @@ def update_user(user_id: int, request: Request, _admin=Depends(admin_required),


@router.delete("/users/{user_id:int}")
-def delete_user(user_id: int, _admin=Depends(admin_required)):
+async def delete_user(user_id: int, _admin=Depends(admin_required)):
    """Delete a user and cascade their data."""
    from app.db import get_conn
-    from app.services.collection_lifecycle import (
-        delete_collections,
-        workspace_collection_ids,
-    )
    with get_conn() as conn:
        user = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
        if not user:
@@ -125,9 +129,6 @@ def delete_user(user_id: int, _admin=Depends(admin_required)):
        # Delete workspaces owned by this user
        ws_rows = conn.execute("SELECT id FROM workspaces WHERE owner_id=?", (user_id,)).fetchall()
        for ws in ws_rows:
-            # Les bases du workspace tombent avec lui (sinon : collections
-            # orphelines listées par /db et My Tasks).
-            delete_collections(conn, workspace_collection_ids(conn, ws["id"]))
            conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws["id"],))
            conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws["id"],))
        conn.execute("DELETE FROM workspaces WHERE owner_id=?", (user_id,))
@@ -138,7 +139,7 @@ def delete_user(user_id: int, _admin=Depends(admin_required)):

 # ── Stats ──
@router.get("/stats")
-def user_stats(_admin=Depends(admin_required)):
+async def user_stats(_admin=Depends(admin_required)):
    """Aggregate stats: total users, workspaces, files, storage."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -158,7 +159,7 @@ def user_stats(_admin=Depends(admin_required)):

 # ── Audit ──
@router.get("/audit")
-def audit_log(limit: int = 100, _admin=Depends(admin_required)):
+async def audit_log(limit: int = 100, _admin=Depends(admin_required)):
    """Recent login history."""
    from app.db import get_conn
    with get_conn() as conn:
@@ -3,39 +3,20 @@ from __future__ import annotations

 import json
 import logging
-from datetime import UTC, datetime
+from datetime import datetime
+from typing import Optional

-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse

-from app.auth.session import SessionManager
 from app.config import settings
 from app.db import get_conn
-from app.routers.board import STATUS_COLORS, STATUS_LABELS, _issue_column, _map_issue_to_card
+from app.routers.board import _issue_column, _map_issue_to_card, STATUS_COLORS, STATUS_LABELS
 from app.services.gitea_client import gitea
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
-
-# A17 : ce router legacy ne sert plus un anonymous. Deux exceptions assumées —
-# le probe d'infra (Docker HEALTHCHECK / CI) et la remontée d'erreur client.
-_API_PUBLIC_PATHS = {"/api/health", "/api/frontend-error"}
-
-
-async def _require_session_or_bearer(request: Request) -> None:
-    """Session de cookie **ou** Bearer d'API valide sur toutes les routes /api."""
-    if request.url.path in _API_PUBLIC_PATHS:
-        return
-    if SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        return
-    auth = request.headers.get("Authorization", "")
-    if auth.startswith("Bearer "):
-        from app.routers.public_api import verify_token
-        verify_token(auth)
-        return
-    raise HTTPException(401, "Authentication required")
-
-
-router = APIRouter(tags=["api"], prefix="/api", dependencies=[Depends(_require_session_or_bearer)])
+router = APIRouter(tags=["api"], prefix="/api")

 # ── Simple rate limiter (in-memory, per-IP) ──
 _rate_limit_store: dict[str, tuple[float, int]] = {}
@@ -46,7 +27,7 @@ def _check_rate_limit(request: Request) -> bool:
    if not settings.rate_limit_enabled:
        return True
    ip = request.client.host if request.client else "unknown"
-    now = datetime.now(UTC).replace(tzinfo=None).timestamp()
+    now = datetime.utcnow().timestamp()
    window_start, count = _rate_limit_store.get(ip, (0, 0))
    if now - window_start > 60:
        _rate_limit_store[ip] = (now, 1)
@@ -67,12 +48,12 @@ async def health(request: Request):
            conn.execute("SELECT 1")
        db_ok = True
    except Exception:
-        logger.exception("health")
+        pass
    try:
        await gitea.get_user_repos(page=1, limit=1)
        gitea_ok = True
    except Exception:
-        logger.exception("health")
+        pass

    return {
        "status": "ok" if (db_ok and gitea_ok) else "degraded",
@@ -83,7 +64,7 @@ async def health(request: Request):


@router.get("/stats")
-def stats():
+async def stats():
    """Global stats for dashboard."""
    with get_conn() as conn:
        board_count = conn.execute("SELECT COUNT(*) as c FROM boards").fetchone()["c"]
@@ -99,6 +80,22 @@ def stats():
    }


+@router.get("/projects")
+async def projects(search: str = Query(default=""), show_archived: bool = Query(default=False)):
+    """List Gitea projects (JSON)."""
+    try:
+        repos = await gitea.get_user_repos(page=1, limit=50)
+        if search:
+            q = search.lower()
+            repos = [r for r in repos if q in r.get("full_name", "").lower() or q in (r.get("description") or "").lower()]
+        if not show_archived:
+            repos = [r for r in repos if not r.get("archived", False)]
+        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
+    except Exception:
+        repos = []
+    return {"projects": repos}
+
+
@router.post("/move")
 async def move_card(
    request: Request,
@@ -153,7 +150,7 @@ async def move_card(
                issue = await gitea.get_issue(owner, repo, issue_id)
                current_labels = [lbl["name"] for lbl in issue.get("labels", [])]
                status_labels = await _get_status_labels(owner, repo, board_id)
-                filtered_names = [name for name in current_labels if name not in status_labels]
+                filtered_names = [l for l in current_labels if l not in status_labels]
                filtered_names.append(mapping["gitea_label"])

                # Resolve label names to IDs
@@ -179,7 +176,7 @@ async def _get_status_labels(owner: str, repo: str, board_id: int) -> list[str]:


@router.post("/col-mapping")
-def set_col_mapping(
+async def set_col_mapping(
    owner: str = Query(...),
    repo: str = Query(...),
    column: str = Query(...),
@@ -209,7 +206,7 @@ def set_col_mapping(


@router.delete("/col-mapping")
-def delete_col_mapping(
+async def delete_col_mapping(
    owner: str = Query(...),
    repo: str = Query(...),
    column: str = Query(...),
@@ -234,7 +231,7 @@ def delete_col_mapping(


@router.get("/board-config/{owner}/{repo}")
-def get_board_config(owner: str, repo: str):
+async def get_board_config(owner: str, repo: str):
    with get_conn() as conn:
        board = conn.execute(
            "SELECT * FROM boards WHERE project_owner=? AND project_name=?",
@@ -255,7 +252,7 @@ def get_board_config(owner: str, repo: str):


@router.post("/board-config/{owner}/{repo}")
-def update_board_config(
+async def update_board_config(
    owner: str,
    repo: str,
    columns: str = Query(default=""),
@@ -297,7 +294,7 @@ async def create_issue(
    if not _check_rate_limit(request):
        raise HTTPException(status_code=429, detail="Rate limit exceeded")

-    label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()] if labels else None
+    label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()] if labels else None
    milestone_id = int(milestone) if milestone.strip().isdigit() else None

    issue = await gitea.create_issue(
@@ -349,7 +346,7 @@ async def update_issue_api(
    if state:
        kwargs["state"] = state
    if labels:
-        label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()]
+        label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()]
    if milestone and milestone.strip().isdigit():
        kwargs["milestone"] = int(milestone)
    if assignee:
@@ -392,7 +389,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
        comments = await gitea.get_issue_comments(owner, repo, issue_id)
    except Exception as e:
        logger.warning("Failed to fetch issue %s/%s #%d: %s", owner, repo, issue_id, e)
-        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found") from e
+        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found")

    # Get checklists from local DB
    with get_conn() as conn:
@@ -444,8 +441,8 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
            "comments": comments,
            "checklists": checklists,
        }
-        from app.templating import ENV
-        env = ENV
+        from jinja2 import Environment, FileSystemLoader
+        env = Environment(loader=FileSystemLoader("app/templates"))
        template = env.get_template("card_detail.html")
        return HTMLResponse(template.render(**ctx))

@@ -460,7 +457,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
 # ── v0.5.0: Checklists ──

@router.post("/checklists/{owner}/{repo}/{issue_id}")
-def create_checklist(
+async def create_checklist(
    owner: str,
    repo: str,
    issue_id: int,
@@ -484,7 +481,7 @@ def create_checklist(


@router.post("/checklist-items/{owner}/{repo}/{issue_id}/{checklist_id}")
-def add_checklist_item(
+async def add_checklist_item(
    owner: str,
    repo: str,
    issue_id: int,
@@ -502,7 +499,7 @@ def add_checklist_item(


@router.patch("/checklist-items/{item_id}")
-def toggle_checklist_item(
+async def toggle_checklist_item(
    item_id: int,
    checked: bool = Query(default=False),
    content: str = Query(default=""),
@@ -524,7 +521,7 @@ def toggle_checklist_item(


@router.delete("/checklist-items/{item_id}")
-def delete_checklist_item(item_id: int):
+async def delete_checklist_item(item_id: int):
    """Delete a checklist item."""
    with get_conn() as conn:
        conn.execute("DELETE FROM checklist_items WHERE id=?", (item_id,))
@@ -533,7 +530,7 @@ def delete_checklist_item(item_id: int):


@router.delete("/checklists/{checklist_id}")
-def delete_checklist(checklist_id: int):
+async def delete_checklist(checklist_id: int):
    """Delete a checklist and all its items."""
    with get_conn() as conn:
        conn.execute("DELETE FROM checklist_items WHERE checklist_id=?", (checklist_id,))
@@ -545,19 +542,14 @@ def delete_checklist(checklist_id: int):
 # ── v1.0.0: User management ──

@router.get("/users/me")
-def get_my_profile(request: Request):
+async def get_my_profile(request: Request):
    """Get current user profile."""
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return {"login": "guest", "full_name": "Guest", "email": ""}
    with get_conn() as conn:
-        # A29-byproduct : jamais `SELECT *` ici — la ligne contenait
-        # password_hash, login_attempts et locked_until.
        row = conn.execute(
-            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
-            "is_admin, is_active, last_login, created_at "
-            "FROM users WHERE login=?",
-            (user.get("login", ""),),
+            "SELECT * FROM users WHERE login=?", (user.get("login", ""),)
        ).fetchone()
        if row:
            return dict(row)
@@ -565,7 +557,7 @@ def get_my_profile(request: Request):


@router.put("/users/me")
-def update_my_profile(request: Request, full_name: str = Query(default=""),
+async def update_my_profile(request: Request, full_name: str = Query(default=""),
                             email: str = Query(default="")):
    """Update current user's local profile."""
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
@@ -584,7 +576,7 @@ def update_my_profile(request: Request, full_name: str = Query(default=""),
 # ── v0.5.0: Card priority & due date ──

@router.post("/card/{owner}/{repo}/{issue_id}")
-def update_card(
+async def update_card(
    owner: str,
    repo: str,
    issue_id: int,
@@ -673,7 +665,7 @@ async def capture_frontend_error(request: Request):


@router.get("/frontend-errors")
-def get_frontend_errors(request: Request, clear: bool = True):
+async def get_frontend_errors(request: Request, clear: bool = True):
    """Retourne les erreurs frontend récentes. Hermes appelle cette route."""
    errors = list(_frontend_errors)
    if clear:
@@ -1,42 +0,0 @@
-"""FlowDeck — Public API v2.
-
-Découpe A28 : l'ancien `api_v2.py` (2 110 lignes, 115 routes) est devenu
-ce package — un module par concern (`_common` = helpers), `router`
-agrégé ci-dessous avec le même prefix/tags qu'avant → 0 changement
-d'URL, 0 changement d'operation_id.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter
-
-from . import (
-    admin,
-    collections,
-    engagement,
-    identity,
-    planning,
-    projects,
-    properties,
-    sharing,
-    templates_io,
-    views,
-    webhooks,
-    workspaces,
-)
-
-router = APIRouter(prefix="/api/v2")
-for _mod in (
-    identity,
-    workspaces,
-    collections,
-    properties,
-    views,
-    engagement,
-    sharing,
-    planning,
-    templates_io,
-    projects,
-    admin,
-    webhooks,
-):
-    router.include_router(_mod.router)
@@ -1,36 +0,0 @@
-"""FlowDeck — API v2 : helpers partagés des modules de routes (A28)."""
-from __future__ import annotations
-
-import hashlib
-import logging
-
-from fastapi import HTTPException, Request
-
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-logger = logging.getLogger(__name__)
-
-def _hash(token: str) -> str:
-    return hashlib.sha256(token.encode()).hexdigest()
-
-def _v2_rate_check(request: Request, user: dict) -> None:
-    ip = request.client.host if request.client else "unknown"
-    th = user.get("_token_hash")
-    if not check_v2_rate_limit(th, ip):
-        raise HTTPException(status_code=429, detail="Rate limit exceeded: 300 req/min per token")
-
-# ── Tokens ────────────────────────────────────────────────────────────────
-
@@ -1,91 +0,0 @@
-"""FlowDeck — Public API v2 : admin.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.patch("/admin/users/{uid}")
-def admin_patch_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone():
-            raise HTTPException(404, "User not found")
-        sets = []
-        params: list = []
-        for k in ("is_active", "is_admin", "full_name", "email"):
-            if k in body:
-                sets.append(f"{k}=?")
-                params.append(int(body[k]) if k in ("is_active", "is_admin") else body[k])
-        if not sets:
-            raise HTTPException(400, "No fields")
-        params.append(uid)
-        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
-        conn.commit()
-    audit_log(user, "admin.user_update", "user", uid, "", request)
-    return {"id": uid, "status": "updated"}
-
-
-@router.delete("/admin/users/{uid}")
-def admin_delete_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    if uid == user["id"]:
-        raise HTTPException(400, "Cannot delete yourself")
-    with get_conn() as conn:
-        conn.execute("DELETE FROM users WHERE id=?", (uid,))
-        conn.commit()
-    audit_log(user, "admin.user_delete", "user", uid, "", request)
-    return {"id": uid, "status": "deleted"}
-
-
-@router.get("/admin/audit-logs")
-def admin_audit_logs_v2(request: Request, limit: int = 50, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    limit = max(1, min(limit, 200))
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM api_audit_log ORDER BY created_at DESC LIMIT ?", (limit,)).fetchall()
-    return {"logs": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/webhooks/events")
-def list_webhook_events_v2(request: Request, authorization: str | None = Header(default=None)):
-    """Catalogue of deliverable events (+ wildcard syntax)."""
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    from app.services.webhook_outbound import EVENTS
-    return {"events": EVENTS, "wildcards": ["*", "page.*", "collection.*"]}
@@ -1,567 +0,0 @@
-"""FlowDeck — Public API v2 : collections.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-from app.services.collection_lifecycle import delete_collections
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/collections")
-def list_collections_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    ws_filter = request.query_params.get("workspace_id")
-    q = (request.query_params.get("query") or "").strip()
-    with get_conn() as conn:
-        where = []
-        params: list = []
-        if ws_filter:
-            try:
-                wid = int(ws_filter)
-                where.append("c.workspace_id=?")
-                params.append(wid)
-            except ValueError:
-                pass
-        if q:
-            where.append("(c.name LIKE ? OR c.description LIKE ?)")
-            like = f"%{q}%"
-            params.extend([like, like])
-        clause = ("WHERE " + " AND ".join(where)) if where else ""
-        total = conn.execute(f"SELECT COUNT(*) FROM collections c {clause}", params).fetchone()[0]
-        rows = conn.execute(f"SELECT c.* FROM collections c {clause} ORDER BY c.name LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
-    cols = []
-    for r in rows:
-        d = row_to_dict(r)
-        # filter by visibility: skip private not visible (best-effort)
-        cols.append(d)
-    resp = {"collections": cols, "total": total, "limit": limit, "offset": offset}
-    return JSONResponse(content=resp, headers=paginate_headers(total))
-
-
-@router.post("/collections")
-def create_collection_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    description = body.get("description", "")
-    icon = body.get("icon", "📋")
-    workspace_id = body.get("workspace_id")
-    schema = body.get("schema") or body.get("schema_json") or []
-    if isinstance(schema, str):
-        try:
-            schema = json.loads(schema)
-        except Exception:
-            schema = []
-    schema_json = json.dumps(schema)
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, description, icon, schema_json, workspace_id, user["id"]))
-        cid = cur.lastrowid
-        # materialize properties if schema provided — A25 : PAS de try ici,
-        # une exception doit interrompre la transaction (sinon la collection est
-        # commitée sans son schéma et l'erreur disparaît).
-        from app.services.db_templates import materialize_properties
-        materialize_properties(conn, cid, schema)
-        # default view
-        conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json) VALUES (?,?,?,?)", (cid, "Default View", "table", json.dumps({"visible_properties": ["Title"]})))
-        conn.commit()
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (cid,)).fetchone()
-    audit_log(user, "collection.create", "collection", cid, name, request)
-    data = {"id": cid, "name": name, "status": "created", "collection": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/collections/{collection_id}")
-def get_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        pages = conn.execute("SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? ORDER BY position LIMIT 50", (collection_id,)).fetchall()
-    d = row_to_dict(row)
-    d["pages"] = [row_to_dict(p) for p in pages]
-    return d
-
-
-@router.patch("/collections/{collection_id}")
-def patch_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        name = body.get("name", row["name"])
-        description = body.get("description", row["description"])
-        icon = body.get("icon", row["icon"])
-        schema = body.get("schema") or body.get("schema_json")
-        if schema is not None:
-            sj = json.dumps(schema) if isinstance(schema, (list, dict)) else str(schema)
-        else:
-            sj = row["schema_json"]
-        conn.execute("UPDATE collections SET name=?, description=?, icon=?, schema_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, description, icon, sj, collection_id))
-        conn.commit()
-    audit_log(user, "collection.update", "collection", collection_id, "", request)
-    return {"id": collection_id, "status": "updated"}
-
-
-@router.delete("/collections/{collection_id}")
-def delete_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        delete_collections(conn, [collection_id])
-        conn.commit()
-    audit_log(user, "collection.delete", "collection", collection_id, "", request)
-    return {"id": collection_id, "status": "deleted"}
-
-
-@router.post("/collections/{collection_id}/linked")
-def create_linked_db(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip() or f"Linked DB {collection_id}"
-    with get_conn() as conn:
-        src = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not src:
-            raise HTTPException(404, "Collection not found")
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, src["description"], src["icon"], src["schema_json"], src["workspace_id"] if "workspace_id" in src.keys() else None, user["id"]))
-        nid = cur.lastrowid
-        # copy data source as linked
-        try:
-            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id, is_linked) VALUES (?, ?, 1)", (nid, collection_id))
-        except Exception:
-            logger.exception("create_linked_db")
-        # copy views + properties (light)
-        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()
-        for p in rows:
-            try:
-                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, position) VALUES (?, ?, ?, ?, ?)", (nid, p["name"], p["prop_type"], p["options_json"], p["position"]))
-            except Exception:
-                logger.exception("create_linked_db")
-        vrows = conn.execute("SELECT * FROM collection_views WHERE collection_id=?", (collection_id,)).fetchall()
-        for v in vrows:
-            try:
-                conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position) VALUES (?, ?, ?, ?, ?)", (nid, v["name"], v["view_type"], v["config_json"], v["position"]))
-            except Exception:
-                logger.exception("create_linked_db")
-        conn.commit()
-    audit_log(user, "collection.linked", "collection", nid, f"src={collection_id}", request)
-    return {"id": nid, "name": name, "status": "created"}
-
-
-@router.post("/collections/{collection_id}/task")
-def toggle_task(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_task FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Collection not found")
-        cur_val = row["is_task"] if "is_task" in row.keys() else 0
-        new_val = 0 if cur_val else 1
-        conn.execute("UPDATE collections SET is_task=? WHERE id=?", (new_val, collection_id))
-        conn.commit()
-    audit_log(user, "collection.toggle_task", "collection", collection_id, str(new_val), request)
-    return {"id": collection_id, "is_task": bool(new_val)}
-
-
-@router.get("/collections/{collection_id}/sources")
-def list_sources(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        rows = conn.execute("SELECT * FROM collection_data_sources WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"sources": [dict(r) for r in rows]}
-
-
-@router.post("/collections/{collection_id}/sources")
-def add_source(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    src_id = body.get("source_collection_id") or body.get("source_id")
-    if not src_id:
-        raise HTTPException(400, "source_collection_id required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (src_id,)).fetchone():
-            raise HTTPException(404, "Source collection not found")
-        try:
-            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id) VALUES (?, ?)", (collection_id, src_id))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    audit_log(user, "collection.add_source", "collection", collection_id, str(src_id), request)
-    return {"collection_id": collection_id, "source_collection_id": src_id, "status": "added"}
-
-
-@router.delete("/collections/{collection_id}/sources/{source_id}")
-def remove_source(collection_id: int, source_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM collection_data_sources WHERE collection_id=? AND (id=? OR source_collection_id=?)", (collection_id, source_id, source_id))
-        conn.commit()
-    audit_log(user, "collection.remove_source", "collection", collection_id, str(source_id), request)
-    return {"status": "removed"}
-
-
-@router.get("/collections/{collection_id}/pages")
-def list_collection_pages_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        total = conn.execute("SELECT COUNT(*) FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        # filters: filter[status]=Done etc., sort, fields
-        # Simple: filter by property name via property_values_json LIKE (best-effort), sort by position or title
-        sort = request.query_params.get("sort") or ""
-        order = "position"
-        desc = False
-        if sort:
-            if sort.startswith("-"):
-                desc = True
-                sort = sort[1:]
-            # allow sorting by title/position/created_at
-            if sort in ("title", "position", "created_at", "updated_at"):
-                order = sort
-        direction = "DESC" if desc else "ASC"
-        rows = conn.execute(f"SELECT * FROM collection_pages WHERE collection_id=? ORDER BY {order} {direction} LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
-    # apply filter[xxx] in-memory (small)
-    filters = {k[7:-1]: v for k, v in request.query_params.items() if k.startswith("filter[") and k.endswith("]")}
-    fields = request.query_params.get("fields")
-    fields_set = set(fields.split(",")) if fields else None
-    out = []
-    for r in rows:
-        d = row_to_dict(r)
-        # property filter (AND)
-        if filters:
-            try:
-                pv = json.loads(r["property_values_json"] or "{}") if isinstance(r["property_values_json"], str) else r["property_values_json"]
-            except Exception:
-                pv = {}
-            ok = True
-            for fk, fv in filters.items():
-                # lookup by prop id or name
-                found = False
-                for kk, vv in (pv or {}).items():
-                    if str(kk) == str(fk) or str(kk).lower() == fk.lower():
-                        if str(vv) == str(fv):
-                            found = True
-                        break
-                # also check title if filter field is title
-                if fk == "title" and d.get("title") == fv:
-                    found = True
-                if not found:
-                    ok = False
-                    break
-            if not ok:
-                continue
-        if fields_set:
-            d = {k: v for k, v in d.items() if k in fields_set or k in ("id", "collection_id")}
-        out.append(d)
-    return JSONResponse(content={"pages": out, "total": total, "limit": limit, "offset": offset}, headers=paginate_headers(total))
-
-
-@router.post("/collections/{collection_id}/pages")
-def create_collection_page_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    title = (body.get("title") or body.get("name") or "Untitled").strip() or "Untitled"
-    icon = body.get("icon", "file")
-    parent_id = body.get("parent_id")
-    prop_vals = body.get("property_values") or body.get("properties") or body.get("property_values_json") or {}
-    if isinstance(prop_vals, str):
-        try:
-            prop_vals = json.loads(prop_vals)
-        except Exception:
-            prop_vals = {}
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        # validate properties if helper exists
-        try:
-            pass
-            # light validation: we rely on existing validators
-        except Exception:
-            logger.exception("create_collection_page_v2")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        # apply auto props
-        try:
-            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()]
-            from app.services.property_types import apply_auto_properties as _aap
-            _aap(props_list, prop_vals, user, is_create=True)
-        except Exception:
-            logger.exception("create_collection_page_v2")
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, icon, position, parent_id, property_values_json) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, title, icon, max_pos, parent_id, json.dumps(prop_vals)))
-        pid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (pid,)).fetchone()
-    audit_log(user, "page.create", "collection_page", pid, title, request)
-    try:
-        run_event_sync(_fire_event("collection.page.created", {"page_id": pid, "collection_id": collection_id, "title": title}))
-    except Exception:
-        logger.exception("create_collection_page_v2")
-    data = {"id": pid, "title": title, "status": "created", "page": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/pages/{page_id}")
-def get_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            # also try pages table (block pages)
-            row2 = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-            if not row2:
-                raise HTTPException(404, "Page not found")
-            d = row_to_dict(row2)
-            # v6.5.0: resolve synced blocks server-side (fresh content).
-            if (d.get("content_format") or "blocks") == "blocks" and d.get("content"):
-                from app.services.synced_blocks import resolve_content_json
-                d["content"] = resolve_content_json(d["content"], d["content_format"])
-            return d
-        d = row_to_dict(row)
-        # property_values_json already parsed by row_to_dict
-        # v6.5.0: expose the row's content page when it exists (no lazy
-        # creation on a read-only endpoint).
-        content_page_id = conn.execute(
-            "SELECT id FROM pages WHERE collection_row_id=?",
-            (page_id,),
-        ).fetchone()
-        d["content_page_id"] = content_page_id["id"] if content_page_id else None
-        return d
-
-
-@router.patch("/pages/{page_id}")
-def patch_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        title = body.get("title", row["title"])
-        icon = body.get("icon", row["icon"])
-        pos = body.get("position", row["position"])
-        parent_id = body.get("parent_id", row["parent_id"])
-        pv_raw = row["property_values_json"] or "{}"
-        try:
-            stored = json.loads(pv_raw) if isinstance(pv_raw, str) else dict(pv_raw)
-        except Exception:
-            stored = {}
-        incoming = body.get("property_values") or body.get("properties")
-        if incoming is not None:
-            if isinstance(incoming, str):
-                try:
-                    incoming = json.loads(incoming)
-                except Exception:
-                    incoming = {}
-            # merge
-            for k, v in (incoming or {}).items():
-                stored[str(k)] = v
-        # apply auto props
-        try:
-            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (row["collection_id"],)).fetchall()]
-            from app.services.property_types import apply_auto_properties as _aap
-            _aap(props_list, stored, user, is_create=False)
-        except Exception:
-            logger.exception("patch_page_v2")
-        conn.execute("UPDATE collection_pages SET title=?, icon=?, position=?, parent_id=?, property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (title, icon, pos, parent_id, json.dumps(stored), page_id))
-        conn.commit()
-    audit_log(user, "page.update", "collection_page", page_id, "", request)
-    try:
-        run_event_sync(_fire_event("collection.page.updated", {"page_id": page_id, "collection_id": row["collection_id"], "title": title}))
-    except Exception:
-        logger.exception("patch_page_v2")
-    return {"id": page_id, "status": "updated"}
-
-
-@router.delete("/pages/{page_id}")
-def delete_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        conn.execute("DELETE FROM collection_pages WHERE id=?", (page_id,))
-        conn.commit()
-    audit_log(user, "page.delete", "collection_page", page_id, "", request)
-    try:
-        run_event_sync(_fire_event("collection.page.deleted", {"page_id": page_id, "collection_id": row["collection_id"]}))
-    except Exception:
-        logger.exception("delete_page_v2")
-    return {"id": page_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/restore")
-def restore_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    # For soft-deleted pages (deleted_at) - but collection_pages has no deleted_at; handle pages table
-    with get_conn() as conn:
-        row = conn.execute("SELECT deleted_at FROM pages WHERE id=?", (page_id,)).fetchone()
-        if row and row["deleted_at"]:
-            conn.execute("UPDATE pages SET deleted_at=NULL WHERE id=?", (page_id,))
-            conn.commit()
-            try:
-                run_event_sync(_fire_event("page.restored", {"page_id": page_id}))
-            except Exception:
-                logger.exception("restore_page_v2")
-            return {"id": page_id, "status": "restored"}
-        raise HTTPException(404, "Page not found or not deleted")
-
-
-@router.post("/pages/{page_id}/move")
-def move_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        parent_id = body.get("parent_id", row["parent_id"])
-        position = body.get("position", row["position"])
-        conn.execute("UPDATE collection_pages SET parent_id=?, position=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (parent_id, position, page_id))
-        conn.commit()
-    audit_log(user, "page.move", "collection_page", page_id, f"parent={parent_id} pos={position}", request)
-    return {"id": page_id, "status": "moved"}
-
-
-@router.get("/pages/{page_id}/sub-items")
-def list_sub_items_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
-            raise HTTPException(404, "Page not found")
-        rows = conn.execute("SELECT * FROM collection_pages WHERE parent_id=? ORDER BY position", (page_id,)).fetchall()
-    return {"sub_items": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/pages/{page_id}/sub-items")
-def create_sub_item_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        parent = conn.execute("SELECT collection_id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not parent:
-            raise HTTPException(404, "Page not found")
-        title = (body.get("title") or "Untitled").strip()
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE parent_id=?", (page_id,)).fetchone()[0]
-        pv = json.dumps(body.get("property_values") or {})
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, parent_id, position, property_values_json) VALUES (?, ?, ?, ?, ?)", (parent["collection_id"], title, page_id, max_pos, pv))
-        nid = cur.lastrowid
-        conn.commit()
-    audit_log(user, "page.create_subitem", "collection_page", nid, title, request)
-    return {"id": nid, "status": "created"}
-
-
-@router.get("/pages/{page_id}/dependencies")
-def list_dependencies_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_dependencies WHERE page_id=?", (page_id,)).fetchall()
-    return {"dependencies": [dict(r) for r in rows]}
-
-
-@router.post("/pages/{page_id}/dependencies")
-def add_dependency_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    dep_id = body.get("dependency_id") or body.get("depends_on")
-    dtype = body.get("dependency_type") or "blocks"
-    if not dep_id:
-        raise HTTPException(400, "dependency_id required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
-            raise HTTPException(404, "Page not found")
-        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (dep_id,)).fetchone():
-            raise HTTPException(404, "Dependency page not found")
-        try:
-            conn.execute("INSERT INTO page_dependencies (page_id, dependency_id, dependency_type) VALUES (?, ?, ?)", (page_id, dep_id, dtype))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    audit_log(user, "page.add_dependency", "collection_page", page_id, str(dep_id), request)
-    return {"status": "added"}
-
-
-@router.delete("/pages/{page_id}/dependencies/{dep_id}")
-def remove_dependency_v2(page_id: int, dep_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_dependencies WHERE page_id=? AND dependency_id=?", (page_id, dep_id))
-        conn.commit()
-    audit_log(user, "page.remove_dependency", "collection_page", page_id, str(dep_id), request)
-    return {"status": "removed"}
-
-
-@router.get("/collections/{collection_id}/properties")
-def list_properties_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"properties": [row_to_dict(r) for r in rows]}
@@ -1,338 +0,0 @@
-"""FlowDeck — Public API v2 : engagement.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/pages/{page_id}/comments")
-def list_comments_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM comments WHERE target_id=? OR page_id=?", (page_id, page_id)).fetchone()[0]
-        rows = conn.execute("SELECT c.*, u.login, u.full_name FROM comments c LEFT JOIN users u ON u.id=c.user_id WHERE c.target_id=? OR c.page_id=? ORDER BY c.created_at LIMIT ? OFFSET ?", (page_id, page_id, limit, offset)).fetchall()
-    return {"comments": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
-
-
-@router.post("/pages/{page_id}/comments")
-def create_comment_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    text = (body.get("body") or body.get("content") or "").strip()
-    if not text:
-        raise HTTPException(400, "body is required")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO comments (page_id, user_id, body, target_type, target_id, anchor_block_id, anchor_start, anchor_end) VALUES (?, ?, ?, 'page', ?, ?, ?, ?)", (page_id, user["id"], text, page_id, body.get("anchor_block_id"), body.get("anchor_start"), body.get("anchor_end")))
-        nid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (nid,)).fetchone()
-    audit_log(user, "comment.create", "comment", nid, text[:80], request)
-    try:
-        run_event_sync(_fire_event("comment.added", {"comment_id": nid, "page_id": page_id, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("create_comment_v2")
-    return {"id": nid, "status": "created", "comment": row_to_dict(row)}
-
-
-@router.patch("/comments/{comment_id}")
-def patch_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your comment")
-        body_text = body.get("body", row["body"])
-        resolved = body.get("resolved", row["resolved"])
-        was_resolved = int(row["resolved"] or 0)
-        conn.execute("UPDATE comments SET body=?, resolved=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (body_text, int(bool(resolved)), comment_id))
-        conn.commit()
-    if int(bool(resolved)) and not was_resolved:
-        try:
-            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
-        except Exception:
-            logger.exception("patch_comment_v2")
-    return {"id": comment_id, "status": "updated"}
-
-
-@router.delete("/comments/{comment_id}")
-def delete_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your comment")
-        conn.execute("DELETE FROM comments WHERE id=?", (comment_id,))
-        conn.commit()
-    return {"id": comment_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/mentions")
-def create_mention_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    targets = body.get("user_ids") or body.get("mentions") or []
-    if isinstance(targets, int):
-        targets = [targets]
-    if not targets:
-        raise HTTPException(400, "user_ids required")
-    created = 0
-    with get_conn() as conn:
-        for uid in targets:
-            try:
-                conn.execute("INSERT INTO notifications (user_id, actor_id, ntype, title, message, resource_type, resource_id, url) VALUES (?, ?, 'mention', 'You were mentioned', ?, 'page', ?, ?)", (uid, user["id"], body.get("message") or f"Mentioned in page {page_id}", page_id, f"/pages/{page_id}"))
-                created += 1
-            except Exception:
-                logger.exception("create_mention_v2")
-        conn.commit()
-    if created:
-        try:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": [u for u in targets if isinstance(u, int)], "count": created}))
-        except Exception:
-            logger.exception("create_mention_v2")
-    return {"mentions": created, "status": "created"}
-
-
-@router.get("/notifications")
-def list_notifications_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    unread = request.query_params.get("unread")
-    with get_conn() as conn:
-        where = "user_id=?"
-        params: list = [user["id"]]
-        if unread == "1":
-            where += " AND is_read=0"
-        total = conn.execute(f"SELECT COUNT(*) FROM notifications WHERE {where}", params).fetchone()[0]
-        rows = conn.execute(f"SELECT * FROM notifications WHERE {where} ORDER BY created_at DESC LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
-    return {"notifications": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
-
-
-@router.get("/notifications/unread-count")
-def unread_count(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        cnt = conn.execute("SELECT COUNT(*) FROM notifications WHERE user_id=? AND is_read=0", (user["id"],)).fetchone()[0]
-    return {"unread": cnt}
-
-
-@router.post("/notifications/{notif_id}/read")
-def mark_read(notif_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?", (notif_id, user["id"]))
-        conn.commit()
-    return {"id": notif_id, "status": "read"}
-
-
-@router.post("/notifications/read-all")
-def mark_all_read(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("UPDATE notifications SET is_read=1 WHERE user_id=?", (user["id"],))
-        conn.commit()
-    return {"status": "all read"}
-
-
-@router.patch("/users/me/preferences")
-def patch_prefs(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
-        try:
-            cur = json.loads(row["notification_prefs"] or "{}")
-        except Exception:
-            cur = {}
-        cur.update(body)
-        conn.execute("UPDATE users SET notification_prefs=? WHERE id=?", (json.dumps(cur), user["id"]))
-        conn.commit()
-    return {"preferences": cur}
-
-
-@router.get("/favorites")
-def list_favorites_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT f.*, p.title, p.workspace_id FROM favorites f JOIN pages p ON p.id=f.page_id WHERE f.user_id=? ORDER BY f.position", (user["id"],)).fetchall()
-    return {"favorites": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/favorites")
-def add_favorite_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    pid = body.get("page_id")
-    if not pid:
-        raise HTTPException(400, "page_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO favorites (user_id, page_id) VALUES (?, ?)", (user["id"], pid))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    try:
-        run_event_sync(_fire_event("favorite.added", {"page_id": pid, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("add_favorite_v2")
-    return {"page_id": pid, "status": "added"}
-
-
-@router.delete("/favorites/{page_id}")
-def remove_favorite_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM favorites WHERE user_id=? AND page_id=?", (user["id"], page_id))
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("favorite.removed", {"page_id": page_id, "user_id": user["id"]}))
-    except Exception:
-        logger.exception("remove_favorite_v2")
-    return {"page_id": page_id, "status": "removed"}
-
-
-@router.get("/tags")
-def list_tags_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (request.query_params.get("q") or "").strip()
-    with get_conn() as conn:
-        if q:
-            rows = conn.execute("SELECT * FROM tags WHERE user_id=? AND name LIKE ? ORDER BY name", (user["id"], f"%{q}%")).fetchall()
-        else:
-            rows = conn.execute("SELECT * FROM tags WHERE user_id=? ORDER BY name", (user["id"],)).fetchall()
-    return {"tags": [dict(r) for r in rows]}
-
-
-@router.post("/tags")
-def create_tag_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name required")
-    color = body.get("color", "#787774")
-    with get_conn() as conn:
-        try:
-            cur = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (name, color, user["id"]))
-            tid = cur.lastrowid
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"id": tid, "name": name, "color": color, "status": "created"}
-
-
-@router.patch("/tags/{tag_id}")
-def patch_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"])).fetchone()
-        if not row:
-            raise HTTPException(404, "Tag not found")
-        name = body.get("name", row["name"])
-        color = body.get("color", row["color"])
-        conn.execute("UPDATE tags SET name=?, color=? WHERE id=?", (name, color, tag_id))
-        conn.commit()
-    return {"id": tag_id, "status": "updated"}
-
-
-@router.delete("/tags/{tag_id}")
-def delete_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"]))
-        conn.commit()
-    return {"id": tag_id, "status": "deleted"}
-
-
-@router.post("/pages/{page_id}/tags")
-def attach_tag_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    tag_id = body.get("tag_id")
-    if not tag_id:
-        raise HTTPException(400, "tag_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO page_tags (page_id, tag_id) VALUES (?, ?)", (page_id, tag_id))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"page_id": page_id, "tag_id": tag_id, "status": "attached"}
-
-
-@router.delete("/pages/{page_id}/tags/{tag_id}")
-def detach_tag_v2(page_id: int, tag_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_tags WHERE page_id=? AND tag_id=?", (page_id, tag_id))
-        conn.commit()
-    return {"status": "detached"}
-
-
-@router.get("/recents")
-def list_recents_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit = int(request.query_params.get("limit", "20"))
-    st = request.query_params.get("source_type")
-    with get_conn() as conn:
-        if st:
-            rows = conn.execute("SELECT * FROM recents WHERE user_id=? AND source_type=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], st, limit)).fetchall()
-        else:
-            rows = conn.execute("SELECT * FROM recents WHERE user_id=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], limit)).fetchall()
-    return {"recents": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/pages/{page_id}/shares")
-def list_shares_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_shares WHERE page_id=?", (page_id,)).fetchall()
-    return {"shares": [dict(r) for r in rows]}
@@ -1,195 +0,0 @@
-"""FlowDeck — Public API v2 : identity.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-import secrets
-from datetime import datetime
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _hash, _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/tokens")
-def create_token(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "API token").strip()[:100]
-    scopes = validate_scopes_input(body.get("scopes") or "read,write")
-    expires_at = body.get("expires_at")
-    # Idempotency
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    token = f"fd_{secrets.token_urlsafe(32)}"
-    prefix = token[:12]
-    th = _hash(token)
-    exp_val = None
-    if expires_at:
-        try:
-            # accept ISO string
-            exp_val = str(expires_at)
-            # validate parse
-            datetime.fromisoformat(exp_val.replace("Z", "+00:00"))
-        except Exception as err:
-            raise HTTPException(400, "Invalid expires_at, use ISO-8601") from err
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes, expires_at) VALUES (?, ?, ?, ?, ?, ?)",
-                (user["id"], name, th, prefix, scopes, exp_val),
-            )
-            conn.commit()
-            tid = cur.lastrowid
-        except Exception as e:
-            raise HTTPException(409, f"Token creation failed: {e}") from None
-        row = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, created_at FROM api_tokens WHERE id=?", (tid,)).fetchone()
-    audit_log(user, "token.create", "api_token", tid, f"scopes={scopes}", request)
-    data = {"id": tid, "name": row["name"], "token": token, "prefix": prefix, "scopes": scopes, "expires_at": to_iso8601(row["expires_at"]) if row["expires_at"] else None, "note": "Copy token now — shown once. Use as Authorization: Bearer <token>"}
-    key = (request.headers.get("Idempotency-Key") or request.headers.get("idempotency-key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 200)
-    return data
-
-
-@router.get("/tokens")
-def list_tokens(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, last_used_at, created_at, revoked FROM api_tokens WHERE user_id=? ORDER BY created_at DESC", (user["id"],)).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["created_at"] = to_iso8601(d.get("created_at"))
-        d["expires_at"] = to_iso8601(d.get("expires_at")) if d.get("expires_at") else None
-        d["last_used_at"] = to_iso8601(d.get("last_used_at")) if d.get("last_used_at") else None
-        # never expose hash
-        out.append({k: v for k, v in d.items() if k != "token_hash"})
-    return {"tokens": out}
-
-
-@router.delete("/tokens/{token_id}")
-def revoke_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, user_id FROM api_tokens WHERE id=?", (token_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Token not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your token")
-        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
-        conn.commit()
-    audit_log(user, "token.revoke", "api_token", token_id, "", request)
-    return {"id": token_id, "status": "revoked"}
-
-
-@router.post("/tokens/{token_id}/rotate")
-def rotate_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, user_id, name, scopes FROM api_tokens WHERE id=?", (token_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Token not found")
-        if row["user_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Not your token")
-        # revoke old
-        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
-        new_token = f"fd_{secrets.token_urlsafe(32)}"
-        th = _hash(new_token)
-        prefix = new_token[:12]
-        cur = conn.execute("INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes) VALUES (?, ?, ?, ?, ?)", (row["user_id"], row["name"], th, prefix, row["scopes"] or "read,write"))
-        conn.commit()
-        nid = cur.lastrowid
-    audit_log(user, "token.rotate", "api_token", token_id, f"new_id={nid}", request)
-    return {"id": nid, "token": new_token, "prefix": prefix, "scopes": row["scopes"], "note": "Copy token now — shown once"}
-
-
-@router.get("/users/me")
-def get_me(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, is_active, auth_method, sidebar_config, notification_prefs, timezone, created_at FROM users WHERE id=?", (user["id"],)).fetchone()
-        if not row:
-            raise HTTPException(404, "User not found")
-        d = row_to_dict(row)
-        # parse json prefs
-        for k in ("notification_prefs", "sidebar_config"):
-            if isinstance(d.get(k), str):
-                try:
-                    d[k] = json.loads(d[k] or "{}")
-                except Exception:
-                    logger.exception("get_me")
-        # never expose secrets
-        return d
-
-
-@router.patch("/users/me")
-def patch_me(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    allowed = {"full_name", "email", "avatar_color", "notification_prefs", "sidebar_config", "timezone"}
-    updates = {}
-    for k in allowed:
-        if k in body:
-            updates[k] = body[k]
-    if not updates:
-        raise HTTPException(400, "No updatable fields")
-    # validation
-    if "email" in updates and updates["email"] and "@" not in str(updates["email"]):
-        raise HTTPException(400, "Invalid email")
-    with get_conn() as conn:
-        sets = []
-        params = []
-        for k, v in updates.items():
-            if k in ("notification_prefs", "sidebar_config"):
-                v = json.dumps(v) if isinstance(v, (dict, list)) else str(v)
-            sets.append(f"{k}=?")
-            params.append(v)
-        params.append(user["id"])
-        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
-        conn.commit()
-        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, timezone, notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
-    audit_log(user, "user.update", "user", user["id"], "", request)
-    return row_to_dict(row)
-
-
-@router.get("/users/search")
-def search_users(request: Request, q: str = "", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (q or request.query_params.get("q") or "").strip()
-    if not q:
-        return {"users": []}
-    like = f"%{q}%"
-    with get_conn() as conn:
-        rows = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color FROM users WHERE login LIKE ? OR email LIKE ? OR full_name LIKE ? LIMIT 20", (like, like, like)).fetchall()
-    return {"users": [dict(r) for r in rows]}
@@ -1,148 +0,0 @@
-"""FlowDeck — Public API v2 : planning.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/sprints")
-def create_sprint_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Sprint").strip()
-    start = body.get("start_date") or body.get("start") or ""
-    end = body.get("end_date") or body.get("end") or ""
-    if not start or not end:
-        raise HTTPException(400, "start_date and end_date required (YYYY-MM-DD)")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO sprints (collection_id, name, start_date, end_date, goal) VALUES (?, ?, ?, ?, ?)", (collection_id, name, start, end, body.get("goal") or ""))
-        sid = cur.lastrowid
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("sprint.created", {"sprint_id": sid, "collection_id": collection_id, "name": name}))
-    except Exception:
-        logger.exception("create_sprint_v2")
-    return {"id": sid, "name": name, "status": "created"}
-
-
-@router.patch("/sprints/{sprint_id}")
-def patch_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Sprint not found")
-        name = body.get("name", row["name"])
-        start = body.get("start_date", row["start_date"])
-        end = body.get("end_date", row["end_date"])
-        goal = body.get("goal", row["goal"])
-        status = body.get("status", row["status"])
-        conn.execute("UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=? WHERE id=?", (name, start, end, goal, status, sprint_id))
-        conn.commit()
-    try:
-        run_event_sync(_fire_event("sprint.updated", {"sprint_id": sprint_id, "collection_id": row["collection_id"], "name": name, "status": status}))
-    except Exception:
-        logger.exception("patch_sprint_v2")
-    return {"id": sprint_id, "status": "updated"}
-
-
-@router.delete("/sprints/{sprint_id}")
-def delete_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM sprints WHERE id=?", (sprint_id,))
-        conn.commit()
-    return {"id": sprint_id, "status": "deleted"}
-
-
-@router.post("/sprints/{sprint_id}/assign")
-def assign_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    pid = body.get("page_id")
-    if not pid:
-        raise HTTPException(400, "page_id required")
-    with get_conn() as conn:
-        try:
-            conn.execute("INSERT INTO sprint_pages (sprint_id, page_id, velocity_points) VALUES (?, ?, ?)", (sprint_id, pid, body.get("velocity_points", 1)))
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, str(e)) from None
-    return {"sprint_id": sprint_id, "page_id": pid, "status": "assigned"}
-
-
-@router.delete("/sprints/{sprint_id}/assign/{page_id}")
-def unassign_sprint_v2(sprint_id: int, page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sprint_id, page_id))
-        conn.commit()
-    return {"status": "removed"}
-
-
-@router.get("/sprints/{sprint_id}/burndown")
-def burndown_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        s = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
-        if not s:
-            raise HTTPException(404, "Sprint not found")
-        pages = conn.execute("SELECT sp.*, cp.property_values_json FROM sprint_pages sp JOIN collection_pages cp ON cp.id=sp.page_id WHERE sp.sprint_id=?", (sprint_id,)).fetchall()
-        total = len(pages)
-        # crude: completed where status property == Done (best-effort)
-        completed = 0
-        for p in pages:
-            try:
-                pv = json.loads(p["property_values_json"] or "{}")
-                for v in pv.values():
-                    if str(v).lower() in ("done", "completed", "terminé"):
-                        completed += 1
-                        break
-            except Exception:
-                logger.exception("burndown_v2")
-        remaining = total - completed
-        # ideal linear
-        ideal = [round(total * (1 - i / 10)) for i in range(11)]
-    return {"sprint_id": sprint_id, "total": total, "completed": completed, "remaining": remaining, "ideal": ideal}
-
-
-@router.get("/collections/{collection_id}/templates")
-def list_templates_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM page_templates WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
-    return {"templates": [row_to_dict(r) for r in rows]}
@@ -1,93 +0,0 @@
-"""FlowDeck — Public API v2 : projects.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/projects")
-def list_projects_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM projects ORDER BY proj_type, owner, name").fetchall()
-    return {"projects": [row_to_dict(r) for r in rows]}
-
-
-@router.get("/projects/{owner}/{repo}/tree")
-async def project_tree_v2(owner: str, repo: str, request: Request, path: str = "", authorization: str | None = Header(default=None)):
-    get_bearer_user(request, authorization)
-    # proxy to gitea client? Return placeholder listing from projects table
-    with get_conn() as conn:
-        proj = conn.execute("SELECT * FROM projects WHERE owner=? AND name=?", (owner, repo)).fetchone()
-        if not proj:
-            raise HTTPException(404, "Project not found")
-    # delegate to gitea API if available (best-effort)
-    try:
-        from app.services.gitea_client import gitea
-        tree = await gitea.list_repo_files(owner, repo, path or "")
-        return {"owner": owner, "repo": repo, "path": path, "tree": tree}
-    except Exception:
-        return {"owner": owner, "repo": repo, "path": path, "tree": []}
-
-
-@router.get("/search")
-def search_v2(request: Request, query: str = "", workspace_id: int | None = None, type: str = "all", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    q = (query or request.query_params.get("query") or "").strip()
-    if not q:
-        return {"results": [], "query": q}
-    like = f"%{q}%"
-    with get_conn() as conn:
-        pages = []
-        # try FTS5
-        try:
-            rows = conn.execute("SELECT p.id, p.title, p.content, p.workspace_id, snippet(pages_fts, -1, '<mark>', '</mark>', '...', 32) as snippet FROM pages_fts f JOIN pages p ON p.id=f.rowid WHERE pages_fts MATCH ? LIMIT 20", (q,)).fetchall()
-            pages = [{"type": "page", "id": r["id"], "title": r["title"], "snippet": r["snippet"]} for r in rows]
-        except Exception:
-            rows = conn.execute("SELECT id, title FROM pages WHERE title LIKE ? OR content LIKE ? LIMIT 20", (like, like)).fetchall()
-            pages = [{"type": "page", "id": r["id"], "title": r["title"]} for r in rows]
-        # collections
-        colls = conn.execute("SELECT id, name FROM collections WHERE name LIKE ? LIMIT 10", (like,)).fetchall()
-        results = pages + [{"type": "collection", "id": r["id"], "title": r["name"]} for r in colls]
-    return {"query": q, "results": results}
-
-
-@router.get("/admin/users")
-def admin_list_users_v2(request: Request, limit: int = 30, offset: int = 0, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
-        raise HTTPException(403, "Admin scope required")
-    limit = max(1, min(limit, 100))
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-        rows = conn.execute("SELECT id, login, full_name, email, is_admin, is_active, created_at FROM users ORDER BY id LIMIT ? OFFSET ?", (limit, offset)).fetchall()
-    return {"users": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
@@ -1,151 +0,0 @@
-"""FlowDeck — Public API v2 : properties.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/properties")
-def create_property_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    ptype = body.get("prop_type") or body.get("type") or "text"
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        try:
-            cur = conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, number_format, position, required, visible_in_views, validation_json, group_name) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", (collection_id, name, ptype, json.dumps(body.get("options") or []), body.get("number_format") or "number", max_pos, int(bool(body.get("required"))), int(bool(body.get("visible_in_views", True))), json.dumps(body.get("validation") or {}), (body.get("group_name") or "").strip()))
-            conn.commit()
-            pid = cur.lastrowid
-        except Exception as e:
-            raise HTTPException(409, f"Property exists: {e}") from None
-    audit_log(user, "property.create", "property", pid, name, request)
-    return {"id": pid, "name": name, "prop_type": ptype, "status": "created"}
-
-
-@router.patch("/properties/{prop_id}")
-def patch_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Property not found")
-        name = body.get("name", row["name"])
-        opts = json.dumps(body.get("options", json.loads(row["options_json"] or "[]")))
-        nf = body.get("number_format", row["number_format"])
-        req = int(bool(body.get("required", row["required"])))
-        vis = int(bool(body.get("visible_in_views", row["visible_in_views"])))
-        vj = json.dumps(body.get("validation", json.loads(row["validation_json"] or "{}"))) if "validation" in body else (row["validation_json"] if "validation_json" in row.keys() else "{}")
-        grp = body.get("group_name", row["group_name"] if "group_name" in row.keys() else "")
-        conn.execute("UPDATE collection_properties SET name=?, options_json=?, number_format=?, required=?, visible_in_views=?, validation_json=?, group_name=? WHERE id=?", (name, opts, nf, req, vis, vj, grp, prop_id))
-        conn.commit()
-    audit_log(user, "property.update", "property", prop_id, "", request)
-    return {"id": prop_id, "status": "updated"}
-
-
-@router.delete("/properties/{prop_id}")
-def delete_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_properties WHERE id=?", (prop_id,)).fetchone():
-            raise HTTPException(404, "Property not found")
-        conn.execute("DELETE FROM collection_properties WHERE id=?", (prop_id,))
-        conn.commit()
-    audit_log(user, "property.delete", "property", prop_id, "", request)
-    return {"id": prop_id, "status": "deleted"}
-
-
-@router.post("/properties/{prop_id}/relation")
-def create_relation_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    related_id = body.get("related_collection_id")
-    reverse = (body.get("reverse_name") or "").strip()
-    if not related_id:
-        raise HTTPException(400, "related_collection_id required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT collection_id FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Property not found")
-        conn.execute("UPDATE collection_properties SET prop_type='relation', related_collection_id=?, reverse_name=? WHERE id=?", (related_id, reverse, prop_id))
-        if reverse:
-            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (related_id,)).fetchone()[0]
-            try:
-                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, related_collection_id, reverse_name, position) VALUES (?, ?, 'relation', ?, ?, ?)", (related_id, reverse, row["collection_id"], "", max_pos))
-            except Exception:
-                logger.exception("create_relation_v2")
-        conn.commit()
-    return {"id": prop_id, "status": "updated"}
-
-
-@router.post("/properties/evaluate-formula")
-def evaluate_formula_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    expr = body.get("expression") or body.get("formula")
-    if not expr:
-        raise HTTPException(400, "expression required")
-    ctx = body.get("context") or {}
-    try:
-        from app.services.formula_engine import FormulaEngine
-        res = FormulaEngine().evaluate(expr, ctx)
-    except Exception as e:
-        raise HTTPException(400, f"Formula error: {e}") from None
-    return {"result": res, "expression": expr}
-
-
-@router.post("/properties/compute-rollup")
-def compute_rollup_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    for k in ("collection_id", "relation_property_id", "target_property_id", "page_id"):
-        if k not in body:
-            raise HTTPException(400, f"{k} required")
-    try:
-        from app.services.rollup_engine import RollupEngine
-        res = RollupEngine().compute(body["collection_id"], body["relation_property_id"], body["target_property_id"], body["page_id"], body.get("function", "count"))
-    except Exception as e:
-        raise HTTPException(400, f"Rollup error: {e}") from None
-    return {"result": res}
-
-
-@router.get("/collections/{collection_id}/views")
-def list_views_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM collection_views WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    return {"views": [row_to_dict(r) for r in rows]}
@@ -1,160 +0,0 @@
-"""FlowDeck — Public API v2 : sharing.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-from app.services.publish import fire_published, fire_unpublished, publish, unpublish
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/pages/{page_id}/shares")
-def create_share_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    perm = (body.get("permission") or "view").strip().lower()
-    if perm not in ("view", "comment", "edit"):
-        raise HTTPException(400, "Invalid permission. Use view, comment, or edit")
-    email = (body.get("email") or "").strip()
-    uid = body.get("user_id")
-    if not email and not uid:
-        raise HTTPException(400, "email or user_id required")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by) VALUES (?, ?, ?, ?, ?)", (page_id, uid, email, perm, user["id"]))
-        conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
-        conn.commit()
-        nid = cur.lastrowid
-    audit_log(user, "share.create", "share", nid, f"page={page_id}", request)
-    try:
-        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": nid, "permission": perm}))
-    except Exception:
-        logger.exception("create_share_v2")
-    return {"id": nid, "page_id": page_id, "status": "shared"}
-
-
-@router.patch("/shares/{share_id}")
-def patch_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    perm = (body.get("permission") or "").strip().lower()
-    if perm not in ("view", "comment", "edit"):
-        raise HTTPException(400, "Invalid permission")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM page_shares WHERE id=?", (share_id,)).fetchone():
-            raise HTTPException(404, "Share not found")
-        conn.execute("UPDATE page_shares SET permission=? WHERE id=?", (perm, share_id))
-        conn.commit()
-    return {"id": share_id, "status": "updated"}
-
-
-@router.delete("/shares/{share_id}")
-def delete_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT page_id FROM page_shares WHERE id=?", (share_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Share not found")
-        conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
-        # unset is_shared if no shares left
-        cnt = conn.execute("SELECT COUNT(*) FROM page_shares WHERE page_id=?", (row["page_id"],)).fetchone()[0]
-        if cnt == 0:
-            conn.execute("UPDATE pages SET is_shared=0 WHERE id=?", (row["page_id"],))
-        conn.commit()
-    return {"id": share_id, "status": "revoked"}
-
-
-@router.post("/pages/{page_id}/publish")
-def publish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    slug_in = (body.get("slug") or body.get("publish_slug") or "").strip() or None
-    slug, _title = publish(page_id, explicit_slug=slug_in)
-    audit_log(user, "page.publish", "page", page_id, slug, request)
-    run_event_sync(fire_published(page_id, slug))
-    return {"page_id": page_id, "slug": slug, "url": f"/p/{slug}", "status": "published"}
-
-
-@router.delete("/pages/{page_id}/publish")
-def unpublish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    unpublish(page_id)
-    run_event_sync(fire_unpublished(page_id))
-    return {"page_id": page_id, "status": "unpublished"}
-
-
-@router.get("/pages/{page_id}/history")
-def list_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT h.*, u.login FROM page_history h LEFT JOIN users u ON u.id=h.user_id WHERE h.page_id=? ORDER BY h.created_at DESC", (page_id,)).fetchall()
-        # also page_versions for block pages
-        vrows = conn.execute("SELECT * FROM page_versions WHERE page_id=? ORDER BY created_at DESC", (page_id,)).fetchall()
-    return {"history": [row_to_dict(r) for r in rows], "versions": [row_to_dict(r) for r in vrows]}
-
-
-@router.post("/pages/{page_id}/history/restore")
-def restore_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    hid = body.get("history_id") or body.get("id") or body.get("version_id")
-    if not hid:
-        raise HTTPException(400, "history_id required")
-    with get_conn() as conn:
-        h = conn.execute("SELECT * FROM page_versions WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
-        if h:
-            conn.execute("UPDATE pages SET content=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (h["blocks_json"], h["title"], page_id))
-            conn.commit()
-            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
-        h2 = conn.execute("SELECT * FROM page_history WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
-        if h2:
-            try:
-                snap = json.loads(h2["snapshot_json"] or "{}")
-            except Exception:
-                snap = {}
-            # best-effort restore content
-            if snap.get("content"):
-                conn.execute("UPDATE pages SET content=? WHERE id=?", (snap["content"], page_id))
-                conn.commit()
-            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
-        raise HTTPException(404, "History not found")
-
-
-@router.get("/collections/{collection_id}/sprints")
-def list_sprints_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM sprints WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        rows = conn.execute("SELECT * FROM sprints WHERE collection_id=? ORDER BY created_at DESC LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
-    return {"sprints": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
@@ -1,205 +0,0 @@
-"""FlowDeck — Public API v2 : templates_io.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import Response
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/templates")
-def create_template_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Template").strip()
-    pv = json.dumps(body.get("property_values") or body.get("property_values_json") or {})
-    cj = json.dumps(body.get("content") or body.get("content_json") or [])
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO page_templates (collection_id, name, property_values_json, content_json) VALUES (?, ?, ?, ?)", (collection_id, name, pv, cj))
-        tid = cur.lastrowid
-        conn.commit()
-    return {"id": tid, "name": name, "status": "created"}
-
-
-@router.patch("/templates/{template_id}")
-def patch_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Template not found")
-        name = body.get("name", row["name"])
-        pv = json.dumps(body.get("property_values", json.loads(row["property_values_json"] or "{}"))) if "property_values" in body else row["property_values_json"]
-        cj = json.dumps(body.get("content", json.loads(row["content_json"] or "[]"))) if "content" in body else row["content_json"]
-        conn.execute("UPDATE page_templates SET name=?, property_values_json=?, content_json=? WHERE id=?", (name, pv, cj, template_id))
-        conn.commit()
-    return {"id": template_id, "status": "updated"}
-
-
-@router.delete("/templates/{template_id}")
-def delete_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_templates WHERE id=?", (template_id,))
-        conn.commit()
-    return {"id": template_id, "status": "deleted"}
-
-
-@router.post("/templates/{template_id}/apply")
-def apply_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        tpl = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
-        if not tpl:
-            raise HTTPException(404, "Template not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (tpl["collection_id"],)).fetchone()[0]
-        pv = tpl["property_values_json"] or "{}"
-        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (tpl["collection_id"], tpl["name"], max_pos, pv))
-        pid = cur.lastrowid
-        conn.commit()
-    return {"template_id": template_id, "page_id": pid, "status": "applied"}
-
-
-@router.get("/templates/database")
-def list_db_templates_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM database_templates ORDER BY name").fetchall()
-    return {"templates": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/templates/database/{template_id}/apply")
-def apply_db_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        tpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (template_id,)).fetchone()
-        if not tpl:
-            raise HTTPException(404, "Template not found")
-        name = (body.get("name") or tpl["name"]).strip()
-        schema = json.loads(tpl["schema_json"] or "[]")
-        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, tpl["description"], tpl["icon"] if "icon" in tpl.keys() else "📋", json.dumps(schema), body.get("workspace_id"), user["id"]))
-        cid = cur.lastrowid
-        # A25 : pas de try — un échec de matérialisation doit interrompre la
-        # transaction plutôt que de commiter une collection sans schéma.
-        from app.services.db_templates import materialize_properties
-        materialize_properties(conn, cid, schema)
-        conn.commit()
-    return {"collection_id": cid, "name": name, "status": "created"}
-
-
-@router.get("/pages/{page_id}/export")
-def export_page_v2(page_id: int, request: Request, format: str = "markdown", authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    fmt = (format or request.query_params.get("format") or "markdown").lower()
-    if fmt not in ("markdown", "html", "pdf"):
-        raise HTTPException(400, "format must be markdown, html or pdf")
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            # try collection_pages
-            row2 = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-            if not row2:
-                raise HTTPException(404, "Page not found")
-            # collection pages: return JSON
-            return {"page": row_to_dict(row2), "format": fmt}
-        # block pages: delegate to export service
-        from app.services.export import export_page as _export
-        try:
-            data, mime, fname = _export(row, fmt)  # type: ignore
-            return Response(content=data, media_type=mime, headers={"Content-Disposition": f'attachment; filename="{fname}"'})
-        except Exception as e:
-            raise HTTPException(500, f"Export failed: {e}") from None
-
-
-@router.get("/collections/{collection_id}/export/csv")
-def export_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    import csv
-    import io
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        props = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()]
-        rows = conn.execute("SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
-    out = io.StringIO()
-    writer = csv.writer(out)
-    header = ["Title"] + [p["name"] for p in props]
-    writer.writerow(header)
-    for r in rows:
-        try:
-            pv = json.loads(r["property_values_json"] or "{}")
-        except Exception:
-            pv = {}
-        vals = [r["title"]]
-        for p in props:
-            vals.append(str(pv.get(str(p["id"])) or pv.get(p["name"]) or ""))
-        writer.writerow(vals)
-    return Response(content=out.getvalue().encode("utf-8"), media_type="text/csv", headers={"Content-Disposition": f'attachment; filename="collection-{collection_id}.csv"'})
-
-
-@router.post("/collections/{collection_id}/import/csv")
-async def import_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    try:
-        form = await request.form()
-        file = form.get("file")
-        data = await file.read() if file else b""
-        text = data.decode("utf-8", errors="ignore")
-    except Exception as err:
-        raise HTTPException(400, "file required (multipart)") from err
-    import csv
-    import io
-    reader = csv.DictReader(io.StringIO(text))
-    created = 0
-    with get_conn() as conn:
-        for row in reader:
-            title = row.get("Title") or row.get("title") or "Untitled"
-            # map remaining columns to property names
-            pv = {}
-            # resolve prop name -> id
-            props = {p["name"]: p["id"] for p in conn.execute("SELECT id, name FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()}
-            for k, v in row.items():
-                if k in ("Title", "title"):
-                    continue
-                pid = props.get(k)
-                if pid:
-                    pv[str(pid)] = v
-            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
-            conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (collection_id, title, max_pos, json.dumps(pv)))
-            created += 1
-        conn.commit()
-    return {"imported": created, "status": "ok"}
@@ -1,164 +0,0 @@
-"""FlowDeck — Public API v2 : views.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.post("/collections/{collection_id}/views")
-def create_view_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "New View").strip()
-    vtype = body.get("view_type") or body.get("type") or "table"
-    config = body.get("config") or body.get("config_json") or {}
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
-            raise HTTPException(404, "Collection not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (collection_id,)).fetchone()[0]
-        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, name, vtype, json.dumps(config), max_pos, user["id"]))
-        vid = cur.lastrowid
-        conn.commit()
-    audit_log(user, "view.create", "view", vid, name, request)
-    try:
-        run_event_sync(_fire_event("collection.view.created", {"view_id": vid, "collection_id": collection_id, "name": name, "view_type": vtype}))
-    except Exception:
-        logger.exception("create_view_v2")
-    return {"id": vid, "name": name, "view_type": vtype, "status": "created"}
-
-
-@router.patch("/views/{view_id}")
-def patch_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "View not found")
-        cfg = json.loads(row["config_json"] or "{}")
-        if "config" in body:
-            cfg.update(body["config"])
-        elif "config_json" in body:
-            try:
-                cfg.update(json.loads(body["config_json"]) if isinstance(body["config_json"], str) else body["config_json"])
-            except Exception:
-                logger.exception("patch_view_v2")
-        # also flat keys
-        for k in ("group_by", "sub_group_by", "wip_limits", "card_size", "cover_property", "cover_mode", "card_properties", "visible_properties", "filters", "sorts", "date_property"):
-            if k in body:
-                cfg[k] = body[k]
-        name = body.get("name", row["name"])
-        vtype = body.get("view_type") or body.get("type") or row["view_type"]
-        conn.execute("UPDATE collection_views SET name=?, view_type=?, config_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, vtype, json.dumps(cfg), view_id))
-        conn.commit()
-    audit_log(user, "view.update", "view", view_id, "", request)
-    return {"id": view_id, "status": "updated"}
-
-
-@router.delete("/views/{view_id}")
-def delete_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM collection_views WHERE id=?", (view_id,)).fetchone():
-            raise HTTPException(404, "View not found")
-        conn.execute("DELETE FROM collection_views WHERE id=?", (view_id,))
-        conn.commit()
-    audit_log(user, "view.delete", "view", view_id, "", request)
-    return {"id": view_id, "status": "deleted"}
-
-
-@router.post("/views/{view_id}/save-as")
-def save_as_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "").strip() or "Copy"
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "View not found")
-        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (row["collection_id"],)).fetchone()[0]
-        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (row["collection_id"], name, row["view_type"], row["config_json"], max_pos, user["id"]))
-        nid = cur.lastrowid
-        conn.commit()
-    return {"id": nid, "name": name, "status": "created"}
-
-
-@router.get("/collections/{collection_id}/dashboards")
-def list_dashboards_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM collection_dashboards WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
-    return {"dashboards": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/collections/{collection_id}/dashboards")
-def create_dashboard_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    name = (body.get("name") or "Dashboard").strip()
-    layout = body.get("layout") or body.get("layout_json") or {"columns": 1, "widgets": []}
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO collection_dashboards (collection_id, name, layout_json) VALUES (?, ?, ?)", (collection_id, name, json.dumps(layout)))
-        did = cur.lastrowid
-        conn.commit()
-    return {"id": did, "name": name, "status": "created"}
-
-
-@router.patch("/dashboards/{dashboard_id}")
-def patch_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_dashboards WHERE id=?", (dashboard_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Dashboard not found")
-        name = body.get("name", row["name"])
-        layout = body.get("layout") or body.get("layout_json")
-        if layout is not None:
-            layout_json = json.dumps(layout)
-        else:
-            layout_json = row["layout_json"]
-        conn.execute("UPDATE collection_dashboards SET name=?, layout_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, layout_json, dashboard_id))
-        conn.commit()
-    return {"id": dashboard_id, "status": "updated"}
-
-
-@router.delete("/dashboards/{dashboard_id}")
-def delete_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM collection_dashboards WHERE id=?", (dashboard_id,))
-        conn.commit()
-    return {"id": dashboard_id, "status": "deleted"}
@@ -1,195 +0,0 @@
-"""FlowDeck — Public API v2 : webhooks.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/webhooks")
-def list_webhooks_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) AS n FROM webhook_subscriptions").fetchone()["n"]
-        rows = conn.execute(
-            "SELECT * FROM webhook_subscriptions ORDER BY created_at DESC LIMIT ? OFFSET ?",
-            (limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"webhooks": [dict(r) for r in rows]},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/webhooks")
-def create_webhook_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    from app.services.webhook_outbound import EVENTS, _event_matches
-    url = (body.get("url") or "").strip()
-    event = (body.get("event") or "page.created").strip()
-    secret = (body.get("secret") or "").strip()
-    if not url or not url.startswith("http"):
-        raise HTTPException(400, "url must start with http")
-    if not event or (event not in EVENTS and not (event.endswith(".*") or event in ("*", "all"))):
-        raise HTTPException(400, f"Unknown event '{event}'. See GET /api/v2/webhooks/events")
-    # make sure the pattern matches at least one known event
-    if not any(_event_matches(event, e) for e in EVENTS):
-        raise HTTPException(400, f"Event pattern '{event}' matches no known event")
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO webhook_subscriptions (url, event, secret) VALUES (?, ?, ?)", (url, event, secret))
-        wid = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (wid,)).fetchone()
-    audit_log(user, "webhook.create", "webhook", wid, url, request)
-    return {"id": wid, "status": "created", "webhook": dict(row) if row else {},
-            "signature_header": "X-FlowDeck-Signature (HMAC-SHA256, sha256=<hex>)" if secret else None}
-
-
-@router.patch("/webhooks/{webhook_id}")
-def patch_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Webhook not found")
-        url = body.get("url", row["url"])
-        event = body.get("event", row["event"])
-        secret = body.get("secret", row["secret"])
-        active = int(bool(body.get("active", row["active"])))
-        conn.execute("UPDATE webhook_subscriptions SET url=?, event=?, secret=?, active=? WHERE id=?", (url, event, secret, active, webhook_id))
-        conn.commit()
-    audit_log(user, "webhook.update", "webhook", webhook_id, "", request)
-    return {"id": webhook_id, "status": "updated"}
-
-
-@router.delete("/webhooks/{webhook_id}")
-def delete_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM webhook_subscriptions WHERE id=?", (webhook_id,))
-        conn.commit()
-    audit_log(user, "webhook.delete", "webhook", webhook_id, "", request)
-    return {"id": webhook_id, "status": "deleted"}
-
-
-@router.post("/webhooks/{webhook_id}/test")
-async def test_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Webhook not found")
-        # live delivery via the prod dispatcher (HMAC + retry + journal),
-        # direct to this subscription only (no wildcard fan-out)
-        from app.services.webhook_outbound import deliver_to_sub
-        ok = await deliver_to_sub(webhook_id, row["url"], "ping",
-                                  {"webhook_id": webhook_id, "test": True},
-                                  row["secret"] or "")
-    audit_log(user, "webhook.test", "webhook", webhook_id, f"ok={ok}", request)
-    return {"webhook_id": webhook_id, "status": "tested", "delivered": ok}
-
-
-@router.get("/webhooks/{webhook_id}/deliveries")
-def list_deliveries_v2(webhook_id: int, request: Request,
-                              status: str | None = None,
-                              authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        if status:
-            total = conn.execute(
-                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=? AND status=?",
-                (webhook_id, status)).fetchone()["n"]
-            rows = conn.execute(
-                "SELECT * FROM webhook_deliveries WHERE webhook_id=? AND status=? "
-                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
-                (webhook_id, status, limit, offset)).fetchall()
-        else:
-            total = conn.execute(
-                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=?",
-                (webhook_id,)).fetchone()["n"]
-            rows = conn.execute(
-                "SELECT * FROM webhook_deliveries WHERE webhook_id=? "
-                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
-                (webhook_id, limit, offset)).fetchall()
-    return JSONResponse(
-        content={"deliveries": [row_to_dict(r) for r in rows]},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/webhooks/{webhook_id}/retry")
-async def retry_webhook_deliveries(webhook_id: int, request: Request,
-                                    authorization: str | None = Header(default=None)):
-    """Manually retry failed deliveries for a webhook."""
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-
-    from app.services.webhook_outbound import retry_due_deliveries
-
-    with get_conn() as conn:
-        # Force retry by setting next_retry_at to the past
-        conn.execute(
-            """UPDATE webhook_deliveries
-               SET next_retry_at = strftime('%s', 'now', '-1 second')
-               WHERE webhook_id = ? AND status = 'retrying'""",
-            (webhook_id,),
-        )
-        conn.commit()
-
-    retried = await retry_due_deliveries()
-    audit_log(user, "webhook.retry", "webhook", webhook_id, f"retried={retried}", request)
-    return {"webhook_id": webhook_id, "status": "retried", "retried_count": retried}
-
-
-@router.post("/webhooks/verify-signature")
-def verify_webhook_signature(request: Request,
-                                    authorization: str | None = Header(default=None),
-                                    body: dict = Body(default={})):
-    """Verify a webhook signature (for debugging/testing)."""
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-
-    from app.services.webhook_outbound import verify_signature
-
-    secret = body.get("secret", "")
-    payload = body.get("payload", "{}")
-    signature = body.get("signature", "")
-
-    is_valid = verify_signature(secret, payload.encode(), signature)
-
-    audit_log(user, "webhook.signature_verify", "webhook", 0, f"valid={is_valid}", request)
-    return {"valid": is_valid, "secret": secret[:10] + "..." if len(secret) > 10 else secret}
@@ -1,230 +0,0 @@
-"""FlowDeck — Public API v2 : workspaces.
-
-Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    require_scope,
-    row_to_dict,
-    store_idempotency,
-    to_iso8601,
-    validate_scopes_input,
-)
-
-from ._common import _v2_rate_check
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api-v2"])
-
-
-
-@router.get("/workspaces")
-def list_workspaces(request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute("SELECT COUNT(*) FROM workspaces WHERE owner_id=? OR id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?)", (user["id"], user["id"])).fetchone()[0]
-        rows = conn.execute("SELECT w.*, wm.role FROM workspaces w LEFT JOIN workspace_members wm ON wm.workspace_id=w.id AND wm.user_id=? WHERE w.owner_id=? OR w.id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?) ORDER BY w.created_at DESC LIMIT ? OFFSET ?", (user["id"], user["id"], user["id"], limit, offset)).fetchall()
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["created_at"] = to_iso8601(d.get("created_at"))
-        try:
-            d["settings"] = json.loads(d.get("settings_json") or "{}")
-        except Exception:
-            d["settings"] = {}
-        out.append(d)
-    return {"workspaces": out, "total": total, "limit": limit, "offset": offset}
-
-
-@router.post("/workspaces")
-def create_workspace(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    settings_json = json.dumps(body.get("settings") or body.get("settings_json") or {})
-    with get_conn() as conn:
-        cur = conn.execute("INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)", (name, user["id"], settings_json))
-        wid = cur.lastrowid
-        # owner is implicitly admin member
-        try:
-            conn.execute("INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')", (wid, user["id"]))
-        except Exception:
-            logger.exception("create_workspace")
-        conn.commit()
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (wid,)).fetchone()
-    audit_log(user, "workspace.create", "workspace", wid, name, request)
-    data = {"id": wid, "name": name, "owner_id": user["id"], "status": "created", "workspace": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 200)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/workspaces/{workspace_id}")
-def get_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        # ACL: must be member or owner
-        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-        is_owner = row["owner_id"] == user["id"]
-        if not is_owner and not member and not user.get("is_admin"):
-            raise HTTPException(404, "Workspace not found")
-        members = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
-    d = row_to_dict(row)
-    d["members"] = [dict(m) for m in members]
-    return d
-
-
-@router.patch("/workspaces/{workspace_id}")
-def patch_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        if row["owner_id"] != user["id"] and not user.get("is_admin"):
-            # check admin member
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can edit workspace")
-        name = body.get("name", row["name"])
-        sj = body.get("settings_json") or body.get("settings")
-        if sj is not None:
-            sj = json.dumps(sj) if isinstance(sj, (dict, list)) else str(sj)
-        else:
-            sj = row["settings_json"]
-        conn.execute("UPDATE workspaces SET name=?, settings_json=? WHERE id=?", (name, sj, workspace_id))
-        conn.commit()
-    audit_log(user, "workspace.update", "workspace", workspace_id, "", request)
-    return {"id": workspace_id, "status": "updated"}
-
-
-@router.delete("/workspaces/{workspace_id}")
-def delete_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        if row["owner_id"] != user["id"] and not user.get("is_admin"):
-            raise HTTPException(403, "Only owner can delete workspace")
-        conn.execute("DELETE FROM workspaces WHERE id=?", (workspace_id,))
-        conn.commit()
-    audit_log(user, "workspace.delete", "workspace", workspace_id, "", request)
-    return {"id": workspace_id, "status": "deleted"}
-
-
-@router.get("/workspaces/{workspace_id}/members")
-def list_workspace_members(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = get_bearer_user(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        rows = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
-    return {"members": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/workspaces/{workspace_id}/members")
-def invite_member(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    target_id = body.get("user_id") or body.get("uid")
-    email = (body.get("email") or "").strip()
-    role = (body.get("role") or "editor").strip().lower()
-    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
-        raise HTTPException(400, "Invalid role")
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        # only owner/admin can invite
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can invite")
-        uid = target_id
-        if not uid and email:
-            u = conn.execute("SELECT id FROM users WHERE email=?", (email,)).fetchone()
-            if not u:
-                raise HTTPException(404, f"User with email {email} not found")
-            uid = u["id"]
-        if not uid:
-            raise HTTPException(400, "user_id or email required")
-        try:
-            conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)", (workspace_id, uid, role))
-        except Exception:
-            conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
-        conn.commit()
-    audit_log(user, "workspace.invite", "workspace", workspace_id, f"uid={uid} role={role}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "added"}
-
-
-@router.patch("/workspaces/{workspace_id}/members/{uid}")
-def update_member_role(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    role = (body.get("role") or "").strip().lower()
-    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
-        raise HTTPException(400, "Invalid role")
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can change roles")
-        conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
-        if conn.total_changes == 0:
-            raise HTTPException(404, "Member not found")
-        conn.commit()
-    audit_log(user, "workspace.role_change", "workspace", workspace_id, f"uid={uid} role={role}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "updated"}
-
-
-@router.delete("/workspaces/{workspace_id}/members/{uid}")
-def remove_member(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None)):
-    user = require_scope("write")(request, authorization)
-    _v2_rate_check(request, user)
-    with get_conn() as conn:
-        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not ws:
-            raise HTTPException(404, "Workspace not found")
-        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
-            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
-            if not mem or mem["role"] not in ("owner", "admin"):
-                raise HTTPException(403, "Only owner/admin can remove members")
-        conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, uid))
-        conn.commit()
-    audit_log(user, "workspace.remove_member", "workspace", workspace_id, f"uid={uid}", request)
-    return {"workspace_id": workspace_id, "user_id": uid, "status": "removed"}
@@ -1,660 +0,0 @@
-"""FlowDeck — Public API v2 : Agent & Skill marketplace (v6.6.0, phase 5).
-
-Thin Bearer+scopes wrappers over the existing agent logic (AgentEngine,
-`agent_skills`, the gallery service) so third-party integrations can drive
-FlowDeck Agent without a browser session:
-
-* ``/api/v2/agents`` — agents CRUD, conversations, synchronous runs (JSON,
-  the SSE stream stays an internal/UI concern), audit journal & rollback.
-* ``/api/v2/skills`` — the skill marketplace: CRUD, portable export/import and
-  the built-in gallery of installable presets.
-
-Rules honoured (see docs/API_GUIDE_V6.md): one code path (the engine and the
-gallery service are reused, never re-implemented), JSON only, no secrets or
-internal columns, rate limit + audit + idempotency on every mutation.
-"""
-from __future__ import annotations
-
-import json
-import time
-
-from fastapi import APIRouter, Header, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.db import get_conn
-from app.routers.agent import _default_agent
-from app.services import skill_gallery
-from app.services.agent_engine import AgentEngine, undo_action
-from app.services.api_v2_helpers import (
-    audit_log,
-    check_idempotency,
-    check_v2_rate_limit,
-    get_bearer_user,
-    has_scope,
-    paginate_headers,
-    parse_pagination,
-    row_to_dict,
-    store_idempotency,
-)
-from app.services.llm_client import LLMClient
-from app.services.llm_config import get_user_llm_key
-
-router = APIRouter(prefix="/api/v2", tags=["api-v2-agent"])
-
-
-# ── Shared guards ──────────────────────────────────────────────────────────
-
-def _guard(request: Request, authorization: str | None, *, write: bool = False) -> dict:
-    """Bearer auth + per-token rate limit (+ write scope when required)."""
-    user = get_bearer_user(request, authorization)
-    ip = request.client.host if request.client else "unknown"
-    if not check_v2_rate_limit(user.get("_token_hash"), ip):
-        raise HTTPException(429, "Rate limit exceeded: 300 req/min per token")
-    if write and not has_scope(user.get("_token_scopes"), "write"):
-        raise HTTPException(403, "Insufficient scope. Required: write")
-    return user
-
-
-async def _json_body(request: Request) -> dict:
-    try:
-        body = await request.json()
-    except Exception:  # noqa: BLE001
-        return {}
-    return body if isinstance(body, dict) else {}
-
-
-def _workspace_of(request: Request, body: dict | None = None) -> int | None:
-    """Workspace resolution mirrors the internal agent router: explicit param
-    wins, then the token's own workspace, else NULL (shared/global scope)."""
-    body = body or {}
-    raw = body.get("workspace_id") or request.query_params.get("workspace_id")
-    if raw is None:
-        return None
-    try:
-        return int(raw)
-    except (TypeError, ValueError):
-        return None
-
-
-def _owned_conversation(conn, conversation_id: int, user_id: int):
-    """Conversation visible to this token's user (ownership is enforced here,
-    unlike the session router where the browser is already authenticated)."""
-    return conn.execute(
-        "SELECT * FROM agent_conversations WHERE id=? AND user_id=?",
-        (conversation_id, user_id),
-    ).fetchone()
-
-
-def _engine_for(user_id: int, workspace_id: int | None, provider: str | None) -> AgentEngine:
-    engine = AgentEngine(user_id, workspace_id=workspace_id)
-    if provider:
-        user_key = get_user_llm_key(user_id, provider)
-        if user_key and user_key.get("api_key"):
-            engine.llm = LLMClient(
-                provider=provider,
-                api_key=user_key["api_key"],
-                api_base=user_key.get("api_base") or None,
-            )
-        else:
-            engine.llm = LLMClient(provider=provider)
-    return engine
-
-
-# ── Agents ─────────────────────────────────────────────────────────────────
-
-@router.get("/agents")
-def list_agents_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    ws = _workspace_of(request)
-    with get_conn() as conn:
-        _default_agent(conn, user["id"])
-        clause = "WHERE workspace_id IS ? OR workspace_id=?"
-        total = conn.execute(f"SELECT COUNT(*) FROM agents {clause}", (ws, ws)).fetchone()[0]
-        rows = conn.execute(
-            f"SELECT * FROM agents {clause} ORDER BY agent_type, name LIMIT ? OFFSET ?",
-            (ws, ws, limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"agents": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/agents")
-async def create_agent_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    name = (body.get("name") or "").strip() or "Custom Agent"
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        try:
-            cur = conn.execute(
-                """INSERT INTO agents (workspace_id, name, icon, agent_type, description,
-                       system_instructions, model, scope_json, trigger_json, approval_mode, created_by)
-                   VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
-                (ws, name, body.get("icon", "🤖"), body.get("agent_type", "custom"),
-                 body.get("description", ""), body.get("system_instructions", ""),
-                 body.get("model", "gpt-4o"),
-                 json.dumps(body.get("scope", {})), json.dumps(body.get("trigger", {})),
-                 body.get("approval_mode", "auto"), user["id"]),
-            )
-            conn.commit()
-            agent_id = cur.lastrowid
-            row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        except Exception as exc:  # noqa: BLE001
-            raise HTTPException(409, f"Cannot create agent: {exc}") from exc
-    audit_log(user, "agent.create", "agent", agent_id, name, request)
-    data = {"id": agent_id, "name": name, "status": "created", "agent": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-# v7.46.0 : `{agent_id:int}` — sans le contrainte de type, la routeparametrée
-# enregistree AVANT `/agents/conversations` capturait le segment « conversations »
-# et renvoyait 422 (int_parsing) au lieu de la liste des conversations.
-@router.get("/agents/{agent_id:int}")
-def get_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Agent not found")
-    return row_to_dict(row)
-
-
-@router.put("/agents/{agent_id:int}")
-async def update_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    with get_conn() as conn:
-        existing = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        if not existing:
-            raise HTTPException(404, "Agent not found")
-        sets, params = [], []
-        for col in ("name", "icon", "description", "system_instructions", "model",
-                    "approval_mode", "is_active"):
-            if col in body:
-                sets.append(f"{col}=?")
-                params.append(body[col])
-        if "scope" in body:
-            sets.append("scope_json=?")
-            params.append(json.dumps(body["scope"]))
-        if "trigger" in body:
-            sets.append("trigger_json=?")
-            params.append(json.dumps(body["trigger"]))
-        if sets:
-            params.append(agent_id)
-            conn.execute(f"UPDATE agents SET {', '.join(sets)} WHERE id=?", params)
-            conn.commit()
-    audit_log(user, "agent.update", "agent", agent_id, "", request)
-    return {"id": agent_id, "status": "updated"}
-
-
-@router.delete("/agents/{agent_id:int}")
-def delete_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone():
-            raise HTTPException(404, "Agent not found")
-        conn.execute("DELETE FROM agents WHERE id=?", (agent_id,))
-        conn.commit()
-    audit_log(user, "agent.delete", "agent", agent_id, "", request)
-    return {"id": agent_id, "status": "deleted"}
-
-
-# ── Conversations (static paths declared before /agents/{agent_id}) ────────
-
-@router.get("/agents/conversations")
-def list_conversations_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    with get_conn() as conn:
-        total = conn.execute(
-            "SELECT COUNT(*) FROM agent_conversations WHERE user_id=?", (user["id"],)
-        ).fetchone()[0]
-        rows = conn.execute(
-            """SELECT * FROM agent_conversations WHERE user_id=?
-               ORDER BY updated_at DESC LIMIT ? OFFSET ?""",
-            (user["id"], limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"conversations": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/agents/conversations")
-async def create_conversation_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    agent_id = body.get("agent_id")
-    with get_conn() as conn:
-        if agent_id is not None:
-            agent = conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone()
-            if not agent:
-                raise HTTPException(404, "Agent not found")
-            agent_id = agent["id"]
-        else:
-            agent_id = _default_agent(conn, user["id"])["id"]
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json, provider, model)
-               VALUES (?,?,?,?,?,?)""",
-            (agent_id, user["id"], body.get("title") or "New conversation",
-             json.dumps({"workspace_id": ws}),
-             body.get("provider") or "", body.get("model") or ""),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-        row = conn.execute("SELECT * FROM agent_conversations WHERE id=?", (conv_id,)).fetchone()
-    audit_log(user, "agent.conversation.create", "agent_conversation", conv_id, "", request)
-    data = {"id": conv_id, "status": "created", "conversation": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201)
-    return JSONResponse(content=data, status_code=201)
-
-
-@router.get("/agents/conversations/{conversation_id}")
-def get_conversation_v2(conversation_id: int, request: Request,
-                              authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    with get_conn() as conn:
-        conv = _owned_conversation(conn, conversation_id, user["id"])
-        if not conv:
-            raise HTTPException(404, "Conversation not found")
-        messages = conn.execute(
-            "SELECT * FROM agent_messages WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    return {"conversation": row_to_dict(conv), "messages": [row_to_dict(m) for m in messages]}
-
-
-@router.delete("/agents/conversations/{conversation_id}")
-def delete_conversation_v2(conversation_id: int, request: Request,
-                                 authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        if not _owned_conversation(conn, conversation_id, user["id"]):
-            raise HTTPException(404, "Conversation not found")
-        conn.execute("DELETE FROM agent_conversations WHERE id=?", (conversation_id,))
-        conn.commit()
-    audit_log(user, "agent.conversation.delete", "agent_conversation", conversation_id, "", request)
-    return {"id": conversation_id, "status": "deleted"}
-
-
-@router.get("/agents/conversations/{conversation_id}/actions")
-def list_actions_v2(conversation_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization)
-    with get_conn() as conn:
-        if not _owned_conversation(conn, conversation_id, user["id"]):
-            raise HTTPException(404, "Conversation not found")
-        rows = conn.execute(
-            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    return {"actions": [row_to_dict(r) for r in rows]}
-
-
-@router.post("/agents/actions/{action_id}/undo")
-def undo_action_v2(action_id: int, request: Request,
-                         authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        row = conn.execute(
-            """SELECT a.id FROM agent_actions a
-               JOIN agent_conversations c ON c.id = a.conversation_id
-               WHERE a.id=? AND c.user_id=?""",
-            (action_id, user["id"]),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Action not found")
-    try:
-        undo_action(action_id)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    except Exception as exc:  # noqa: BLE001
-        raise HTTPException(500, f"Rollback failed: {exc}") from exc
-    audit_log(user, "agent.action.undo", "agent_action", action_id, "", request)
-    return {"id": action_id, "status": "reverted"}
-
-
-# ── Runs (JSON — the SSE stream stays internal) ────────────────────────────
-
-def _collect_run_events(events: list[dict]) -> dict:
-    """Aggregate an engine event stream into a JSON run result.
-
-    Engine events are flat (``{"type": "final", "content": ...}``), the same
-    shape the SSE panel consumes.
-    """
-    final = None
-    reasoning = []
-    actions = []
-    error = None
-    for ev in events:
-        etype = ev.get("type")
-        if etype == "final":
-            final = ev.get("content") or final
-        elif etype == "reasoning":
-            reasoning.append(ev.get("content") or "")
-        elif etype == "action":
-            actions.append({k: v for k, v in ev.items() if k != "type"})
-        elif etype == "error":
-            error = ev.get("message") or "run failed"
-    return {
-        "status": "failed" if error else "completed",
-        "final": final,
-        "error": error,
-        "reasoning": reasoning,
-        "actions": actions,
-    }
-
-
-@router.post("/agents/conversations/{conversation_id}/run")
-async def run_conversation_v2(conversation_id: int, request: Request,
-                              authorization: str | None = Header(default=None)):
-    """Synchronous agent run: buffers the engine stream and returns JSON.
-
-    Third parties get one HTTP round-trip instead of an SSE subscription; the
-    same AgentEngine, permissions, journal and webhooks are used as the UI.
-    """
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    objective = (body.get("message") or body.get("objective") or "").strip()
-    if not objective:
-        raise HTTPException(400, "message is required")
-
-    with get_conn() as conn:
-        conv = _owned_conversation(conn, conversation_id, user["id"])
-        if not conv:
-            raise HTTPException(404, "Conversation not found")
-        eff_provider = body.get("provider") or conv["provider"] or None
-        eff_model = body.get("model") or conv["model"] or None
-        if body.get("provider") is not None or body.get("model") is not None:
-            conn.execute(
-                "UPDATE agent_conversations SET provider=?, model=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (body.get("provider", conv["provider"] or ""),
-                 body.get("model", conv["model"] or ""), conversation_id),
-            )
-            conn.commit()
-        conv_context = {}
-        try:
-            conv_context = json.loads(conv["context_json"] or "{}") or {}
-        except (TypeError, ValueError):
-            conv_context = {}
-
-    ws = _workspace_of(request, body)
-    if ws is None:
-        ws = conv_context.get("workspace_id")
-
-    engine = _engine_for(user["id"], ws, eff_provider)
-    started = time.time()
-    events = [
-        ev async for ev in engine.run(
-            conversation_id, objective,
-            model=eff_model,
-            mentions=body.get("mentions"),
-            files=body.get("files"),
-            skill_id=body.get("skill_id"),
-            skill_ids=body.get("skill_ids"),
-            extra_context=body.get("context"),
-        )
-    ]
-    result = _collect_run_events(events)
-    with get_conn() as conn:
-        actions = conn.execute(
-            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
-            (conversation_id,),
-        ).fetchall()
-    payload = {
-        "conversation_id": conversation_id,
-        "status": result["status"],
-        "final": result["final"],
-        "error": result["error"],
-        "reasoning": result["reasoning"],
-        "actions": [row_to_dict(a) for a in actions],
-        "events": events,
-        "duration_ms": int((time.time() - started) * 1000),
-    }
-    audit_log(user, "agent.run", "agent_conversation", conversation_id, objective[:200], request)
-    status_code = 200 if result["status"] == "completed" else 500
-    data = payload
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, status_code)
-    return JSONResponse(content=data, status_code=status_code)
-
-
-@router.post("/agents/{agent_id}/trigger")
-async def trigger_agent_v2(agent_id: int, request: Request,
-                           authorization: str | None = Header(default=None)):
-    """Fire a custom agent from an external integration (JSON, synchronous)."""
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        agent = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
-        if not agent:
-            raise HTTPException(404, "Agent not found")
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
-               VALUES (?,?,?,?)""",
-            (agent_id, user["id"], f"Run: {agent['name']}", json.dumps({"workspace_id": ws})),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-
-    objective = (agent["system_instructions"] or "").strip() or f"Exécute l'agent « {agent['name']} »."
-    if body.get("message"):
-        objective = f"{objective}\n\n{body['message']}"
-    engine = _engine_for(user["id"], ws, agent["model"] or None)
-    started = time.time()
-    events = [ev async for ev in engine.run(conv_id, objective, model=agent["model"])]
-    result = _collect_run_events(events)
-    payload = {
-        "conversation_id": conv_id,
-        "agent_id": agent_id,
-        "status": result["status"],
-        "final": result["final"],
-        "error": result["error"],
-        "reasoning": result["reasoning"],
-        "actions": result["actions"],
-        "duration_ms": int((time.time() - started) * 1000),
-    }
-    audit_log(user, "agent.trigger", "agent", agent_id, objective[:200], request)
-    return JSONResponse(content=payload, status_code=200 if result["status"] == "completed" else 500)
-
-
-# ── Skill marketplace ──────────────────────────────────────────────────────
-
-@router.get("/skills")
-def list_skills_v2(request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    limit, offset = parse_pagination(request)
-    ws = _workspace_of(request)
-    with get_conn() as conn:
-        total = conn.execute(
-            "SELECT COUNT(*) FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?",
-            (ws, ws),
-        ).fetchone()[0]
-        rows = conn.execute(
-            """SELECT * FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?
-               ORDER BY name LIMIT ? OFFSET ?""",
-            (ws, ws, limit, offset),
-        ).fetchall()
-    return JSONResponse(
-        content={"skills": [row_to_dict(r) for r in rows], "total": total,
-                 "limit": limit, "offset": offset},
-        headers=paginate_headers(total),
-    )
-
-
-@router.post("/skills")
-async def create_skill_v2(request: Request, authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    try:
-        fields = skill_gallery.parse_payload(
-            {k: body[k] for k in ("name", "description", "prompt_template", "allowed_tools")
-             if k in body} | {"format": skill_gallery.EXPORT_FORMAT}
-        )
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    try:
-        row, created = skill_gallery.upsert_skill(
-            fields, workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite")),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.create", "skill", row.get("id"), fields["name"], request)
-    data = {"id": row.get("id"), "name": fields["name"],
-            "status": "created" if created else "updated", "skill": row_to_dict(row) if row else {}}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201 if created else 200)
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-# Gallery & import are static segments: declared before /skills/{skill_id} so
-# FastAPI never tries to coerce "gallery" into an int path parameter.
-@router.get("/skills/gallery")
-def skills_gallery_v2(request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    presets = skill_gallery.list_gallery()
-    return {"gallery": presets, "total": len(presets),
-            "install": "POST /api/v2/skills/gallery/{slug}/install"}
-
-
-@router.post("/skills/gallery/{slug}/install")
-async def install_gallery_skill_v2(slug: str, request: Request,
-                                   authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    preset = skill_gallery.get_gallery(slug)
-    if not preset:
-        raise HTTPException(404, f"Unknown gallery skill: {slug}")
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    try:
-        row, created = skill_gallery.upsert_skill(
-            skill_gallery.parse_payload(preset),
-            workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite", True)),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.gallery.install", "skill", row.get("id"), slug, request)
-    data = {"slug": slug, "id": row.get("id"), "name": row.get("name"),
-            "status": "installed" if created else "updated", "skill": row_to_dict(row)}
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-@router.post("/skills/import")
-async def import_skill_v2(request: Request, authorization: str | None = Header(default=None)):
-    """Import a portable skill document (from another FlowDeck instance)."""
-    user = _guard(request, authorization, write=True)
-    idem = check_idempotency(request, user["id"])
-    if idem:
-        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    body = await _json_body(request)
-    payload = body.get("payload") if isinstance(body.get("payload"), dict) else body
-    try:
-        fields = skill_gallery.parse_payload(payload)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from exc
-    ws = _workspace_of(request, body)
-    try:
-        row, created = skill_gallery.upsert_skill(
-            fields, workspace_id=ws, created_by=user["id"],
-            overwrite=bool(body.get("overwrite")),
-        )
-    except ValueError as exc:
-        raise HTTPException(409, str(exc)) from exc
-    audit_log(user, "skill.import", "skill", row.get("id"), fields["name"], request)
-    data = {"id": row.get("id"), "name": fields["name"],
-            "status": "imported" if created else "updated", "skill": row_to_dict(row)}
-    key = (request.headers.get("Idempotency-Key") or "").strip()
-    if key:
-        store_idempotency(key, user["id"], data, 201 if created else 200)
-    return JSONResponse(content=data, status_code=201 if created else 200)
-
-
-@router.get("/skills/{skill_id}")
-def get_skill_v2(skill_id: int, request: Request, authorization: str | None = Header(default=None)):
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Skill not found")
-    return row_to_dict(row)
-
-
-@router.get("/skills/{skill_id}/export")
-def export_skill_v2(skill_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    """Portable JSON document — POST it to /api/v2/skills/import elsewhere."""
-    _guard(request, authorization)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-    if not row:
-        raise HTTPException(404, "Skill not found")
-    return skill_gallery.export_skill(row)
-
-
-@router.delete("/skills/{skill_id}")
-def delete_skill_v2(skill_id: int, request: Request,
-                          authorization: str | None = Header(default=None)):
-    user = _guard(request, authorization, write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT name FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Skill not found")
-        conn.execute("DELETE FROM agent_skills WHERE id=?", (skill_id,))
-        conn.commit()
-    audit_log(user, "skill.delete", "skill", skill_id, row["name"] or "", request)
-    return {"id": skill_id, "status": "deleted"}
-
-
-@router.post("/skills/{skill_id}/apply")
-async def apply_skill_v2(skill_id: int, request: Request,
-                         authorization: str | None = Header(default=None)):
-    """Open a conversation pre-loaded with the skill (ready to run)."""
-    user = _guard(request, authorization, write=True)
-    body = await _json_body(request)
-    ws = _workspace_of(request, body)
-    with get_conn() as conn:
-        skill = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
-        if not skill:
-            raise HTTPException(404, "Skill not found")
-        agent_id = _default_agent(conn, user["id"])["id"]
-        cur = conn.execute(
-            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
-               VALUES (?,?,?,?)""",
-            (agent_id, user["id"], skill["name"],
-             json.dumps({"workspace_id": ws if ws is not None else skill["workspace_id"],
-                         "skill_id": skill_id})),
-        )
-        conv_id = cur.lastrowid
-        conn.commit()
-    audit_log(user, "skill.apply", "skill", skill_id, skill["name"], request)
-    return JSONResponse(content={"conversation_id": conv_id, "skill": skill["name"],
-                                 "status": "ready"}, status_code=201)
@@ -1,124 +0,0 @@
-"""FlowDeck — unified audit log API (v7.2.0).
-
-Merges ``api_audit_log`` + ``permission_audit_log`` + ``sso_login_history``
-with actor/resource/date filters and CSV export (10k rows max, 365-day
-retention note). Admin only. See ``docs/V72_Enterprise_SCIM_2FA.md``.
-"""
-from __future__ import annotations
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import JSONResponse, PlainTextResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.api_v2_helpers import (
-    has_scope,
-    parse_pagination,
-    resolve_bearer_token,
-)
-
-router = APIRouter(tags=["audit"])
-
-
-def _admin_user(request: Request) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        with get_conn() as conn:
-            row = conn.execute("SELECT is_admin FROM users WHERE id=?",
-                               (sess.get("id"),)).fetchone()
-        if row and row["is_admin"]:
-            return sess
-        raise HTTPException(403, "Admin required")
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if user and user.get("is_admin") and has_scope(
-                user.get("_token_scopes") or "read", "admin"):
-            return user
-    raise HTTPException(401, "Admin authentication required")
-
-
-def _query(source: str, actor: str, action: str, limit: int, offset: int):
-    """One source query → (rows, columns). All normalized to a common shape."""
-    with get_conn() as conn:
-        if source in ("api", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, user_id AS actor, action,
-                          resource_type || ':' || resource_id AS resource,
-                          ip_address AS ip, detail, 'api' AS source
-                   FROM api_audit_log
-                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
-                     AND (?='' OR action LIKE ?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
-            ).fetchall()
-            if source == "api":
-                return rows
-            api = [dict(r) for r in rows]
-        else:
-            api = []
-        if source in ("permissions", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, performed_by AS actor, action,
-                          resource_type || ':' || resource_id AS resource,
-                          ip_address AS ip,
-                          ('target=' || COALESCE(target_user_id, target_group_id, '')
-                           || ' ' || COALESCE(old_role,'') || '→' || COALESCE(new_role,'')) AS detail,
-                          'permissions' AS source
-                   FROM permission_audit_log
-                   WHERE (?='' OR CAST(performed_by AS TEXT)=?)
-                     AND (?='' OR action LIKE ?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
-            ).fetchall()
-            if source == "permissions":
-                return rows
-            perm = [dict(r) for r in rows]
-        else:
-            perm = []
-        if source in ("sso", "all"):
-            rows = conn.execute(
-                """SELECT created_at AS at, user_id AS actor,
-                          ('sso_' || provider_type || '_' ||
-                            CASE success WHEN 1 THEN 'success' ELSE 'failure' END) AS action,
-                          provider_name AS resource, ip_address AS ip,
-                          COALESCE(error_message, sso_identifier, '') AS detail,
-                          'sso' AS source
-                   FROM sso_login_history
-                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
-                   ORDER BY id DESC LIMIT ? OFFSET ?""",
-                (actor, actor, limit, offset)).fetchall()
-            if source == "sso":
-                return rows
-            sso = [dict(r) for r in rows]
-        else:
-            sso = []
-    merged = sorted(api + perm + sso, key=lambda d: str(d.get("at") or ""),
-                    reverse=True)
-    return merged[:limit]
-
-
-@router.get("/api/v2/audit/logs")
-def audit_logs(request: Request):
-    _admin_user(request)
-    qp = request.query_params
-    source = (qp.get("source") or "all").lower()
-    if source not in ("all", "api", "permissions", "sso"):
-        raise HTTPException(400, "source must be all|api|permissions|sso")
-    limit, offset = parse_pagination(request, default_limit=50, max_limit=500)
-    rows = _query(source, qp.get("actor") or "", qp.get("action") or "", limit, offset)
-    rows = [dict(r) if not isinstance(r, dict) else r for r in rows]
-    if qp.get("format") == "csv":
-        import csv
-        import io
-        buf = io.StringIO()
-        writer = csv.DictWriter(buf, fieldnames=["at", "source", "actor", "action",
-                                                 "resource", "ip", "detail"])
-        writer.writeheader()
-        for r in rows[:10000]:
-            writer.writerow({k: r.get(k, "") for k in writer.fieldnames})
-        return PlainTextResponse(buf.getvalue(), media_type="text/csv",
-                                 headers={"Content-Disposition":
-                                          "attachment; filename=audit.csv"})
-    return JSONResponse(content={"logs": rows, "source": source,
-                                 "limit": limit, "offset": offset})
@@ -4,43 +4,15 @@ from __future__ import annotations
 import logging
 import secrets

-from fastapi import APIRouter, Body, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi import APIRouter, Request, Query
+from fastapi.responses import RedirectResponse, HTMLResponse

 from app.auth.session import SessionManager
 from app.config import settings
-from app.templating import CSP_NONCE

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["auth"], prefix="/auth")

-
-def get_redirect_uri(request: Request) -> str:
-    """OAuth redirect URI for this request.
-
-    Explicit `OAUTH_REDIRECT_URI` env override wins (must be registered in the
-    provider's OAuth app). Otherwise it is derived from the request so it always
-    matches the URL the user actually used: scheme from `X-Forwarded-Proto`
-    (reverse proxies) falling back to the request scheme, host from
-    `X-Forwarded-Host` falling back to the `Host` header.
-    """
-    if settings.oauth_redirect_uri:
-        return settings.oauth_redirect_uri
-    proto = request.headers.get("x-forwarded-proto", "")
-    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
-    fwd_host = request.headers.get("x-forwarded-host", "")
-    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
-    return f"{scheme}://{host}/auth/callback"
-
-def _with_nonce(html: str) -> str:
-    """A20 : injecte le nonce CSP au moment du rendu.
-
-    `LOCAL_LOGIN_HTML` est une constante de module — le nonce, lui, est par
-    requête, donc il ne peut être figé qu'ici.
-    """
-    return html.replace("<script>", f'<script nonce="{CSP_NONCE.get()}">', 1)
-
-
 LOCAL_LOGIN_HTML = """<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -73,7 +45,6 @@ body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,
 .oauth-section{margin-top:20px;border-top:1px solid rgba(255,255,255,.08);padding-top:20px;}
 .oauth-btn{display:flex;align-items:center;justify-content:center;gap:8px;width:100%;padding:10px;border-radius:8px;font-size:14px;cursor:pointer;border:1px solid rgba(255,255,255,.12);background:#2A2A2A;color:#fff;}
 .oauth-btn:hover{background:#333;}
-.sso-btn{border-color:rgba(35,131,226,.5);}
 </style>
 </head>
 <body>
@@ -99,17 +70,11 @@ body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,
    <div class="form-group" id="name-group" style="display:none"><label>Name</label><input type="text" id="name"></div>
    <button type="submit" class="btn btn-primary" id="submit-btn">Login</button>
  </form>
-  <div class="oauth-section" id="oauth-section">
+  <div class="oauth-section">
    <p style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
    <button class="oauth-btn" onclick="window.location='/auth/login?provider=gitea'" style="margin-bottom:8px">🔗 <span id="gitea-btn-label">Login</span> with Gitea</button>
    <button class="oauth-btn" onclick="window.location='/auth/login?provider=github'">🐙 <span id="github-btn-label">Login</span> with GitHub</button>
  </div>
-  <!-- SSO / SAML + OIDC (v6.7.0) — buttons injected by loadSsoProviders() -->
-  <div class="oauth-section" id="sso-section" style="display:none">
-    <p id="sso-divider" style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
-    <div id="sso-buttons"></div>
-    <p id="sso-only-note" style="display:none;font-size:12px;color:rgba(255,255,255,.45);margin-top:12px;line-height:1.5;">This instance only accepts your organization account — local login is disabled.</p>
-  </div>
 </div>
 <script>
 // Show session expired banner if ?expired=1 in URL
@@ -118,47 +83,15 @@ let mode='login';
 function switchTab(t){mode=t;document.querySelectorAll('.tab').forEach(el=>el.classList.remove('active'));document.getElementById('tab-'+t).classList.add('active');document.getElementById('name-group').style.display=t==='register'?'block':'none';document.getElementById('submit-btn').textContent=t==='register'?'Register':'Login';document.getElementById('error-msg').style.display='none';document.getElementById('success-msg').style.display='none';var lbl=t==='register'?'Register':'Login';var e1=document.getElementById('gitea-btn-label');var e2=document.getElementById('github-btn-label');if(e1)e1.textContent=lbl;if(e2)e2.textContent=lbl;}
 function togglePassword(){var pw=document.getElementById('password');var btn=pw.parentElement.querySelector('.pw-toggle');if(pw.type==='password'){pw.type='text';btn.textContent='🙈';}else{pw.type='password';btn.textContent='👁';}}
 async function handleLogin(e){e.preventDefault();const email=document.getElementById('email').value;const password=document.getElementById('password').value;const name=document.getElementById('name').value;const url=mode==='register'?'/auth/register':'/auth/local-login';const body={email,password};if(mode==='register')body.name=name;try{const r=await fetch(url,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const d=await r.json();if(!r.ok){document.getElementById('error-msg').textContent=d.error||'Error';document.getElementById('error-msg').style.display='block';return;}if(d.status==='ok'){window.location='/workspaces';}}catch(err){document.getElementById('error-msg').textContent='Network error';document.getElementById('error-msg').style.display='block';}}
-// SSO buttons (v6.7.0) — rendered from /api/v2/sso/providers
-(async function loadSsoProviders(){
-  try{
-    const r = await fetch('/api/v2/sso/providers');
-    if(!r.ok) return;
-    const d = await r.json();
-    const providers = d.providers || [];
-    if(!providers.length) return;
-    const wrap = document.getElementById('sso-buttons');
-    providers.forEach(function(p){
-      const b = document.createElement('button');
-      b.className = 'oauth-btn sso-btn';
-      b.style.marginBottom = '8px';
-      b.title = 'Sign in with ' + (p.name || 'SSO');
-      b.onclick = function(){ window.location = p.login_url; };
-      const icon = document.createElement('span'); icon.textContent = p.icon || '🏢';
-      const label = document.createElement('span');
-      label.textContent = (mode === 'register' ? 'Sign up' : 'Login') + ' with ' + (p.name || 'SSO');
-      b.appendChild(icon); b.appendChild(label);
-      wrap.appendChild(b);
-    });
-    document.getElementById('sso-section').style.display = 'block';
-    if(d.sso_only){
-      // Local auth is refused server-side too — don't show a dead form.
-      const form = document.getElementById('login-form'); if(form) form.style.display = 'none';
-      const tabs = document.querySelector('.tabs'); if(tabs) tabs.style.display = 'none';
-      const oauth = document.getElementById('oauth-section'); if(oauth) oauth.style.display = 'none';
-      const note = document.getElementById('sso-only-note'); if(note) note.style.display = 'block';
-      const intro = document.querySelector('.login-box p'); if(intro) intro.textContent = 'Sign in with your organization account to continue';
-    }
-  }catch(e){}
-})();
 </script>
 </body>
 </html>"""


@router.get("/register")
-def register_page(request: Request):
+async def register_page(request: Request):
    """Show the registration page (local login page with register tab active)."""
-    return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML.replace(
+    return HTMLResponse(LOCAL_LOGIN_HTML.replace(
        'class="tab active" onclick="switchTab(\'login\')"',
        'class="tab" onclick="switchTab(\'login\')"'
    ).replace(
@@ -173,16 +106,16 @@ def register_page(request: Request):
    ).replace(
        'id="submit-btn">Login<',
        'id="submit-btn">Register<'
-    )), status_code=200)
+    ), status_code=200)


@router.get("/login")
-def login(request: Request, provider: str = Query("gitea")):
+async def login(request: Request, provider: str = Query("gitea")):
    """Redirect to OAuth2 authorize page or show local login page."""
    # Local login page (POST handled by /auth/local-login)
    from fastapi.responses import HTMLResponse
    if provider == "local":
-        return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML), status_code=200)
+        return HTMLResponse(LOCAL_LOGIN_HTML, status_code=200)

    # OAuth flow — check if provider is configured
    from app.auth.providers import get_provider
@@ -211,20 +144,23 @@ def login(request: Request, provider: str = Query("gitea")):
    # Encode auth mode in state to survive session loss during OAuth redirect
    signed_state = f"{state}:{mode}" if mode else state
    request.session["oauth_mode"] = mode
-    # Redirect URI derived from the incoming request (scheme-aware); stored in
-    # session so the callback reuses the EXACT same URI for token exchange
-    redirect_uri = get_redirect_uri(request)
-    request.session["oauth_redirect_uri"] = redirect_uri
-    auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=redirect_uri, force_login=(mode == "link"))
+    # Dynamic redirect URI based on incoming Host header
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=dynamic_redirect_uri, force_login=(mode == "link"))
    return RedirectResponse(url=auth_url, status_code=302)


@router.post("/register")
-def register(request: Request, body: dict = Body(default={})):
+async def register(request: Request):
    """Register a new local account."""
-
    from app.db import get_conn
    from app.password_utils import hash_password
+    import json
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    email = body.get("email", "").strip()
    password = body.get("password", "").strip()
    name = body.get("name", email.split("@")[0] if "@" in email else email)
@@ -236,16 +172,6 @@ def register(request: Request, body: dict = Body(default={})):
        from fastapi.responses import JSONResponse
        return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)

-    # SSO-only instance (v6.7.0): local registration is refused — accounts are
-    # auto-provisioned by the IdP instead (admins still come from Settings).
-    from app.services.sso_provisioning import is_sso_only
-    if is_sso_only():
-        from fastapi.responses import JSONResponse
-        return JSONResponse(
-            {"error": "Registration is disabled — sign in with your organization SSO"},
-            status_code=403,
-        )
-
    with get_conn() as conn:
        existing = conn.execute("SELECT id FROM users WHERE login=?", (email,)).fetchone()
        if existing:
@@ -265,7 +191,7 @@ def register(request: Request, body: dict = Body(default={})):
    user_data = dict(user)
    # Log login
    _log_login(user_data["id"], request)
-    session = SessionManager.create_session(user_data, request)
+    session = SessionManager.create_session(user_data)
    from fastapi.responses import JSONResponse
    response = JSONResponse({"status": "ok", "user": {"login": email, "name": name}})
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -273,14 +199,16 @@ def register(request: Request, body: dict = Body(default={})):


@router.post("/local-login")
-def local_login(request: Request, body: dict = Body(default={})):
+async def local_login(request: Request):
    """Login with email + password."""
-    import time
-
-    from fastapi.responses import JSONResponse
-
    from app.db import get_conn
-    from app.password_utils import is_locked, verify_password
+    from app.password_utils import verify_password, is_locked
+    from fastapi.responses import JSONResponse
+    import json, time
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    email = body.get("email", "").strip()
    password = body.get("password", "").strip()

@@ -311,42 +239,14 @@ def local_login(request: Request, body: dict = Body(default={})):
            conn.commit()
        return JSONResponse({"error": "Invalid credentials"}, status_code=401)

-    # Successful local login — SSO-only instances keep a way in for admins
-    # only (every other account must use the IdP, design §7.1).
-    from app.services.sso_provisioning import is_sso_only
-    if is_sso_only() and not ud.get("is_admin"):
-        return JSONResponse(
-            {"error": "Local login is disabled on this instance — sign in with SSO"},
-            status_code=403,
-        )
-
-    # v7.2.0: verified domain with SSO enforcement (admins keep local access).
-    if not ud.get("is_admin"):
-        with get_conn() as conn:
-            dom = (ud.get("email") or "").split("@")[-1].lower() if "@" in (ud.get("email") or "") else ""
-            if dom:
-                enforced = conn.execute(
-                    "SELECT id FROM domain_claims WHERE domain=? AND verified=1"
-                    " AND enforce_sso=1", (dom,)).fetchone()
-                if enforced:
-                    return JSONResponse(
-                        {"error": "Local login is disabled for your domain — sign in with SSO"},
-                        status_code=403)
-
+    # Successful login
    with get_conn() as conn:
        conn.execute(
            "UPDATE users SET login_attempts=0, locked_until=NULL, last_login=? WHERE id=?",
            (str(time.time()), ud["id"]),
        )
        conn.commit()
-
-    # v7.2.0: TOTP 2FA — password OK, but hold the session until code check.
-    from app.services import two_factor as _2fa
-    if _2fa.is_enabled(ud["id"]):
-        return JSONResponse({"status": "2fa_required",
-                             "pending": _2fa.mint_pending(ud["id"])})
-
-    session = SessionManager.create_session(ud, request)
+    session = SessionManager.create_session(ud)
    _log_login(ud["id"], request)
    response = JSONResponse({"status": "ok", "user": {"login": ud["login"], "name": ud["full_name"]}})
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -382,10 +282,10 @@ async def callback(
    if not oauth_provider:
        return HTMLResponse(f"<h1>Unknown provider: {provider_name}</h1>", status_code=400)

-    # Exchange code for token — reuse the redirect URI from the authorize step
-    # (stored in session), falling back to deriving it from this request
-    redirect_uri = request.session.get("oauth_redirect_uri") or get_redirect_uri(request)
-    token_data = await oauth_provider.exchange_code(code, redirect_uri=redirect_uri)
+    # Exchange code for token — use dynamic redirect URI matching the authorize step
+    host = request.headers.get("host", "localhost:8080")
+    dynamic_redirect_uri = f"http://{host}/auth/callback"
+    token_data = await oauth_provider.exchange_code(code, redirect_uri=dynamic_redirect_uri)
    if not token_data:
        return HTMLResponse("<h1>Token exchange failed</h1>", status_code=400)

@@ -402,7 +302,7 @@ async def callback(
    oauth_mode = request.session.pop("oauth_mode", "")
    if oauth_mode == "link":
        from app.auth.session import get_current_user as gcu
-        current = gcu(request)
+        current = await gcu(request)
        if not current:
            return HTMLResponse("<h1>Not logged in — please log in first</h1>", status_code=400)
        from app.db import get_conn as _gc
@@ -444,7 +344,7 @@ async def callback(
    user_data = dict(user) if user else oauth_user

    # Create session
-    session = SessionManager.create_session(user_data, request)
+    session = SessionManager.create_session(user_data)
    _log_login(user_data["id"], request)
    response = RedirectResponse(url="/workspaces", status_code=302)
    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
@@ -452,107 +352,21 @@ async def callback(


@router.get("/logout")
-def logout(request: Request):
-    """Clear session and redirect to login page.
-
-    SAML sessions additionally hand over to the IdP's Single Logout when one
-    is configured (the actual cookie clearing happens on the SLO route).
-    """
-    cookie = request.cookies.get("flowdeck_session", "")
-    user = SessionManager.decode_session(cookie) if cookie else None
-    local_target = "/auth/login?provider=local"
-
-    if user and user.get("_sso_name_id"):
-        # SSO session → let /auth/saml/logout revoke locally + notify the IdP.
-        return RedirectResponse(url=f"/auth/saml/logout?next={local_target}", status_code=302)
-
-    response = RedirectResponse(url=local_target, status_code=302)
+async def logout():
+    """Clear session and redirect to login page."""
+    response = RedirectResponse(url="/auth/login?provider=local", status_code=302)
    response.delete_cookie("flowdeck_session")
    return response


@router.get("/user")
-def current_user(request: Request):
+async def current_user(request: Request):
    """Return current user info as JSON."""
    from app.auth.session import get_current_user as gcu
-    from app.auth.session import public_user
-    user = gcu(request)
+    user = await gcu(request)
    if not user:
        return {"authenticated": False}
-    return {"authenticated": True, "user": public_user(user)}
-
-
-# ── v7.2.0 — TOTP 2FA ─────────────────────────────────────────────────────
-
-@router.post("/local-verify")
-def local_verify(request: Request, body: dict = Body(default={})):
-    """Exchange a 2FA ``pending`` token + TOTP/backup code for a session."""
-    from fastapi.responses import JSONResponse
-
-    from app.db import get_conn
-    from app.services import two_factor as _2fa
-    user_id = _2fa.redeem_pending(body.get("pending", ""))
-    if not user_id:
-        return JSONResponse({"error": "Challenge expired — log in again"}, status_code=401)
-    if not _2fa.verify_code(user_id, body.get("code", "")):
-        return JSONResponse({"error": "Invalid code"}, status_code=401)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
-        if not row or not row["is_active"]:
-            return JSONResponse({"error": "Account disabled"}, status_code=403)
-        ud = dict(row)
-    session = SessionManager.create_session(ud, request)
-    _log_login(ud["id"], request)
-    response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
-    response.set_cookie("flowdeck_session", session, httponly=True,
-                        max_age=86400 * 7, samesite="lax", path="/")
-    return response
-
-
-def _session_user_or_401(request: Request) -> dict:
-    from fastapi import HTTPException
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user
-
-
-@router.get("/2fa/status")
-def twofa_status(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    return {"enabled": _2fa.is_enabled(user["id"]),
-            "backup_remaining": _2fa.remaining_backup_codes(user["id"])}
-
-
-@router.post("/2fa/setup")
-def twofa_setup(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    return _2fa.setup_secret(user["id"])
-
-
-@router.post("/2fa/activate")
-def twofa_activate(request: Request, body: dict = Body(default={})):
-    from fastapi.responses import JSONResponse
-
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    try:
-        codes = _2fa.activate_secret(user["id"], body.get("secret", ""),
-                                     body.get("code", ""))
-    except ValueError:
-        return JSONResponse({"error": "Invalid code — secret not activated"},
-                            status_code=400)
-    return {"status": "enabled", "backup_codes": codes}
-
-
-@router.post("/2fa/disable")
-def twofa_disable(request: Request):
-    from app.services import two_factor as _2fa
-    user = _session_user_or_401(request)
-    _2fa.disable(user["id"])
-    return {"status": "disabled"}
+    return {"authenticated": True, "user": user}

 # ── Helpers ──
 def _log_login(user_id: int, request: Request):
@@ -568,4 +382,4 @@ def _log_login(user_id: int, request: Request):
            )
            conn.commit()
    except Exception:
-        logger.exception("_log_login")
+        pass
@@ -1,318 +0,0 @@
-"""FlowDeck — Automations API (v5.1.0): rules CRUD, manual/button run, history."""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, Depends, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import (
-    get_page_context,
-    get_steps,
-    press_button,
-    run_automation,
-    validate_step,
-)
-
-logger = logging.getLogger(__name__)
-
-
-def _require_session(request: Request) -> None:
-    """A13 : toute la route (CRUD, run, press-button) exige une session."""
-    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        raise HTTPException(status_code=401, detail="Authentication required")
-
-
-router = APIRouter(tags=["automations"], dependencies=[Depends(_require_session)])
-
-TRIGGER_TYPES = ("event", "cron", "button")
-
-
-def _json_or_dumps(val, default="[]"):
-    """Store JSON string columns without double-encoding."""
-    if val is None:
-        return default
-    if isinstance(val, str):
-        try:
-            json.loads(val)
-            return val
-        except (TypeError, json.JSONDecodeError):
-            return json.dumps(val)
-    return json.dumps(val)
-
-
-def _current_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    return user if user and user.get("id") else {}
-
-
-def _validate_payload(body: dict) -> None:
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name required")
-    trigger_type = body.get("trigger_type", "event")
-    if trigger_type not in TRIGGER_TYPES:
-        raise HTTPException(status_code=400, detail="invalid trigger_type")
-    if trigger_type == "event" and not body.get("event"):
-        raise HTTPException(status_code=400, detail="event required for event trigger")
-    if trigger_type == "cron" and not (body.get("cron_expression") or "").strip():
-        raise HTTPException(status_code=400, detail="cron_expression required for cron trigger")
-    for key in ("condition_json", "actions_json"):
-        val = body.get(key, "[]")
-        try:
-            if isinstance(val, str):
-                json.loads(val)
-            else:
-                json.dumps(val)
-        except (TypeError, json.JSONDecodeError):
-            raise HTTPException(status_code=400, detail=f"{key} must be valid JSON") from None
-
-
-@router.get("/workspace/automations")
-def list_automations(request: Request):
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM automations ORDER BY created_at DESC").fetchall()
-    items = [dict(r) for r in rows]
-    return {"automations": items}
-
-
-@router.post("/workspace/automations")
-def create_automation(request: Request, body: dict = Body(default={})):
-    _validate_payload(body)
-    user = _current_user(request)
-    by = user["id"]
-    with get_conn() as conn:
-        cur = conn.execute(
-            """INSERT INTO automations
-               (workspace, name, trigger_type, event, cron_expression, collection_id,
-                condition_json, actions_json, enabled, created_by)
-               VALUES (?,?,?,?,?,?,?,?,?,?)""",
-            (
-                body.get("workspace", "") or "",
-                (body.get("name") or "").strip(),
-                body.get("trigger_type", "event"),
-                body.get("event", "page.created"),
-                body.get("cron_expression", "") or "",
-                body.get("collection_id") or None,
-                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
-                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
-                int(body.get("enabled", True)),
-                by,
-            ),
-        )
-        conn.commit()
-        new_id = cur.lastrowid
-    return {"id": new_id, "status": "created"}
-
-
-@router.get("/workspace/automations/{auto_id}")
-def get_automation(request: Request, auto_id: int):
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
-    if not row:
-        raise HTTPException(status_code=404, detail="Automation not found")
-    return dict(row)
-
-
-@router.put("/workspace/automations/{auto_id}")
-def update_automation(request: Request, auto_id: int, body: dict = Body(default={})):
-    _validate_payload(body)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id FROM automations WHERE id=?", (auto_id,)).fetchone()
-        if not row:
-            raise HTTPException(status_code=404, detail="Automation not found")
-        conn.execute(
-            """UPDATE automations SET
-                 name=?, trigger_type=?, event=?, cron_expression=?, collection_id=?,
-                 condition_json=?, actions_json=?, enabled=?, updated_at=CURRENT_TIMESTAMP
-               WHERE id=?""",
-            (
-                (body.get("name") or "").strip(),
-                body.get("trigger_type", "event"),
-                body.get("event", "page.created"),
-                body.get("cron_expression", "") or "",
-                body.get("collection_id") or None,
-                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
-                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
-                int(body.get("enabled", True)),
-                auto_id,
-            ),
-        )
-        conn.commit()
-    return {"id": auto_id, "status": "updated"}
-
-
-@router.delete("/workspace/automations/{auto_id}")
-def delete_automation(request: Request, auto_id: int):
-    with get_conn() as conn:
-        conn.execute("DELETE FROM automations WHERE id=?", (auto_id,))
-        conn.commit()
-    return {"id": auto_id, "status": "deleted"}
-
-
-async def _execute(automation_id: int, trigger_source: str, body: dict) -> dict:
-    page_id = body.get("page_id") if isinstance(body, dict) else None
-    collection_id = body.get("collection_id") if isinstance(body, dict) else None
-    context = {"collection_id": collection_id, "page_id": page_id}
-    if page_id:
-        context.update(get_page_context(int(page_id), collection_id or 0))
-    result = await run_automation(automation_id, trigger_source, context)
-    result["automation_id"] = automation_id
-    return result
-
-
-@router.post("/workspace/automations/{auto_id}/run")
-async def run_automation_endpoint(request: Request, auto_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
-    return await _execute(auto_id, "manual", body)
-
-
-@router.post("/api/automations/{auto_id}/run")
-async def run_automation_button(request: Request, auto_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
-    return await _execute(auto_id, "button", body)
-
-
-@router.get("/workspace/automations/{auto_id}/runs")
-def automation_runs_history(request: Request, auto_id: int, limit: int = 50):
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT * FROM automation_runs WHERE automation_id=?
-               ORDER BY created_at DESC, id DESC LIMIT ?""",
-            (auto_id, limit),
-        ).fetchall()
-    return {"runs": [dict(r) for r in rows]}
-
-
-# ── v7.0.0 — chained steps (trigger/condition/delay/action) ───────────────
-
-STEP_SECRET_FIELDS = {"webhook_url"}
-
-
-def _require_session(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-def _get_auto(auto_id: int) -> dict | None:
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
-    return dict(row) if row else None
-
-
-def _auto_404():
-    # NOTE: return (not raise) — the global 404 handler redirects non-/api
-    # paths to /workspaces, which TestClient follows into a 200.
-    from fastapi.responses import JSONResponse
-    return JSONResponse({"detail": "Automation not found"}, status_code=404)
-
-
-def _encrypt_step_config(config: dict) -> dict:
-    """Encrypt secret fields at rest (empty = keep existing, like sso_config)."""
-    from app.services.sso_provisioning import encrypt_secret
-    cfg = dict(config or {})
-    for field in STEP_SECRET_FIELDS:
-        if field in cfg and cfg[field]:
-            val = str(cfg[field])
-            if not val.startswith("gAAAAA"):
-                cfg[field] = encrypt_secret(val)
-    return cfg
-
-
-@router.get("/workspace/automations/{auto_id}/steps")
-def list_steps(request: Request, auto_id: int):
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    return {"automation_id": auto_id, "steps": get_steps(auto_id)}
-
-
-@router.post("/workspace/automations/{auto_id}/steps")
-def create_step(request: Request, auto_id: int, body: dict = Body(default={})):
-    _require_session(request)
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    kind = body.get("kind", "")
-    config = body.get("config", {}) or {}
-    validate_step(kind, config)
-    with get_conn() as conn:
-        pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1)+1 FROM automation_steps WHERE automation_id=?",
-            (auto_id,)).fetchone()[0]
-        cur = conn.execute(
-            "INSERT INTO automation_steps (automation_id, kind, position, config_json)"
-            " VALUES (?,?,?,?)",
-            (auto_id, kind, int(body.get("position", pos)),
-             json.dumps(_encrypt_step_config(config))))
-        conn.commit()
-        step_id = cur.lastrowid
-    return {"id": step_id, "status": "created"}
-
-
-@router.put("/workspace/automations/steps/{step_id}")
-def update_step(request: Request, step_id: int, body: dict = Body(default={})):
-    _require_session(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM automation_steps WHERE id=?", (step_id,)).fetchone()
-        if not row:
-            from fastapi.responses import JSONResponse
-            return JSONResponse({"detail": "Step not found"}, status_code=404)
-        kind = body.get("kind", row["kind"])
-        try:
-            config = body.get("config", json.loads(row["config_json"] or "{}"))
-        except (TypeError, json.JSONDecodeError):
-            config = {}
-        validate_step(kind, config if isinstance(config, dict) else {})
-        conn.execute(
-            "UPDATE automation_steps SET kind=?, position=?, config_json=? WHERE id=?",
-            (kind, int(body.get("position", row["position"])),
-             json.dumps(_encrypt_step_config(config)), step_id))
-        conn.commit()
-    return {"id": step_id, "status": "updated"}
-
-
-@router.delete("/workspace/automations/steps/{step_id}")
-def delete_step(request: Request, step_id: int):
-    _require_session(request)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM automation_steps WHERE id=?", (step_id,))
-        conn.commit()
-    return {"id": step_id, "status": "deleted"}
-
-
-@router.put("/workspace/automations/{auto_id}/mode")
-def set_trigger_mode(request: Request, auto_id: int, body: dict = Body(default={})):
-    """Set multi-trigger mode: any (default) or all (5-minute window)."""
-    _require_session(request)
-    if _get_auto(auto_id) is None:
-        return _auto_404()
-    mode = (body.get("mode") or "any").lower()
-    if mode not in ("any", "all"):
-        raise HTTPException(status_code=400, detail="mode must be any or all")
-    with get_conn() as conn:
-        conn.execute("UPDATE automations SET trigger_mode=? WHERE id=?", (mode, auto_id))
-        conn.commit()
-    return {"id": auto_id, "trigger_mode": mode}
-
-
-@router.post("/api/automations/press-button")
-async def press_button_endpoint(request: Request):
-    """Run the automation linked to a native DB button cell (CSRF-exempt)."""
-    body = await request.json() if request.headers.get("content-type") else {}
-    try:
-        collection_id = int(body.get("collection_id", 0))
-        row_id = int(body.get("row_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(status_code=400, detail="collection_id + row_id required") from None
-    prop_ref = body.get("property", body.get("property_id", ""))
-    if not prop_ref:
-        raise HTTPException(status_code=400, detail="property required")
-    user = _current_user(request)
-    try:
-        result = await press_button(collection_id, row_id, prop_ref, user.get("id") or 1)
-    except ValueError as exc:
-        raise HTTPException(status_code=400, detail=str(exc)) from None
-    return result
@@ -1,108 +0,0 @@
-"""FlowDeck — Board : Kanban Notion-style + multi-vues.
-
-Découpe A28 : l'ancien `board.py` (2 101 lignes, 53 routes) est
-devenu ce package — un module par concern, helpers/constantes dans
-`_common`. Ré-exportés (importateurs inchangés) : api.py
-(STATUS_COLORS, STATUS_LABELS, _issue_column, _map_issue_to_card),
-webhooks (_issue_column), dashboard (_sidebar_data,
-_load_workspace_pages, _load_shared_sidebar_pages, _file_icon),
-tests (_build_page_tree, _REPO_REF_RE, _unfurl_repo).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter
-
-from . import (  # ordre = ordre d'enregistrement d'origine
-    board_views,
-    embed,
-    import_,
-    library,
-    page_api,
-    page_media,
-    page_ops,
-    pages,
-    sharing,
-    sync,
-    synced,
-    wiki,
-)
-from ._common import (  # noqa: F401 — ré-exports
-    _REPO_REF_RE,
-    AI_KEYWORD_COLORS,
-    STATUS_COLORS,
-    STATUS_LABELS,
-    _apply_filters,
-    _apply_sorts,
-    _block_texts,
-    _build_page_tree,
-    _create_page_from_markdown,
-    _ensure_block_ids,
-    _ensure_page_editable,
-    _extract_ai_keywords,
-    _file_icon,
-    _get_project_properties,
-    _issue_column,
-    _load_children,
-    _load_shared_sidebar_pages,
-    _load_workspace_pages,
-    _local_workspaces_for_user,
-    _map_issue_to_card,
-    _record_version,
-    _sidebar_data,
-    _store_uploaded_file,
-    _unfurl_repo,
-    _upload_root,
-    _ws_id_for,
-    asyncio_get_labels,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter()
-for _mod in (
-    wiki,
-    page_api,
-    library,
-    sharing,
-    synced,
-    board_views,
-    pages,
-    page_media,
-    import_,
-    embed,
-    page_ops,
-    sync,
-):
-    router.include_router(_mod.router)
-
-__all__ = [
-    "router",
-    "AI_KEYWORD_COLORS",
-    "STATUS_COLORS",
-    "STATUS_LABELS",
-    "_REPO_REF_RE",
-    "_apply_filters",
-    "_apply_sorts",
-    "_block_texts",
-    "_build_page_tree",
-    "_create_page_from_markdown",
-    "_ensure_block_ids",
-    "_ensure_page_editable",
-    "_extract_ai_keywords",
-    "_file_icon",
-    "_get_project_properties",
-    "_issue_column",
-    "_load_children",
-    "_load_shared_sidebar_pages",
-    "_load_workspace_pages",
-    "_local_workspaces_for_user",
-    "_map_issue_to_card",
-    "_record_version",
-    "_sidebar_data",
-    "_store_uploaded_file",
-    "_unfurl_repo",
-    "_upload_root",
-    "_ws_id_for",
-    "asyncio_get_labels",
-]
@@ -1,882 +0,0 @@
-"""FlowDeck — Board : helpers et constantes partagés (A28).
-
-Les 23 helpers de l'ancien board.py (dont 4 async) + constantes
-(STATUS_COLORS/STATUS_LABELS/AI_KEYWORD_COLORS/_REPO_REF_RE) —
-ré-exportés : api.py, webhooks, dashboard, tests.
-"""
-from __future__ import annotations
-
-import json
-import logging
-import re
-from pathlib import Path
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-from app.routers.dashboard import _get_app_version
-from app.routers.sidebar_config import get_sidebar_config_sync
-from app.services.gitea_client import gitea
-from app.services.http_client import shared_client
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(tags=["board"], prefix="/board")
-
-STATUS_COLORS = {"todo": "var(--gray)", "progress": "var(--blue)", "done": "var(--green)"}
-STATUS_LABELS = {"todo": "To-do", "progress": "In progress", "done": "Complete"}
-
-AI_KEYWORD_COLORS = [
-    "#E03E3E", "#D9730D", "#9B72F0", "#0F7B6C", "#3399CC",
-    "#E255A1", "#787774", "#6B4E3D", "#6374C4", "#5A9E4B",
-]
-
-_REPO_REF_RE = re.compile(r"^(gitea|github):([\w\-\.]+)/([\w\-\.]+)$")
-
-
-
-def _ensure_page_editable(conn, page_id: int, user: dict | None) -> None:
-    """v5.12.0: raise 423 when the page is locked and the actor may not edit.
-
-    Allowed to edit a locked page: admins and the user who locked it
-    (locked_by). Unauthenticated callers only pass when the page is unlocked.
-    """
-    row = conn.execute("SELECT is_locked, locked_by FROM pages WHERE id=?", (page_id,)).fetchone()
-    if not row or not row["is_locked"]:
-        return
-    uid = (user or {}).get("id")
-    is_admin = bool((user or {}).get("is_admin"))
-    if is_admin or (uid and row["locked_by"] == uid):
-        return
-    raise HTTPException(423, "Page is locked — only the owner of the lock or an admin can edit")
-
-
-
-
-
-
-def _ensure_block_ids(blocks) -> None:
-    """Assign unique ids to blocks missing one, recursively.
-
-    Built-in page templates ship without ids (the editor used to assign them
-    client-side only). Without persisted ids, the realtime layer and the editor
-    disagree on block identity, which duplicated lines / shuffled blocks when
-    editing a template-created page. We now materialize ids at creation time.
-    """
-    import uuid
-    if not isinstance(blocks, list):
-        return
-    for b in blocks:
-        if isinstance(b, dict):
-            if not b.get("id"):
-                b["id"] = "b" + uuid.uuid4().hex[:12]
-            if isinstance(b.get("children"), list):
-                _ensure_block_ids(b["children"])
-
-
-
-
-
-
-# ── Core helpers ──
-
-def _issue_column(issue: dict, columns: list[str], board_id: int) -> str:
-    if issue.get("state") == "closed":
-        return "Terminé" if "Terminé" in columns else columns[-1]
-    for lbl in issue.get("labels", []):
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT column_name FROM col_mapping WHERE board_id=? AND gitea_label=?",
-                (board_id, lbl["name"]),
-            ).fetchone()
-            if row and row["column_name"] in columns:
-                return row["column_name"]
-    return columns[0] if columns else "Backlog"
-
-
-
-
-
-
-def _map_issue_to_card(issue: dict, owner: str = "", repo: str = "") -> dict:
-    title = issue.get("title", "Untitled")
-    status = "todo"
-    if issue.get("state") == "closed":
-        status = "done"
-    labels = issue.get("labels", [])
-    for lbl in labels:
-        name = lbl.get("name", "").lower()
-        if "progress" in name or "doing" in name:
-            status = "progress"
-        elif "done" in name or "complete" in name or "terminé" in name:
-            status = "done"
-
-    assignee = issue.get("assignee", {}) or {}
-    assignee_name = assignee.get("login", "")
-    tag = labels[0].get("name", "") if labels else ""
-    tag_color = labels[0].get("color", "#787774") if labels else "#787774"
-    if tag_color and not tag_color.startswith("#"):
-        tag_color = f"#{tag_color}"
-
-    icon_map = {
-        "bug": "🐛", "feature": "✨", "enhancement": "⚡", "documentation": "📄",
-        "design": "🎨", "testing": "🧪", "refactor": "🔧", "security": "🔒",
-    }
-    icon = "file"
-    for lbl in labels:
-        for kw, emoji in icon_map.items():
-            if kw in lbl.get("name", "").lower():
-                icon = emoji
-                break
-
-    # Load custom property values
-    props = {}
-    if owner and repo:
-        with get_conn() as conn:
-            pvs = conn.execute("""
-                SELECT pp.name, pp.prop_type, pv.value
-                FROM property_values pv
-                JOIN project_properties pp ON pp.id = pv.property_id
-                WHERE pp.project_owner=? AND pp.project_name=? AND pv.gitea_issue_id=?
-            """, (owner, repo, issue.get("number", 0))).fetchall()
-            for pv in pvs:
-                props[pv["name"]] = {"type": pv["prop_type"], "value": pv["value"]}
-
-    # AI keywords from DB
-    keywords = []
-    if owner and repo:
-        with get_conn() as conn:
-            kw_rows = conn.execute(
-                "SELECT keyword, color FROM ai_keywords WHERE project_owner=? AND project_name=? ORDER BY usage_count DESC",
-                (owner, repo),
-            ).fetchall()
-            # Filter: show keywords matching this issue's labels
-            label_names = {lbl.get("name", "").lower() for lbl in labels}
-            for kw in kw_rows:
-                if kw["keyword"].lower() in label_names or any(
-                    kw["keyword"].lower() in lbl for lbl in label_names
-                ):
-                    keywords.append({"name": kw["keyword"], "color": kw["color"]})
-
-    return {
-        "id": str(issue.get("number", 0)),
-        "title": title,
-        "status": status,
-        "status_color": STATUS_COLORS.get(status, "var(--gray)"),
-        "status_label": STATUS_LABELS.get(status, "To-do"),
-        "icon": icon,
-        "assignee": assignee_name,
-        "tag": tag if tag else None,
-        "tag_color": tag_color,
-        "due_date": issue.get("due_date", ""),
-        "url": issue.get("html_url", ""),
-        "keywords": keywords,
-        "custom_props": props,
-    }
-
-
-
-
-
-
-def _build_page_tree(conn, parent_id: int | None, ws_key: str, depth: int = 0, max_depth: int = 3) -> list[dict]:
-    """Build nested page tree recursively. max_depth prevents infinite recursion."""
-    if depth >= max_depth:
-        return []
-    rows = conn.execute(
-        "SELECT id, title, updated_at FROM pages WHERE workspace=? AND parent_id IS ? AND deleted_at IS NULL AND collection_row_id IS NULL ORDER BY sort_order ASC, updated_at DESC",
-        (ws_key, parent_id),
-    ).fetchall()
-    items = []
-    for row in rows:
-        children = _build_page_tree(conn, row["id"], ws_key, depth + 1, max_depth)
-        items.append({
-            "id": f"page/{row['id']}",
-            "db_id": row["id"],
-            "name": row["title"] or "New page",
-            "icon": "📄",
-            "url": f"/pages/{row['id']}",
-            "active": False,
-            "depth": depth,
-            "has_children": len(children) > 0,
-            "children": children,
-        })
-    return items
-
-
-
-
-
-
-def _file_icon(name: str, content_format: str = "") -> str:
-    """Map file extension to icon name (SVG-safe)."""
-    # FlowDeck internal pages (no extension)
-    if content_format and content_format != 'file':
-        return 'edit'
-    n = name.lower()
-    if re.search(r'\.(png|jpe?g|gif|webp|svg|bmp|ico)$', n):
-        return 'image'
-    if n.endswith('.pdf'):
-        return 'file'
-    if re.search(r'\.(md|markdown)$', n):
-        return 'edit'
-    if n.endswith('.py'):
-        return 'file'
-    if re.search(r'\.(js|jsx|ts|tsx)$', n):
-        return 'file'
-    if re.search(r'\.(html?|xml)$', n):
-        return 'file'
-    if n.endswith('.css'):
-        return 'file'
-    if n.endswith('.json'):
-        return 'file'
-    if n.endswith('.sql'):
-        return 'file'
-    if re.search(r'\.(sh|bash|zsh)$', n):
-        return 'file'
-    if n.endswith('.ps1'):
-        return 'file'
-    if re.search(r'\.(rs|go|java|rb|php|c|cpp|h|swift|kt|scala|r)$', n):
-        return 'file'
-    if re.search(r'\.(txt|log)$', n):
-        return 'file'
-    if re.search(r'\.(zip|tar|gz|rar|7z)$', n):
-        return 'file'
-    return 'file'
-
-
-
-
-
-
-def _load_workspace_pages(ws_cookie: str) -> list:
-    """Load top-level pages with children for the active workspace."""
-    if not ws_cookie:
-        return []
-    try:
-        ws_id = int(ws_cookie)
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, title, parent_section, content_format, "
-                "is_shared, share_mode, COALESCE(published,0) AS published "
-                "FROM pages WHERE workspace_id=? AND parent_id IS NULL AND deleted_at IS NULL AND collection_row_id IS NULL ORDER BY created_at DESC",
-                (ws_id,),
-            ).fetchall()
-        items = []
-        for r in rows:
-            is_folder = r["parent_section"] == "Workspace"
-            title = r["title"] or "Untitled"
-            sub_children = _load_children(r["id"])
-            is_shared = bool(r["is_shared"] or r["share_mode"] != "private" or r["published"])
-            items.append({
-                "db_id": r["id"], "name": title,
-                "id": f"page/{r['id']}",
-                "icon": "📁" if is_folder else _file_icon(title, r["content_format"]),
-                "is_folder": is_folder,
-                "is_shared": is_shared,
-                "child_count": len(sub_children),
-                "children": sub_children,
-            })
-        return items
-    except (ValueError, Exception):
-        return []
-
-
-
-
-
-
-def _load_children(parent_id: int) -> list:
-    """Recursively load children of a page."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title, parent_section, content_format, "
-            "is_shared, share_mode, COALESCE(published,0) AS published "
-            "FROM pages WHERE parent_id=? AND deleted_at IS NULL ORDER BY created_at",
-            (parent_id,),
-        ).fetchall()
-    children = []
-    for r in rows:
-        is_folder = r["parent_section"] == "Workspace"
-        title = r["title"] or "Untitled"
-        sub_children = _load_children(r["id"])
-        is_shared = bool(r["is_shared"] or r["share_mode"] != "private" or r["published"])
-        children.append({
-            "db_id": r["id"], "name": title,
-            "id": f"page/{r['id']}",
-            "icon": "📁" if is_folder else _file_icon(title, r["content_format"]),
-            "is_folder": is_folder,
-            "is_shared": is_shared,
-            "child_count": len(sub_children),
-            "children": sub_children,
-        })
-    return children
-
-
-
-
-
-
-def _local_workspaces_for_user(user: dict | None, workspace_id: int = 0) -> list[dict]:
-    """Return list of local workspaces for a user."""
-    if not user:
-        return []
-    try:
-        from app.db import get_conn
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, name FROM workspaces WHERE owner_id = ? ORDER BY name",
-                (user["id"],)
-            ).fetchall()
-            return [{"id": r["id"], "name": r["name"]} for r in rows]
-    except Exception:
-        return []
-
-
-
-
-
-
-def _load_shared_sidebar_pages(user_id: int) -> tuple[list, list, list, list]:
-    """Shared / received / published pages for the sidebar (reused by dashboard)."""
-    with get_conn() as conn:
-        own_ws = (
-            "SELECT w.id FROM workspaces w WHERE w.owner_id = ? "
-            "UNION SELECT wm.workspace_id FROM workspace_members wm WHERE wm.user_id = ?"
-        )
-        own_ws_names = (
-            "SELECT w.name FROM workspaces w WHERE w.owner_id = ? "
-            "UNION SELECT w.name FROM workspaces w "
-            "JOIN workspace_members wm ON wm.workspace_id = w.id WHERE wm.user_id = ?"
-        )
-        # Scope "shared by me"-style lists to pages in the user's own workspaces
-        # (or legacy pages whose workspace_id is NULL but identify the workspace by text).
-        scope_cond = (
-            f"(workspace_id IN ({own_ws}) "
-            f"OR (workspace_id IS NULL AND lower(workspace) IN "
-            f"(SELECT lower(name) FROM ({own_ws_names}))) "
-            f"OR (workspace_id IS NULL AND lower(workspace) = lower("
-            f"(SELECT login FROM users WHERE id=?))))"
-        )
-        scope_params = (user_id, user_id, user_id, user_id, user_id)
-
-        made_nominal = conn.execute(
-            "SELECT DISTINCT p.id, p.title, p.workspace, p.updated_at FROM page_shares s "
-            "JOIN pages p ON p.id=s.page_id "
-            "WHERE s.created_by=? AND p.deleted_at IS NULL",
-            (user_id,),
-        ).fetchall()
-        made_link = conn.execute(
-            f"SELECT id, title, workspace, updated_at FROM pages "
-            f"WHERE share_mode='anyone' AND published=0 AND deleted_at IS NULL "
-            f"AND {scope_cond}",
-            scope_params,
-        ).fetchall()
-        made_flag = conn.execute(
-            f"SELECT id, title, workspace, updated_at FROM pages "
-            f"WHERE (is_shared=1 OR share_mode != 'private') AND COALESCE(published,0)=0 AND deleted_at IS NULL "
-            f"AND {scope_cond}",
-            scope_params,
-        ).fetchall()
-        published_rows = conn.execute(
-            f"SELECT id, title, workspace, updated_at FROM pages "
-            f"WHERE published=1 AND deleted_at IS NULL AND {scope_cond} "
-            f"ORDER BY updated_at DESC LIMIT 20",
-            scope_params,
-        ).fetchall()
-        try:
-            received_rows = conn.execute(
-                "SELECT DISTINCT p.id, p.title, p.workspace, p.updated_at FROM page_shares s "
-                "JOIN pages p ON p.id=s.page_id "
-                "LEFT JOIN group_members gm ON gm.group_id = s.shared_with_group_id AND gm.user_id=? "
-                "WHERE (s.shared_with_user_id=? OR gm.user_id=?) AND p.deleted_at IS NULL",
-                (user_id, user_id, user_id),
-            ).fetchall()
-        except Exception:
-            received_rows = conn.execute(
-                "SELECT DISTINCT p.id, p.title, p.workspace, p.updated_at FROM page_shares s "
-                "JOIN pages p ON p.id=s.page_id "
-                "WHERE s.shared_with_user_id=? AND p.deleted_at IS NULL",
-                (user_id,),
-            ).fetchall()
-
-    def _entry(r, icon):
-        return {
-            "id": f"page/{r['id']}",
-            "db_id": r["id"],
-            "name": r["title"] or "New page",
-            "icon": icon,
-            "url": f"/pages/{r['id']}",
-            "active": False,
-            "indent": 0,
-            "depth": 0,
-            "has_children": False,
-            "children": [],
-        }
-
-    made_map = {}
-    for r in (*made_nominal, *made_link, *made_flag):
-        made_map.setdefault(r["id"], r)
-    made_sorted = sorted(made_map.values(), key=lambda r: r["updated_at"] or "", reverse=True)[:20]
-    shared_made = [_entry(r, "link") for r in made_sorted]
-    received_sorted = [r for r in received_rows if r["id"] not in made_map]
-    received_sorted = sorted(received_sorted, key=lambda r: r["updated_at"] or "", reverse=True)[:20]
-    shared_received = [_entry(r, "users") for r in received_sorted]
-    published = [_entry(r, "globe") for r in published_rows]
-    shared_all = [_entry(r, "link") for r in made_sorted]
-    return shared_made, shared_received, published, shared_all
-
-
-
-
-
-
-def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    ws_name = user.get("login", "Bruno") if user else "Bruno"
-    ws_key = f"{owner}/{repo}" if owner and repo else ws_name  # workspace = project context
-
-    # Active workspace name from cookie (for local workspace display)
-    from app.routers.dashboard import WORKSPACE_COOKIE
-    ws_cookie = request.cookies.get(WORKSPACE_COOKIE, "")
-    active_ws_name = "Workspace"
-    workspace_pages = []
-    gitea_workspace = False
-    gitea_owner = ""
-    gitea_repo = ""
-    has_active_workspace = False
-    local_ws_id = 0
-
-    if ws_cookie and ws_cookie.startswith("gitea:"):
-        # Gitea workspace: preserve context across pages. Also load the local
-        # mirror workspace so it appears in "My Workspaces" in the top section
-        # of the sidebar, in parallel with the Gitea repository tree.
-        parts = ws_cookie.split(":", 2)
-        if len(parts) >= 3:
-            gitea_owner = parts[1]
-            gitea_repo = parts[2]
-            active_ws_name = f"{gitea_owner}/{gitea_repo}"
-            gitea_workspace = True
-            has_active_workspace = True
-            # Get local workspace ID for mirror and load its tree
-            if user:
-                try:
-                    with get_conn() as conn:
-                        row = conn.execute(
-                            "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                            (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
-                        ).fetchone()
-                        if row:
-                            local_ws_id = row["id"]
-                            workspace_pages = _load_workspace_pages(str(local_ws_id))
-                except Exception:
-                    logger.exception("_sidebar_data")
-    elif ws_cookie and user:
-        try:
-            wsi = int(ws_cookie)
-            with get_conn() as conn:
-                row = conn.execute(
-                    "SELECT id, name, owner_id FROM workspaces WHERE id=? AND owner_id=?",
-                    (wsi, user["id"])
-                ).fetchone()
-                if row:
-                    active_ws_name = row["name"]
-                    workspace_pages = _load_workspace_pages(ws_cookie)
-                    has_active_workspace = True
-                    # v7.46.0 : comme pour le sidebar dashboard, exposer l'ID de
-                    # l'espace ACTIF (le bouton Home de base.html pointait sinon
-                    # sur ``local_workspaces[0]``, premier espace trie par nom).
-                    local_ws_id = wsi
-        except (ValueError, Exception):
-            pass
-    recent = []
-    if owner and repo:
-        view_map = {
-            "Kanban board": "kanban", "Detailed board": "detailed",
-            "Table view": "table", "Status overview": "status", "Team Load": "teamload",
-        }
-        first = True
-        for label, view in view_map.items():
-            indent = 0 if first else 1
-            active = first
-            recent.append({
-                "id": f"{owner}/{repo}/{view}",
-                "name": label, "icon": "folder" if first else "",
-                "url": f"/board/{owner}/{repo}?view={view}",
-                "active": active, "indent": indent,
-                "depth": indent, "has_children": False, "children": [],
-            })
-            first = False
-    # Load pages as nested tree for this project workspace
-    with get_conn() as conn:
-        tree_pages = _build_page_tree(conn, None, ws_key)
-        for p in tree_pages:
-            recent.append(p)
-    # Private pages: same as recent but filtered for page/ items (non-board views)
-    private_items = [r for r in recent if r.get("active") or r["id"].startswith("page/")]
-
-    # Load favorite pages from DB
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        fav_rows = conn.execute(
-            "SELECT p.id, p.title, p.workspace, p.updated_at FROM favorites f "
-            "JOIN pages p ON p.id = f.page_id "
-            "WHERE f.user_id=? ORDER BY f.position", (uid,)
-        ).fetchall()
-    favorites = []
-    for r in fav_rows:
-        favorites.append({
-            "id": f"page/{r['id']}",
-            "db_id": r["id"],
-            "name": r["title"] or "New page",
-            "icon": "📄",
-            "url": f"/pages/{r['id']}",
-            "active": False,
-            "indent": 0,
-            "depth": 0,
-            "has_children": False,
-            "children": [],
-        })
-
-    # Load shared pages
-    shared_made_pages, shared_received_pages, published_pages, shared_pages = _load_shared_sidebar_pages(uid)
-
-    # Auth method & OAuth badge data
-    auth_method = "local"
-    gitea_linked = False
-    github_linked = False
-    if user and user.get("id"):
-        try:
-            with get_conn() as conn:
-                am_row = conn.execute("SELECT auth_method FROM users WHERE id=?", (user["id"],)).fetchone()
-                if am_row and am_row["auth_method"]:
-                    auth_method = am_row["auth_method"]
-                tokens = conn.execute(
-                    "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
-                ).fetchall()
-                for t in tokens:
-                    if t["provider"] == "gitea":
-                        gitea_linked = True
-                    elif t["provider"] == "github":
-                        github_linked = True
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    return {"workspace_name": ws_name, "workspace_initial": ws_name[0].upper() if ws_name else "B",
-            "active_ws_name": active_ws_name,
-            "workspace_key": f"{gitea_owner}/{gitea_repo}" if gitea_workspace else ws_key,
-            "workspace_pages": workspace_pages,
-            "gitea_workspace": gitea_workspace,
-            "gitea_owner": gitea_owner,
-            "gitea_repo": gitea_repo,
-            "local_ws_id": local_ws_id,
-            "current_page": repo or "Dashboard", "last_edited": "now",
-            "recent_pages": recent, "private_pages": private_items,
-            "favorite_pages": favorites, "shared_pages": shared_pages,
-            "shared_made_pages": shared_made_pages,
-            "shared_received_pages": shared_received_pages,
-            "published_pages": published_pages,
-            "user": user,
-            "auth_method": auth_method,
-            "gitea_linked": gitea_linked,
-            "github_linked": github_linked,
-            "has_active_workspace": has_active_workspace,
-            "app_version": _get_app_version(),
-            "local_workspaces": _local_workspaces_for_user(user),
-            "sidebar_config": get_sidebar_config_sync(uid)}
-
-
-
-
-
-
-def _extract_ai_keywords(owner: str, repo: str, labels: list[dict], body: str = ""):
-    """Extract and persist AI keywords from issue labels and body."""
-    if not owner or not repo:
-        return
-    candidates = set()
-    for lbl in labels:
-        name = lbl.get("name", "").strip().lower()
-        if name and len(name) > 1:
-            candidates.add(name)
-    # Simple extraction from body: single words > 3 chars
-    for word in re.findall(r'\b[a-zA-Z]{4,}\b', body.lower()):
-        if word not in ("this", "that", "with", "from", "have", "when", "will"):
-            candidates.add(word)
-
-    with get_conn() as conn:
-        for kw in candidates:
-            kw = kw[:30]
-            existing = conn.execute(
-                "SELECT id, usage_count FROM ai_keywords WHERE project_owner=? AND project_name=? AND keyword=?",
-                (owner, repo, kw),
-            ).fetchone()
-            if existing:
-                conn.execute("UPDATE ai_keywords SET usage_count=? WHERE id=?",
-                             (existing["usage_count"] + 1, existing["id"]))
-            else:
-                color_idx = len(candidates) % len(AI_KEYWORD_COLORS)
-                conn.execute(
-                    "INSERT INTO ai_keywords (project_owner, project_name, keyword, color) VALUES (?,?,?,?)",
-                    (owner, repo, kw, AI_KEYWORD_COLORS[color_idx]),
-                )
-        conn.commit()
-
-
-
-
-
-
-def _get_project_properties(owner: str, repo: str) -> list[dict]:
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM project_properties WHERE project_owner=? AND project_name=? ORDER BY position",
-            (owner, repo),
-        ).fetchall()
-    return [dict(r) for r in rows]
-
-
-
-
-
-
-
-
-
-
-async def asyncio_get_labels(owner: str, repo: str):
-    return await gitea.get_labels(owner, repo)
-
-
-
-
-
-
-def _apply_filters(cards: list[dict], status_filter: str, filters: str) -> list[dict]:
-    if status_filter:
-        allowed = set(status_filter.split(","))
-        cards = [c for c in cards if c["status"] in allowed]
-    if filters:
-        for f in filters.split(","):
-            if ":" in f:
-                prop, val = f.split(":", 1)
-                val_lower = val.lower()
-                if prop == "assignee":
-                    cards = [c for c in cards if c.get("assignee", "").lower() == val_lower]
-                elif prop == "tag":
-                    cards = [c for c in cards if (c.get("tag") or "").lower() == val_lower]
-                elif prop == "keyword":
-                    cards = [c for c in cards if any(val_lower in kw.get("name", "").lower() for kw in c.get("keywords", []))]
-    return cards
-
-
-
-
-
-
-def _apply_sorts(cards: list[dict], sorts: str) -> list[dict]:
-    if not sorts:
-        return cards
-    order = {"todo": 0, "progress": 1, "done": 2}
-    for spec in reversed(sorts.split(",")):
-        if ":" not in spec:
-            continue
-        field, direction = spec.split(":", 1)
-        rev = direction == "desc"
-        if field == "name":
-            cards.sort(key=lambda c: c["title"].lower(), reverse=rev)
-        elif field == "status":
-            cards.sort(key=lambda c: order.get(c["status"], 0), reverse=rev)
-        elif field == "assignee":
-            cards.sort(key=lambda c: c.get("assignee", "").lower(), reverse=rev)
-        elif field == "deadline":
-            cards.sort(key=lambda c: c.get("due_date", ""), reverse=rev)
-    return cards
-
-
-# ═══════════ Library page ═══════════
-
-
-
-
-
-def _record_version(conn, page_id: int, user_id, title: str, blocks_json: str) -> None:
-    """Insert a version snapshot unless it is byte-identical to the latest one."""
-    prev = conn.execute(
-        "SELECT COALESCE(title, ''), blocks_json FROM page_versions "
-        "WHERE page_id=? ORDER BY id DESC LIMIT 1",
-        (page_id,),
-    ).fetchone()
-    if prev is not None and prev["blocks_json"] == blocks_json:
-        if prev["title"] != (title or ""):
-            conn.execute(
-                "UPDATE page_versions SET title=? WHERE id="
-                "(SELECT id FROM page_versions WHERE page_id=? ORDER BY id DESC LIMIT 1)",
-                (title or "", page_id),
-            )
-        return
-    conn.execute(
-        "INSERT INTO page_versions (page_id, user_id, title, blocks_json, note) VALUES (?,?,?,?,'edited')",
-        (page_id, user_id, title or "", blocks_json),
-    )
-
-
-
-
-
-
-def _block_texts(b: dict) -> list[str]:
-    """Flatten a block (including children) into searchable text chunks."""
-    out = []
-    raw = b.get("content")
-    if isinstance(raw, str) and raw.strip():
-        out.append(raw)
-    for child in b.get("children") or []:
-        out.extend(_block_texts(child))
-    return out
-
-
-
-
-
-
-# ═══════════ v5.5.0: Cover & icon ═══════════
-
-
-def _upload_root() -> Path:
-    return Path(settings.data_dir)
-
-
-
-
-
-
-def _ws_id_for(request: Request, page_id: int) -> int:
-    """The active workspace id for the page (cookie, then page, then fallback 1)."""
-    cookie = request.cookies.get("flowdeck_workspace", "")
-    try:
-        ws_id = int(cookie)
-        if ws_id > 0:
-            return ws_id
-    except (ValueError, TypeError):
-        pass
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT workspace_id FROM pages WHERE id=?", (page_id,)
-        ).fetchone()
-        if row and row["workspace_id"]:
-            return int(row["workspace_id"])
-    return 1
-
-
-
-
-
-
-async def _store_uploaded_file(request: Request, ws_id: int) -> dict:
-    """Persist an uploaded file under uploads/workspace_{ws_id}/ and return
-    {file_url, file_path, mime_type, size, file_name}."""
-    import datetime
-    import re as _re
-
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    original = (upload.filename or "cover.png").replace("\\", "/").rsplit("/", 1)[-1]
-    name = _re.sub(r"[^A-Za-z0-9._-]", "_", original)[:120]
-    ext = name.rsplit(".", 1)[-1].lower() if "." in name else "bin"
-    if ext not in {"png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico", "avif"}:
-        raise HTTPException(400, "Unsupported image format")
-    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S")
-    folder = _upload_root() / f"uploads/workspace_{ws_id}"
-    folder.mkdir(parents=True, exist_ok=True)
-    final = f"{stamp}_{name}"
-    (folder / final).write_bytes(await upload.read())
-    mime = f"image/{'svg+xml' if ext == 'svg' else 'jpeg' if ext == 'jpg' else ext}"
-    return {
-        "file_url": f"/api/files/{ws_id}/{final}",
-        "file_path": f"uploads/workspace_{ws_id}/{final}",
-        "mime_type": mime,
-        "size": (folder / final).stat().st_size,
-        "file_name": name,
-    }
-
-
-
-
-
-
-# ═══════════ v5.4.0: Import (Markdown / .md / Notion .zip) ═══════════
-
-
-async def _create_page_from_markdown(request: Request, markdown: str, title: str = "") -> int:
-    """Convert markdown → blocks (server-side, same mapping as the editor) and
-    create a page in the caller's workspace."""
-    from app.services.export import _md_to_blocks
-
-    blocks = _md_to_blocks(markdown or "")
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    ws_key = user.get("login", "Bruno") if user else "Bruno"
-    file_title = title.strip() or "Import"
-    fallback = (file_title or "Imported page").replace("/", "-").replace("\\", "-")[:120]
-    if not blocks:
-        blocks = [{"type": "paragraph", "content": markdown or ""}]
-    with get_conn() as conn:
-        next_order = conn.execute(
-            "SELECT COALESCE(MAX(sort_order), -1) + 1 FROM pages WHERE workspace=? AND parent_id IS NULL",
-            (ws_key,),
-        ).fetchone()[0]
-        cur = conn.execute(
-            "INSERT INTO pages (workspace, title, content, content_format, parent_section, sort_order, workspace_id) "
-            "VALUES (?,?,?,?,'Private',?,(SELECT id FROM workspaces WHERE name=? LIMIT 1))",
-            (ws_key, fallback, json.dumps(blocks), "blocks", next_order, ws_key),
-        )
-        conn.commit()
-        return cur.lastrowid
-
-
-
-
-
-
-async def _unfurl_repo(forge: str, owner: str, repo: str):
-    """Resolve a ``gitea:owner/repo`` / ``github:owner/repo`` ref."""
-    try:
-        if forge == "gitea":
-            from app.services.gitea_client import GiteaClient
-            info = await GiteaClient().get_repo_info(owner, repo)
-            site = "Gitea"
-        else:
-            from app.config import settings
-            from app.services.github_adapter import GitHubAdapter
-            token = getattr(settings, "github_token", None) or ""
-            if token:
-                info = await GitHubAdapter(access_token=token).get_repo_info(owner, repo)
-            else:
-                async with shared_client(timeout=10) as client:
-                    r = await client.get(
-                        f"https://api.github.com/repos/{owner}/{repo}",
-                        headers={"Accept": "application/vnd.github+json"},
-                    )
-                r.raise_for_status()
-                info = r.json()
-            site = "GitHub"
-    except Exception as exc:  # noqa: BLE001 — forge lookup is best-effort
-        logging.getLogger(__name__).debug("unfurl %s failed: %s", forge, exc)
-        return None
-    branch = info.get("default_branch") or "main"
-    return {
-        "url": info.get("html_url") or f"https://{forge}.com/{owner}/{repo}",
-        "title": info.get("full_name") or f"{owner}/{repo}",
-        "description": (info.get("description") or f"{site} repository "
-                        f"{owner}/{repo} · default branch: {branch}"),
-        "image": "",
-        "site_name": site,
-        "language": info.get("language") or "",
-    }
-
-
-
@@ -1,223 +0,0 @@
-"""FlowDeck — Board : board_views.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, HTTPException, Query, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-from app.services.gitea_client import gitea
-
-from ._common import (
-    STATUS_COLORS,
-    STATUS_LABELS,
-    _apply_filters,
-    _apply_sorts,
-    _extract_ai_keywords,
-    _get_project_properties,
-    _map_issue_to_card,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-# ═══════════ Board page ═══════════
-
-@router.get("/{owner}/{repo}", response_class=HTMLResponse)
-def board(request: Request, owner: str, repo: str, view: str = Query(default="")):
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, owner, repo)
-    template = env.get_template("board.html")
-    return template.render(request=request, owner=owner, repo=repo, groups=[],
-                          initial_view=view, **sidebar)
-
-
-# ═══════════ View fragments ═══════════
-
-
-
-
-# ═══════════ View fragments ═══════════
-
-@router.get("/{owner}/{repo}/view/{view}", response_class=HTMLResponse)
-async def board_view(
-    request: Request, owner: str, repo: str, view: str,
-    status: str = Query(default=""),
-    filter: str = Query(default=""),
-    sort: str = Query(default=""),
-):
-    try:
-        issues = await gitea.get_issues(owner, repo, state="all")
-        issues_only = [i for i in issues if not i.get("pull_request")]
-        cards = [_map_issue_to_card(i, owner, repo) for i in issues_only]
-        cards = _apply_filters(cards, status, filter)
-        cards = _apply_sorts(cards, sort)
-    except Exception as e:
-        logger.error("Board view error: %s", e)
-        cards = []
-
-    from app.templating import ENV
-    env = ENV
-
-    # Dynamic groups from Gitea labels (fallback to hardcoded)
-    group_names = ["Design", "Engineering", "No Team"]
-    groups = []
-    for gname in group_names:
-        gid = gname.lower().replace(" ", "-")
-        gcards = cards
-        groups.append({
-            "id": gid, "name": gname,
-            "counts": {
-                "todo": len([c for c in gcards if c["status"] == "todo"]),
-                "progress": len([c for c in gcards if c["status"] == "progress"]),
-                "done": len([c for c in gcards if c["status"] == "done"]),
-            },
-            "cards": gcards,
-        })
-
-    ctx = {"owner": owner, "repo": repo, "groups": groups, "cards": cards}
-
-    template_map = {
-        "table": "table_view.html",
-        "status": "status_overview.html",
-        "teamload": "team_load.html",
-        "detailed": "detailed_board.html",
-    }
-
-    if view == "table":
-        grouped = {g["name"]: g["cards"] for g in groups}
-        ctx["grouped_cards"] = grouped
-    elif view == "status":
-        counts = {"todo": 0, "progress": 0, "done": 0}
-        for c in cards:
-            if c["status"] in counts:
-                counts[c["status"]] += 1
-        ctx.update(status_data=counts, status_colors=STATUS_COLORS, status_labels=STATUS_LABELS)
-    elif view == "teamload":
-        members = {}
-        for c in cards:
-            name = c.get("assignee") or "Unassigned"
-            if name not in members:
-                members[name] = {"name": name, "initial": name[0].upper(),
-                                 "todo": 0, "progress": 0, "complete": 0, "total": 0}
-            sk = c["status"] if c["status"] in ("todo", "progress") else "complete"
-            members[name][sk] += 1
-            members[name]["total"] += 1
-        ctx["team_data"] = list(members.values())
-    elif view == "detailed":
-        pass
-    else:
-        template_map["kanban"] = "board_fragment.html"
-
-    template_name = template_map.get(view, "board_fragment.html")
-    template = env.get_template(template_name)
-    return template.render(**ctx)
-
-
-# ═══════════ v0.9.0: Custom Properties API ═══════════
-
-
-
-
-# ═══════════ v0.9.0: Custom Properties API ═══════════
-
-@router.get("/api/properties/{owner}/{repo}")
-def get_properties(owner: str, repo: str):
-    return {"properties": _get_project_properties(owner, repo)}
-
-
-
-
-@router.post("/api/properties/{owner}/{repo}")
-def create_property(owner: str, repo: str, name: str = Query(...),
-                          prop_type: str = Query(default="select"),
-                          options: str = Query(default="")):
-    opts = json.dumps([o.strip() for o in options.split(",") if o.strip()])
-    with get_conn() as conn:
-        try:
-            conn.execute(
-                "INSERT INTO project_properties (project_owner, project_name, name, prop_type, options_json) VALUES (?,?,?,?,?)",
-                (owner, repo, name, prop_type, opts),
-            )
-            conn.commit()
-        except Exception as e:
-            raise HTTPException(409, f"Property already exists: {e}") from e
-    return {"status": "ok", "name": name, "type": prop_type}
-
-
-
-
-@router.delete("/api/properties/{owner}/{repo}")
-def delete_property(owner: str, repo: str, name: str = Query(...)):
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM project_properties WHERE project_owner=? AND project_name=? AND name=?",
-            (owner, repo, name),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/properties/{owner}/{repo}/values")
-def set_property_value(owner: str, repo: str, issue_id: int = Query(...),
-                              name: str = Query(...), value: str = Query(default="")):
-    with get_conn() as conn:
-        prop = conn.execute(
-            "SELECT id FROM project_properties WHERE project_owner=? AND project_name=? AND name=?",
-            (owner, repo, name),
-        ).fetchone()
-        if not prop:
-            raise HTTPException(404, f"Property '{name}' not found")
-        conn.execute(
-            "INSERT OR REPLACE INTO property_values (property_id, gitea_issue_id, value) VALUES (?,?,?)",
-            (prop["id"], issue_id, value),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-# ═══════════ v0.9.0: AI Keywords API ═══════════
-
-
-
-
-# ═══════════ v0.9.0: AI Keywords API ═══════════
-
-@router.get("/api/ai-keywords/{owner}/{repo}")
-def get_ai_keywords(owner: str, repo: str):
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT keyword, color, usage_count FROM ai_keywords WHERE project_owner=? AND project_name=? ORDER BY usage_count DESC LIMIT 30",
-            (owner, repo),
-        ).fetchall()
-    return {"keywords": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/ai-keywords/{owner}/{repo}/extract")
-async def extract_ai_keywords(owner: str, repo: str):
-    """Re-extract keywords from all issues in the repo."""
-    try:
-        issues = await gitea.get_issues(owner, repo, state="all")
-        for issue in issues:
-            if not issue.get("pull_request"):
-                _extract_ai_keywords(owner, repo, issue.get("labels", []), issue.get("body", ""))
-    except Exception as e:
-        raise HTTPException(500, str(e)) from e
-    return {"status": "ok", "issues_scanned": len(issues)}
-
-
-# ═══════════ Pages Markdown ═══════════
@@ -1,64 +0,0 @@
-"""FlowDeck — Board : embed.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.config import settings
-
-from ._common import _REPO_REF_RE, _unfurl_repo
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.post("/api/og/metadata")
-async def og_metadata(request: Request):
-    """v5.5.0: Open Graph metadata for a bookmark card.
-
-    v7.3.0: ``gitea:owner/repo`` and ``github:owner/repo`` schemes are
-    unfurled straight from the forge API (no HTTP fetch of the HTML page).
-    """
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    url = (body.get("url") or "").strip()
-    if not url:
-        raise HTTPException(400, "url required")
-    m = _REPO_REF_RE.match(url)
-    if m:
-        forge, owner, repo = m.group(1).lower(), m.group(2), m.group(3)
-        data = await _unfurl_repo(forge, owner, repo)
-        if data:
-            return {"ok": True, **data}
-    from app.services.og_fetcher import fetch_og_metadata
-    try:
-        data = await fetch_og_metadata(url)
-    except ValueError as exc:
-        # A12 : SSRF — URL vers un hôte privé/loopback (ou redirection vers l'un).
-        raise HTTPException(400, str(exc)) from None
-    return {"ok": True, **data}
-
-
-
-
-@router.post("/api/embed/resolve")
-def resolve_embed(request: Request, body: dict = Body(...)):
-    """v5.5.0: rewrite a pasted URL to its provider embed src.
-
-    Powers the universal ``/embed`` block (YouTube, Vimeo, Figma, Maps,
-    Docs, Loom, CodePen, Miro, Spotify, SoundCloud, Twitch, X/Twitter…).
-    """
-    url = (body.get("url") or "").strip()
-    if not url:
-        raise HTTPException(400, "url required")
-    from app.services.embeds import resolve_embed as _resolve
-    data = _resolve(url, parent=settings.app_base_url)
-    return {"ok": True, "url": url, **data}
@@ -1,85 +0,0 @@
-"""FlowDeck — Board : import_.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.services.automations import fire_event
-
-from ._common import _create_page_from_markdown
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.post("/api/pages/import")
-async def import_page(request: Request):
-    """v5.4.0: import markdown text as a new page (blocks) in the workspace."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    markdown = body.get("markdown", "")
-    title = body.get("title", "")
-    if not markdown and not body.get("csv"):
-        raise HTTPException(400, "markdown field required")
-    if not markdown.strip():
-        raise HTTPException(400, "markdown is empty")
-    page_id = await _create_page_from_markdown(request, markdown, title)
-    await fire_event("page.created", {"page_id": page_id, "title": title or "Import",
-                                      "workspace": ""})
-    return {"status": "ok", "id": page_id}
-
-
-
-
-@router.post("/api/pages/import/file")
-async def import_file(request: Request):
-    """v5.4.0: import an uploaded .md file (or a Notion export .zip containing
-    markdown pages) into the workspace. Returns the created page ids."""
-    import io as _io
-    import zipfile
-
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    filename = (upload.filename or "import.md").replace("\\", "/").rsplit("/", 1)[-1]
-    data = await upload.read()
-    created_ids = []
-
-    if filename.lower().endswith(".zip"):
-        try:
-            zf = zipfile.ZipFile(_io.BytesIO(data))
-        except zipfile.BadZipFile:
-            raise HTTPException(400, "Invalid zip archive") from None
-        md_entries = sorted(
-            (n for n in zf.namelist() if n.lower().endswith((".md", ".markdown"))),
-            key=lambda n: (n.count("/"), n.lower()),
-        )
-        if not md_entries:
-            raise HTTPException(400, "No .md files found in archive")
-        for name in md_entries:
-            raw = zf.read(name).decode("utf-8", errors="replace")
-            title = name.replace("\\", "/").rsplit("/", 1)[-1][:-3]
-            try:
-                created_ids.append(await _create_page_from_markdown(request, raw, title))
-            except Exception as exc:  # noqa: BLE001 - keep importing the rest
-                logger.warning("import failed for %s: %s", name, exc)
-    else:
-        try:
-            raw = data.decode("utf-8")
-        except UnicodeDecodeError:
-            raise HTTPException(400, "Only text/markdown files are supported") from None
-        title = filename.replace(".md", "").replace(".markdown", "").replace(".txt", "")
-        created_ids.append(await _create_page_from_markdown(request, raw, title))
-
-    if not created_ids:
-        raise HTTPException(422, "No pages could be imported")
-    return {"status": "ok", "ids": created_ids, "count": len(created_ids)}
@@ -1,66 +0,0 @@
-"""FlowDeck — Board : library.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Query, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-
-from ._common import _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-# ═══════════ Library page ═══════════
-
-@router.get("/library", response_class=HTMLResponse)
-def library_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
-    """Library page avec onglets Recents, Favorites, Shared, Private — scopé au workspace."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, owner, repo)
-    # Load all pages for the workspace from DB
-    ws_key = f"{owner}/{repo}" if owner and repo else ""
-    with get_conn() as conn:
-        if ws_key:
-            rows = conn.execute(
-                "SELECT id, title, workspace, updated_at FROM pages "
-                "WHERE workspace=? AND collection_row_id IS NULL ORDER BY updated_at DESC",
-                (ws_key,),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, title, workspace, updated_at FROM pages "
-                "WHERE collection_row_id IS NULL ORDER BY updated_at DESC",
-            ).fetchall()
-    all_pages = []
-    for r in rows:
-        page = dict(r)
-        all_pages.append({
-            "id": f"page/{page['id']}",
-            "name": page["title"] or "Untitled",
-            "icon": "📄",
-            "url": f"/pages/{page['id']}",
-            "created_by": "You",
-            "source": page.get("workspace") or "Private",
-            "last_edited": page.get("updated_at", "now"),
-            "last_visited": page.get("updated_at", "now"),
-        })
-    sidebar["recent_pages"] = all_pages
-    sidebar["favorite_pages"] = []
-    sidebar["private_pages"] = [p for p in all_pages if p.get("source") == "🔒 Private"]
-    sidebar["shared_pages"] = []
-    sidebar["shared_made_pages"] = []
-    sidebar["shared_received_pages"] = []
-    template = env.get_template("library.html")
-    return template.render(**sidebar)
-
-# ═══════════ Favorites API ═══════════
@@ -1,263 +0,0 @@
-"""FlowDeck — Board : page_api.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-
-from ._common import _ensure_block_ids
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.post("/api/pages/{page_id}/lock")
-def set_page_lock(request: Request, page_id: int, body: dict = Body(default={})):
-    """v5.12.0: lock/unlock a page (read-only for everyone except the locker,
-    admins and the page creator)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    locked = bool(body.get("locked"))
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, is_locked, locked_by, workspace FROM pages WHERE id=?",
-                           (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        is_admin = 1 if user.get("is_admin") else 0
-        if row["is_locked"] and not is_admin and row["locked_by"] != user["id"]:
-            raise HTTPException(403, "Only the person who locked this page (or an admin) can unlock it")
-        conn.execute("UPDATE pages SET is_locked=?, locked_by=? WHERE id=?",
-                     (1 if locked else 0, user["id"] if locked else None, page_id))
-        conn.commit()
-    run_event_sync(fire_event("page.locked" if locked else "page.unlocked",
-                     {"page_id": page_id, "by": user["id"]}))
-    return {"status": "ok", "is_locked": int(locked)}
-
-
-
-
-@router.post("/api/pages/{page_id}/options")
-def set_page_options(request: Request, page_id: int, body: dict = Body(default={})):
-    """v5.12.0: page layout options — full-width and compact typography."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    updates = {}
-    for key in ("full_width", "font_small"):
-        if key in body:
-            updates[key] = 1 if body[key] else 0
-    if not updates:
-        raise HTTPException(400, "nothing to update")
-    sets = ", ".join(f"{k}=?" for k in updates)
-    with get_conn() as conn:
-        row = conn.execute("SELECT id FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        conn.execute(f"UPDATE pages SET {sets}, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                     (*updates.values(), page_id))
-        conn.commit()
-    return {"status": "ok", **{k: bool(v) for k, v in updates.items()}}
-
-
-
-
-@router.get("/api/page-templates")
-def list_page_templates_api(request: Request):
-    """v5.12.0: built-in + user global page templates for the picker."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = (user or {}).get("id")
-    from app.services.block_templates import template_list
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT id, name, icon, description, created_by
-               FROM page_global_templates
-               WHERE created_by IS NULL OR created_by=?
-               ORDER BY created_at""",
-            (uid,),
-        ).fetchall()
-    mine = [dict(r) for r in rows]
-    for t in mine:
-        t["builtin"] = False
-    return {"templates": template_list() + mine}
-
-
-
-
-@router.post("/api/page-templates")
-def create_page_template(request: Request, body: dict = Body(default={})):
-    """v5.12.0: save the current page (or a raw block list) as a personal
-    global template: {name, icon?, description?, page_id? | blocks?}."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    name = (body.get("name") or "").strip()
-    if not name:
-        raise HTTPException(400, "name is required")
-    blocks = body.get("blocks")
-    if body.get("page_id"):
-        with get_conn() as conn:
-            row = conn.execute("SELECT content, content_format FROM pages WHERE id=?",
-                               (int(body["page_id"]),)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        if row["content_format"] == "blocks" and row["content"]:
-            try:
-                blocks = json.loads(row["content"])
-            except (json.JSONDecodeError, TypeError):
-                raise HTTPException(400, "Page content is not block JSON") from None
-    if not isinstance(blocks, list) or not blocks:
-        raise HTTPException(400, "blocks (or page_id) required")
-    with get_conn() as conn:
-        cur = conn.execute(
-            """INSERT INTO page_global_templates (name, icon, description, blocks_json, created_by)
-               VALUES (?, ?, ?, ?, ?)""",
-            (name, body.get("icon") or "📄", body.get("description") or "",
-             json.dumps(blocks), user["id"]),
-        )
-        conn.commit()
-        tid = cur.lastrowid
-    return {"status": "ok", "id": tid}
-
-
-
-
-@router.post("/api/page-templates/{template_id}/use")
-def use_page_template(request: Request, template_id: int, body: dict = Body(default={})):
-    """v5.12.0: instantiate a page from a template (built-in or user).
-
-    Body: {key?} for built-ins OR uses the row id for user templates.
-    Creates 'blocks'-format page in the caller's workspace and returns its id.
-    """
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    title = (body.get("title") or "").strip()
-    blocks_json = None
-    if template_id == 0:
-        from app.services.block_templates import blocks_json_for
-        key = body.get("key") or "empty"
-        blocks_json = blocks_json_for(key)
-        name = key
-        if blocks_json is None:
-            raise HTTPException(404, "Unknown built-in template")
-    else:
-        with get_conn() as conn:
-            uid = (user or {}).get("id")
-            row = conn.execute(
-                "SELECT * FROM page_global_templates WHERE id=? AND (created_by IS NULL OR created_by=?)",
-                (template_id, uid),
-            ).fetchone()
-        if not row:
-            raise HTTPException(404, "Template not found")
-        blocks_json = row["blocks_json"]
-        name = row["name"]
-        title = title or row["name"]
-    # Resolve the target workspace so the new page actually shows up in the
-    # active local workspace (bugfix: template pages previously got
-    # workspace_id = NULL and never appeared in the sidebar/tree).
-    uid = (user or {}).get("id")
-    ws_id_raw = body.get("workspace_id")
-    ws_id = None
-    if ws_id_raw is not None:
-        try:
-            ws_id = int(ws_id_raw)
-        except (TypeError, ValueError):
-            ws_id = None
-    ws_key = user.get("login", "Bruno") if user else "Bruno"
-    if ws_id is not None:
-        with get_conn() as conn:
-            ws_row = conn.execute(
-                "SELECT id, name, owner_id FROM workspaces WHERE id=?", (ws_id,)
-            ).fetchone()
-        if ws_row and (uid is None or ws_row["owner_id"] == uid):
-            ws_key = ws_row["name"] or ws_key
-        else:
-            ws_id = None
-    else:
-        body_ws = (body.get("workspace") or "").strip()
-        if body_ws:
-            ws_key = body_ws
-    # Optional target folder: instantiate the template as a child of it.
-    parent_id = body.get("parent_id")
-    try:
-        parent_id = int(parent_id) if parent_id not in (None, "", 0, "0") else None
-    except (TypeError, ValueError):
-        parent_id = None
-    try:
-        parsed_blocks = json.loads(blocks_json)
-    except (json.JSONDecodeError, TypeError):
-        raise HTTPException(500, "Template content corrupted") from None
-    _ensure_block_ids(parsed_blocks)
-    blocks_json = json.dumps(parsed_blocks)
-    with get_conn() as conn:
-        if parent_id is not None:
-            next_order = conn.execute(
-                "SELECT COALESCE(MAX(sort_order), -1) + 1 FROM pages WHERE parent_id=?",
-                (parent_id,),
-            ).fetchone()[0]
-        elif ws_id is not None:
-            next_order = conn.execute(
-                "SELECT COALESCE(MAX(sort_order), -1) + 1 FROM pages WHERE workspace_id=? AND parent_id IS NULL",
-                (ws_id,),
-            ).fetchone()[0]
-        else:
-            next_order = conn.execute(
-                "SELECT COALESCE(MAX(sort_order), -1) + 1 FROM pages WHERE workspace=? AND parent_id IS NULL",
-                (ws_key,),
-            ).fetchone()[0]
-        cur = conn.execute(
-            """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id, sort_order)
-               VALUES (?,?,?,?,?, 'Private', ?, ?)""",
-            (ws_key, ws_id, title or name, blocks_json, "blocks", parent_id, next_order),
-        )
-        conn.commit()
-        page_id = cur.lastrowid
-    run_event_sync(fire_event("page.created", {"page_id": page_id, "title": title or name,
-                                      "workspace": ws_key, "from_template": name}))
-    return {"status": "ok", "id": page_id, "title": title or name}
-
-
-@router.get("/api/page-templates/{template_id}/blocks")
-def page_template_blocks(request: Request, template_id: int, key: str = ""):
-    """v7.53.0 : blocs d'un canevas, pour l'insérer dans le document ouvert.
-
-    Builtin : ``template_id=0`` + ``?key=`` (même convention que ``/use``).
-    Canevas personnel : son ``id``. Les blocs builtin sont sans ``id`` — le
-    front appelle ``ensureBlockIds()`` (déjà global côté éditeur).
-    """
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if template_id == 0:
-        from app.services.block_templates import blocks_json_for
-        raw = blocks_json_for(key or "empty")
-        if raw is None:
-            raise HTTPException(404, "Unknown built-in template")
-    else:
-        uid = (user or {}).get("id")
-        with get_conn() as conn:
-            row = conn.execute(
-                "SELECT blocks_json FROM page_global_templates "
-                "WHERE id=? AND (created_by IS NULL OR created_by=?)",
-                (template_id, uid),
-            ).fetchone()
-        if not row:
-            raise HTTPException(404, "Template not found")
-        raw = row["blocks_json"]
-    try:
-        blocks = json.loads(raw)
-    except (json.JSONDecodeError, TypeError) as exc:
-        raise HTTPException(500, "Template content corrupted") from exc
-    if not isinstance(blocks, list):
-        raise HTTPException(500, "Template content corrupted")
-    return {"blocks": blocks}
-
-
-# ── Core helpers ──
@@ -1,122 +0,0 @@
-"""FlowDeck — Board : page_media.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-
-from ._common import _store_uploaded_file, _ws_id_for
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-# ═══════════ v5.4.0: Page & collection duplication ═══════════
-
-
-@router.post("/api/pages/{page_id}/duplicate")
-def duplicate_page(request: Request, page_id: int):
-    """Duplicate a page (block/markdown content included) as a sibling."""
-    SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM pages WHERE id=? AND deleted_at IS NULL", (page_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        page = dict(row)
-
-    def copy_tree(src_id: int, parent_id) -> int:
-        with get_conn() as conn:
-            conn.execute("SELECT * FROM pages WHERE id=?", (src_id,)).fetchone()
-            cur = conn.execute(
-                "INSERT INTO pages (workspace, workspace_id, title, content, content_format, "
-                "parent_section, parent_id, sort_order, share_mode, published, is_published, "
-                "publish_slug, is_shared, cover_url, page_icon, created_at, updated_at) "
-                "SELECT workspace, workspace_id, title || ' copy', content, content_format, "
-                "parent_section, ?, sort_order, share_mode, 0, is_published, '', is_shared, "
-                "cover_url, page_icon, created_at, updated_at FROM pages WHERE id=?",
-                (parent_id, src_id),
-            )
-            new_id = cur.lastrowid
-            conn.commit()
-            for child in conn.execute(
-                "SELECT id FROM pages WHERE parent_id=? ", (src_id,)
-            ).fetchall():
-                copy_tree(child["id"], new_id)
-        return new_id
-
-    new_id = copy_tree(page_id, page.get("parent_id"))
-    title = (page.get("title") or "Untitled") + " copy"
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET title=? WHERE id=?", (title, new_id))
-        conn.commit()
-    run_event_sync(fire_event("page.created", {"page_id": new_id, "title": title,
-                                      "workspace": page.get("workspace")}))
-    return {"status": "ok", "id": new_id, "title": title}
-
-
-# ═══════════ v5.5.0: Cover & icon ═══════════
-
-
-
-
-@router.post("/api/pages/{page_id}/cover")
-async def set_page_cover(request: Request, page_id: int):
-    """v5.5.0: upload an image cover for a page.
-
-    JSON body {cover_url} accepts an external URL; multipart ``file`` uploads
-    an image stored in the workspace's uploads directory.
-    """
-    ctype = (request.headers.get("content-type") or "").lower()
-    if ctype.startswith("application/json"):
-        body = await request.json()
-        cover_url = (body.get("cover_url") or "").strip()
-        if not cover_url:
-            raise HTTPException(400, "cover_url required")
-        with get_conn() as conn:
-            conn.execute("UPDATE pages SET cover_url=? WHERE id=?", (cover_url, page_id))
-            conn.commit()
-        return {"status": "ok", "page_id": page_id, "cover_url": cover_url}
-    ws_id = _ws_id_for(request, page_id)
-    meta = await _store_uploaded_file(request, ws_id)
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET cover_url=? WHERE id=?", (meta["file_url"], page_id))
-        conn.commit()
-    return {"status": "ok", "page_id": page_id, "cover_url": meta["file_url"]}
-
-
-
-
-@router.delete("/api/pages/{page_id}/cover")
-def remove_page_cover(request: Request, page_id: int):
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET cover_url='' WHERE id=?", (page_id,))
-        conn.commit()
-    return {"status": "ok", "page_id": page_id}
-
-
-
-
-@router.post("/api/pages/{page_id}/icon")
-def set_page_icon(request: Request, page_id: int, body: dict = Body(default={})):
-    """v5.5.0: set a page emoji/icon label (or a custom-emoji image URL)."""
-    icon = (body.get("icon") or "").strip()
-    if len(icon) > 512:
-        raise HTTPException(400, "icon too long")
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET page_icon=? WHERE id=?", (icon, page_id))
-        conn.commit()
-    return {"status": "ok", "page_id": page_id, "icon": icon}
-
-
-# ═══════════ v5.4.0: Import (Markdown / .md / Notion .zip) ═══════════
@@ -1,176 +0,0 @@
-"""FlowDeck — Board : page_ops.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.permission_manager import PermissionManager
-
-from ._common import _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.put("/api/pages/{page_id}/move")
-def move_page(request: Request, page_id: int, body: dict = Body(default={})):
-    """Move a page to another workspace or reorder within tree.
-
-    Body (JSON): { workspace_id?: int, parent_id?: int, new_order?: int }
-    - workspace_id: move page to a different workspace
-    - parent_id: change parent (0 = root level)
-    - new_order: position among siblings (0 = append)
-    """
-    new_ws_id = body.get("workspace_id")
-    new_parent_id = body.get("parent_id", 0)
-    new_order = body.get("new_order", 0)
-
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, workspace, workspace_id FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-
-        if new_ws_id:
-            # Move to a different workspace: get the workspace name
-            ws_row = conn.execute("SELECT name FROM workspaces WHERE id=?", (new_ws_id,)).fetchone()
-            if not ws_row:
-                return JSONResponse({"status": "error", "detail": "Workspace not found"}, status_code=404)
-            conn.execute(
-                "UPDATE pages SET workspace_id=?, workspace=?, parent_id=NULL, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (new_ws_id, ws_row["name"], page_id),
-            )
-        else:
-            # Reorder within same workspace
-            conn.execute(
-                "UPDATE pages SET parent_id=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (new_parent_id if new_parent_id > 0 else None, page_id),
-            )
-            conn.execute(
-                "UPDATE pages SET sort_order=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (new_order, page_id),
-            )
-
-        conn.commit()
-    run_event_sync(fire_event("page.moved", {"page_id": page_id, "workspace_id": new_ws_id or 0,
-                                    "parent_id": new_parent_id}))
-    return {"status": "ok", "id": page_id}
-
-
-
-
-@router.delete("/api/pages/{page_id}")
-def delete_page(request: Request, page_id: int):
-    """Move a page to trash (soft delete)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = (user or {}).get("id")
-    if not uid:
-        raise HTTPException(403, "Authentication required")
-    # v6.0.0: granular page permissions — need at least edit access to trash.
-    if not PermissionManager(uid).can_edit_page(page_id):
-        raise HTTPException(403, "You don't have edit access to this page")
-    with get_conn() as conn:
-        row = conn.execute("SELECT id, title FROM pages WHERE id=? AND deleted_at IS NULL", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-        import datetime
-        conn.execute("UPDATE pages SET deleted_at=? WHERE id=?", (datetime.datetime.now(datetime.UTC).replace(tzinfo=None).isoformat(), page_id,))
-        conn.commit()
-    run_event_sync(fire_event("page.deleted", {"page_id": page_id, "title": row["title"] or ""}))
-    return {"status": "ok", "deleted": page_id, "title": row["title"]}
-
-
-
-
-@router.get("/pages/{page_id}", response_class=HTMLResponse)
-def view_page(request: Request, page_id: int):
-    """Render a page as HTML, or a file viewer for uploaded files.
-    ?embed=1 — minimal mode for side peek (editor only, no header)."""
-    embed = request.query_params.get("embed") == "1"
-    from app.templating import ENV
-    env = ENV
-    # v6.0.0: granular page permissions — hide restricted pages (404).
-    user_hdr = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if user_hdr and user_hdr.get("id") and not PermissionManager(user_hdr["id"]).can_view_page(page_id):
-        return HTMLResponse("<h2>Page not found</h2>", status_code=404)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            return HTMLResponse("<h2>Page not found</h2>", status_code=404)
-    page = dict(row)
-    # v6.5.0: synced blocks resolve server-side at read time (fresh content
-    # even when the stored cache is stale).
-    from app.services.synced_blocks import resolve_content_json
-    page["content"] = resolve_content_json(page.get("content", ""), page.get("content_format"))
-
-    ws = page.get("workspace", "")
-    parts = ws.split("/") if "/" in ws else ["", ""]
-    owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
-    sidebar = _sidebar_data(request, owner, repo)
-    # Check if page is favorited
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        fav = conn.execute(
-            "SELECT id FROM favorites WHERE user_id=? AND page_id=?", (uid, page_id)
-        ).fetchone()
-
-    # Build page_data, including file metadata for uploaded files
-    _locked = bool(page.get("is_locked", 0))
-    _locked_by = page.get("locked_by") if "locked_by" in page else None
-    _can_edit = (not _locked) or bool(user and user.get("is_admin")) or (uid and _locked_by == uid)
-    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0)), "cover_url": page.get("cover_url", "") or "", "page_icon": page.get("page_icon", "") or "",
-                 "is_locked": _locked,
-                 "locked_by": _locked_by,
-                 "can_edit": _can_edit,
-                 "full_width": bool(page.get("full_width", 0)) if "full_width" in page else False,
-                 "font_small": bool(page.get("font_small", 0)) if "font_small" in page else False}
-
-    # For file pages, extract file metadata and add to page_data
-    if page.get("content_format") == "file":
-        import json as _json
-        try:
-            meta = _json.loads(page.get("content", "{}"))
-        except _json.JSONDecodeError:
-            meta = {}
-        file_path = meta.get("file_path", "").replace("\\", "/")
-        mime_type = meta.get("mime_type", "application/octet-stream")
-        file_size = meta.get("size", 0)
-        # Build workspace_id from file_path
-        fp_parts = file_path.split("/")
-        ws_id = ""
-        for p in fp_parts:
-            if p.startswith("workspace_"):
-                ws_id = p.replace("workspace_", "")
-                break
-        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
-        file_url = f"/api/files/{ws_id}/{filename}" if ws_id else ""
-        page_data["file_url"] = file_url
-        page_data["file_mime"] = mime_type
-        page_data["file_size"] = file_size
-        page_data["file_name"] = filename
-
-    from app.routers.dashboard import _nav_breadcrumb
-    with get_conn() as conn:
-        nav_crumbs = _nav_breadcrumb(conn, page_id)
-    ctx = {**sidebar, "page": page, "page_favorited": fav is not None,
-           "page_share_mode": page.get("share_mode", "private"),
-           "page_published": bool(page.get("published", 0)),
-           "page_is_shared": bool(page.get("is_shared", 0)) or page.get("share_mode", "private") != "private" or bool(page.get("published", 0)),
-           "page_data": page_data,
-           "breadcrumb_items": nav_crumbs,
-           "nav_workspace_id": page.get("workspace_id") or 0,
-           "nav_page_id": page_id,
-           "embed_mode": embed}
-    template = env.get_template("page_editor_embed.html" if embed else "page_editor.html")
-    response = template.render(**ctx)
-    return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})
@@ -1,271 +0,0 @@
-"""FlowDeck — Board : pages.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Query, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.permission_manager import PermissionManager
-
-from ._common import _block_texts, _ensure_page_editable, _record_version
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-# ═══════════ Pages Markdown ═══════════
-
-@router.post("/api/pages")
-def create_page(request: Request, title: str = Query(default=""),
-                       section: str = Query(default="Private"),
-                       project: str = Query(default=""),
-                       parent_id: int = Query(default=0)):
-    """Create a new Markdown page, optionally as a sub-page."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        # A7 : la création de page exige une session (route sortue de la liste CSRF).
-        raise HTTPException(401, "Authentication required")
-    ws_key = project if project else (user.get("login", "Bruno") if user else "Bruno")
-    page_title = title.strip() if title else ""
-    try:
-        with get_conn() as conn:
-            # Compute next sort_order for this parent
-            next_order = 0
-            parent_val = parent_id if parent_id > 0 else None
-            row = conn.execute(
-                "SELECT COALESCE(MAX(sort_order), -1) + 1 FROM pages WHERE workspace=? AND parent_id IS ?",
-                (ws_key, parent_val),
-            ).fetchone()
-            if row:
-                next_order = row[0]
-            cur = conn.execute(
-                "INSERT INTO pages (workspace, title, parent_section, parent_id, sort_order) VALUES (?,?,?,?,?)",
-                (ws_key, page_title, section, parent_val, next_order),
-            )
-            conn.commit()
-            page_id = cur.lastrowid
-        run_event_sync(fire_event("page.created", {"page_id": page_id, "title": page_title,
-                                          "workspace": ws_key, "parent_id": parent_id}))
-        return {"status": "ok", "id": page_id, "title": page_title, "workspace": ws_key, "parent_id": parent_id}
-    except Exception as e:
-        logger.error("create_page failed: %s", e)
-        from fastapi.responses import JSONResponse
-        return JSONResponse({"error": "Failed to create page", "detail": str(e)}, status_code=500)
-
-
-
-
-@router.get("/api/pages/{page_id}")
-def get_page(request: Request, page_id: int):
-    """Get a Markdown page."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    # v6.0.0: granular page permissions — 404 (not 403) hides restricted pages.
-    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Page not found")
-    return dict(row)
-
-
-
-
-@router.put("/api/pages/{page_id}")
-def update_page(request: Request, page_id: int, title: str = Query(default=""),
-                       content: str = Query(default=""),
-                       content_format: str = Query(default="")):
-    """Update a page's title and/or content. Accepts JSON body for blocks."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(403, "Authentication required")
-    # v6.0.0: granular page permissions — hidden pages 404 (not 403); a visible
-    # page the caller cannot edit yields 403.
-    pm = PermissionManager(user["id"], bool(user.get("is_admin")))
-    if not pm.can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-    if not pm.can_edit_page(page_id):
-        raise HTTPException(403, "You don't have edit access to this page")
-    with get_conn() as conn:
-        _ensure_page_editable(conn, page_id, user)
-        if title:
-            conn.execute("UPDATE pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (title, page_id))
-            # v6.5.0: renaming a database row's content page updates the row.
-            from app.services.row_pages import sync_page_title_to_row
-            sync_page_title_to_row(conn, page_id)
-        if content:
-            conn.execute("UPDATE pages SET content=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (content, page_id))
-        if content_format:
-            conn.execute("UPDATE pages SET content_format=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (content_format, page_id))
-        conn.commit()
-    run_event_sync(fire_event("page.updated", {"page_id": page_id, "title": title,
-                                      "content_format": content_format or "markdown",
-                                      "actor_id": user.get("id")}))
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/pages/{page_id}/blocks")
-def save_page_blocks(request: Request, page_id: int, body: dict = Body(...)):
-    """Save blocks JSON content (Notion-style block editor).
-
-    v5.4.0: a version snapshot is recorded (if the block content actually
-    changed) so the UI can browse the version history and restore any of them.
-    v5.14.0: synced block references are tracked in page_synced_blocks.
-    """
-    blocks = body.get("blocks", [])
-    blocks_json = json.dumps(blocks)
-    title = body.get("title", "")
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = (user or {}).get("id")
-    # No session → legacy single-user behaviour; otherwise enforce edit rights.
-    if uid and not PermissionManager(uid).can_edit_page(page_id):
-        raise HTTPException(403, "You don't have edit access to this page")
-
-    # Extract synced block ids from the blocks
-    def _extract_synced(blocks: list[dict]) -> set[int]:
-        ids: set[int] = set()
-        for b in blocks:
-            if b.get("type") == "synced" and b.get("synced_id"):
-                ids.add(b["synced_id"])
-            if isinstance(b.get("children"), list):
-                ids |= _extract_synced(b["children"])
-        return ids
-
-    synced_ids = _extract_synced(blocks)
-
-    with get_conn() as conn:
-        _ensure_page_editable(conn, page_id, user)
-        if title:
-            conn.execute("UPDATE pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (title, page_id))
-            # v6.5.0: renaming a database row's content page updates the row.
-            from app.services.row_pages import sync_page_title_to_row
-            sync_page_title_to_row(conn, page_id)
-        conn.execute(
-            "UPDATE pages SET content=?, content_format='blocks', updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (blocks_json, page_id),
-        )
-        _record_version(conn, page_id, uid, title or "", blocks_json)
-        # Update synced block references
-        existing = {r["synced_block_id"] for r in conn.execute(
-            "SELECT synced_block_id FROM page_synced_blocks WHERE page_id=?", (page_id,)
-        ).fetchall()}
-        for sid in synced_ids:
-            if sid not in existing:
-                conn.execute(
-                    "INSERT OR IGNORE INTO page_synced_blocks (page_id, synced_block_id, block_index) VALUES (?, ?, 0)",
-                    (page_id, sid),
-                )
-        for sid in existing - synced_ids:
-            conn.execute(
-                "DELETE FROM page_synced_blocks WHERE page_id=? AND synced_block_id=?",
-                (page_id, sid),
-            )
-        conn.commit()
-    run_event_sync(fire_event("page.updated", {"page_id": page_id, "title": title or "",
-                                      "content_format": "blocks",
-                                      "actor_id": uid}))
-    return {"status": "ok", "id": page_id}
-
-
-
-
-@router.get("/api/pages/{page_id}/backlinks")
-def page_backlinks(request: Request, page_id: int):
-    """v5.4.0: pages that link to this one ("Lié depuis…").
-
-    Scans every non-deleted page's blocks (and raw markdown) for an internal
-    reference to ``/pages/{page_id}`` or ``#fdblk-…`` inside ``/pages/{page_id}``.
-    """
-    target = f"/pages/{page_id}" if page_id else None
-    wiki_target = f"[[fdpage:{page_id}]]" if page_id else None
-    backlinks = []
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title, workspace, content, content_format, updated_at "
-            "FROM pages WHERE deleted_at IS NULL AND id != ?",
-            (page_id,),
-        ).fetchall()
-    for r in rows:
-        fmt = r["content_format"]
-        hits = False
-        if fmt == "blocks" and r["content"]:
-            try:
-                blocks = json.loads(r["content"])
-                for b in blocks if isinstance(blocks, list) else []:
-                    for text in _block_texts(b):
-                        if target and (target in text or (wiki_target and wiki_target in text)):
-                            hits = True
-                            break
-                    if hits:
-                        break
-            except (json.JSONDecodeError, TypeError):
-                hits = target and (target in (r["content"] or "") or (wiki_target and wiki_target in (r["content"] or "")))
-        elif fmt == "markdown":
-            hits = target and (target in (r["content"] or "") or (wiki_target and wiki_target in (r["content"] or "")))
-        elif r["content"]:
-            hits = target and (target in json.dumps(r["content"]) or (wiki_target and wiki_target in json.dumps(r["content"])))
-        if not hits and target:
-            hits = f"/pages/{page_id}" in (r["content"] or "")
-        if hits:
-            backlinks.append({
-                "id": r["id"],
-                "title": r["title"] or "Untitled",
-                "workspace": r["workspace"] or "",
-                "updated_at": r["updated_at"] or "",
-            })
-    backlinks.sort(key=lambda x: x.get("updated_at") or "", reverse=True)
-    return {"backlinks": backlinks}
-
-
-
-
-@router.get("/api/pages/{page_id}/versions")
-def page_versions(request: Request, page_id: int):
-    """v5.4.0: version history for a block-editor page."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT pv.id, pv.title, pv.note, pv.created_at, "
-            "COALESCE(u.login, '') AS author "
-            "FROM page_versions pv LEFT JOIN users u ON u.id=pv.user_id "
-            "WHERE pv.page_id=? ORDER BY pv.id DESC LIMIT 100",
-            (page_id,),
-        ).fetchall()
-    return {"versions": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/pages/{page_id}/versions/{version_id}/restore")
-def restore_version(request: Request, page_id: int, version_id: int):
-    """v5.4.0: restore a page from a version snapshot."""
-    with get_conn() as conn:
-        ver = conn.execute(
-            "SELECT * FROM page_versions WHERE id=? AND page_id=?",
-            (version_id, page_id),
-        ).fetchone()
-        if not ver:
-            raise HTTPException(404, "Version not found")
-        conn.execute(
-            "UPDATE pages SET content=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (ver["blocks_json"], ver["title"] or "", page_id),
-        )
-        conn.commit()
-    run_event_sync(fire_event("page.updated", {"page_id": page_id, "title": ver["title"] or "",
-                                      "content_format": "blocks"}))
-    return {"status": "ok", "restored": version_id}
-
-
-# ═══════════ v5.4.0: Page & collection duplication ═══════════
@@ -1,236 +0,0 @@
-"""FlowDeck — Board : sharing.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.collection_lifecycle import (
-    collections_hosted_by_page,
-    collections_hosted_by_pages,
-    delete_collections,
-)
-from app.services.publish import fire_published, fire_unpublished, publish, unpublish
-
-from ._common import _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-# ═══════════ Favorites API ═══════════
-
-@router.get("/api/favorites")
-def list_favorites(request: Request):
-    """List favorited page IDs for the current user."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT page_id FROM favorites WHERE user_id=? ORDER BY position", (uid,)
-        ).fetchall()
-    return {"favorites": [r["page_id"] for r in rows]}
-
-
-
-
-@router.post("/api/favorites/{page_id:int}")
-def add_favorite(request: Request, page_id: int):
-    """Add a page to favorites."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT id FROM favorites WHERE user_id=? AND page_id=?", (uid, page_id)
-        ).fetchone()
-        if not existing:
-            pos = conn.execute(
-                "SELECT COALESCE(MAX(position), -1) + 1 FROM favorites WHERE user_id=?", (uid,)
-            ).fetchone()[0]
-            conn.execute(
-                "INSERT INTO favorites (user_id, page_id, position) VALUES (?,?,?)",
-                (uid, page_id, pos),
-            )
-            conn.commit()
-    try:
-        run_event_sync(fire_event("favorite.added", {"page_id": page_id, "user_id": uid}))
-    except Exception:
-        logger.exception("add_favorite")
-    return {"status": "added", "page_id": page_id}
-
-
-
-
-@router.delete("/api/favorites/{page_id:int}")
-def remove_favorite(request: Request, page_id: int):
-    """Remove a page from favorites."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
-    with get_conn() as conn:
-        conn.execute("DELETE FROM favorites WHERE user_id=? AND page_id=?", (uid, page_id))
-        conn.commit()
-    try:
-        run_event_sync(fire_event("favorite.removed", {"page_id": page_id, "user_id": uid}))
-    except Exception:
-        logger.exception("remove_favorite")
-    return {"status": "removed", "page_id": page_id}
-
-# ═══════════ Share API ═══════════
-
-
-
-# ═══════════ Share API ═══════════
-
-@router.post("/api/share/{page_id:int}")
-def update_share(request: Request, page_id: int, body: dict = Body(default={})):
-    """Save share settings for a page."""
-    mode = body.get("mode", "private")
-    published = body.get("published", False)
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET share_mode=?, published=? WHERE id=?",
-            (mode, 1 if published else 0, page_id),
-        )
-        conn.commit()
-    return {"status": "ok", "share_mode": mode, "published": published}
-
-
-
-
-@router.post("/api/pages/{page_id:int}/publish")
-def publish_page(request: Request, page_id: int):
-    """Publish a page to the web (generates publish_slug)."""
-    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        raise HTTPException(401, "Authentication required")
-    slug, title = publish(page_id)
-    run_event_sync(fire_published(page_id, slug))
-    return {"is_published": True, "publish_slug": slug, "title": title}
-
-
-
-
-@router.delete("/api/pages/{page_id:int}/publish")
-def unpublish_page(request: Request, page_id: int):
-    """Unpublish a page from the web."""
-    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
-        raise HTTPException(401, "Authentication required")
-    unpublish(page_id)
-    run_event_sync(fire_unpublished(page_id))
-    return {"is_published": False}
-
-
-# ═══════════ Trash (must be before /{owner}/{repo} catch-all) ═══════════
-
-
-def _trash_session(request: Request):
-    """Trash : session obligatoire (les 3 routes mutaient/ lisaient toutes les
-    pages sans aucune vérification — le CSRF seul ne protège pas, le cookie est
-    lisible par JS et un attaquant fixe cookie ET en-tête)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        raise HTTPException(401, "Authentication required")
-    return user
-
-
-@router.get("/api/trash")
-def list_trash(request: Request):
-    _trash_session(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title, workspace, parent_section, deleted_at FROM pages "
-            "WHERE deleted_at IS NOT NULL ORDER BY deleted_at DESC"
-        ).fetchall()
-    return [
-        {
-            "id": r["id"],
-            "name": r["title"] or "Untitled",
-            "icon": "📁" if r["parent_section"] == "Workspace" else "📄",
-            "path": r["workspace"] or "Private",
-            "deleted_at": r["deleted_at"],
-        }
-        for r in rows
-    ]
-
-
-
-
-@router.post("/api/trash/{page_id}/restore")
-def restore_page(request: Request, page_id: int):
-    _trash_session(request)
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET deleted_at=NULL WHERE id=?", (page_id,))
-        conn.commit()
-    try:
-        run_event_sync(fire_event("page.restored", {"page_id": page_id}))
-    except Exception:
-        logger.exception("restore_page")
-    return {"status": "ok", "restored": page_id}
-
-
-
-
-@router.delete("/api/trash/{page_id}")
-def permanent_delete(request: Request, page_id: int):
-    _trash_session(request)
-    with get_conn() as conn:
-        # La page hôte d'une base disparaît définitivement → sa base et ses
-        # lignes aussi, sinon My Tasks (et /db) continuaient de lister des
-        # tâches sans document.
-        collections = collections_hosted_by_page(conn, page_id)
-        conn.execute("UPDATE pages SET parent_id=NULL WHERE parent_id=?", (page_id,))
-        conn.execute("DELETE FROM pages WHERE id=? AND deleted_at IS NOT NULL", (page_id,))
-        delete_collections(conn, collections)
-        conn.commit()
-    return {"status": "ok", "deleted": page_id, "collections": len(collections)}
-
-
-
-
-@router.post("/api/trash/empty")
-def empty_trash(request: Request):
-    """Empty Trash : purge en masse (les enfants des pages supprimées passent
-    en racine, comme permanent_delete — comportement historique conservé)."""
-    _trash_session(request)
-    with get_conn() as conn:
-        n = conn.execute(
-            "SELECT COUNT(*) FROM pages WHERE deleted_at IS NOT NULL"
-        ).fetchone()[0]
-        # Bases portées par les pages purgées (les pages contenu de ligne
-        # n'hébergent aucune base et ne remontent rien).
-        trashed = [
-            r["id"]
-            for r in conn.execute(
-                "SELECT id FROM pages WHERE deleted_at IS NOT NULL"
-            ).fetchall()
-        ]
-        collections = collections_hosted_by_pages(conn, trashed)
-        conn.execute(
-            "UPDATE pages SET parent_id=NULL WHERE parent_id IN "
-            "(SELECT id FROM pages WHERE deleted_at IS NOT NULL)"
-        )
-        conn.execute("DELETE FROM pages WHERE deleted_at IS NOT NULL")
-        delete_collections(conn, collections)
-        conn.commit()
-    return {"status": "ok", "deleted": n, "collections": len(collections)}
-
-
-
-
-@router.get("/trash", response_class=HTMLResponse)
-def trash_page(request: Request):
-    from app.templating import ENV
-    env = ENV
-    template = env.get_template("trash.html")
-    return template.render(**_sidebar_data(request))
-
-
-# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════
-# These routes MUST be registered before the catch-all /{owner}/{repo} below.
@@ -1,51 +0,0 @@
-"""FlowDeck — Board : sync.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, HTTPException
-
-from app.db import get_conn
-from app.services.gitea_client import gitea
-
-from ._common import _extract_ai_keywords, _issue_column
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.post("/api/sync/{owner}/{repo}")
-async def sync_project(owner: str, repo: str):
-    """Full bidirectional sync: fetch Gitea issues → update local DB."""
-    try:
-        issues = await gitea.get_issues(owner, repo, state="all")
-        issues_only = [i for i in issues if not i.get("pull_request")]
-        with get_conn() as conn:
-            board = conn.execute(
-                "SELECT id, columns_json FROM boards WHERE project_owner=? AND project_name=?",
-                (owner, repo),
-            ).fetchone()
-            if board:
-                board_id = board["id"]
-                columns = json.loads(board["columns_json"])
-                # A23 : un seul executemany pour toutes les cards.
-                conn.executemany(
-                    "INSERT OR REPLACE INTO cards (board_id, gitea_issue_id, column_name) VALUES (?,?,?)",
-                    [
-                        (board_id, issue["number"], _issue_column(issue, columns, board_id))
-                        for issue in issues_only
-                    ],
-                )
-                for issue in issues_only:
-                    # Extract AI keywords from each issue
-                    _extract_ai_keywords(owner, repo, issue.get("labels", []), issue.get("body", ""))
-                conn.commit()
-                return {"status": "ok", "issues_synced": len(issues_only)}
-    except Exception as e:
-        raise HTTPException(500, str(e)) from e
@@ -1,165 +0,0 @@
-"""FlowDeck — Board : synced.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Query, Request
-
-from app.auth.session import SessionManager
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════# These routes MUST be registered before the catch-all /{owner}/{repo} below.
-
-def _session_user(request: Request) -> dict:
-    """Session obligatoire — sans garde, un appel anonyme levait
-    ``AttributeError: 'NoneType' object has no attribute 'get'`` (HTTP 500)
-    au lieu d'un 401."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user
-
-
-def _assert_can_edit_block(request: Request, sb: dict) -> None:
-    """Seul l'auteur du bloc (ou un admin global) peut le modifier/supprimer."""
-    user = _session_user(request)
-    if sb.get("created_by") in (None, user.get("id")):
-        return
-    if user.get("is_admin"):
-        return
-    raise HTTPException(403, "Not the author of this synced block")
-
-
-@router.get("/api/synced-blocks")
-def list_synced_blocks_api(request: Request, workspace: str = Query(default="")):
-    """List synced blocks for a workspace."""
-    user = _session_user(request)
-    from app.services.synced_blocks import list_synced_blocks
-    return {"synced_blocks": list_synced_blocks(workspace or user.get("login", ""))}
-
-
-
-@router.post("/api/synced-blocks")
-def create_synced_block_api(request: Request, body: dict = Body(...)):
-    """Create a new synced block."""
-    user = _session_user(request)
-    from app.services.synced_blocks import create_synced_block
-    sid = create_synced_block(
-        workspace=body.get("workspace", ""),
-        title=body.get("title", "Synced block"),
-        content=body.get("content", []),
-        created_by=user.get("id"),
-    )
-    return {"status": "ok", "synced_block_id": sid}
-
-
-
-
-@router.put("/api/synced-blocks/{sid}")
-async def update_synced_block_api(request: Request, sid: int):
-    """Update a synced block's content (propagates to all pages)."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    from app.services.synced_blocks import (
-        get_synced_block,
-        page_ids_for_synced,
-        sync_synced_blocks_in_page,
-        update_synced_block,
-    )
-    sb = get_synced_block(sid)
-    if not sb:
-        raise HTTPException(404, "Synced block not found")
-    _assert_can_edit_block(request, sb)
-    update_synced_block(sid, body.get("title", sb["title"]), body.get("content", []))
-    # v6.5.0: rewrite every referencing page's stored content first (DB row
-    # content pages included), THEN push the realtime update so open rooms
-    # reload the fresh content from the DB.
-    for pid in page_ids_for_synced(sid):
-        sync_synced_blocks_in_page(pid)
-    from app.services.realtime_server import manager
-    await manager._propagate_synced(sid)
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/synced-blocks/{sid}")
-async def delete_synced_block_api(request: Request, sid: int):
-    """Delete a synced block."""
-    from app.services.synced_blocks import (
-        delete_synced_block,
-        get_synced_block,
-        mark_synced_block_deleted,
-        page_ids_for_synced,
-    )
-    sb = get_synced_block(sid)
-    if not sb:
-        raise HTTPException(404, "Synced block not found")
-    _assert_can_edit_block(request, sb)
-    # v6.5.0: collect referencing pages BEFORE the FK cascade wipes the
-    # refs, rewrite their stored content (deleted state), then broadcast.
-    pids = page_ids_for_synced(sid)
-    delete_synced_block(sid)
-    mark_synced_block_deleted(sid, pids)
-    from app.services.realtime_server import manager
-    await manager._broadcast_synced_to(pids, sid)
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/synced-blocks/{sid}")
-def get_synced_block_api(request: Request, sid: int):
-    """Get a synced block by id."""
-    _session_user(request)
-    from app.services.synced_blocks import get_synced_block
-    sb = get_synced_block(sid)
-    if not sb:
-        raise HTTPException(404, "Synced block not found")
-    return dict(sb)
-
-
-
-
-@router.post("/api/pages/{page_id}/synced")
-def add_synced_to_page(request: Request, page_id: int, body: dict = Body(...)):
-    """Add a synced block reference to a page."""
-    from app.services.synced_blocks import add_page_synced, get_synced_block
-    sid = body.get("synced_block_id")
-    sb = get_synced_block(sid)
-    if not sb:
-        raise HTTPException(404, "Synced block not found")
-    add_page_synced(page_id, sid, body.get("block_index", 0))
-    return {"status": "ok", "synced_block_id": sid}
-
-
-
-
-@router.delete("/api/pages/{page_id}/synced/{sid}")
-def remove_synced_from_page(request: Request, page_id: int, sid: int):
-    """Remove a synced block reference from a page (unsync)."""
-    from app.services.synced_blocks import remove_page_synced
-    remove_page_synced(page_id, sid)
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/pages/{page_id}/synced")
-def get_page_synced_refs(request: Request, page_id: int):
-    """Get all synced block references for a page."""
-    from app.services.synced_blocks import get_page_synced
-    return {"synced_blocks": get_page_synced(page_id)}
-
-
-# ═══════════ Board page ═══════════
@@ -1,76 +0,0 @@
-"""FlowDeck — Board : wiki.
-
-Découpe A28 de l'ancien app/routers/board.py (2 101 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Query, Request
-
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["board"], prefix="/board")
-
-
-
-
-@router.get("/api/wiki/pages")
-def wiki_page_search(request: Request, q: str = Query(default="")):
-    """v5.11.0: page picker for [[ wiki-links. Fuzzy-ish title search across
-    every non-deleted page the current user can see (single source: pages)."""
-    q = (q or "").strip().lower()
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT id, title, page_icon, workspace FROM pages
-               WHERE deleted_at IS NULL
-               ORDER BY updated_at DESC LIMIT 500"""
-        ).fetchall()
-    results = []
-    for r in rows:
-        title = r["title"] or "Untitled"
-        if q:
-            # subsequence match ("mtg" → "Meeting notes") or plain substring.
-            hay = title.lower()
-            it = iter(hay)
-            subseq = all(ch in it for ch in q)
-            if q not in hay and not subseq:
-                continue
-        results.append({
-            "id": r["id"],
-            "title": title,
-            "icon": r["page_icon"] or "",
-            "workspace": r["workspace"] or "",
-        })
-        if len(results) >= 20:
-            break
-    return {"pages": results}
-
-
-
-
-@router.get("/api/wiki/titles")
-def wiki_titles(request: Request, ids: str = Query(default="")):
-    """v5.11.0: resolve page-id lists to current labels (rename propagation)."""
-    parsed: list[int] = []
-    for part in (ids or "").split(","):
-        part = part.strip()
-        if part.isdigit():
-            parsed.append(int(part))
-    parsed = parsed[:200]
-    out: dict[str, str] = {}
-    if parsed:
-        placeholders = ",".join("?" * len(parsed))
-        with get_conn() as conn:
-            rows = conn.execute(
-                f"SELECT id, title, page_icon, deleted_at FROM pages WHERE id IN ({placeholders})",
-                parsed,
-            ).fetchall()
-        for r in rows:
-            if r["deleted_at"]:
-                out[str(r["id"])] = "Deleted page"
-            else:
-                icon = (r["page_icon"] or "")
-                out[str(r["id"])] = (icon + " " if icon else "") + (r["title"] or "Untitled")
-    return {"titles": out}
@@ -1,208 +0,0 @@
-"""FlowDeck — Collaboration API (v4.9.0): inline comments on pages + mentions.
-
-Comments live in the existing `comments` table, extended with a target_type /
-target_id pair and inline anchors (anchor_block_id + text offsets). Mentions
-written in a comment body automatically notify the mentioned users.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import notifications as notif
-from app.services.automations import fire_event as _fire_event
-from app.services.automations import run_event_sync
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collaboration"], prefix="/api")
-
-
-def _current_user(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
-
-
-def _page_url(page_id: int) -> str:
-    from app.config import settings
-    return f"{settings.app_base_url}/pages/{page_id}"
-
-
-def _serialize(rows):
-    out = []
-    for r in rows:
-        d = dict(r)
-        d["author"] = {
-            "id": r["author_id"],
-            "login": r["author_login"],
-            "full_name": r["author_name"],
-            "avatar_url": r["author_avatar"],
-            "avatar_color": r["author_color"],
-        }
-        for k in ("author_id", "author_login", "author_name", "author_avatar", "author_color"):
-            d.pop(k, None)
-        out.append(d)
-    return out
-
-
-@router.get("/pages/{page_id}/comments")
-def list_comments(request: Request, page_id: int):
-    """List page-level and inline comments for a FlowDeck page."""
-    _current_user(request)
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        rows = conn.execute(
-            """SELECT c.*, c.user_id AS author_id, u.login AS author_login,
-                      u.full_name AS author_name, u.avatar_url AS author_avatar,
-                      u.avatar_color AS author_color
-               FROM comments c
-               JOIN users u ON c.user_id = u.id
-               WHERE c.target_type='page' AND c.target_id=?
-               ORDER BY c.created_at ASC, c.id ASC""",
-            (page_id,),
-        ).fetchall()
-    return {"page_id": page_id, "comments": _serialize(rows)}
-
-
-@router.post("/pages/{page_id}/comments")
-def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
-    """Create a page or inline comment. Mentions (@login) notify users."""
-    user = _current_user(request)
-    text = (body.get("body") or "").strip()
-    if not text:
-        raise HTTPException(400, "body required")
-
-    anchor_block = body.get("anchor_block_id")
-    anchor_start = body.get("anchor_start")
-    anchor_end = body.get("anchor_end")
-    # normalize empty anchor → page-level comment
-    if not anchor_block or anchor_start is None or anchor_end is None:
-        anchor_block, anchor_start, anchor_end = None, None, None
-    elif int(anchor_start) == int(anchor_end):
-        anchor_block, anchor_start, anchor_end = None, None, None
-
-    parent_id = body.get("parent_id")
-    uid = user["id"]
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        conn.execute(
-            "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
-            (uid, user.get("login", "admin"), user.get("full_name", "Admin")),
-        )
-        cur = conn.execute(
-            """INSERT INTO comments
-               (page_id, user_id, body, parent_id, target_type, target_id,
-                anchor_block_id, anchor_start, anchor_end)
-               VALUES (?,?,?,?, 'page', ?, ?, ?, ?)""",
-            (page_id, uid, text, parent_id, page_id, anchor_block, anchor_start, anchor_end),
-        )
-        comment_id = cur.lastrowid
-        conn.commit()
-
-        # v7.3.0: commenting implies following — the author gets the
-        # (throttled) page.updated notifications like any other follower.
-        from app.services import wiki as wiki_svc
-        wiki_svc.ensure_follow(page_id, uid, conn=conn)
-        conn.commit()
-
-        # Notify users @-mentioned in the comment (skip the author).
-        url = _page_url(page_id)
-        title = f"New comment on “{page['title']}”"
-        message = f"{user.get('full_name') or user.get('login')} commented: {text[:300]}"
-        notif.process_mentions(
-            text, uid, "mention", title, message,
-            "page", page_id, url, conn=conn,
-        )
-        conn.commit()
-
-    try:
-        run_event_sync(_fire_event("comment.added", {"comment_id": comment_id, "page_id": page_id, "user_id": uid}))
-        mentioned_ids = notif.extract_mentions(text)
-        if mentioned_ids:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "comment_id": comment_id, "count": len(mentioned_ids)}))
-    except Exception:
-        logger.exception("add_comment")
-
-    return {"id": comment_id, "status": "created"}
-
-
-@router.post("/pages/{page_id}/mentions")
-def notify_page_mentions(request: Request, page_id: int, body: dict = Body(default={})):
-    """Notify users @-mentioned in a page's content (called on save).
-
-    Accepts {"text": "..."} containing @login handles. Deduplicated server-side
-    against a per-page cache so repeated auto-saves don't spam notifications.
-    """
-    user = _current_user(request)
-    text = body.get("text") or ""
-    with get_conn() as conn:
-        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(404, "Page not found")
-        url = _page_url(page_id)
-        mentioned = notif.process_mentions(
-            text, user["id"], "mention", f"You were mentioned in “{page['title']}”",
-            f"{user.get('full_name') or user.get('login')} mentioned you on a page.",
-            "page", page_id, url, conn=conn,
-        )
-        conn.commit()
-    if mentioned:
-        try:
-            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": mentioned, "count": len(mentioned)}))
-        except Exception:
-            logger.exception("notify_page_mentions")
-    return {"mentioned": mentioned}
-
-
-@router.put("/comments/{comment_id}")
-def update_comment(request: Request, comment_id: int, body: dict = Body(default={})):
-    """Update a comment body or resolve/unresolve it."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM comments WHERE id=?", (comment_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"]:
-            raise HTTPException(403, "Not allowed to edit this comment")
-        if "body" in body and body.get("body") is not None:
-            conn.execute(
-                "UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (body["body"].strip(), comment_id),
-            )
-        was_resolved = int(row["resolved"] or 0)
-        if "resolved" in body and body.get("resolved") is not None:
-            conn.execute("UPDATE comments SET resolved=? WHERE id=?",
-                         (1 if body["resolved"] else 0, comment_id))
-        conn.commit()
-    if body.get("resolved") and not was_resolved:
-        try:
-            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
-        except Exception:
-            logger.exception("update_comment")
-    return {"id": comment_id, "status": "updated"}
-
-
-@router.delete("/comments/{comment_id}")
-def delete_comment(request: Request, comment_id: int):
-    """Delete a comment and its replies."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
-        if not row:
-            raise HTTPException(404, "Comment not found")
-        if row["user_id"] != user["id"]:
-            # allow page "owners" — fall back to a simple ownership rule for now
-            raise HTTPException(403, "Not allowed to delete this comment")
-        conn.execute("DELETE FROM comments WHERE id=? OR parent_id=?", (comment_id, comment_id))
-        conn.commit()
-    return {"id": comment_id, "status": "deleted"}
@@ -1,67 +0,0 @@
-"""FlowDeck — Collections : bases de données façon Notion.
-
-Découpe A28 : l'ancien `collections.py` (2 622 lignes, 53 routes) est
-devenu ce package — un module par concern, helpers dans `_common`
-(auth/permissions/validation) et `_renderers` (rendus HTML des vues).
-Ré-exports : automations importe `_validate_page_properties`, les
-tests importent les helpers de graphes.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter
-
-from . import (  # ordre = ordre d'enregistrement d'origine
-    boards,
-    crud,
-    dashboard_views,
-    data_api,
-    index_page,
-    linked,
-    meta,
-    pages,
-    properties,
-    structure,
-    task_db,
-    views,
-)
-from ._common import _validate_page_properties  # noqa: F401
-from ._renderers import (  # noqa: F401 — ré-exports tests
-    _chart_aggregate,
-    _chart_values,
-    _fmt_number,
-    _render_chart,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter()
-# `task_db` est enregistré **en premier** : sa route statique
-# `GET /db/task-dbs/api` serait sinon capturée par `data_api`'s
-# `GET /db/{collection_id}/api` (`collection_id="task-dbs"` → 422).
-# `index_page` (la page HTML `/db`) vient ensuite, avant tout module
-# déclarant `/db/{collection_id}` — sinon la racine serait capturée en 422.
-for _mod in (
-    task_db,
-    index_page,
-    crud,
-    pages,
-    boards,
-    meta,
-    properties,
-    views,
-    structure,
-    linked,
-    dashboard_views,
-    data_api,
-):
-    router.include_router(_mod.router)
-
-__all__ = [
-    "router",
-    "_chart_aggregate",
-    "_chart_values",
-    "_fmt_number",
-    "_render_chart",
-    "_validate_page_properties",
-]
@@ -1,220 +0,0 @@
-"""FlowDeck — Collections : helpers partagés (A28).
-
-Les 8 helpers de tête de l'ancien collections.py (auth, permissions,
-validation) — ré-exportés par le package.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.auth.session import SessionManager
-from app.services.permission_manager import PermissionManager
-from app.services.property_types import (
-    AUTO_TYPES,
-    validate_property_rule,
-)
-from app.services.recurrence import (
-    RECURRENCE_KEY,
-    is_valid_timezone,
-    validate_rule,
-)
-from app.services.reminders import REMINDER_KEY, parse_lead
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-def _current_user(request: Request) -> dict:
-    """Resolve the session user, falling back to the local admin (single-user)."""
-    s = request.cookies.get("flowdeck_session", "")
-    return SessionManager.decode_session(s) or {"login": "admin", "id": 1}
-
-
-
-
-
-
-def _session_user(request: Request) -> dict | None:
-    """Resolve the session user WITHOUT the admin fallback (for ACL checks)."""
-    s = request.cookies.get("flowdeck_session", "")
-    user = SessionManager.decode_session(s)
-    return user if user and user.get("id") else None
-
-
-
-
-
-
-def _require_view(collection_id: int, user: dict | None) -> None:
-    """Raise 404 when the user may not view the collection (404 hides it).
-
-    A6 : plus de session = accès refusé — l'absence de user ne vaut plus
-    « legacy single-user » ( lecture anonyme de n'importe quelle collection ).
-    """
-    if not user:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    pm = PermissionManager(user["id"])
-    if not pm.can_view_collection(collection_id):
-        raise HTTPException(status_code=404, detail="Collection not found")
-
-
-
-
-
-
-def _require_edit(collection_id: int, user: dict | None) -> None:
-    """Raise 401/403 when the user may not edit pages in the collection."""
-    if not user:
-        raise HTTPException(status_code=401, detail="Authentication required")
-    pm = PermissionManager(user["id"])
-    if not pm.can_edit_collection(collection_id):
-        raise HTTPException(status_code=403, detail="You don't have edit access to this collection")
-
-
-
-
-
-
-def _collection_properties(conn, collection_id: int) -> list[dict]:
-    return [
-        dict(r) for r in conn.execute(
-            "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-    ]
-
-
-
-
-
-def _apply_template(conn, template_name: str) -> dict | None:
-    """Resolve a database template by name (from the seeded/built-in set)."""
-    if not template_name:
-        return None
-    row = conn.execute(
-        "SELECT id, name, icon, description, schema_json FROM database_templates WHERE name=?",
-        (template_name,),
-    ).fetchone()
-    if row:
-        return dict(row)
-    return None
-
-
-
-
-
-
-def _validate_page_properties(conn, collection_id: int, properties: dict, exclude_page_id: int | None = None) -> None:
-    """Validate submitted property values against the collection's schema.
-
-    Raises ``HTTPException(400)`` with a user-friendly message on the first
-    failure (type, required, unique, min/max).
-    """
-    props = conn.execute(
-        "SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)
-    ).fetchall()
-
-    for prop in props:
-        ptype = prop["prop_type"]
-        if ptype == "title" or ptype in AUTO_TYPES:
-            continue
-        pid = prop["id"]
-        # Values may be keyed by property id (FlowDeckDB UI) or by name (agent).
-        value = properties.get(str(pid))
-        if value is None:
-            value = properties.get(prop["name"])
-        validation = prop["validation_json"] if "validation_json" in prop.keys() else "{}"
-
-        existing_values = None
-        try:
-            import json as _json
-            vcfg = _json.loads(validation) if validation else {}
-        except Exception:
-            vcfg = {}
-        if vcfg.get("unique"):
-            rows = conn.execute(
-                "SELECT id, property_values_json FROM collection_pages WHERE collection_id=?",
-                (collection_id,),
-            ).fetchall()
-            existing_values = []
-            for r in rows:
-                if exclude_page_id is not None and r["id"] == exclude_page_id:
-                    continue
-                try:
-                    pv = _json.loads(r["property_values_json"] or "{}")
-                except Exception:
-                    pv = {}
-                existing_values.append(pv.get(str(pid)) or pv.get(prop["name"]))
-
-        ok, msg = validate_property_rule(ptype, value, validation, existing_values=existing_values)
-        if not ok:
-            raise HTTPException(status_code=400, detail=f"Property '{prop['name']}': {msg}")
-
-
-
-
-
-
-def _validate_meta_keys(conn, collection_id: int, properties: dict) -> None:
-    """Validate the ``__recurrence__`` / ``__reminder__`` meta keys stored
-    alongside real property values. Raises HTTPException(400) on bad shape.
-
-    Each meta key maps a date-property id to a rule/reminder object. We verify
-    the target is actually a date property and the payload parses.
-    """
-    date_ids = {
-        str(r["id"]) for r in conn.execute(
-            "SELECT id FROM collection_properties WHERE collection_id=? AND prop_type='date'",
-            (collection_id,),
-        ).fetchall()
-    }
-
-    rec = properties.get(RECURRENCE_KEY)
-    if rec not in (None, {}):
-        if not isinstance(rec, dict):
-            raise HTTPException(status_code=400, detail="Recurrence must be an object")
-        for prop_id, rule in rec.items():
-            if rule is None:
-                continue
-            if str(prop_id) not in date_ids:
-                raise HTTPException(status_code=400, detail="Recurrence target must be a date property")
-            ok, msg = validate_rule(rule)
-            if not ok:
-                raise HTTPException(status_code=400, detail=f"Recurrence: {msg}")
-
-    rem = properties.get(REMINDER_KEY)
-    if rem not in (None, {}):
-        if not isinstance(rem, dict):
-            raise HTTPException(status_code=400, detail="Reminder must be an object")
-        for prop_id, reminder in rem.items():
-            if reminder is None:
-                continue
-            if str(prop_id) not in date_ids:
-                raise HTTPException(status_code=400, detail="Reminder target must be a date property")
-            if not isinstance(reminder, dict):
-                raise HTTPException(status_code=400, detail="Reminder must be an object")
-            if reminder.get("unit") not in (None, "none", "minutes", "hours", "days"):
-                raise HTTPException(status_code=400, detail="Reminder unit must be minutes/hours/days/none")
-            if parse_lead(reminder) is None and reminder.get("unit") != "none":
-                raise HTTPException(status_code=400, detail="Reminder value must be a positive integer")
-
-    from app.services.recurrence import TIMEZONE_KEY
-    tzmap = properties.get(TIMEZONE_KEY)
-    if tzmap not in (None, {}):
-        if not isinstance(tzmap, dict):
-            raise HTTPException(status_code=400, detail="Timezone map must be an object")
-        for prop_id, value in tzmap.items():
-            if str(prop_id) not in date_ids:
-                raise HTTPException(status_code=400, detail="Timezone target must be a date property")
-            if value and not is_valid_timezone(str(value)):
-                raise HTTPException(status_code=400, detail=f"Unknown timezone '{value}'")
-
-
-# ── API: List & Create (no path params) ──
-
-
-
@@ -1,667 +0,0 @@
-"""FlowDeck — Collections : rendus HTML des vues (A28).
-
-Les 15 helpers de rendu de l'ancien collections.py (_render_view,
-_render_chart, …) + CHART_MAX_GROUPS — ré-exportés pour les tests.
-"""
-from __future__ import annotations
-
-import json
-
-from app.db import get_conn
-from app.templating import CSP_NONCE
-
-CHART_MAX_GROUPS = 200
-
-
-
-# ── View renderers (v1.6.0) ──
-
-def _render_view(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    if view_type == "calendar":
-        return _render_calendar(view_type, collection, pages, config)
-    elif view_type == "gallery":
-        return _render_gallery(view_type, collection, pages, config)
-    elif view_type == "list":
-        return _render_list(view_type, collection, pages, config)
-    elif view_type == "timeline":
-        return _render_timeline(view_type, collection, pages, config)
-    elif view_type == "chart":
-        return _render_chart(view_type, collection, pages, config)
-    elif view_type == "form":
-        return _render_form(view_type, collection, pages, config)
-    elif view_type == "map":
-        return _render_map(view_type, collection, pages, config)
-    elif view_type == "feed":
-        return _render_feed(view_type, collection, pages, config)
-    elif view_type == "gantt":
-        return _render_gantt(view_type, collection, pages, config)
-    else:
-        return _render_table(view_type, collection, pages, config)
-
-
-
-
-
-
-def _base_html(title: str, icon: str, view_type: str, body: str) -> str:
-    return f"""<!DOCTYPE html>
-<html><head><meta charset="utf-8"><title>{title} — FlowDeck</title>
-<style>
-body{{font-family:system-ui,sans-serif;background:#191919;color:#fff;margin:0;padding:20px}}
-h1{{font-size:24px;margin:0 0 8px}} p.desc{{color:#A0A0A0;margin:0 0 20px}}
-.view-tabs{{display:flex;gap:4px;margin-bottom:20px;border-bottom:1px solid #333;padding-bottom:8px}}
-.tab{{padding:6px 14px;border-radius:6px;cursor:pointer;color:#A0A0A0;font-size:13px;background:none;border:none}}
-.tab:hover,.tab.active{{background:#333;color:#fff}}
-</style></head><body>
-<h1>{icon} {title}</h1>
-<div class="view-tabs">
-<a class="tab{' active' if view_type=='table' else ''}" href="?view_type=table">📊 Table</a>
-<a class="tab{' active' if view_type=='board' else ''}" href="?view_type=board">📋 Board</a>
-<a class="tab{' active' if view_type=='calendar' else ''}" href="?view_type=calendar">📅 Calendar</a>
-<a class="tab{' active' if view_type=='gallery' else ''}" href="?view_type=gallery">🖼️ Gallery</a>
-<a class="tab{' active' if view_type=='list' else ''}" href="?view_type=list">📝 List</a>
-<a class="tab{' active' if view_type=='timeline' else ''}" href="?view_type=timeline">📈 Timeline</a>
-<a class="tab{' active' if view_type=='gantt' else ''}" href="?view_type=gantt">📊 Gantt</a>
-<a class="tab{' active' if view_type=='chart' else ''}" href="?view_type=chart">📉 Chart</a>
-<a class="tab{' active' if view_type=='form' else ''}" href="?view_type=form">📋 Form</a>
-<a class="tab{' active' if view_type=='map' else ''}" href="?view_type=map">🗺️ Map</a>
-<a class="tab{' active' if view_type=='feed' else ''}" href="?view_type=feed">📰 Feed</a>
-</div>
-{body}
-</body></html>"""
-
-
-
-
-
-
-def _render_calendar(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    from datetime import date as dt_date
-    from datetime import timedelta
-    today = dt_date.today()
-    # Determine month/year from config or current
-    year = config.get("year", today.year)
-    month = config.get("month", today.month)
-    first = dt_date(year, month, 1)
-    # Start from Monday of first week
-    start = first - timedelta(days=first.weekday())
-    days_in_month = []
-    for i in range(42):  # 6 weeks
-        d = start + timedelta(days=i)
-        days_in_month.append(d)
-
-    # Map pages to dates
-    date_pages: dict[str, list[dict]] = {}
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        for v in props.values():
-            if isinstance(v, str) and v.startswith("20"):
-                d = v[:10]
-                date_pages.setdefault(d, []).append(p)
-                break
-
-    cells = ""
-    for d in days_in_month:
-        iso = d.isoformat()
-        items = date_pages.get(iso, [])
-        other_month = " other-month" if d.month != month else ""
-        today_class = " today" if d == today else ""
-        items_html = "".join(
-            f"<div class='cal-item' title='{p['title']}'>{p.get('icon','📄')} {p['title'][:20]}</div>"
-            for p in items
-        )
-        cells += f"<div class='cal-day{other_month}{today_class}'><span class='cal-num'>{d.day}</span>{items_html}</div>"
-
-    prev = first - timedelta(days=1)
-    next_month = first + timedelta(days=32)
-    next_month = next_month.replace(day=1)
-
-    return _base_html(collection["name"], collection.get("icon", "📅"), view_type, f"""
-<style>
-.calendar{{display:grid;grid-template-columns:repeat(7,1fr);gap:1px;background:#333;border-radius:8px;overflow:hidden}}
-.cal-header{{background:#222;padding:8px;text-align:center;font-size:11px;color:#A0A0A0;text-transform:uppercase}}
-.cal-day{{background:#1a1a1a;min-height:80px;padding:4px}}
-.cal-day.other-month{{opacity:.35}}
-.cal-day.today{{background:#1a2744}}
-.cal-num{{font-size:12px;color:#A0A0A0;display:block;margin-bottom:2px}}
-.cal-item{{font-size:11px;padding:2px 4px;margin:1px 0;background:#333;border-radius:3px;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}}
-.cal-nav{{display:flex;gap:8px;align-items:center;margin-bottom:12px}}
-.cal-nav a{{color:#3366CC;text-decoration:none;font-size:14px}}
-.cal-nav span{{font-size:16px;font-weight:600}}
-</style>
-<div class="cal-nav">
-<a href="?view_type=calendar&year={prev.year}&month={prev.month}">← {prev.strftime('%B')}</a>
-<span>{first.strftime('%B %Y')}</span>
-<a href="?view_type=calendar&year={next_month.year}&month={next_month.month}">{next_month.strftime('%B')} →</a>
-</div>
-<div class="calendar">
-<div class="cal-header">Mon</div><div class="cal-header">Tue</div><div class="cal-header">Wed</div>
-<div class="cal-header">Thu</div><div class="cal-header">Fri</div><div class="cal-header">Sat</div><div class="cal-header">Sun</div>
-{cells}
-</div>
-<p class="desc">{len(pages)} pages in collection</p>
-""")
-
-
-
-
-
-
-def _render_gallery(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    card_size = config.get("card_size", "medium")
-    size_css = {"small": "160px", "medium": "220px", "large": "300px"}.get(card_size, "220px")
-
-    cards = ""
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        cover_url = config.get("cover_property")
-        cover_html = ""
-        if cover_url:
-            for _k, v in props.items():
-                if isinstance(v, list) and len(v) > 0:
-                    url = v[0].get("url", "") if isinstance(v[0], dict) else str(v[0])
-                    if url.startswith("http"):
-                        cover_html = f"<div class='gal-cover' style='background-image:url({url})'></div>"
-                        break
-
-        prop_tags = "".join(
-            f"<span class='gal-prop'>{str(v)[:30]}</span>"
-            for v in list(props.values())[:3] if v
-        )
-
-        cards += f"""<div class='gal-card'>
-{cover_html}
-<div class='gal-body'>
-<div class='gal-title'>{p.get('icon','📄')} {p['title']}</div>
-<div class='gal-props'>{prop_tags}</div>
-</div>
-</div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "🖼️"), view_type, f"""
-<style>
-.gallery{{display:grid;grid-template-columns:repeat(auto-fill,minmax({size_css},1fr));gap:12px}}
-.gal-card{{background:#1a1a1a;border-radius:8px;overflow:hidden;border:1px solid #333}}
-.gal-card:hover{{border-color:#555}}
-.gal-cover{{height:120px;background:#222;background-size:cover;background-position:center}}
-.gal-body{{padding:12px}}
-.gal-title{{font-size:14px;font-weight:500;margin-bottom:6px}}
-.gal-props{{display:flex;flex-wrap:wrap;gap:4px}}
-.gal-prop{{font-size:11px;padding:2px 6px;background:#333;border-radius:4px;color:#A0A0A0}}
-</style>
-<div class="gallery">{cards}</div>
-<p class="desc">{len(pages)} cards</p>
-""")
-
-
-
-
-
-
-def _render_list(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    items = ""
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        preview = " · ".join(str(v)[:60] for v in list(props.values())[:3] if v)
-        items += f"""<div class='list-item'>
-<span class='list-icon'>{p.get('icon','📄')}</span>
-<div class='list-content'>
-<div class='list-title'>{p['title']}</div>
-<div class='list-preview'>{preview}</div>
-</div>
-</div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "📝"), view_type, f"""
-<style>
-.list-item{{display:flex;align-items:flex-start;gap:10px;padding:10px 12px;background:#1a1a1a;border-radius:6px;margin-bottom:4px;border:1px solid #222}}
-.list-item:hover{{border-color:#444}}
-.list-icon{{font-size:18px;margin-top:1px}}
-.list-content{{flex:1;min-width:0}}
-.list-title{{font-size:14px;font-weight:500}}
-.list-preview{{font-size:12px;color:#A0A0A0;margin-top:2px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}}
-</style>
-{items}
-<p class="desc">{len(pages)} items</p>
-""")
-
-
-
-
-
-
-def _render_timeline(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    # Find date range
-    dates = []
-    page_dates = []
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        start_val = end_val = None
-        for _k, v in props.items():
-            if isinstance(v, str) and v.startswith("20"):
-                if "..." in v:
-                    parts = v.split("...")
-                    start_val, end_val = parts[0][:10], parts[1][:10] if len(parts) > 1 else parts[0][:10]
-                else:
-                    start_val = end_val = v[:10]
-                break
-        if start_val:
-            dates.append(start_val)
-            if end_val:
-                dates.append(end_val)
-            page_dates.append((p, start_val, end_val or start_val))
-
-    if not dates:
-        return _base_html(collection["name"], collection.get("icon", "📈"), view_type,
-                          "<p class='desc'>No date data to display timeline.</p>")
-
-    from datetime import date as dt_date
-    min_date = min(dt_date.fromisoformat(d) for d in dates)
-    max_date = max(dt_date.fromisoformat(d) for d in dates)
-    total = (max_date - min_date).days or 1
-
-    bars = ""
-    for p, start, end in page_dates:
-        sd = dt_date.fromisoformat(start)
-        ed = dt_date.fromisoformat(end)
-        left = (sd - min_date).days / total * 100
-        width = max((ed - sd).days / total * 100, 1)
-        bars += f"""<div class='tl-row'>
-<span class='tl-label'>{p.get('icon','📄')} {p['title']}</span>
-<div class='tl-track'>
-<div class='tl-bar' style='left:{left:.1f}%;width:{width:.1f}%' title='{start} → {end}'></div>
-</div>
-</div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "📈"), view_type, f"""
-<style>
-.tl-row{{display:flex;align-items:center;margin-bottom:8px;gap:12px}}
-.tl-label{{width:160px;font-size:13px;text-align:right;flex-shrink:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}}
-.tl-track{{flex:1;height:28px;background:#222;border-radius:4px;position:relative}}
-.tl-bar{{position:absolute;top:4px;height:20px;background:#3366CC;border-radius:4px;min-width:4px}}
-</style>
-<div class="tl-header" style="display:flex;margin-bottom:16px;padding-left:172px">
-<span style="flex:1;font-size:11px;color:#A0A0A0">{min_date}</span>
-<span style="font-size:11px;color:#A0A0A0">{max_date}</span>
-</div>
-{bars}
-<p class="desc">{len(pages)} items · {min_date} → {max_date}</p>
-""")
-
-
-# ── v4.3.0: New view types ──
-
-# Multi-collection dashboards and chart aggregations cap the number of
-# input rows/groups at 200 (keeps the rendered HTML and export reasonable).
-
-
-
-
-def _chart_values(pages: list[dict], chart_property: str) -> list[float]:
-    """Numeric values of ``chart_property`` across ``pages`` (cap 200)."""
-    values: list[float] = []
-    for p in pages[:CHART_MAX_GROUPS]:
-        props = json.loads(p.get("property_values_json", "{}") or "{}")
-        v = props.get(chart_property)
-        if v is None or v == "":
-            continue
-        try:
-            values.append(float(v))
-        except (ValueError, TypeError):
-            continue
-    return values
-
-
-
-
-
-
-def _chart_aggregate(pages: list[dict], chart_property: str, aggregate: str) -> float:
-    """Compute count|sum|avg|min|max over a property (or row count)."""
-    values = _chart_values(pages, chart_property)
-    if aggregate == "count":
-        return float(len(pages[:CHART_MAX_GROUPS]))
-    if not values:
-        return 0.0
-    if aggregate == "sum":
-        return float(sum(values))
-    if aggregate == "avg":
-        return float(sum(values) / len(values))
-    if aggregate == "min":
-        return float(min(values))
-    if aggregate == "max":
-        return float(max(values))
-    return 0.0
-
-
-
-
-
-
-def _fmt_number(value: float) -> str:
-    if abs(value) >= 1e9:
-        return f"{value / 1e9:.2f}B"
-    if abs(value) >= 1e6:
-        return f"{value / 1e6:.2f}M"
-    if abs(value) >= 1e3:
-        return f"{value / 1e3:.1f}K"
-    if value == int(value):
-        return str(int(value))
-    return f"{value:.2f}"
-
-
-
-
-
-
-def _render_chart(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    """Chart view — bar, line, pie, doughnut, scatter via Chart.js CDN, plus
-    the v7.3.0 ``number`` KPI widget (count|sum|avg|min|max aggregate)."""
-    chart_type = config.get("chart_type", "bar")
-    chart_property = config.get("chart_property", "")
-
-    if chart_type == "number":
-        aggregate = config.get("aggregate", "sum" if chart_property else "count")
-        if aggregate not in ("count", "sum", "avg", "min", "max"):
-            aggregate = "sum" if chart_property else "count"
-        num = _chart_aggregate(pages, chart_property, aggregate)
-        label = config.get("title") or chart_property or collection["name"]
-        return _base_html(collection["name"], collection.get("icon", "📊"), view_type, f"""
-<style>
-.kpi{{max-width:420px;margin:60px auto;background:rgba(255,255,255,.04);border:1px solid rgba(255,255,255,.12);border-radius:14px;padding:36px;text-align:center}}
-.kpi-label{{font-size:13px;text-transform:uppercase;letter-spacing:1.2px;opacity:.6;margin-bottom:10px}}
-.kpi-value{{font-size:64px;font-weight:700;line-height:1;font-variant-numeric:tabular-nums}}
-.kpi-agg{{font-size:12px;color:var(--text-dim);margin-top:12px}}
-</style>
-<div class="kpi">
-  <div class="kpi-label">{label}</div>
-  <div class="kpi-value">{_fmt_number(num)}</div>
-  <div class="kpi-agg">{aggregate} · {len(pages[:CHART_MAX_GROUPS])} row(s)
-    {' of ' + chart_property if chart_property else ''}</div>
-</div>
-""")
-
-    labels = []
-    values = []
-    for p in pages[:CHART_MAX_GROUPS]:
-        labels.append(str(p.get("title") or "")[:30])
-        props = json.loads(p.get("property_values_json", "{}") or "{}")
-        val = 0.0
-        if chart_property:
-            v_raw = props.get(chart_property, 0)
-            try:
-                val = float(v_raw) if v_raw else 0.0
-            except (ValueError, TypeError):
-                val = 0.0
-        values.append(val)
-
-    labels_json = json.dumps(labels)
-    values_json = json.dumps(values)
-    subtitle = (f"{len(pages[:CHART_MAX_GROUPS])} entries"
-                + (f" (truncated at {CHART_MAX_GROUPS})" if len(pages) > CHART_MAX_GROUPS else ""))
-
-    return _base_html(collection["name"], collection.get("icon", "📊"), view_type, f"""
-<style>
-.chart-container{{max-width:800px;margin:0 auto}}
-canvas{{max-height:400px}}
-</style>
-<div class="chart-container"><canvas id="chartCanvas"></canvas></div>
-<script src="/static/js/vendor/chart.umd.js"></script>
-<script nonce="{CSP_NONCE.get()}">
-new Chart(document.getElementById('chartCanvas'), {{
-  type: '{chart_type}',
-  data: {{
-    labels: {labels_json},
-    datasets: [{{
-      label: '{config.get("title") or collection["name"]}',
-      data: {values_json},
-      backgroundColor: ['#3366CC','#DC3912','#FF9900','#109618','#990099','#0099C6','#DD4477','#66AA00'],
-    }}]
-  }},
-  options: {{ responsive: true }}
-}});
-</script>
-<p class="desc">{subtitle}</p>
-""")
-
-
-
-
-
-
-def _render_form(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    """Form view — generates an HTML form that creates new pages in the collection."""
-    properties = []
-    with get_conn() as conn:
-        props = conn.execute(
-            "SELECT name, prop_type, options_json FROM collection_properties WHERE collection_id=? AND prop_type!='formula' ORDER BY position",
-            (collection["id"],),
-        ).fetchall()
-        for p in props:
-            prop_dict = dict(p)
-            prop_dict["options"] = json.loads(prop_dict.get("options_json", "[]"))
-            properties.append(prop_dict)
-
-    fields = ""
-    for prop in properties:
-        name = prop["name"]
-        ptype = prop["prop_type"]
-        if ptype in ("text", "email", "url", "phone", "number"):
-            fields += f"""<div class='form-field'><label>{name}</label><input type='{"number" if ptype=="number" else "text"}' name='prop_{name}' placeholder='{name}'></div>"""
-        elif ptype in ("select", "status"):
-            options = "".join(f"<option value='{o}'>{o}</option>" for o in prop.get("options", []))
-            fields += f"""<div class='form-field'><label>{name}</label><select name='prop_{name}'>{options}</select></div>"""
-        elif ptype == "checkbox":
-            fields += f"""<div class='form-field'><label><input type='checkbox' name='prop_{name}' value='1'> {name}</label></div>"""
-        elif ptype == "date":
-            fields += f"""<div class='form-field'><label>{name}</label><input type='date' name='prop_{name}'></div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "📝"), view_type, f"""
-<style>
-.form-field{{margin-bottom:12px}}
-.form-field label{{display:block;font-size:13px;color:#A0A0A0;margin-bottom:4px}}
-.form-field input,.form-field select{{width:100%;max-width:400px;padding:8px;background:#333;border:1px solid #555;border-radius:6px;color:#fff;font-size:14px}}
-.form-submit{{padding:8px 20px;background:#3366CC;color:#fff;border:none;border-radius:6px;cursor:pointer;font-size:14px;margin-top:8px}}
-.form-submit:hover{{background:#254E99}}
-</style>
-<div class="form-container">
-<h3>New entry in {collection['name']}</h3>
-<form id="collectionForm" onsubmit="submitForm(event)">
-{fields}
-<div class='form-field'><label>Title</label><input type='text' name='title' placeholder='Page title' required></div>
-<button type='submit' class='form-submit'>Submit</button>
-</form>
-<div id="formResult" style="margin-top:12px;color:#4CAF50;display:none">✓ Created successfully!</div>
-</div>
-<script nonce="{CSP_NONCE.get()}">
-async function submitForm(e) {{
-  e.preventDefault();
-  const form = document.getElementById('collectionForm');
-  const fd = new FormData(form);
-  const properties = {{}};
-  const title = fd.get('title') || 'New entry';
-  fd.forEach((v,k) => {{ if(k.startsWith('prop_')) properties[k.slice(5)] = v; }});
-  const resp = await fetch('/db/{collection["id"]}/pages/api', {{
-    method:'POST', headers:{{'Content-Type':'application/json'}},
-    body: JSON.stringify({{title, properties}})
-  }});
-  if(resp.ok) {{
-    document.getElementById('formResult').style.display='block';
-    form.reset();
-  }}
-}}
-</script>
-""")
-
-
-
-
-
-
-def _render_map(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    """Map view — displays pages with location data on Leaflet map."""
-    markers = []
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        lat, lng = None, None
-        for _k, v in props.items():
-            if isinstance(v, str) and "," in v:
-                parts = v.split(",")
-                try:
-                    lat, lng = float(parts[0].strip()), float(parts[1].strip())
-                except ValueError:
-                    continue
-            elif isinstance(v, dict):
-                lat = v.get("lat")
-                lng = v.get("lng")
-        if lat and lng:
-            markers.append({"title": p["title"], "lat": lat, "lng": lng})
-
-    markers_json = json.dumps(markers)
-    center_lat = markers[0]["lat"] if markers else 45.5
-    center_lng = markers[0]["lng"] if markers else -73.5
-
-    return _base_html(collection["name"], collection.get("icon", "🗺️"), view_type, f"""
-<style>
-#map{{height:400px;border-radius:8px}}
-</style>
-<link rel="stylesheet" href="/static/js/vendor/leaflet.css" />
-<div id="map"></div>
-<script src="/static/js/vendor/leaflet.js"></script>
-<script nonce="{CSP_NONCE.get()}">
-const map = L.map('map').setView([{center_lat}, {center_lng}], 6);
-L.tileLayer('https://{{s}}.tile.openstreetmap.org/{{z}}/{{x}}/{{y}}.png', {{attribution:'© OSM'}}).addTo(map);
-const markers = {markers_json};
-markers.forEach(m => L.marker([m.lat, m.lng]).addTo(map).bindPopup(m.title));
-if(markers.length===0) L.marker([{center_lat},{center_lng}]).addTo(map).bindPopup('Default');
-</script>
-<p class="desc">{len(markers)} location(s) mapped</p>
-""")
-
-
-
-
-
-
-def _render_feed(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    """Feed view — chronological feed of pages, newest first."""
-    sorted_pages = sorted(pages, key=lambda p: p.get("created_at", ""), reverse=True)
-    items = ""
-    for p in sorted_pages:
-        created = p.get("created_at", "")[:10] if p.get("created_at") else ""
-        items += f"""<div class='feed-item'>
-<div class='feed-meta'>{created}</div>
-<div class='feed-title'>{p.get('icon','📄')} {p['title']}</div>
-</div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "📰"), view_type, f"""
-<style>
-.feed-item{{padding:12px 16px;border-left:2px solid #333;margin-bottom:8px;background:#1a1a1a;border-radius:0 8px 8px 0}}
-.feed-item:hover{{border-left-color:#3366CC}}
-.feed-meta{{font-size:11px;color:#A0A0A0;margin-bottom:4px}}
-.feed-title{{font-size:14px;font-weight:500}}
-</style>
-{items}
-<p class="desc">{len(sorted_pages)} entries</p>
-""")
-
-
-
-
-
-
-def _render_gantt(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    """Gantt view — timeline with dependencies and group_by support."""
-    group_by = config.get("group_by", "")
-
-    gantt_data = []
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        group = None
-        start_val = end_val = None
-        for _k, v in props.items():
-            if isinstance(v, str) and v.startswith("20"):
-                if "→" in v:
-                    parts = v.split("→")
-                    start_val, end_val = parts[0].strip()[:10], parts[1].strip()[:10] if len(parts) > 1 else parts[0].strip()[:10]
-                elif "..." in v:
-                    parts = v.split("...")
-                    start_val, end_val = parts[0][:10], parts[1][:10] if len(parts) > 1 else parts[0][:10]
-                else:
-                    start_val = end_val = v[:10]
-                break
-        if group_by:
-            group = str(props.get(group_by, props.get("Status", "")))[:20]
-        if start_val:
-            gantt_data.append({"title": p["title"], "start": start_val, "end": end_val or start_val, "group": group or ""})
-
-    if not gantt_data:
-        return _base_html(collection["name"], collection.get("icon", "📊"), view_type, "<p class='desc'>No date data for Gantt chart.</p>")
-
-    from datetime import date as dt_date_2
-    all_dates = [d["start"] for d in gantt_data] + [d["end"] for d in gantt_data]
-    min_date = min(dt_date_2.fromisoformat(d) for d in all_dates)
-    max_date = max(dt_date_2.fromisoformat(d) for d in all_dates)
-    total_days = max((max_date - min_date).days, 1)
-
-    groups = {}
-    for d in gantt_data:
-        groups.setdefault(d["group"], []).append(d)
-    if not groups or all(k == "" for k in groups):
-        groups = {"": gantt_data}
-
-    rows = ""
-    for group_name, items in sorted(groups.items()):
-        if group_name:
-            rows += f"<div class='gantt-group'>{group_name} ({len(items)})</div>"
-        for item in items:
-            sd = dt_date_2.fromisoformat(item["start"])
-            ed = dt_date_2.fromisoformat(item["end"])
-            left = max((sd - min_date).days / total_days * 100, 0)
-            width = max((ed - sd).days / total_days * 100, 1)
-            rows += f"""<div class='gantt-row'>
-<span class='gantt-label'>{item['title'][:30]}</span>
-<div class='gantt-track'><div class='gantt-bar' style='left:{left:.1f}%;width:{width:.1f}%' title='{item["start"]} → {item["end"]}'></div></div>
-<span class='gantt-dates'>{item['start']} → {item['end']}</span>
-</div>"""
-
-    return _base_html(collection["name"], collection.get("icon", "📊"), view_type, f"""
-<style>
-.gantt-group{{padding:8px 12px;background:#222;font-size:13px;font-weight:600;margin:8px 0 4px;border-radius:4px}}
-.gantt-row{{display:flex;align-items:center;margin-bottom:6px;gap:8px}}
-.gantt-label{{width:180px;font-size:12px;text-align:right;flex-shrink:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}}
-.gantt-track{{flex:1;height:24px;background:#222;border-radius:4px;position:relative}}
-.gantt-bar{{position:absolute;top:3px;height:18px;background:linear-gradient(90deg,#3366CC,#5599EE);border-radius:4px;min-width:4px}}
-.gantt-dates{{font-size:10px;color:#A0A0A0;flex-shrink:0;min-width:140px}}
-</style>
-<div class="gantt-header" style="display:flex;margin-bottom:8px;padding-left:188px">
-<span style="flex:1;font-size:10px;color:#A0A0A0">{min_date}</span>
-<span style="font-size:10px;color:#A0A0A0">{max_date}</span>
-</div>
-{rows}
-<p class="desc">{len(gantt_data)} items · {min_date} → {max_date}</p>
-""")
-
-
-
-
-
-
-def _render_table(view_type: str, collection: dict, pages: list[dict], config: dict) -> str:
-    rows = ""
-    for p in pages:
-        props = json.loads(p.get("property_values_json", "{}"))
-        prop_cells = "".join(f"<td>{str(v)[:80]}</td>" for v in list(props.values())[:4])
-        rows += f"<tr><td>{p.get('icon','📄')}</td><td>{p['title']}</td>{prop_cells}</tr>"
-
-    return _base_html(collection["name"], collection.get("icon", "📊"), view_type, f"""
-<style>
-table{{width:100%;border-collapse:collapse}}
-th,td{{padding:8px 12px;text-align:left;font-size:13px;border-bottom:1px solid #333}}
-th{{color:#A0A0A0;font-weight:500;background:#1a1a1a;position:sticky;top:0}}
-tr:hover td{{background:#222}}
-</style>
-<table><thead><tr><th></th><th>Title</th><th>Properties</th></tr></thead><tbody>{rows}</tbody></table>
-<p class="desc">{len(pages)} rows</p>
-""")
-
-
-
@@ -1,61 +0,0 @@
-"""FlowDeck — Collections : boards.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── Gitea Board Compatibility (BEFORE {collection_id} wildcards) ──
-
-
-@router.get("/boards/api")
-def list_boards_as_collections(request: Request):
-    """API: list all Gitea boards as pseudo-collections."""
-    from app.services.collection_adapter import GiteaBoardCompat
-    boards = GiteaBoardCompat.list_boards_as_collections()
-    return {"boards": boards}
-
-
-
-
-@router.get("/board/{owner}/{repo}/api")
-async def get_board_as_collection(request: Request, owner: str, repo: str):
-    """API: get a specific Gitea board as a pseudo-collection."""
-    from app.services.collection_adapter import GiteaBoardCompat
-    coll = GiteaBoardCompat.get_board_as_collection(owner, repo)
-    if not coll:
-        raise HTTPException(status_code=404, detail="Board not found")
-
-    from app.services.gitea_client import gitea
-    issues = await gitea.get_issues(owner, repo, state="all")
-    cards = GiteaBoardCompat.get_board_cards(owner, repo, issues)
-
-    return {"collection": coll, "pages": cards}
-
-
-
-
-@router.post("/board/{owner}/{repo}/sync")
-async def sync_board_to_collection(request: Request, owner: str, repo: str):
-    """Sync a Gitea board to a real collection."""
-    from app.services.collection_adapter import GiteaBoardCompat
-    from app.services.gitea_client import gitea
-
-    issues = await gitea.get_issues(owner, repo, state="all")
-    coll_id = GiteaBoardCompat.sync_to_collection(owner, repo, issues)
-    if coll_id is None:
-        raise HTTPException(status_code=404, detail="Board not found")
-
-    return {"collection_id": coll_id, "status": "synced"}
-
-
-# ── Collection Properties (v1.4.0) ──
@@ -1,350 +0,0 @@
-"""FlowDeck — Collections : crud.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.routers.dashboard._common import _get_active_workspace
-from app.services.automations import fire_event, run_event_sync
-from app.services.collection_lifecycle import delete_collections
-from app.services.db_templates import materialize_properties
-from app.services.permission_manager import PermissionManager
-
-from ._common import _apply_template, _require_view, _session_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── API: List & Create (no path params) ──
-#
-# `GET /db` (la page HTML) vit dans `index_page.py` : elle était auparavant
-# un dump JSON de debug, sans layout — alors qu'elle sert de destination au
-# bouton « Ouvrir mes bases » de My Tasks.
-
-
-
-
-@router.get("/api")
-def list_collections_api(request: Request):
-    """API: list all collections."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM collections ORDER BY name"
-        ).fetchall()
-    return {"collections": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api")
-def create_collection_api(request: Request, body: dict = Body(default={})):
-    """API: create a new collection, optionally from a database template."""
-
-    name = body.get("name", "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name is required")
-
-    description = body.get("description", "")
-    icon = body.get("icon", "📋")
-    gitea_owner = body.get("gitea_owner")
-    gitea_repo = body.get("gitea_repo")
-    schema = body.get("schema", [])
-    is_locked = body.get("is_locked", False)
-
-    # Workspace d'appartenance : celui du body si fourni et autorisé, sinon le
-    # workspace actif de l'utilisateur. Sans cela la collection reste orpheline
-    # et n'apparaît dans aucune vue scopée (ex. /my-tasks).
-    user = _session_user(request)
-    workspace_id = body.get("workspace_id")
-    if workspace_id is not None:
-        try:
-            workspace_id = int(workspace_id)
-        except (TypeError, ValueError):
-            raise HTTPException(status_code=400, detail="workspace_id must be an integer") from None
-        with get_conn() as conn:
-            exists = conn.execute("SELECT 1 FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
-        if not exists:
-            raise HTTPException(status_code=400, detail="workspace_id does not exist")
-    else:
-        active = _get_active_workspace(request, (user or {}).get("id"))
-        workspace_id = active["id"] if active else None
-
-    with get_conn() as conn:
-        # Apply a template if requested (provides schema + icon).
-        tpl = _apply_template(conn, body.get("template"))
-        if tpl:
-            if body.get("name"):
-                name = body["name"].strip()
-            description = tpl["description"]
-            icon = tpl.get("icon") or icon
-            try:
-                schema = json.loads(tpl["schema_json"])
-            except (json.JSONDecodeError, TypeError):
-                schema = []
-
-        schema_json = json.dumps(schema)
-
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, gitea_owner, gitea_repo, is_locked,
-                workspace_id)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?)""",
-            (name, description, icon, schema_json, gitea_owner, gitea_repo, int(is_locked),
-             workspace_id),
-        )
-        collection_id = cur.lastrowid
-
-        materialize_properties(conn, collection_id, schema)
-
-        conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json)
-               VALUES (?, ?, ?, ?)""",
-            (collection_id, "Default View", "table", json.dumps({
-                "visible_properties": ["Title"],
-                "sorts": [],
-                "filters": [],
-            })),
-        )
-        conn.commit()
-
-    run_event_sync(fire_event("collection.created", {"collection_id": collection_id, "name": name, "icon": icon}))
-    return {"id": collection_id, "name": name, "status": "created"}
-
-
-# ── API: Update & Delete (no path-param conflicts) ──
-
-
-
-
-# ── API: Update & Delete (no path-param conflicts) ──
-
-
-@router.put("/api/{collection_id}")
-def update_collection_api(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: update a collection."""
-
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        name = body.get("name", existing["name"])
-        description = body.get("description", existing["description"])
-        icon = body.get("icon", existing["icon"])
-        is_locked = body.get("is_locked", existing["is_locked"])
-        schema_json = json.dumps(body.get("schema", json.loads(existing["schema_json"])))
-        gitea_owner = body.get("gitea_owner", existing["gitea_owner"])
-        gitea_repo = body.get("gitea_repo", existing["gitea_repo"])
-
-        conn.execute(
-            """UPDATE collections SET name=?, description=?, icon=?, schema_json=?,
-               is_locked=?, gitea_owner=?, gitea_repo=?, updated_at=CURRENT_TIMESTAMP
-               WHERE id=?""",
-            (name, description, icon, schema_json, int(is_locked),
-             gitea_owner, gitea_repo, collection_id),
-        )
-        conn.commit()
-
-    run_event_sync(fire_event("collection.updated", {"collection_id": collection_id, "name": name}))
-    return {"id": collection_id, "status": "updated"}
-
-
-
-
-@router.delete("/api/{collection_id}")
-def delete_collection_api(request: Request, collection_id: int):
-    """API: delete a collection and its pages (CASCADE)."""
-    # v6.0.0: granular collection permissions — owner/admin only.
-    user = _session_user(request)
-    _require_view(collection_id, user)
-    if user:
-        pm = PermissionManager(user["id"])
-        if not pm.can_manage_collection_permissions(collection_id):
-            raise HTTPException(status_code=403, detail="Only a collection owner can delete it")
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        # `delete_collections` détache la page hôte et les vues liées avant la
-        # suppression : `pages.collection_id` et
-        # `collection_data_sources.source_collection_id` sont en NO ACTION, la
-        # suppression brute levait un IntegrityError.
-        delete_collections(conn, [collection_id])
-        conn.commit()
-
-    run_event_sync(fire_event("collection.deleted", {"collection_id": collection_id,
-                                           "name": existing["name"] if existing else ""}))
-    return {"id": collection_id, "status": "deleted"}
-
-
-
-
-@router.post("/{collection_id}/duplicate")
-def duplicate_collection_api(request: Request, collection_id: int):
-    """v5.4.0: deep-duplicate a database (views + properties + pages + data
-    sources) into a new collection named '<original> (copy)'."""
-    with get_conn() as conn:
-        src = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not src:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        new_name = (src["name"] or "Database") + " copy"
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, gitea_owner, gitea_repo, is_locked,
-                is_inline, parent_page_id, workspace_id, created_by, is_task, updated_at)
-               SELECT ?, description, icon, schema_json, gitea_owner, gitea_repo, is_locked,
-                      is_inline, parent_page_id, workspace_id, created_by, is_task, updated_at
-               FROM collections WHERE id=?""",
-            (new_name, collection_id),
-        )
-        new_id = cur.lastrowid
-
-        # ── Properties (remap ids so relation/rollup refs stay valid) ──
-        prop_map: dict[int, int] = {}
-        rows = conn.execute(
-            "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        # A23 : un seul executemany ; les rowid sont contigus (même transaction,
-        # insertion dans l'ordre de `rows`), donc le mappeur se fait par index.
-        tuples = [
-            (new_id, p["name"], p["prop_type"], p["options_json"], p["number_format"],
-             None, p["reverse_name"], None, None, p["rollup_function"],
-             p["formula_expression"], p["position"], p["required"],
-             p["visible_in_views"])
-            for p in rows
-        ]
-        if tuples:
-            ncur = conn.executemany(
-                """INSERT INTO collection_properties
-                   (collection_id, name, prop_type, options_json, number_format,
-                    related_collection_id, reverse_name, relation_property_id,
-                    target_property_id, rollup_function, formula_expression,
-                    position, required, visible_in_views)
-                   VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
-                tuples,
-            )
-            new_ids = [
-                r["id"]
-                for r in conn.execute(
-                    "SELECT id FROM collection_properties WHERE collection_id=? ORDER BY id",
-                    (new_id,),
-                ).fetchall()
-            ]
-            assert len(new_ids) == len(tuples), "remap des propriétés : effectif inattendu"
-            for p, new_pid in zip(rows, new_ids, strict=True):
-                prop_map[p["id"]] = new_pid
-
-        # Fix cross-property references after all rows exist (creates may target
-        # columns not inserted yet). Related collection remapped to the copy.
-        for p in rows:
-            p = dict(p)  # convert sqlite3.Row to dict
-            new_pid = prop_map[p["id"]]
-            related = p["related_collection_id"]
-            related_new = new_id if related == collection_id else related
-            if p["prop_type"] == "relation":
-                conn.execute(
-                    "UPDATE collection_properties SET related_collection_id=? WHERE id=?",
-                    (related_new, new_pid),
-                )
-            if p.get("relation_property_id") and p["relation_property_id"] in prop_map:
-                conn.execute(
-                    "UPDATE collection_properties SET relation_property_id=? WHERE id=?",
-                    (prop_map[p["relation_property_id"]], new_pid),
-                )
-            if p.get("target_property_id") and p["target_property_id"] in prop_map:
-                conn.execute(
-                    "UPDATE collection_properties SET target_property_id=? WHERE id=?",
-                    (prop_map[p["target_property_id"]], new_pid),
-                )
-
-        # ── Views ──
-        vrows = conn.execute(
-            "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        for v in vrows:
-            conn.execute(
-                """INSERT INTO collection_views
-                   (collection_id, name, view_type, config_json, position)
-                   VALUES (?,?,?,?,?)""",
-                (new_id, v["name"], v["view_type"], v["config_json"], v["position"]),
-            )
-
-        # ── Pages (rows) with property ids remapped to the copy's properties ──
-        prows = conn.execute(
-            "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        page_map: dict[int, int] = {}
-        for p in prows:
-            try:
-                pv = json.loads(p["property_values_json"]) if p["property_values_json"] else {}
-            except (json.JSONDecodeError, TypeError):
-                pv = {}
-            pv_new = {}
-            for k, val in pv.items():
-                try:
-                    prop_id = int(k)
-                except (ValueError, TypeError):
-                    prop_id = None
-                new_key = str(prop_map.get(prop_id, prop_id)) if prop_id is not None else k
-                pv_new[new_key] = val
-            ncur = conn.execute(
-                """INSERT INTO collection_pages
-                   (collection_id, title, icon, position, parent_id, gitea_issue_id,
-                    gitea_issue_number, property_values_json, created_at, updated_at)
-                   SELECT ?, title, icon, position, NULL, NULL, NULL, ?, created_at, updated_at
-                   FROM collection_pages WHERE id=?""",
-                (new_id, json.dumps(pv_new), p["id"]),
-            )
-            page_map[p["id"]] = ncur.lastrowid
-
-        # Re-parent sub-items to the copied rows.
-        for p in prows:
-            if p["parent_id"] and p["parent_id"] in page_map:
-                conn.execute(
-                    "UPDATE collection_pages SET parent_id=? WHERE id=?",
-                    (page_map[p["parent_id"]], page_map[p["id"]]),
-                )
-
-        # ── Data sources (linked DBs) ──
-        drows = conn.execute(
-            "SELECT * FROM collection_data_sources WHERE collection_id=?",
-            (collection_id,),
-        ).fetchall()
-        for d in drows:
-            src_coll = d["source_collection_id"]
-            src_now = new_id if src_coll == collection_id else src_coll
-            conn.execute(
-                """INSERT INTO collection_data_sources
-                   (collection_id, source_collection_id, source_name, is_linked, position)
-                   VALUES (?,?,?,?,?)""",
-                (new_id, src_now, d["source_name"], d["is_linked"], d["position"]),
-            )
-
-        conn.commit()
-
-    run_event_sync(fire_event("collection.created", {"collection_id": new_id, "name": new_name}))
-    return {"id": new_id, "name": new_name, "status": "duplicated"}
-
-
-# ── Page CRUD (standalone, BEFORE collection wildcards) ──
@@ -1,214 +0,0 @@
-"""FlowDeck — Collections : dashboard_views.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import html as _htmlmod
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-
-from ._common import _require_view, _session_user
-from ._renderers import CHART_MAX_GROUPS, _base_html, _render_chart, _render_view
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-@router.post("/{collection_id}/pages/{page_id}/auto-shift/api")
-def auto_shift_dates(request: Request, collection_id: int, page_id: int, body: dict = Body(default={})):
-    """API: auto-shift dates based on blocking dependencies."""
-    from datetime import date as dt_date
-    from datetime import timedelta
-
-    skip_weekends = body.get("skip_weekends", False)
-
-    with get_conn() as conn:
-        page = conn.execute("SELECT property_values_json FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(status_code=404, detail="Page not found")
-
-        # Get all blocking dependencies
-        deps = conn.execute(
-            "SELECT * FROM page_dependencies WHERE page_id=? AND dependency_type='blocks'",
-            (page_id,),
-        ).fetchall()
-
-        shifted = False
-        new_start = None
-        for dep in deps:
-            dep_page = conn.execute(
-                "SELECT title, property_values_json FROM collection_pages WHERE id=?",
-                (dep["dependency_id"],),
-            ).fetchone()
-            if not dep_page:
-                continue
-            dep_props = json.loads(dep_page["property_values_json"])
-            # Find the latest end date among blockers
-            for v in dep_props.values():
-                if isinstance(v, str) and v.startswith("20"):
-                    end_date = v.split("...")[-1].split("→")[-1].strip()[:10]
-                    try:
-                        ed = dt_date.fromisoformat(end_date)
-                        if new_start is None or ed >= new_start:
-                            new_start = ed + timedelta(days=1)
-                        shifted = True
-                    except ValueError:
-                        continue
-
-        if not shifted:
-            return {"page_id": page_id, "shifted": False, "message": "No blocking dependencies with dates found"}
-
-        # Skip weekends if requested
-        if skip_weekends and new_start:
-            while new_start.weekday() >= 5:  # 5=Sat, 6=Sun
-                new_start = new_start + timedelta(days=1)
-
-        # Update the page's date properties
-        props = json.loads(page["property_values_json"])
-        for k, v in list(props.items()):
-            if isinstance(v, str) and v.startswith("20"):
-                old_parts = v.split("...")
-                old_end = old_parts[-1] if len(old_parts) > 1 else old_parts[0]
-                try:
-                    old_start_d = dt_date.fromisoformat(old_parts[0][:10])
-                    old_end_d = dt_date.fromisoformat(old_end[:10])
-                    duration = (old_end_d - old_start_d).days
-                    new_end = new_start + timedelta(days=max(duration, 0))
-                    props[k] = f"{new_start.isoformat()}...{new_end.isoformat()}"
-                except ValueError:
-                    props[k] = new_start.isoformat()
-                break
-
-        conn.execute(
-            "UPDATE collection_pages SET property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (json.dumps(props), page_id),
-        )
-        conn.commit()
-
-    return {"page_id": page_id, "shifted": True, "new_start": new_start.isoformat(), "skip_weekends": skip_weekends}
-
-
-# ── {collection_id} wildcards (LAST — catches everything else) ──
-
-
-
-
-# ── {collection_id} wildcards (LAST — catches everything else) ──
-
-
-@router.get("/{collection_id}/dashboards/{dashboard_id}", response_class=HTMLResponse)
-def view_dashboard(request: Request, collection_id: int, dashboard_id: int):
-    """v7.3.0: render a collection dashboard grid (multi-DB widgets).
-
-    Widgets live in ``collection_dashboards.layout_json`` as
-    ``{"columns": N, "widgets": [{collection_id?, view_type?, chart_type?,
-    chart_property?, aggregate?, title?, width?, height?}]}``. Each widget may
-    point at *any* database (the dashboard's own collection is the default),
-    which is what "dashboards multi-DB" means.
-    """
-    uid = _session_user(request)
-    _require_view(collection_id, uid)
-    with get_conn() as conn:
-        dash = conn.execute(
-            "SELECT * FROM collection_dashboards WHERE id=? AND collection_id=?",
-            (dashboard_id, collection_id)).fetchone()
-        if not dash:
-            raise HTTPException(404, "Dashboard not found")
-    layout = json.loads(dash["layout_json"] or "{}")
-    columns = max(1, int(layout.get("columns", 1) or 1))
-    widgets = layout.get("widgets", []) or []
-    if not isinstance(widgets, list):
-        widgets = []
-
-    rendered = []
-    for w in widgets[:40]:
-        if not isinstance(w, dict):
-            continue
-        wc = int(w.get("collection_id") or 0) or collection_id
-        with get_conn() as conn:
-            coll = conn.execute("SELECT * FROM collections WHERE id=?", (wc,)).fetchone()
-        if not coll:
-            continue
-        try:
-            _require_view(wc, uid)
-        except HTTPException:
-            continue  # restricted database → widget skipped, not rendered
-        with get_conn() as conn:
-            wpages = conn.execute(
-                "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position LIMIT ?",
-                (wc, CHART_MAX_GROUPS)).fetchall()
-        wconfig = {k: v for k, v in w.items()
-                   if k in ("chart_type", "chart_property", "aggregate", "title")}
-        view_type = w.get("view_type") or "chart"
-        if view_type == "chart":
-            body = _render_chart(view_type, dict(coll), [dict(p) for p in wpages], wconfig)
-        else:
-            body = _render_view(view_type, dict(coll), [dict(p) for p in wpages], wconfig)
-        width = int(w.get("width") or 0)
-        span = f"grid-column: span {width};" if width and width > 0 else ""
-        rendered.append(f'<div class="dash-widget" style="{span}">{body}</div>')
-
-    grid_css = f"grid-template-columns: repeat({columns}, minmax(0, 1fr));"
-    body = f"""
-<style>
-.dash-grid{{display:grid;{grid_css} gap:16px;max-width:1200px;margin:0 auto;padding:24px}}
-.dash-widget{{background:rgba(255,255,255,.02);border:1px solid rgba(255,255,255,.08);border-radius:12px;overflow:hidden}}
-.dash-widget .desc{{color:var(--text-dim);font-size:12px;padding:8px 16px 16px}}
-</style>
-<h1 style="max-width:1200px;margin:24px auto 0;padding:0 24px;font-size:22px;">{_htmlmod.escape(dash['name'])}</h1>
-<div class="dash-grid">{''.join(rendered) if rendered else '<p style="color:var(--text-dim);padding:20px;">Empty dashboard — add widgets to <code>layout_json</code>.</p>'}</div>
-"""
-    return HTMLResponse(_base_html(dash["name"], "📊", "dashboard", body))
-
-
-
-
-@router.get("/{collection_id}", response_class=HTMLResponse)
-@router.get("/{collection_id}/view/{view_type}", response_class=HTMLResponse)
-def view_collection(request: Request, collection_id: int, view_type: str = "table"):
-    """Main view — renders collection in the requested view type."""
-    # v6.0.0: granular collection permissions — hide restricted collections.
-    _require_view(collection_id, _session_user(request))
-    with get_conn() as conn:
-        collection = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not collection:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        view = conn.execute(
-            "SELECT * FROM collection_views WHERE collection_id=? AND view_type=? ORDER BY position LIMIT 1",
-            (collection_id, view_type),
-        ).fetchone()
-        if not view:
-            view = conn.execute(
-                "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position LIMIT 1",
-                (collection_id,),
-            ).fetchone()
-
-        pages = conn.execute(
-            "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-
-    collection_dict = dict(collection)
-    pages_list = [dict(p) for p in pages]
-    config = json.loads(view["config_json"]) if view else {}
-
-    if "year" in request.query_params:
-        config["year"] = int(request.query_params["year"])
-    if "month" in request.query_params:
-        config["month"] = int(request.query_params["month"])
-
-    return HTMLResponse(_render_view(view_type, collection_dict, pages_list, config))
-
-
-# ── View renderers (v1.6.0) ──
@@ -1,122 +0,0 @@
-"""FlowDeck — Collections : data_api.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.property_types import (
-    apply_auto_properties,
-)
-
-from ._common import (
-    _collection_properties,
-    _current_user,
-    _require_edit,
-    _require_view,
-    _session_user,
-    _validate_meta_keys,
-    _validate_page_properties,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-@router.get("/{collection_id}/api")
-def get_collection_api(request: Request, collection_id: int):
-    """API: get a single collection with its pages."""
-    # v6.0.0: granular collection permissions — hide restricted collections.
-    _require_view(collection_id, _session_user(request))
-    with get_conn() as conn:
-        collection = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not collection:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        pages = conn.execute(
-            "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        views = conn.execute(
-            "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-
-    return {
-        "collection": dict(collection),
-        "pages": [dict(p) for p in pages],
-        "views": [dict(v) for v in views],
-    }
-
-
-
-
-@router.post("/{collection_id}/pages/api")
-def create_page_api(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: create a page in a collection."""
-    # v6.0.0: granular collection permissions — viewer/commenter cannot create.
-    _require_view(collection_id, _session_user(request))
-    _require_edit(collection_id, _session_user(request))
-
-    title = body.get("title", "").strip()
-    if not title:
-        raise HTTPException(status_code=400, detail="title is required")
-
-    icon = body.get("icon", "📄")
-    property_values = body.get("properties", {})
-    cover_url = body.get("cover_url", "")
-    gitea_issue_id = body.get("gitea_issue_id")
-    gitea_issue_number = body.get("gitea_issue_number")
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        _validate_page_properties(conn, collection_id, property_values)
-        _validate_meta_keys(conn, collection_id, property_values)
-        apply_auto_properties(
-            _collection_properties(conn, collection_id),
-            property_values,
-            _current_user(request),
-            is_create=True,
-        )
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        cur = conn.execute(
-            """INSERT INTO collection_pages
-               (collection_id, title, icon, cover_url, position, gitea_issue_id, gitea_issue_number, property_values_json)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?)""",
-            (collection_id, title, icon, cover_url, max_pos, gitea_issue_id, gitea_issue_number,
-             json.dumps(property_values)),
-        )
-        conn.commit()
-        page_id = cur.lastrowid
-
-    run_event_sync(fire_event("page.created", {
-        "page_id": page_id,
-        "collection_id": collection_id,
-        "title": title,
-        "icon": icon,
-        "properties": property_values,
-    }))
-    run_event_sync(fire_event("collection.page.created", {
-        "page_id": page_id,
-        "collection_id": collection_id,
-        "title": title,
-    }))
-    return {"id": page_id, "title": title, "status": "created"}
@@ -1,259 +0,0 @@
-"""FlowDeck — Collections : la page « /db » (liste des bases).
-
-`GET /db` était un **dump JSON de debug** (le HTML renvoyé était un
-`<pre>` dans le vide, sans layout) : c'est pourtant la destination du bouton
-« Ouvrir mes bases » de My Tasks, et le point d'entrée pour convertir une base
-en base de tâches. On le remplace par une vraie page :
-
-* bases **du workspace courant** d'abord (ce que voit l'utilisateur dans la
-  sidebar), puis celles de ses **autres workspaces** dans une section séparée :
-  sans cela, un utilisateur dont le workspace actif ne contient aucune base
-  tombe sur une page vide alors qu'il en possède ailleurs ;
-* indicateur « Base de tâches » / « À configurer » par base ;
-* accès direct à la page de la base, où se trouve le bouton de conversion.
-
-**Rattachement d'une base à un workspace.** `collections.workspace_id` n'est
-renseigné que pour les bases créées via `/db/api`. Une base née d'un document
-(page convertie en base, base inline) a `workspace_id` **NULL** et n'appartient
-qu'à travers sa page hôte : la résout par `COALESCE(workspace_id, page hôte)`
-(`app/services.collection_lifecycle.effective_workspace_sql`). Filtrer sur
-`workspace_id`, ou faire un `JOIN workspaces`, faisait disparaître ces bases de
-la page alors qu'elles sont listées dans la sidebar du workspace — l'utilisateur
-les voyait sans pouvoir les ouvrir.
-
-Le filtre de vivacité (`live_collection_ids`) est appliqué : une base dont la
-page hôte est à la corbeille n'est pas proposée, puisqu'elle est inaccessible.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-from app.routers.dashboard._common import _get_active_workspace
-from app.services.collection_lifecycle import (
-    effective_workspace_sql,
-    live_collection_ids,
-    user_workspace_ids,
-)
-from app.templating import ENV
-
-from ._common import _session_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-#: Colonnes communes aux deux listes (carte de base). `c.` qualification
-#: obligatoire : le nom de la collection d'icônes homonyme rendrait `rows` et
-#: `id` ambigus.
-_CARD_COLUMNS = """
-    c.id, c.name, c.icon, c.parent_page_id, c.workspace_id, c.is_task,
-    c.task_assignee_prop, c.task_status_prop, c.task_due_prop,
-    (SELECT COUNT(*) FROM collection_pages cp
-      WHERE cp.collection_id = c.id AND cp.parent_id IS NULL) AS rows
-"""
-
-
-def _esc(value) -> str:
-    return (
-        str(value if value is not None else "")
-        .replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
-        .replace('"', "&quot;").replace("'", "&#39;")
-    )
-
-
-def _card(r: dict) -> str:
-    """Une carte de base : état My Tasks + ce qu'il reste à faire."""
-    target = (f"/pages/{r['parent_page_id']}" if r["parent_page_id"]
-              else f"/db/{r['id']}")
-    labels = {"assignee": "Assigné à", "status": "Statut", "due": "Échéance"}
-    missing = [role for role in ("assignee", "status", "due")
-               if not r.get(f"task_{role}_prop")]
-
-    if r["is_task"] and not missing:
-        badge = '<span class="db-card-badge ok">Base de tâches</span>'
-        hint = "Alimente My Tasks."
-    elif r["is_task"]:
-        badge = '<span class="db-card-badge warn">À configurer</span>'
-        hint = ("Il manque : " + ", ".join(labels[m] for m in missing)
-                + ". Ouvrez la base puis « Configurer » dans sa barre.")
-    else:
-        badge = ""
-        hint = "Ouvrez-la puis cliquez sur « Convertir en base de tâches »."
-
-    # `workspace_id` est NULL pour une base portée par une page : on affiche le
-    # nom du workspace effectif plutôt que celui de la colonne brute.
-    ws_label = r.get("ws_label") or ""
-    meta = f'{r["rows"]} ligne(s)'
-    if ws_label:
-        meta += f" · {ws_label}"
-
-    return f"""<a class="db-card" href="{_esc(target)}">
-<div class="db-card-head">
-<span class="db-card-icon">{_esc(r["icon"] or "📋")}</span>
-<span class="db-card-name">{_esc(r["name"])}</span>
-{badge}
-</div>
-<div class="db-card-meta">{_esc(meta)}</div>
-<div class="db-card-hint">{_esc(hint)}</div>
-</a>"""
-
-
-@router.get("", response_class=HTMLResponse)
-def list_collections(request: Request):
-    """Liste des bases du workspace, dans le layout de l'application."""
-    user = _session_user(request)
-
-    if not user:
-        from fastapi.responses import RedirectResponse
-
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-
-    with get_conn() as conn:
-        workspace = _get_active_workspace(request, user.get("id")) or {}
-        ws_id = workspace.get("id")
-        ws_name = workspace.get("name") or "Workspace"
-
-        rows = _collections_of(conn, ws_id) if ws_id else []
-        # Bases des autres workspaces : la page ne doit jamais laisser
-        # l'utilisateur sans piste s'il en possède ailleurs.
-        current_ids = {r["id"] for r in rows}
-        others = [r for r in _all_collections(conn, user.get("id"), ws_id)
-                  if r["id"] not in current_ids]
-
-        connected = sum(1 for r in rows if r["is_task"])
-
-    return HTMLResponse(_render(request, ws_name, rows, connected, bool(ws_id),
-                                others))
-
-
-def _collections_of(conn, ws_id) -> list[dict]:
-    """Bases d'un workspace, vivantes seulement.
-
-    `live_collection_ids` écarte les bases dont la page hôte a disparu (corbeille
-    ou suppression) : elles sont inaccessibles, les proposer serait trompeur.
-
-    Le rattachement passe par le workspace **effectif** : une base créée depuis
-    un document a `workspace_id` NULL et n'est repérée que via sa page hôte.
-    """
-    live = set(live_collection_ids(conn, ws_id))
-    rows = conn.execute(
-        f"""SELECT {_CARD_COLUMNS}
-              FROM collections c
-             WHERE {effective_workspace_sql("c")} = ?
-             ORDER BY c.name""",
-        (ws_id,),
-    ).fetchall()
-    return [dict(r) for r in rows if r["id"] in live]
-
-
-def _all_collections(conn, user_id, current_ws_id=None) -> list[dict]:
-    """Toutes les bases accessibles à l'utilisateur, tous workspaces confondus.
-
-    Sert à la section « Autres workspaces » : l'utilisateur doit pouvoir
-    retrouver une base même si elle n'est pas dans le workspace actif (My Tasks
-    étant transverse, ces bases l'alimentent aussi).
-
-    Le périmètre est celui de `user_workspace_ids` (propriétaire **ou** membre) :
-    sans ce filtre, la page exposait les bases de tous les utilisateurs de
-    l'instance. Les bases sans workspace rattachable sont exclues — elles
-    n'appartiennent à personne.
-    """
-    ws_ids = user_workspace_ids(conn, user_id)
-    if not ws_ids:
-        return []
-    qs = ",".join("?" * len(ws_ids))
-    names = {
-        r["id"]: r["name"]
-        for r in conn.execute(
-            f"SELECT id, name FROM workspaces WHERE id IN ({qs})", ws_ids
-        ).fetchall()
-    }
-    rows = conn.execute(
-        f"""SELECT {_CARD_COLUMNS},
-                   {effective_workspace_sql("c")} AS ws_effective
-              FROM collections c
-             WHERE {effective_workspace_sql("c")} IN ({qs})
-             ORDER BY c.name""",
-        ws_ids,
-    ).fetchall()
-
-    live: dict[int, set[int]] = {}
-    out = []
-    for r in rows:
-        d = dict(r)
-        ws = d["ws_effective"]
-        if ws not in live:
-            live[ws] = set(live_collection_ids(conn, ws))
-        if d["id"] not in live[ws]:
-            continue
-        # Le workspace courant est déjà indiqué dans l'en-tête de la page.
-        d["ws_label"] = "" if ws == current_ws_id else names.get(ws, "")
-        out.append(d)
-    return out
-
-
-def _render(request: Request, ws_name: str, rows: list[dict], connected: int,
-            has_ws: bool, others: list[dict] | None = None) -> str:
-    """Rendu de la page, dans le layout commun (sidebar + base.html)."""
-    from app.routers.dashboard import _sidebar_data
-
-    others = others or []
-    blocks = [_card(r) for r in rows]
-    other_blocks = [_card(r) for r in others]
-
-    if rows or others:
-        total = len(rows) + len(others)
-        summary = (f"{connected} base(s) de tâches connectée(s) sur {total}"
-                   if connected else
-                   f"Aucune base de tâches connectée sur {total}")
-        sections = f"""<div class="db-grid">{''.join(blocks)}</div>"""
-        if other_blocks:
-            sections += ('<h2 class="db-section-title">Autres workspaces</h2>'
-                         '<p class="db-section-sub">Ces bases appartiennent à '
-                         "d'autres workspaces — elles alimentent tout de même "
-                         f'My Tasks.</p><div class="db-grid">'
-                         f"{''.join(other_blocks)}</div>")
-        body = f"""<div class="db-index">
-<div class="db-index-head">
-<h1>📋 Bases de données</h1>
-<span class="db-index-ws">{_esc(ws_name)}</span>
-</div>
-<p class="db-index-sub">{summary} — les bases de tâches alimentent
-<a href="/my-tasks">My Tasks</a>.</p>
-{sections}
-</div>"""
-    elif has_ws:
-        body = """<div class="db-empty">
-<div class="db-empty-icon">📋</div>
-<h1>Aucune base dans ce workspace</h1>
-<p>Créez une page, puis convertissez-la en base de données — ou partez
-d'un modèle depuis le menu d'ajout.</p>
-<p class="db-empty-hint">Une base reliée à My Tasks apparaît ici avec son
-état de configuration.</p>
-</div>"""
-    else:
-        body = """<div class="db-empty">
-<div class="db-empty-icon">📋</div>
-<h1>Aucun workspace sélectionné</h1>
-<p>Créez ou ouvrez d'abord un workspace : vos bases y seront rattachées.</p>
-</div>"""
-
-    # `my_tasks.css` porte les styles `.db-*` de cette page (cartes, sections,
-    # états vides) **et** ceux de My Tasks. Elle est liée par `base.html`
-    # (le shell, jamais swappé) : la lier ici exposait la page à un <link>
-    # retiré par htmx lors d'une navigation partielle.
-    block_tpl = ENV.from_string(
-        '{% extends "base.html" %}'
-        "{% block content %}{{ content_html|safe }}{% endblock %}"
-    )
-    return block_tpl.render(
-        **_sidebar_data(request, []),
-        request=request,
-        content_html=body,
-        page_title="Bases de données",
-        title_prefix="Bases de données",
-        page_icon="grid",
-    )
@@ -1,297 +0,0 @@
-"""FlowDeck — Collections : linked.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-import sqlite3
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.db_templates import materialize_properties
-
-from ._common import _apply_template
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-@router.post("/{collection_id}/linked/api")
-def create_linked_database(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: create a linked database view from a source collection.
-    A linked database copies the structure (views, filters, sorts) of a source
-    but shares the same pages — edits to pages propagate to the source.
-    """
-
-    name = body.get("name", "").strip()
-    body.get("workspace_id")
-
-    with get_conn() as conn:
-        source = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not source:
-            raise HTTPException(status_code=404, detail="Source collection not found")
-
-        if not name:
-            name = f"{source['name']} (linked)"
-
-        # Create the linked collection (shallow copy of structure)
-        # Inherit workspace_id from source for permission inheritance
-        src_dict = dict(source)
-        source_workspace_id = src_dict.get("workspace_id")
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, is_locked, is_inline, parent_page_id, workspace_id)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?)""",
-            (
-                name,
-                src_dict["description"],
-                src_dict["icon"],
-                src_dict["schema_json"],
-                0,  # linked DB is never locked
-                1,  # linked DB starts as inline
-                src_dict.get("parent_page_id"),
-                source_workspace_id,  # linked DB inherits source workspace permissions
-            ),
-        )
-        linked_id = cur.lastrowid
-
-        # Copy views from source
-        views = conn.execute(
-            "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        for v in views:
-            conn.execute(
-                "INSERT INTO collection_views (collection_id, name, view_type, config_json, position) VALUES (?, ?, ?, ?, ?)",
-                (linked_id, v["name"], v["view_type"], v["config_json"], v["position"]),
-            )
-
-        # Add the source as a data source with is_linked=1
-        conn.execute(
-            """INSERT INTO collection_data_sources
-               (collection_id, source_collection_id, source_name, is_linked, position)
-               VALUES (?, ?, ?, 1, 0)""",
-            (linked_id, collection_id, source["name"]),
-        )
-
-        # Copy properties from source
-        props = conn.execute(
-            "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-        for p in props:
-            conn.execute(
-                """INSERT INTO collection_properties
-                   (collection_id, name, prop_type, options_json, number_format,
-                    related_collection_id, reverse_name, relation_property_id,
-                    target_property_id, rollup_function, formula_expression,
-                    position, required, visible_in_views)
-                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-                (
-                    linked_id, p["name"], p["prop_type"], p["options_json"],
-                    p["number_format"], p["related_collection_id"], p["reverse_name"],
-                    p["relation_property_id"], p["target_property_id"],
-                    p["rollup_function"], p["formula_expression"],
-                    p["position"], p["required"], p["visible_in_views"],
-                ),
-            )
-
-        conn.commit()
-
-    return {
-        "linked_id": linked_id,
-        "name": name,
-        "source_collection_id": collection_id,
-        "status": "created",
-    }
-
-
-
-
-@router.post("/{collection_id}/toggle-inline/api")
-def toggle_inline(request: Request, collection_id: int):
-    """API: toggle a collection between full-page and inline mode."""
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT id, is_inline FROM collections WHERE id=?",
-            (collection_id,),
-        ).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        new_inline = 0 if coll["is_inline"] else 1
-        conn.execute(
-            "UPDATE collections SET is_inline=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (new_inline, collection_id),
-        )
-        conn.commit()
-
-    return {
-        "collection_id": collection_id,
-        "is_inline": bool(new_inline),
-        "mode": "inline" if new_inline else "full-page",
-    }
-
-
-
-
-@router.post("/inline/api")
-def create_inline_database(request: Request, body: dict = Body(default={})):
-    """API: create an inline database within a parent page (optionally from a template)."""
-
-    name = body.get("name", "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name is required")
-
-    description = body.get("description", "")
-    icon = body.get("icon", "📋")
-    parent_page_id = body.get("parent_page_id")
-    workspace_id = body.get("workspace_id")
-    schema = body.get("schema", [])
-
-    with get_conn() as conn:
-        tpl = _apply_template(conn, body.get("template"))
-        if tpl:
-            if body.get("name"):
-                name = body["name"].strip()
-            description = tpl["description"]
-            icon = tpl.get("icon") or icon
-            try:
-                schema = json.loads(tpl["schema_json"])
-            except (json.JSONDecodeError, TypeError):
-                schema = []
-
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, is_inline, parent_page_id, workspace_id)
-               VALUES (?, ?, ?, ?, 1, ?, ?)""",
-            (name, description, icon, json.dumps(schema), parent_page_id, workspace_id),
-        )
-        collection_id = cur.lastrowid
-
-        materialize_properties(conn, collection_id, schema)
-
-        # Create default view
-        conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json)
-               VALUES (?, ?, ?, ?)""",
-            (collection_id, "Default View", "table", json.dumps({
-                "visible_properties": ["Title"],
-                "sorts": [],
-                "filters": [],
-            })),
-        )
-        conn.commit()
-
-    return {
-        "id": collection_id,
-        "name": name,
-        "icon": icon,
-        "is_inline": True,
-        "parent_page_id": parent_page_id,
-        "status": "created",
-    }
-
-
-# ── v4.4.0: Tasks & Dependencies ──
-
-
-
-
-# ── v4.4.0: Tasks & Dependencies ──
-
-
-@router.put("/{collection_id}/toggle-task/api")
-def toggle_task(request: Request, collection_id: int):
-    """API: toggle is_task flag on a collection (Turn into Tasks).
-
-    Rétrocompatible : l'activation passe désormais par la même conversion que
-    ``POST /db/{id}/task-db/api``, donc les trois colonnes requises sont liées
-    (créées si besoin). Sans cela, cette route laissait une base « connectée »
-    mais muette — elle n'émettait aucune tâche faute de mapping.
-    """
-    from .task_db import disable_task_db_in_conn, enable_task_db_in_conn
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id, is_task FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-        if coll["is_task"]:
-            disable_task_db_in_conn(conn, collection_id)
-            new_val = 0
-        else:
-            enable_task_db_in_conn(conn, collection_id)
-            new_val = 1
-    return {"collection_id": collection_id, "is_task": bool(new_val), "mode": "tasks" if new_val else "standard"}
-
-
-
-
-@router.get("/{collection_id}/pages/{page_id}/dependencies/api")
-def list_page_dependencies(request: Request, collection_id: int, page_id: int):
-    """API: list dependencies for a page (blocks, blocked_by, related)."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM page_dependencies WHERE page_id=? ORDER BY created_at",
-            (page_id,),
-        ).fetchall()
-        deps = []
-        for r in rows:
-            d = dict(r)
-            dep_page = conn.execute(
-                "SELECT id, title FROM collection_pages WHERE id=?", (r["dependency_id"],)
-            ).fetchone()
-            if dep_page:
-                d["dependency_title"] = dep_page["title"]
-            deps.append(d)
-    return {"dependencies": deps}
-
-
-
-
-@router.post("/{collection_id}/pages/{page_id}/dependencies/api")
-def add_page_dependency(request: Request, collection_id: int, page_id: int, body: dict = Body(default={})):
-    """API: add a dependency (blocks/blocked_by/related) between two pages."""
-    dependency_id = body.get("dependency_id")
-    if not dependency_id:
-        raise HTTPException(status_code=400, detail="dependency_id is required")
-    dep_type = body.get("dependency_type", "blocks")
-    auto_shift = body.get("auto_shift", "overlap")
-
-    with get_conn() as conn:
-        for pid in (page_id, dependency_id):
-            if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (pid,)).fetchone():
-                raise HTTPException(status_code=404, detail=f"Page {pid} not found")
-        try:
-            cur = conn.execute(
-                "INSERT INTO page_dependencies (page_id, dependency_id, dependency_type, auto_shift) VALUES (?,?,?,?)",
-                (page_id, dependency_id, dep_type, auto_shift),
-            )
-            conn.commit()
-        except sqlite3.IntegrityError:
-            raise HTTPException(status_code=409, detail="This dependency already exists") from None
-    return {"id": cur.lastrowid, "page_id": page_id, "dependency_id": dependency_id, "status": "added"}
-
-
-
-
-@router.delete("/{collection_id}/pages/{page_id}/dependencies/{dep_id}/api")
-def remove_page_dependency(request: Request, collection_id: int, page_id: int, dep_id: int):
-    """API: remove a dependency."""
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM page_dependencies WHERE id=? AND page_id=?", (dep_id, page_id)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Dependency not found")
-        conn.execute("DELETE FROM page_dependencies WHERE id=?", (dep_id,))
-        conn.commit()
-    return {"id": dep_id, "status": "removed"}
@@ -1,197 +0,0 @@
-"""FlowDeck — Collections : meta.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.db import get_conn
-from app.services.permission_manager import PermissionManager
-from app.services.recurrence import (
-    RECURRENCE_KEY,
-    expand_rule,
-    parse_date,
-)
-
-from ._common import _collection_properties, _current_user, _require_view, _session_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── Collection Properties (v1.4.0) ──
-
-
-@router.get("/property-types/api")
-def list_property_types_api(request: Request):
-    """API: list all available property types."""
-    from app.services.property_types import PROPERTY_TYPES
-    return {"types": PROPERTY_TYPES}
-
-
-
-
-@router.get("/{collection_id}/properties/api")
-def list_properties_api(request: Request, collection_id: int):
-    """API: list all properties visible to the current user."""
-    user = _session_user(request)
-    _require_view(collection_id, user)
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-        rows = conn.execute(
-            "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-    props = [dict(r) for r in rows]
-    # v6.0.0: property-level visibility — owners/editors see everything, other
-    # users only the properties explicitly granted or left open.
-    if user:
-        pm = PermissionManager(user["id"])
-        visible = pm.get_visible_properties(collection_id)
-        props = [p for p in props if p["id"] in visible]
-    return {"properties": props}
-
-
-
-
-@router.get("/{collection_id}/members/api")
-def list_collection_members_api(request: Request, collection_id: int):
-    """API: list workspace members available for a ``person`` property.
-
-    Resolves the collection's workspace and returns its members (falling back to
-    every active user for standalone databases without a workspace).
-    """
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT workspace_id FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        ws_id = coll["workspace_id"] if "workspace_id" in coll.keys() else None
-        if ws_id:
-            rows = conn.execute(
-                """SELECT u.id, u.login, u.full_name, u.avatar_url, u.avatar_color, wm.role
-                   FROM workspace_members wm JOIN users u ON wm.user_id=u.id
-                   WHERE wm.workspace_id=? AND u.is_active=1 ORDER BY u.full_name, u.login""",
-                (ws_id,),
-            ).fetchall()
-        else:
-            rows = []
-        if not rows:
-            rows = conn.execute(
-                """SELECT id, login, full_name, avatar_url, avatar_color, '' AS role
-                   FROM users WHERE is_active=1 ORDER BY full_name, login"""
-            ).fetchall()
-
-    return {"members": [dict(r) for r in rows]}
-
-
-
-
-@router.get("/{collection_id}/calendar/api")
-def collection_calendar_api(request: Request, collection_id: int,
-                                  start: str = "", end: str = "",
-                                  date_property: str = ""):
-    """API (v5.8.0): expanded calendar events for a window [start, end].
-
-    Returns every occurrence (recurrence-aware, virtual — never persisted)
-    of the rows in the collection whose ``date_property`` falls inside the
-    inclusive window. Rows without a rule yield their base date.
-    """
-    user = _current_user(request)
-    s = parse_date(start)
-    e = parse_date(end)
-    if s is None or e is None or s > e:
-        raise HTTPException(status_code=400, detail="start/end must be YYYY-MM-DD")
-    if (e - s).days > 370:
-        raise HTTPException(status_code=400, detail="window too large (max 370 days)")
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        props = _collection_properties(conn, collection_id)
-        date_props = [p for p in props if p["prop_type"] == "date"]
-        target = None
-        if date_property:
-            target = next((p for p in date_props
-                           if str(p["id"]) == str(date_property) or p["name"] == date_property), None)
-            if target is None:
-                raise HTTPException(status_code=400, detail="Unknown date property")
-        elif date_props:
-            target = date_props[0]
-        if target is None:
-            return {"events": [], "timezone": "", "property": None}
-
-        urow = conn.execute("SELECT timezone FROM users WHERE id=?", (user.get("id") or 1,)).fetchone()
-        user_tz = (urow["timezone"] if urow and "timezone" in urow.keys() else "") or ""
-
-        rows = conn.execute(
-            "SELECT id, title, icon, property_values_json FROM collection_pages WHERE collection_id=?",
-            (collection_id,),
-        ).fetchall()
-
-    pid = str(target["id"])
-    events: list[dict] = []
-    for r in rows:
-        try:
-            pv = json.loads(r["property_values_json"] or "{}")
-        except (json.JSONDecodeError, TypeError):
-            continue
-        base_value = pv.get(pid)
-        if base_value is None:
-            base_value = pv.get(target["name"])
-        if parse_date(base_value) is None:
-            continue
-        rec_all = pv.get(RECURRENCE_KEY) if isinstance(pv.get(RECURRENCE_KEY), dict) else {}
-        rule = rec_all.get(pid) or rec_all.get(target["name"])
-        row_tz = user_tz
-        if isinstance(rule, dict) and rule.get("timezone"):
-            row_tz = rule["timezone"]
-        tzmap = pv.get("__timezone__")
-        if isinstance(tzmap, dict):
-            ev_tz = tzmap.get(pid) or tzmap.get(target["name"])
-            if ev_tz:
-                row_tz = str(ev_tz)
-        if rule:
-            dates = expand_rule(base_value, rule, s, e, max_occurrences=500)
-        else:
-            d = parse_date(base_value)
-            dates = [d.isoformat()] if d and s <= d <= e else []
-        for iso in dates:
-            events.append({
-                "date": iso,
-                "page_id": r["id"],
-                "title": r["title"],
-                "icon": r["icon"],
-                "recurring": bool(rule),
-                "time": str(base_value)[11:16] if len(str(base_value)) >= 16 else "",
-                "timezone": row_tz,
-            })
-    events.sort(key=lambda ev: (ev["date"], ev["page_id"]))
-    return {"events": events, "timezone": user_tz, "property": {"id": target["id"], "name": target["name"]}}
-
-
-
-
-@router.get("/timezones/api")
-def timezones_api(request: Request):
-    """API (v5.8.0): the user's timezone plus a picker-friendly zone list."""
-    user = _current_user(request)
-    with get_conn() as conn:
-        row = conn.execute("SELECT timezone FROM users WHERE id=?", (user.get("id") or 1,)).fetchone()
-    from app.services.recurrence import common_timezones
-    return {
-        "timezone": (row["timezone"] if row and "timezone" in row.keys() else "") or "",
-        "zones": common_timezones(),
-    }
@@ -1,184 +0,0 @@
-"""FlowDeck — Collections : pages.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.property_types import (
-    apply_auto_properties,
-)
-
-from ._common import (
-    _collection_properties,
-    _current_user,
-    _require_edit,
-    _require_view,
-    _session_user,
-    _validate_meta_keys,
-    _validate_page_properties,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── Page CRUD (standalone, BEFORE collection wildcards) ──
-
-
-@router.get("/pages/{page_id}/api")
-def get_page_api(request: Request, page_id: int):
-    """API: get a single page."""
-    with get_conn() as conn:
-        page = conn.execute(
-            "SELECT * FROM collection_pages WHERE id=?", (page_id,)
-        ).fetchone()
-        if not page:
-            raise HTTPException(status_code=404, detail="Page not found")
-    # v6.0.0: granular collection/page permissions.
-    _require_view(page["collection_id"], _session_user(request))
-    return dict(page)
-
-
-
-
-@router.get("/pages/{page_id}/open/api")
-def open_row_page_api(request: Request, page_id: int):
-    """v6.5.0 — content page of a database row (lazy-created).
-
-    Any DB view (table/board/gallery/list/calendar) opens a row through
-    this endpoint: it returns the shadow ``pages`` id whose full page
-    editor carries the row's block content (synced blocks included).
-    """
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT collection_id FROM collection_pages WHERE id=?",
-            (page_id,),
-        ).fetchone()
-        if not row:
-            raise HTTPException(status_code=404, detail="Page not found")
-        coll_id = row["collection_id"]
-    # v6.0.0: granular collection permissions (same gate as the row itself).
-    _require_view(coll_id, _session_user(request))
-    from app.services.row_pages import ensure_row_page
-    try:
-        content_page_id = ensure_row_page(page_id)
-    except KeyError:
-        raise HTTPException(status_code=404, detail="Page not found") from None
-    return {"page_id": content_page_id, "row_id": page_id}
-
-
-
-
-@router.put("/pages/{page_id}/api")
-def update_page_api(request: Request, page_id: int, body: dict = Body(default={})):
-    """API: update a page's properties."""
-
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collection_pages WHERE id=?", (page_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Page not found")
-        # v6.0.0: granular collection/page permissions.
-        _require_edit(existing["collection_id"], _session_user(request))
-
-        title = body.get("title", existing["title"])
-        icon = body.get("icon", existing["icon"])
-        cover_url = body.get("cover_url", existing["cover_url"] if "cover_url" in existing.keys() else "")
-        position = body.get("position", existing["position"])
-        parent_id = body.get("parent_id", existing["parent_id"])
-
-        try:
-            stored = json.loads(existing["property_values_json"])
-        except (json.JSONDecodeError, TypeError):
-            stored = {}
-
-        if "properties" in body:
-            # Partial PATCH semantics: merge submitted values over stored ones.
-            props = dict(stored)
-            props.update(body["properties"])
-        else:
-            props = stored
-
-        _validate_page_properties(conn, existing["collection_id"], props, exclude_page_id=page_id)
-        _validate_meta_keys(conn, existing["collection_id"], props)
-        apply_auto_properties(
-            _collection_properties(conn, existing["collection_id"]),
-            props,
-            _current_user(request),
-            is_create=False,
-        )
-
-        property_values = json.dumps(props)
-
-        conn.execute(
-            """UPDATE collection_pages
-               SET title=?, icon=?, cover_url=?, position=?, parent_id=?, property_values_json=?,
-                   updated_at=CURRENT_TIMESTAMP
-               WHERE id=?""",
-            (title, icon, cover_url, position, parent_id, property_values, page_id),
-        )
-        # v6.5.0: keep the row's content page title in sync (row → page).
-        from app.services.row_pages import sync_row_title_to_page
-        sync_row_title_to_page(conn, page_id)
-        conn.commit()
-
-    run_event_sync(fire_event("page.updated", {
-        "page_id": page_id,
-        "collection_id": existing["collection_id"],
-        "title": title,
-        "icon": icon,
-        "properties": props,
-    }))
-    run_event_sync(fire_event("collection.page.updated", {
-        "page_id": page_id,
-        "collection_id": existing["collection_id"],
-        "title": title,
-    }))
-    # Notify newly assigned people (person properties) — v5.8.0.
-    from app.services.notifications import notify_assignment
-    user = _current_user(request)
-    notify_assignment(existing["collection_id"], page_id, title,
-                      stored, props, user.get("id"))
-    return {"id": page_id, "status": "updated"}
-
-
-
-
-@router.delete("/pages/{page_id}/api")
-def delete_page_api(request: Request, page_id: int):
-    """API: delete a page from its collection."""
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collection_pages WHERE id=?", (page_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Page not found")
-        # v6.0.0: granular collection/page permissions.
-        _require_edit(existing["collection_id"], _session_user(request))
-
-        conn.execute("DELETE FROM collection_pages WHERE id=?", (page_id,))
-        conn.commit()
-
-    run_event_sync(fire_event("page.deleted", {
-        "page_id": page_id,
-        "collection_id": existing["collection_id"],
-        "title": existing["title"],
-    }))
-    run_event_sync(fire_event("collection.page.deleted", {
-        "page_id": page_id,
-        "collection_id": existing["collection_id"],
-    }))
-    return {"id": page_id, "status": "deleted"}
-
-
-# ── Gitea Board Compatibility (BEFORE {collection_id} wildcards) ──
@@ -1,322 +0,0 @@
-"""FlowDeck — Collections : properties.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-@router.post("/{collection_id}/property-groups/api")
-def set_property_groups_api(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: (re)assign properties to collapsible groups in the table header.
-
-    Body: ``{"groups": [{"name": "Basics", "property_ids": [1, 2]}]}``. Properties
-    omitted from any group have their group cleared. Empty group names clear.
-    """
-    groups = body.get("groups", [])
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        conn.execute(
-            "UPDATE collection_properties SET group_name='' WHERE collection_id=?",
-            (collection_id,),
-        )
-        for grp in groups:
-            gname = (grp.get("name") or "").strip()
-            if not gname:
-                continue
-            for pid in grp.get("property_ids", []) or []:
-                conn.execute(
-                    "UPDATE collection_properties SET group_name=? WHERE id=? AND collection_id=?",
-                    (gname, pid, collection_id),
-                )
-        conn.commit()
-
-    return {"status": "updated"}
-
-
-
-
-@router.post("/{collection_id}/properties/api")
-def create_property_api(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: create a new property on a collection."""
-
-    name = body.get("name", "").strip()
-    if not name:
-        raise HTTPException(status_code=400, detail="name is required")
-
-    prop_type = body.get("prop_type", "text")
-    options_json = json.dumps(body.get("options", []))
-    number_format = body.get("number_format", "number")
-    required = int(body.get("required", False))
-    visible = int(body.get("visible_in_views", True))
-    validation_json = json.dumps(body.get("validation", {}))
-    group_name = (body.get("group_name") or "").strip()
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_properties WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        try:
-            cur = conn.execute(
-                """INSERT INTO collection_properties
-                   (collection_id, name, prop_type, options_json, number_format,
-                    position, required, visible_in_views, validation_json, group_name)
-                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-                (collection_id, name, prop_type, options_json, number_format, max_pos,
-                 required, visible, validation_json, group_name),
-            )
-            conn.commit()
-        except Exception:
-            raise HTTPException(status_code=409, detail=f"Property '{name}' already exists") from None
-
-    return {"id": cur.lastrowid, "name": name, "prop_type": prop_type,
-            "group_name": group_name, "status": "created"}
-
-
-
-
-@router.put("/properties/{prop_id}/api")
-def update_property_api(request: Request, prop_id: int, body: dict = Body(default={})):
-    """API: update a property."""
-
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collection_properties WHERE id=?", (prop_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Property not found")
-
-        name = body.get("name", existing["name"])
-        options_json = json.dumps(body.get("options", json.loads(existing["options_json"])))
-        number_format = body.get("number_format", existing["number_format"])
-        required = int(body.get("required", existing["required"]))
-        visible = int(body.get("visible_in_views", existing["visible_in_views"]))
-        if "validation" in body:
-            validation_json = json.dumps(body.get("validation", {}))
-        else:
-            validation_json = existing["validation_json"] if "validation_json" in existing.keys() else "{}"
-        group_name = body.get("group_name", existing["group_name"] if "group_name" in existing.keys() else "")
-
-        conn.execute(
-            """UPDATE collection_properties
-               SET name=?, options_json=?, number_format=?, required=?, visible_in_views=?,
-                   validation_json=?, group_name=?
-               WHERE id=?""",
-            (name, options_json, number_format, required, visible, validation_json,
-             group_name, prop_id),
-        )
-        conn.commit()
-
-    return {"id": prop_id, "status": "updated"}
-
-
-
-
-@router.delete("/properties/{prop_id}/api")
-def delete_property_api(request: Request, prop_id: int):
-    """API: delete a property."""
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collection_properties WHERE id=?", (prop_id,)
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Property not found")
-        conn.execute("DELETE FROM collection_properties WHERE id=?", (prop_id,))
-        conn.commit()
-
-    return {"id": prop_id, "status": "deleted"}
-
-
-# ── Relations, Rollups, Formulas (v1.5.0) ──
-
-
-
-
-# ── Relations, Rollups, Formulas (v1.5.0) ──
-
-
-@router.post("/{collection_id}/properties/relation")
-def create_relation_property(request: Request, collection_id: int, body: dict = Body(default={})):
-    """Create a relation property between two collections."""
-
-    name = body.get("name", "").strip()
-    related_collection_id = body.get("related_collection_id")
-    reverse_name = body.get("reverse_name", "").strip()
-
-    if not name or not related_collection_id:
-        raise HTTPException(status_code=400, detail="name and related_collection_id are required")
-
-    with get_conn() as conn:
-        # Verify both collections exist
-        for cid in (collection_id, related_collection_id):
-            if not conn.execute("SELECT id FROM collections WHERE id=?", (cid,)).fetchone():
-                raise HTTPException(status_code=404, detail=f"Collection {cid} not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_properties WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        cur = conn.execute(
-            """INSERT INTO collection_properties
-               (collection_id, name, prop_type, related_collection_id, reverse_name, position)
-               VALUES (?, ?, 'relation', ?, ?, ?)""",
-            (collection_id, name, related_collection_id, reverse_name, max_pos),
-        )
-        prop_id = cur.lastrowid
-
-        # Create reverse relation on the related collection
-        if reverse_name:
-            max_pos2 = conn.execute(
-                "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_properties WHERE collection_id=?",
-                (related_collection_id,),
-            ).fetchone()[0]
-            conn.execute(
-                """INSERT INTO collection_properties
-                   (collection_id, name, prop_type, related_collection_id, reverse_name, position)
-                   VALUES (?, ?, 'relation', ?, ?, ?)""",
-                (related_collection_id, reverse_name, collection_id, name, max_pos2),
-            )
-
-        conn.commit()
-
-    return {"id": prop_id, "name": name, "prop_type": "relation", "status": "created"}
-
-
-
-
-@router.post("/{collection_id}/properties/relation/link")
-def link_pages(request: Request, collection_id: int, body: dict = Body(default={})):
-    """Link two pages via a relation property."""
-
-    property_id = body.get("property_id")
-    source_page_id = body.get("source_page_id")
-    target_page_id = body.get("target_page_id")
-
-    if not all([property_id, source_page_id, target_page_id]):
-        raise HTTPException(status_code=400, detail="property_id, source_page_id, target_page_id required")
-
-    with get_conn() as conn:
-        # Get the relation property
-        prop = conn.execute(
-            "SELECT * FROM collection_properties WHERE id=? AND prop_type='relation'",
-            (property_id,),
-        ).fetchone()
-        if not prop:
-            raise HTTPException(status_code=404, detail="Relation property not found")
-
-        # Update source page's property_values_json
-        source = conn.execute(
-            "SELECT property_values_json FROM collection_pages WHERE id=?",
-            (source_page_id,),
-        ).fetchone()
-        if not source:
-            raise HTTPException(status_code=404, detail="Source page not found")
-
-        props = json.loads(source["property_values_json"])
-        current = props.get(str(property_id), [])
-        if not isinstance(current, list):
-            current = []
-        if target_page_id not in current:
-            current.append(target_page_id)
-        props[str(property_id)] = current
-
-        conn.execute(
-            "UPDATE collection_pages SET property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (json.dumps(props), source_page_id),
-        )
-
-        # Update reverse relation if exists
-        if prop["reverse_name"]:
-            reverse_prop = conn.execute(
-                "SELECT id FROM collection_properties WHERE collection_id=? AND name=? AND prop_type='relation'",
-                (prop["related_collection_id"], prop["reverse_name"]),
-            ).fetchone()
-            if reverse_prop:
-                target = conn.execute(
-                    "SELECT property_values_json FROM collection_pages WHERE id=?",
-                    (target_page_id,),
-                ).fetchone()
-                if target:
-                    tprops = json.loads(target["property_values_json"])
-                    tcurrent = tprops.get(str(reverse_prop["id"]), [])
-                    if not isinstance(tcurrent, list):
-                        tcurrent = []
-                    if source_page_id not in tcurrent:
-                        tcurrent.append(source_page_id)
-                    tprops[str(reverse_prop["id"])] = tcurrent
-                    conn.execute(
-                        "UPDATE collection_pages SET property_values_json=? WHERE id=?",
-                        (json.dumps(tprops), target_page_id),
-                    )
-
-        conn.commit()
-
-    return {"status": "linked", "source": source_page_id, "target": target_page_id}
-
-
-
-
-@router.post("/rollup/compute")
-def compute_rollup(request: Request, body: dict = Body(default={})):
-    """Compute a rollup aggregation."""
-
-    collection_id = body.get("collection_id")
-    relation_property_id = body.get("relation_property_id")
-    target_property_id = body.get("target_property_id")
-    page_id = body.get("page_id")
-    rollup_function = body.get("function", "count")
-
-    if not all([collection_id, relation_property_id, target_property_id, page_id]):
-        raise HTTPException(status_code=400, detail="collection_id, relation_property_id, target_property_id, page_id required")
-
-    from app.services.rollup_engine import RollupEngine
-    engine = RollupEngine()
-    result = engine.compute(
-        collection_id, relation_property_id, target_property_id, page_id, rollup_function,
-    )
-
-    return {"result": result, "function": rollup_function}
-
-
-
-
-@router.post("/formula/evaluate")
-def evaluate_formula(request: Request, body: dict = Body(default={})):
-    """Evaluate a formula expression."""
-
-    expression = body.get("expression", "")
-    context = body.get("context", {})
-
-    if not expression:
-        raise HTTPException(status_code=400, detail="expression is required")
-
-    from app.services.formula_engine import FormulaEngine
-    engine = FormulaEngine()
-    result = engine.evaluate(expression, context)
-
-    return {"result": result, "expression": expression}
-
-
-# ── v1.7.0 View Management ──
@@ -1,267 +0,0 @@
-"""FlowDeck — Collections : structure.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-import sqlite3
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-from app.services.property_types import (
-    apply_auto_properties,
-)
-
-from ._common import _collection_properties, _current_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── v1.8.0 Sub-items & Dependencies ──
-
-
-@router.get("/{collection_id}/pages/{page_id}/sub-items")
-def list_sub_items(request: Request, collection_id: int, page_id: int):
-    """API: list sub-items of a page."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT * FROM collection_pages WHERE parent_id=? ORDER BY position",
-            (page_id,),
-        ).fetchall()
-    return {"sub_items": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/{collection_id}/pages/{page_id}/sub-items")
-def create_sub_item(request: Request, collection_id: int, page_id: int, body: dict = Body(default={})):
-    """API: create a sub-item under a page."""
-
-    title = body.get("title", "New sub-item").strip()
-    if not title:
-        raise HTTPException(status_code=400, detail="title is required")
-
-    with get_conn() as conn:
-        parent = conn.execute("SELECT id FROM collection_pages WHERE id=? AND collection_id=?", (page_id, collection_id)).fetchone()
-        if not parent:
-            raise HTTPException(status_code=404, detail="Parent page not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE parent_id=?",
-            (page_id,),
-        ).fetchone()[0]
-
-        sub_props = body.get("properties", {}) or {}
-        apply_auto_properties(
-            _collection_properties(conn, collection_id),
-            sub_props,
-            _current_user(request),
-            is_create=True,
-        )
-
-        cur = conn.execute(
-            "INSERT INTO collection_pages (collection_id, title, parent_id, position, property_values_json) VALUES (?, ?, ?, ?, ?)",
-            (collection_id, title, page_id, max_pos, json.dumps(sub_props)),
-        )
-        conn.commit()
-        new_id = cur.lastrowid
-
-    run_event_sync(fire_event("page.created", {
-        "page_id": new_id,
-        "collection_id": collection_id,
-        "parent_id": page_id,
-        "title": title,
-        "properties": body.get("properties", {}),
-    }))
-    run_event_sync(fire_event("collection.page.created", {
-        "page_id": new_id,
-        "collection_id": collection_id,
-        "title": title,
-    }))
-    return {"id": new_id, "title": title, "parent_id": page_id, "status": "created"}
-
-
-
-
-@router.get("/{collection_id}/pages/{page_id}/status-aggregate")
-def aggregate_child_status(request: Request, collection_id: int, page_id: int):
-    """API: compute aggregate status from children."""
-    with get_conn() as conn:
-        children = conn.execute(
-            "SELECT property_values_json FROM collection_pages WHERE parent_id=?",
-            (page_id,),
-        ).fetchall()
-
-    statuses = []
-    for c in children:
-        props = json.loads(c["property_values_json"])
-        for v in props.values():
-            if isinstance(v, str) and v:
-                statuses.append(v)
-
-    total = len(statuses)
-    if total == 0:
-        return {"total": 0, "done": 0, "all_done": False}
-
-    done = sum(1 for s in statuses if s.lower() in ("done", "complete", "completed", "terminé"))
-    return {"total": total, "done": done, "all_done": done == total}
-
-
-
-
-@router.post("/{collection_id}/pages/{page_id}/dependencies")
-def set_dependencies(request: Request, collection_id: int, page_id: int, body: dict = Body(default={})):
-    """API: set blocking dependencies for a page (stored as 'blocks' property)."""
-
-    blocks_ids = body.get("blocks", [])
-
-    with get_conn() as conn:
-        page = conn.execute("SELECT property_values_json FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(status_code=404, detail="Page not found")
-
-        props = json.loads(page["property_values_json"])
-        props["blocks"] = blocks_ids
-
-        conn.execute(
-            "UPDATE collection_pages SET property_values_json=? WHERE id=?",
-            (json.dumps(props), page_id),
-        )
-        conn.commit()
-
-    return {"page_id": page_id, "blocks": blocks_ids, "status": "updated"}
-
-
-
-
-@router.post("/{collection_id}/pages/{page_id}/check-deps")
-def check_dependencies(request: Request, collection_id: int, page_id: int, body: dict = Body(default={})):
-    """API: check if a page can transition to a new status."""
-
-    body.get("new_status", "Done")
-
-    with get_conn() as conn:
-        page = conn.execute("SELECT property_values_json FROM collection_pages WHERE id=?", (page_id,)).fetchone()
-        if not page:
-            raise HTTPException(status_code=404, detail="Page not found")
-
-        props = json.loads(page["property_values_json"])
-        blocks_ids = props.get("blocks", [])
-
-        if not blocks_ids:
-            return {"can_transition": True, "blocked_by": []}
-
-        # Check blocked pages status
-        placeholders = ",".join("?" for _ in blocks_ids)
-        blocked = conn.execute(
-            f"SELECT id, title, property_values_json FROM collection_pages WHERE id IN ({placeholders})",
-            blocks_ids,
-        ).fetchall()
-
-        blockers = []
-        for b in blocked:
-            bprops = json.loads(b["property_values_json"])
-            bstatus = None
-            for v in bprops.values():
-                if isinstance(v, str) and v:
-                    bstatus = v
-                    break
-            if bstatus and bstatus.lower() not in ("done", "complete", "completed", "terminé"):
-                blockers.append({"id": b["id"], "title": b["title"], "status": bstatus})
-
-        return {
-            "can_transition": len(blockers) == 0,
-            "blocked_by": blockers,
-        }
-
-
-# ── v4.1.0: Data Sources & Linked Databases ──
-
-
-
-
-# ── v4.1.0: Data Sources & Linked Databases ──
-
-
-@router.get("/{collection_id}/sources/api")
-def list_data_sources(request: Request, collection_id: int):
-    """API: list all data sources for a collection."""
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        rows = conn.execute(
-            "SELECT * FROM collection_data_sources WHERE collection_id=? ORDER BY position",
-            (collection_id,),
-        ).fetchall()
-    return {"sources": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/{collection_id}/sources/api")
-def add_data_source(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: add a data source to a collection."""
-
-    source_collection_id = body.get("source_collection_id")
-    if not source_collection_id:
-        raise HTTPException(status_code=400, detail="source_collection_id is required")
-
-    source_name = body.get("source_name", "").strip()
-    is_linked = body.get("is_linked", False)
-
-    with get_conn() as conn:
-        # Verify both collections exist
-        for cid in (collection_id, source_collection_id):
-            if not conn.execute("SELECT id FROM collections WHERE id=?", (cid,)).fetchone():
-                raise HTTPException(status_code=404, detail=f"Collection {cid} not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_data_sources WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        try:
-            cur = conn.execute(
-                """INSERT INTO collection_data_sources
-                   (collection_id, source_collection_id, source_name, is_linked, position)
-                   VALUES (?, ?, ?, ?, ?)""",
-                (collection_id, source_collection_id, source_name, int(is_linked), max_pos),
-            )
-            conn.commit()
-        except sqlite3.IntegrityError:
-            raise HTTPException(status_code=409, detail="This data source already exists in this collection") from None
-
-    return {
-        "id": cur.lastrowid,
-        "collection_id": collection_id,
-        "source_collection_id": source_collection_id,
-        "status": "added",
-    }
-
-
-
-
-@router.delete("/{collection_id}/sources/{source_id}/api")
-def remove_data_source(request: Request, collection_id: int, source_id: int):
-    """API: remove a data source from a collection."""
-    with get_conn() as conn:
-        existing = conn.execute(
-            "SELECT * FROM collection_data_sources WHERE id=? AND collection_id=?",
-            (source_id, collection_id),
-        ).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="Data source not found")
-
-        conn.execute("DELETE FROM collection_data_sources WHERE id=?", (source_id,))
-        conn.commit()
-
-    return {"id": source_id, "status": "removed"}
@@ -1,270 +0,0 @@
-"""FlowDeck — Collections : « base de tâches » (My Tasks façon Notion).
-
-Unlike Notion — where any base can be added to the dashboard widget from
-scratch — a base doit **explicitement** alimenter My Tasks :
-``POST /db/{id}/task-db`` bascule ``collections.is_task`` et enregistre le
-mapping des trois propriétés requises (Assigné à / Statut / Échéance).
-Tant que le mapping est incomplet, la base est connectée mais **n'émet
-aucune tâche** (`task_databases.collect_tasks` la saute) — l'UI le signale
-plutôt que de deviner une colonne.
-
-Limite : 10 bases connectées au tableau de bord (`MAX_TASK_SOURCES`).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.task_databases import (
-    MAX_TASK_SOURCES,
-    ROLE_LABELS,
-    ROLE_TYPES,
-    TASK_ROLES,
-    list_task_sources,
-    source_state,
-)
-
-from ._common import _require_edit, _session_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-#: Trio de statuts amorcé quand une colonne Statut est créée à la conversion.
-DEFAULT_STATUS_OPTIONS = [
-    {"name": "À faire", "color": "gray"},
-    {"name": "En cours", "color": "blue"},
-    {"name": "Terminée", "color": "green"},
-]
-
-
-def _user_id(request: Request) -> int:
-    """ID de l'appelant — session obligatoire.
-
-    `_current_user` retombe sur l'admin (id 1) en cas d'absence de session :
-   wrong pour une route qui liste *les bases de l'utilisateur* (un anonyme
-    verrait le tableau de bord de l'admin). On passe donc par `_session_user`.
-    """
-    user = _session_user(request)
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user["id"]
-
-
-@router.get("/task-dbs/api")
-def list_connected_task_databases(request: Request):
-    """Bases de tâches connectées au tableau de bord My Tasks."""
-    uid = _user_id(request)
-    with get_conn() as conn:
-        sources = list_task_sources(conn, uid)
-    return {
-        "sources": [
-            {k: s[k] for k in (
-                "id", "name", "icon", "workspace_id", "workspace_name",
-                "configured", "missing_roles", "status_options",
-            )}
-            for s in sources
-        ],
-        "total": len(sources),
-        "max_sources": MAX_TASK_SOURCES,
-        "limit_reached": len(sources) >= MAX_TASK_SOURCES,
-    }
-
-
-@router.get("/{collection_id}/task-db/api")
-def get_task_db_state(request: Request, collection_id: int):
-    """État de conversion + colonnes candidates pour la modale."""
-    _require_edit(collection_id, _session_user(request))
-    with get_conn() as conn:
-        state = source_state(conn, collection_id)
-    if not state["exists"]:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    return state
-
-
-@router.post("/{collection_id}/task-db/api")
-def enable_task_db(request: Request, collection_id: int, body: dict = Body(default={})):
-    """Convertit la base en base de tâches (mapping explicite des 3 rôles).
-
-    ``mapping`` : ``{"assignee": <prop_id>, "status": …, "due": …}``.
-    ``create_missing`` : ``{"status": {"name": "Statut", "options": [...]}}``
-    pour qu'une colonne absente soit créée dans la transaction.
-    """
-    _require_edit(collection_id, _session_user(request))
-
-    with get_conn() as conn:
-        state = enable_task_db_in_conn(
-            conn,
-            collection_id,
-            mapping=body.get("mapping") or {},
-            create_missing=body.get("create_missing") or {},
-        )
-
-    return {"status": "enabled", "collection_id": collection_id,
-            "mapping": state["mapping"], "configured": state["configured"]}
-
-
-def enable_task_db_in_conn(conn, collection_id: int, *, mapping: dict | None = None,
-                           create_missing: dict | None = None) -> dict:
-    """Active ``is_task`` et enregistre le mapping — dans la transaction
-    appelante.
-
-    Point d'entrée unique de la conversion : la route `/task-db/api` comme
-    l'ancien `PUT /db/{id}/toggle-task/api` (qui aurait sinon laissé une base
-    « connectée » sans aucune colonne liée, donc muette).
-    """
-    state = source_state(conn, collection_id)
-    if not state["exists"]:
-        raise HTTPException(status_code=404, detail="Collection not found")
-
-    # ── Limite de sources (on recompte : la base elle-même peut déjà être
-    #    connectée, auquel cas on ne la compte pas deux fois).
-    if not state["is_task"] and state["sources_count"] >= MAX_TASK_SOURCES:
-        raise HTTPException(
-            status_code=409,
-            detail=(
-                f"Limite de {MAX_TASK_SOURCES} bases de tâches atteinte. "
-                "Déconnectez une base avant d'en ajouter une autre."
-            ),
-        )
-
-    # ── Création des colonnes manquantes ──
-    create_missing = create_missing or {}
-    mapping = dict(mapping or {})
-    by_name = {p["name"]: p for p in state["all_properties"]}
-    for role in TASK_ROLES:
-        if mapping.get(role):
-            continue
-        spec = create_missing.get(role) or {}
-        name = (spec.get("name") or ROLE_LABELS[role]).strip()
-        prop_type = spec.get("prop_type") or ROLE_TYPES[role][0]
-        if prop_type not in ROLE_TYPES[role]:
-            raise HTTPException(
-                status_code=400,
-                detail=f"Type '{prop_type}' incompatible avec le rôle '{role}'",
-            )
-        if name in by_name:
-            # La colonne existe déjà (nom saisi) → on la lie.
-            mapping[role] = by_name[name]["id"]
-            continue
-        created = _create_property(conn, collection_id, name, prop_type,
-                                   spec.get("options"))
-        mapping[role] = created["id"]
-
-    # ── Validation : les 3 rôles pointent une colonne de la bonne base ──
-    props = {
-        p["id"]: p
-        for p in conn.execute(
-            "SELECT id, name, prop_type FROM collection_properties WHERE collection_id=?",
-            (collection_id,),
-        ).fetchall()
-    }
-    seen: dict[int, str] = {}
-    for role in TASK_ROLES:
-        prop_id = mapping.get(role)
-        if not prop_id:
-            raise HTTPException(
-                status_code=400,
-                detail=f"Colonne « {ROLE_LABELS[role]} » manquante",
-            )
-        try:
-            prop_id = int(prop_id)
-        except (TypeError, ValueError):
-            raise HTTPException(status_code=400,
-                                detail="Identifiant de propriété invalide") from None
-        prop = props.get(prop_id)
-        if prop is None:
-            raise HTTPException(
-                status_code=400,
-                detail=f"« {ROLE_LABELS[role]} » n'appartient pas à cette base",
-            )
-        if prop["prop_type"] not in ROLE_TYPES[role]:
-            raise HTTPException(
-                status_code=400,
-                detail=(
-                    f"« {prop['name']} » est de type {prop['prop_type']}, "
-                    f"incompatible avec « {ROLE_LABELS[role]} »"
-                ),
-            )
-        if prop_id in seen:
-            raise HTTPException(
-                status_code=400,
-                detail=f"« {prop['name']} » est déjà utilisé pour « {seen[prop_id]} »",
-            )
-        seen[prop_id] = ROLE_LABELS[role]
-        mapping[role] = prop_id
-
-    conn.execute(
-        """UPDATE collections
-              SET is_task = 1,
-                  task_assignee_prop = ?, task_status_prop = ?, task_due_prop = ?,
-                  updated_at = CURRENT_TIMESTAMP
-            WHERE id = ?""",
-        (mapping["assignee"], mapping["status"], mapping["due"], collection_id),
-    )
-    conn.commit()
-    return source_state(conn, collection_id)
-
-
-@router.delete("/{collection_id}/task-db/api")
-def disable_task_db(request: Request, collection_id: int):
-    """Déconnecte la base du tableau de bord (les tâches sont conservées)."""
-    _require_edit(collection_id, _session_user(request))
-    with get_conn() as conn:
-        disable_task_db_in_conn(conn, collection_id)
-    return {"status": "disabled", "collection_id": collection_id}
-
-
-def disable_task_db_in_conn(conn, collection_id: int) -> None:
-    """Déconnexion dans la transaction appelante : efface aussi le mapping,
-    pour ne pas laisser des identifiants de colonnes mortes."""
-    row = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-    if row is None:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    conn.execute(
-        """UPDATE collections
-              SET is_task = 0, task_assignee_prop = NULL, task_status_prop = NULL,
-                  task_due_prop = NULL, updated_at = CURRENT_TIMESTAMP
-            WHERE id = ?""",
-        (collection_id,),
-    )
-    conn.commit()
-
-
-def _create_property(conn, collection_id: int, name: str, prop_type: str,
-                     options=None) -> dict:
-    """Crée une propriété (à la position suivante) et la renvoie.
-
-    Une colonne Statut amorcée sans options reçoit le trio classique
-    « À faire / En cours / Terminée » : sans options, le Kanban n'aurait
-    aucune colonne à afficher.
-    """
-    import json
-
-    row = conn.execute(
-        "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_properties "
-        "WHERE collection_id = ?",
-        (collection_id,),
-    ).fetchone()
-    position = row[0] if row else 0
-
-    opts = []
-    for opt in options or []:
-        if isinstance(opt, str):
-            opts.append({"name": opt, "color": "gray"})
-        elif isinstance(opt, dict) and opt.get("name"):
-            opts.append({"name": opt["name"], "color": opt.get("color") or "gray"})
-    if not opts and prop_type in ("status", "select"):
-        opts = list(DEFAULT_STATUS_OPTIONS)
-
-    cur = conn.execute(
-        """INSERT INTO collection_properties
-           (collection_id, name, prop_type, options_json, position, required,
-            visible_in_views)
-           VALUES (?, ?, ?, ?, ?, 0, 1)""",
-        (collection_id, name, prop_type, json.dumps(opts), position),
-    )
-    prop_id = cur.lastrowid
-    conn.commit()
-    return {"id": prop_id, "name": name, "prop_type": prop_type}
@@ -1,187 +0,0 @@
-"""FlowDeck — Collections : views.
-
-Découpe A28 de l'ancien app/routers/collections.py (2 622 lignes, 53 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-from app.services.automations import fire_event, run_event_sync
-
-from ._common import _current_user
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["collections"], prefix="/db")
-
-
-
-
-# ── v1.7.0 View Management ──
-
-
-@router.get("/views/{view_id}/api")
-def get_view_api(request: Request, view_id: int):
-    """API: get a single view config."""
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not row:
-            raise HTTPException(status_code=404, detail="View not found")
-    return dict(row)
-
-
-
-
-@router.put("/views/{view_id}/config")
-def update_view_config(request: Request, view_id: int, body: dict = Body(default={})):
-    """API: update view configuration (group_by, card_size, visible_properties, etc.)."""
-
-    with get_conn() as conn:
-        existing = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="View not found")
-
-        config = json.loads(existing["config_json"])
-        for key in ("group_by", "sub_group_by", "wip_limits", "card_size", "cover_property",
-                    "cover_mode", "card_properties", "visible_properties", "filters", "sorts",
-                    "filter_conjunction", "date_property", "date_range_property",
-                    "property_groups", "view_type"):
-            if key in body:
-                config[key] = body[key]
-
-        new_type = body.get("view_type") or existing["view_type"]
-        conn.execute(
-            "UPDATE collection_views SET config_json=?, name=COALESCE(?, name), view_type=?, "
-            "updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (json.dumps(config), body.get("name"), new_type, view_id),
-        )
-        conn.commit()
-
-    return {"id": view_id, "status": "updated", "config": config, "view_type": new_type}
-
-
-
-
-@router.post("/{collection_id}/views/save-as")
-def save_view_as(request: Request, collection_id: int, body: dict = Body(default={})):
-    """API: save current view state as a new named view."""
-
-    name = body.get("name", "New View")
-    config = body.get("config", {})
-    user = _current_user(request)
-    user_id = user.get("id") if user else None
-
-    with get_conn() as conn:
-        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
-        if not coll:
-            raise HTTPException(status_code=404, detail="Collection not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_views WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        view_type = body.get("view_type", "table")
-        cur = conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json, position, created_by)
-               VALUES (?, ?, ?, ?, ?, ?)""",
-            (collection_id, name, view_type, json.dumps(config), max_pos, user_id),
-        )
-        conn.commit()
-        new_view_id = cur.lastrowid
-
-    run_event_sync(fire_event("collection.view.created", {
-        "view_id": new_view_id,
-        "collection_id": collection_id,
-        "name": name,
-        "view_type": view_type,
-    }))
-    return {"id": new_view_id, "name": name, "view_type": view_type,
-            "config_json": json.dumps(config), "created_by": user_id, "status": "saved"}
-
-
-
-
-@router.get("/{collection_id}/views/api")
-def list_views_api(request: Request, collection_id: int):
-    """API: list views for a collection visible to the current user.
-
-    Shared/legacy views (``created_by IS NULL``) are visible to everyone;
-    personal views (``created_by = user``) only to their owner.
-    """
-    user = _current_user(request)
-    user_id = user.get("id") if user else None
-    with get_conn() as conn:
-        if user_id is not None:
-            rows = conn.execute(
-                """SELECT * FROM collection_views
-                   WHERE collection_id=? AND (created_by IS NULL OR created_by=?)
-                   ORDER BY position""",
-                (collection_id, user_id),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT * FROM collection_views WHERE collection_id=? AND created_by IS NULL ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-    return {"views": [dict(r) for r in rows]}
-
-
-
-
-@router.delete("/views/{view_id}/api")
-def delete_view_api(request: Request, view_id: int):
-    """API: delete a saved view."""
-    with get_conn() as conn:
-        existing = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="View not found")
-        conn.execute("DELETE FROM collection_views WHERE id=?", (view_id,))
-        conn.commit()
-    return {"id": view_id, "status": "deleted"}
-
-
-
-
-@router.post("/views/{view_id}/duplicate")
-def duplicate_view_api(request: Request, view_id: int, body: dict = Body(default={})):
-    """API: duplicate a view (config + type), owned by the current user."""
-
-    with get_conn() as conn:
-        existing = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
-        if not existing:
-            raise HTTPException(status_code=404, detail="View not found")
-
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_views WHERE collection_id=?",
-            (existing["collection_id"],),
-        ).fetchone()[0]
-
-        user = _current_user(request)
-        user_id = user.get("id") if user else None
-        name = body.get("name") or (existing["name"] + " copy")
-        cur = conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json, position, created_by)
-               VALUES (?, ?, ?, ?, ?, ?)""",
-            (existing["collection_id"], name, existing["view_type"],
-             existing["config_json"], max_pos, user_id),
-        )
-        conn.commit()
-        dup_view_id = cur.lastrowid
-
-    run_event_sync(fire_event("collection.view.created", {
-        "view_id": dup_view_id,
-        "collection_id": existing["collection_id"],
-        "name": name,
-        "view_type": existing["view_type"],
-    }))
-    return {"id": dup_view_id, "name": name, "view_type": existing["view_type"],
-            "status": "duplicated"}
-
-
-# ── v1.8.0 Sub-items & Dependencies ──
@@ -1,77 +0,0 @@
-"""FlowDeck — Dashboard (pages HTML + API de l'app).
-
-Découpe A28 : l'ancien `dashboard.py` (2 735 lignes, 63 routes) est
-devenu ce package — un module par concern, helpers dans `_common`,
-re-export de tout ce que les 7 importateurs existants utilisent
-(main, board, my_tasks, web_clipper, wiki, sites, tests).
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter
-
-from . import (  # ordre = ordre d'enregistrement d'origine (openapi identique)
-    account_api,
-    account_settings,
-    local_workspace,
-    pages_api,
-    pages_html,
-    public,
-    workspace,
-    workspaces,
-)
-from ._common import (  # noqa: F401 — re-export des helpers
-    _VERSION,
-    WORKSPACE_COOKIE,
-    _build_breadcrumb,
-    _build_tree_children,
-    _file_page_disk_path,
-    _format_size,
-    _get_active_workspace,
-    _get_app_version,
-    _get_user_id,
-    _get_user_or_redirect,
-    _local_workspaces_for_user,
-    _nav_breadcrumb,
-    _render_blocks_public,
-    _require_page_view,
-    _require_user_id,
-    _sanitize_id,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter()
-for _mod in (
-    pages_html,
-    account_api,
-    workspace,
-    local_workspace,
-    workspaces,
-    account_settings,
-    public,
-    pages_api,
-):
-    router.include_router(_mod.router)
-
-__all__ = [
-    "router",
-    "WORKSPACE_COOKIE",
-    "_VERSION",
-    "_build_breadcrumb",
-    "_build_tree_children",
-    "_file_page_disk_path",
-    "_format_size",
-    "_get_active_workspace",
-    "_get_app_version",
-    "_get_user_id",
-    "_get_user_or_redirect",
-    "_local_workspaces_for_user",
-    "_nav_breadcrumb",
-    "_render_blocks_public",
-    "_require_page_view",
-    "_require_user_id",
-    "_sanitize_id",
-    "_sidebar_data",
-]
@@ -1,780 +0,0 @@
-"""FlowDeck — Dashboard : helpers partagés des modules de routes (A28).
-
-Les 15 helpers top-level de l'ancien dashboard.py vivent ici (état :
-_VERSION, WORKSPACE_COOKIE) — ré-exportés par le package.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import HTTPException, Request
-from fastapi.responses import RedirectResponse
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-
-_VERSION = None
-
-WORKSPACE_COOKIE = "flowdeck_workspace"
-
-
-
-def _get_app_version() -> str:
-    """Read version from VERSION file with caching."""
-    global _VERSION
-    if _VERSION is not None:
-        return _VERSION
-    try:
-        import os
-        version_path = os.path.join(os.path.dirname(__file__), "..", "..", "VERSION")
-        if os.path.exists(version_path):
-            with open(version_path) as f:
-                _VERSION = f.read().strip()
-        else:
-            # Docker fallback
-            version_path = "/app/VERSION"
-            if os.path.exists(version_path):
-                with open(version_path) as f:
-                    _VERSION = f.read().strip()
-            else:
-                _VERSION = "0.0.0"
-    except Exception:
-        _VERSION = "0.0.0"
-    return _VERSION
-
-
-
-
-
-
-def _get_user_or_redirect(request: Request):
-    """Return decoded user or a RedirectResponse to login page.
-    Skips redirect when DB has no users (fresh install / test env)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        # Allow through if no users exist yet (fresh install / tests)
-        try:
-            with get_conn() as conn:
-                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-                if count == 0:
-                    return {"id": 1, "login": "admin", "full_name": "Admin", "is_admin": True}
-        except Exception:
-            logger.exception("_get_user_or_redirect")
-        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
-    return user
-
-
-
-
-
-
-def _local_workspaces_for_user(user: dict | None, workspace_id: int = 0) -> list[dict]:
-    """Return list of local workspaces for a user."""
-    if not user:
-        return []
-    try:
-        with get_conn() as conn:
-            rows = conn.execute(
-                "SELECT id, name FROM workspaces WHERE owner_id = ? ORDER BY name",
-                (user["id"],)
-            ).fetchall()
-            return [{"id": r["id"], "name": r["name"]} for r in rows]
-    except Exception:
-        return []
-
-
-
-
-
-
-def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool = True) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    ws = user.get("login", "Bruno") if user else "Bruno"
-    initial = ws[0].upper() if ws else "B"
-
-    # Get avatar info from DB
-    avatar_url = ""
-    avatar_color = "#3A3A3A"
-    if user:
-        try:
-            with get_conn() as conn:
-                row = conn.execute("SELECT avatar_url, avatar_color FROM users WHERE id = ?", (user["id"],)).fetchone()
-                if row:
-                    avatar_url = row["avatar_url"] or ""
-                    avatar_color = row["avatar_color"] or "#3A3A3A"
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    recent_pages = []
-    for repo in repos[:10]:
-        full_name = repo.get("full_name", "")
-        recent_pages.append({
-            "id": full_name,
-            "name": repo.get("name", full_name),
-            "icon": "folder",
-            "url": f"/board/{full_name}",
-            "active": False,
-            "indent": 0,
-            "depth": 0,
-            "has_children": False,
-            "children": [],
-        })
-
-    # Active workspace from cookie (skip on pages like /workspaces where no
-    # workspace context should be shown)
-    from app.routers.board import _load_workspace_pages
-    ws_cookie = request.cookies.get("flowdeck_workspace", "")
-    active_ws_name = "Workspace"
-    workspace_pages = []
-    gitea_workspace = False
-    gitea_owner = ""
-    gitea_repo = ""
-    has_active_workspace = False
-    local_ws_id = 0
-
-    if ws_cookie and ws_cookie.startswith("gitea:"):
-        # Gitea workspace: set owner/repo for client-side tree loading
-        # AND open the local workspace mirror of the same name in the
-        # sidebar's top "My Workspaces" section, in parallel with the
-        # Gitea repository tree.
-        parts = ws_cookie.split(":", 2)
-        if len(parts) >= 3:
-            gitea_owner = parts[1]
-            gitea_repo = parts[2]
-            active_ws_name = f"{gitea_owner}/{gitea_repo}"
-            gitea_workspace = True
-            has_active_workspace = True
-            # Load the local mirror workspace tree so it appears in "My
-            # Workspaces" alongside the Gitea repository section.
-            if user:
-                try:
-                    with get_conn() as conn:
-                        row = conn.execute(
-                            "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                            (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
-                        ).fetchone()
-                        if row:
-                            local_ws_id = row["id"]
-                            workspace_pages = _load_workspace_pages(str(local_ws_id))
-                except (ValueError, Exception):
-                    pass
-    elif include_workspace and ws_cookie and user:
-        try:
-            wsi = int(ws_cookie)
-            with get_conn() as conn:
-                # Verify this workspace belongs to the current user
-                row = conn.execute(
-                    "SELECT id, name, owner_id FROM workspaces WHERE id=? AND owner_id=?",
-                    (wsi, user["id"])
-                ).fetchone()
-                if row:
-                    active_ws_name = row["name"]
-                    workspace_pages = _load_workspace_pages(ws_cookie)
-                    has_active_workspace = True
-                    # v7.46.0 : exposer l'ID de l'espace ACTIF. Avant, le sidebar
-                    # ne fournissait que son nom et le bouton Home de la sidebar
-                    # retombait sur ``local_workspaces[0]`` (premier espace TRIE
-                    # PAR NOM) → clic sur Home = changement d'espace surprise.
-                    local_ws_id = wsi
-                # else: stale cookie from another user — ignore
-        except (ValueError, Exception):
-            pass
-
-    # Auth method & OAuth badge data
-    auth_method = "local"
-    gitea_linked = False
-    github_linked = False
-    if user and user.get("id"):
-        try:
-            with get_conn() as conn:
-                am_row = conn.execute("SELECT auth_method FROM users WHERE id=?", (user["id"],)).fetchone()
-                if am_row and am_row["auth_method"]:
-                    auth_method = am_row["auth_method"]
-                tokens = conn.execute(
-                    "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
-                ).fetchall()
-                for t in tokens:
-                    if t["provider"] == "gitea":
-                        gitea_linked = True
-                    elif t["provider"] == "github":
-                        github_linked = True
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Get local workspace ID for Gitea workspace mirror (le miroir Gitea est un
-    # espace DISTINCT : on ne doit pas écraser ``local_ws_id`` (espace actif).
-    gitea_mirror_ws_id = 0
-    if gitea_workspace and gitea_owner and gitea_repo:
-        try:
-            with get_conn() as conn:
-                row = conn.execute(
-                    "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                    (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
-                ).fetchone()
-                if row:
-                    gitea_mirror_ws_id = row["id"]
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Private pages for mirror workspace (when Gitea remote active)
-    private_pages = []
-    if gitea_workspace and gitea_mirror_ws_id:
-        try:
-            with get_conn() as conn:
-                pp_rows = conn.execute(
-                    "SELECT id, title FROM pages WHERE parent_section='Private' AND workspace_id=? AND deleted_at IS NULL ORDER BY updated_at DESC LIMIT 20",
-                    (gitea_mirror_ws_id,)
-                ).fetchall()
-                private_pages = [{"id": r[0], "title": r[1] or "Untitled"} for r in pp_rows]
-        except Exception:
-            logger.exception("_sidebar_data")
-
-    # Shared / received / published pages for the sidebar (Par moi / Avec moi)
-    shared_made_pages = []
-    shared_received_pages = []
-    published_pages = []
-    shared_pages = []
-    if user and user.get("id"):
-        from app.routers.board import _load_shared_sidebar_pages
-        shared_made_pages, shared_received_pages, published_pages, shared_pages = _load_shared_sidebar_pages(user["id"])
-
-    sidebar = {
-        "workspace_name": ws, "workspace_initial": initial,
-        "active_ws_name": active_ws_name,
-        "workspace_key": f"{gitea_owner}/{gitea_repo}" if gitea_workspace else "",
-        "gitea_workspace": gitea_workspace,
-        "gitea_owner": gitea_owner,
-        "gitea_repo": gitea_repo,
-        "local_ws_id": local_ws_id,
-        "workspace_pages": workspace_pages,
-        "current_page": "Dashboard", "last_edited": "now",
-        "recent_pages": recent_pages,
-        "private_pages": private_pages,
-        "favorite_pages": [],
-        "shared_pages": shared_pages,
-        "shared_made_pages": shared_made_pages,
-        "shared_received_pages": shared_received_pages,
-        "published_pages": published_pages,
-        "user": user,
-        "avatar_url": avatar_url,
-        "avatar_color": avatar_color,
-        "auth_method": auth_method,
-        "gitea_linked": gitea_linked,
-        "github_linked": github_linked,
-        "has_active_workspace": has_active_workspace,
-        "app_version": _get_app_version(),
-    }
-
-    sidebar["local_workspaces"] = _local_workspaces_for_user(user)
-
-    return sidebar
-
-
-
-
-
-
-# ═══════════ User API endpoints ═══════════
-
-def _get_user_id(request: Request) -> int:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    return user["id"] if user and user.get("id") else 1
-
-
-
-
-
-
-def _require_user_id(request: Request) -> int:
-    """A3/A4 — 401 sans session (les routes qui mutent un compte ne tolèrent
-    plus le fallback « legacy single-user » → id 1 = l'admin seedé)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    return user["id"]
-
-
-
-
-
-
-def _file_page_disk_path(page: dict):
-    """Resolve the on-disk file behind a ``content_format == 'file'`` page.
-
-    Returns ``(abs_path: Path, filename: str, mime: str, size: int)`` or None
-    when the row is not a file page, references a non-textual/missing file, or
-    the path escapes the data root (path-traversal guard).
-    """
-    if (page.get("content_format") or "") != "file":
-        return None
-    import json as _json
-    try:
-        meta = _json.loads(page.get("content", "{}"))
-    except (_json.JSONDecodeError, TypeError):
-        meta = {}
-    if not isinstance(meta, dict):
-        return None
-    rel = (meta.get("file_path") or "").replace("\\", "/").strip()
-    if not rel or not rel.startswith("uploads/"):
-        return None
-    parts = rel.split("/")
-    if ".." in parts or "." in parts:
-        return None
-    from pathlib import Path
-    root = Path(settings.data_dir).resolve()
-    full = (root / rel).resolve()
-    try:
-        full.relative_to(root)
-    except ValueError:
-        return None
-    if not full.exists() or not full.is_file():
-        return None
-    filename = parts[-1] or page.get("title", "file")
-    mime = meta.get("mime_type") or "application/octet-stream"
-    size = meta.get("size") or 0
-    return (full, filename, mime, size)
-
-
-
-
-
-
-def _require_page_view(request: Request, page_id: int) -> None:
-    """A16 : lecture d'une pièce jointe = session + `can_view_page` (404 sinon)."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    from app.services.permission_manager import PermissionManager
-
-    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
-        raise HTTPException(404, "Page not found")
-
-
-
-
-
-
-def _build_tree_children(conn, parent_id: int | None, ws_id: int, uid: int | None = None) -> list:
-    """Recursively build the tree of children for a node."""
-    if parent_id is None:
-        rows = conn.execute(
-            "SELECT id, title, parent_section, content_format, content, page_icon, "
-            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
-            "created_at, updated_at FROM pages "
-            "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
-            "ORDER BY created_at DESC",
-            (ws_id,),
-        ).fetchall()
-    else:
-        rows = conn.execute(
-            "SELECT id, title, parent_section, content_format, content, page_icon, "
-            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
-            "created_at, updated_at FROM pages "
-            "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
-            "ORDER BY created_at DESC",
-            (parent_id, ws_id),
-        ).fetchall()
-
-    # Get workspace owner name for author display
-    ws_owner = conn.execute(
-        "SELECT u.full_name, u.login FROM workspaces w JOIN users u ON u.id=w.owner_id WHERE w.id=?",
-        (ws_id,),
-    ).fetchone()
-    author = ws_owner["full_name"] or ws_owner["login"] if ws_owner else "—"
-
-    # Collect all page IDs to fetch tags in one query
-    all_ids = [r["id"] for r in rows]
-    tags_map = {}
-    favorited_ids = set()
-    if all_ids:
-        placeholders = ",".join("?" for _ in all_ids)
-        tag_rows = conn.execute(
-            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
-            f"JOIN tags t ON t.id=pt.tag_id WHERE pt.page_id IN ({placeholders})",
-            all_ids,
-        ).fetchall()
-        for tr in tag_rows:
-            tags_map.setdefault(tr["page_id"], []).append({
-                "id": tr["id"], "name": tr["name"], "color": tr["color"],
-            })
-        if uid is not None:
-            fav_rows = conn.execute(
-                f"SELECT page_id FROM favorites WHERE user_id=? AND page_id IN ({placeholders})",
-                [uid, *all_ids],
-            ).fetchall()
-            favorited_ids = {fr["page_id"] for fr in fav_rows}
-
-    tree = []
-    for r in rows:
-        is_folder = r["parent_section"] == "Workspace"
-        children = _build_tree_children(conn, r["id"], ws_id, uid)
-
-        # Compute size
-        size = 0
-        if r["content_format"] == "file":
-            import json as _json
-            try:
-                meta = _json.loads(r["content"])
-                size = meta.get("size", 0)
-            except Exception:
-                size = len(r["content"] or "")
-        else:
-            size = len(r["content"] or "")
-
-        tree.append({
-            "id": r["id"],
-            "name": r["title"] or "Untitled",
-            "type": "folder" if is_folder else "page",
-            "is_folder": is_folder,
-            "content_format": r["content_format"] if not is_folder else None,
-            "page_icon": r["page_icon"] or "",
-            "children": children,
-            "has_children": len(children) > 0,
-            "child_count": len(children),
-            "size": size,
-            "size_display": _format_size(size),
-            "created_at": r["created_at"],
-            "updated_at": r["updated_at"],
-            "author": author,
-            "tags": tags_map.get(r["id"], []),
-            "is_shared": bool(r["is_shared"]),
-            "favorited": r["id"] in favorited_ids,
-        })
-    return tree
-
-
-
-
-
-
-def _format_size(size_bytes: int) -> str:
-    """Human-readable file size."""
-    if size_bytes < 1024:
-        return f"{size_bytes} B"
-    elif size_bytes < 1024 * 1024:
-        return f"{size_bytes / 1024:.1f} KB"
-    elif size_bytes < 1024 * 1024 * 1024:
-        return f"{size_bytes / (1024 * 1024):.1f} MB"
-    return f"{size_bytes / (1024 * 1024 * 1024):.2f} GB"
-
-
-
-
-
-
-def _build_breadcrumb(conn, folder_id: int) -> list:
-    """Build breadcrumb trail from root to folder_id."""
-    breadcrumb = []
-    current = folder_id
-    seen = set()
-    while current and current not in seen:
-        seen.add(current)
-        row = conn.execute(
-            "SELECT id, title, parent_id, parent_section FROM pages WHERE id=?",
-            (current,),
-        ).fetchone()
-        if row:
-            breadcrumb.insert(0, {
-                "id": row["id"],
-                "name": row["title"] or "Untitled",
-                "is_folder": row["parent_section"] == "Workspace",
-            })
-            current = row["parent_id"]
-        else:
-            break
-    return breadcrumb
-
-
-
-
-
-
-def _nav_breadcrumb(conn, page_id: int) -> list:
-    """Build a Notion-style breadcrumb chain (root -> page) for the header.
-
-    Returns a list of dicts: {id, label, url, icon, menu}. The last item is the
-    current page (url = None). Every item has ``menu: True`` so the header can
-    open a sibling-navigation dropdown for it.
-    """
-    from app.routers.board import _file_icon
-    chain = []
-    current = page_id
-    seen = set()
-    while current and current not in seen:
-        seen.add(current)
-        row = conn.execute(
-            "SELECT id, title, parent_id, parent_section, content_format "
-            "FROM pages WHERE id=? AND deleted_at IS NULL",
-            (current,),
-        ).fetchone()
-        if not row:
-            break
-        is_folder = row["parent_section"] == "Workspace"
-        title = row["title"] or "Untitled"
-        chain.insert(0, {
-            "id": row["id"],
-            "label": title,
-            "url": None,
-            "icon": "folder" if is_folder else _file_icon(title, row["content_format"]),
-            "menu": True,
-        })
-        current = row["parent_id"]
-    # All items except the current page are navigable links.
-    for i, item in enumerate(chain):
-        if i < len(chain) - 1:
-            item["url"] = f"/pages/{item['id']}"
-    return chain
-
-
-
-
-
-
-def _get_active_workspace(request: Request, user_id: int = None) -> dict | None:
-    """Get the active workspace ID from the cookie (verified for current user), or first user workspace, or None."""
-    ws_id = request.cookies.get(WORKSPACE_COOKIE)
-    if ws_id:
-        try:
-            with get_conn() as conn:
-                ws = conn.execute("SELECT * FROM workspaces WHERE id=?",
-                                  (int(ws_id),)).fetchone()
-                if ws:
-                    ws_dict = dict(ws)
-                    # Verify ownership — only return if it belongs to the current user
-                    if user_id is None or ws_dict.get("owner_id") == user_id:
-                        return ws_dict
-        except (ValueError, Exception):
-            pass
-    # Fallback: first workspace owned by this user
-    if user_id:
-        with get_conn() as conn:
-            ws = conn.execute(
-                "SELECT * FROM workspaces WHERE owner_id=? ORDER BY id LIMIT 1",
-                (user_id,)
-            ).fetchone()
-            if ws:
-                return dict(ws)
-    return None
-
-
-
-
-
-
-def _sanitize_id(block_id: str) -> str:
-    """Sanitize a block id for use as an HTML anchor (only alnum kept)."""
-    if not block_id:
-        return ""
-    return "".join(ch for ch in str(block_id) if ch.isalnum())
-
-
-
-
-
-
-def _render_blocks_public(blocks: list, titles: dict | None = None) -> str:
-    """Render FlowDeck blocks as plain HTML for public pages.
-
-    v5.11.0: ``titles`` (token → label, see app.services.wiki_links) turns
-    ``[[fdpage:ID]]`` / ``[[fddate:...]]`` tokens into chips/links.
-    """
-    html_parts = []
-
-    def _wiki(c: str) -> str:
-        if titles and ("[[fdpage:" in c or "[[fddate:" in c):
-            from app.services.wiki_links import resolve_tokens_html
-            return resolve_tokens_html(c, titles)
-        return c
-
-    for b in blocks:
-        t = b.get("type", "paragraph")
-        c = _wiki(b.get("content", "") or "")
-        if t == "heading_1":
-            html_parts.append(f'<h1 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:2.5rem;font-weight:700;margin:32px 0 8px;">{c}</h1>')
-        elif t == "heading_2":
-            html_parts.append(f'<h2 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.75rem;font-weight:600;margin:28px 0 6px;">{c}</h2>')
-        elif t == "heading_3":
-            html_parts.append(f'<h3 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.35rem;font-weight:600;margin:24px 0 4px;">{c}</h3>')
-        elif t == "heading_4":
-            html_parts.append(f'<h4 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.15rem;font-weight:600;margin:20px 0 4px;">{c}</h4>')
-        elif t == "bulleted_list":
-            html_parts.append(f'<li style="margin-left:24px;">{c}</li>')
-        elif t == "numbered_list":
-            html_parts.append(f'<li style="margin-left:24px;list-style:decimal;">{c}</li>')
-        elif t == "to_do":
-            checked = "checked" if b.get("checked") else ""
-            todo_style = "text-decoration:line-through;opacity:.5" if b.get("checked") else ""
-            html_parts.append(
-                f'<div style="display:flex;align-items:center;gap:8px;margin:4px 0;">'
-                f'<input type="checkbox" {checked} disabled>'
-                f'<span style="{todo_style}">{c}</span>'
-                f'</div>'
-            )
-        elif t == "toggle":
-            children_html = ""
-            if b.get("children"):
-                children_html = '<div style="margin-left:22px;padding-left:12px;border-left:1px solid rgba(255,255,255,.1);margin-top:4px;">'
-                children_html += _render_blocks_public(b["children"], titles)
-                children_html += "</div>"
-            html_parts.append(
-                f'<details style="margin:8px 0;" open><summary style="cursor:pointer;font-weight:500;">{c}</summary>{children_html}</details>'
-            )
-        elif t == "quote":
-            html_parts.append(
-                f'<blockquote style="border-left:3px solid var(--accent,#4c9aff);margin:12px 0;padding:4px 16px;opacity:.85;">{c}</blockquote>'
-            )
-        elif t == "table_of_contents":
-            toc = [
-                x for x in blocks
-                if x.get("type", "").startswith("heading_") and (x.get("content") or "").strip()
-            ]
-            if toc:
-                items = []
-                for h in toc:
-                    lvl = int(h["type"].split("_")[-1])
-                    items.append(
-                        f'<div style="margin-left:{max(0, lvl - 1) * 14}px;padding:5px 8px;font-size:14px;">'
-                        f'<a href="#h-{_sanitize_id(h.get("id",""))}" style="color:inherit;text-decoration:none;display:block;">{h.get("content","")}</a></div>'
-                    )
-                html_parts.append(
-                    '<div style="border:1px solid rgba(255,255,255,.1);border-radius:8px;padding:16px 20px;margin:4px 0;">'
-                    '<div style="font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.5px;opacity:.5;margin-bottom:10px;">On this page</div>'
-                    + "".join(items) + "</div>"
-                )
-        elif t == "math":
-            tex = c.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
-            html_parts.append(
-                f'<div data-katex="{tex}" style="margin:12px 0;padding:12px 16px;background:rgba(255,255,255,.04);border-radius:8px;overflow-x:auto;"></div>'
-            )
-        elif t == "columns":
-            cols_html = ""
-            for child in b.get("children") or []:
-                cols_html += (
-                    '<div style="flex:1;min-width:0;padding:10px 12px;background:rgba(255,255,255,.05);'
-                    'border-radius:8px;box-sizing:border-box;">'
-                    + _render_blocks_public([child], titles) + "</div>"
-                )
-            html_parts.append(
-                f'<div style="display:flex;gap:12px;margin:8px 0 16px;align-items:stretch;">{cols_html}</div>'
-            )
-        elif t == "callout":
-            icon = b.get("icon", "💡")
-            bg = (b.get("style") or {}).get("bgColor", "rgba(76,154,255,.1)")
-            html_parts.append(
-                f'<div style="display:flex;gap:10px;padding:14px 18px;margin:12px 0;border-radius:8px;'
-                f'background:{bg};align-items:flex-start;">'
-                f'<span style="font-size:20px;flex-shrink:0;">{icon}</span>'
-                f'<span>{c}</span></div>'
-            )
-        elif t == "code":
-            lang = b.get("language", "")
-            lang_label = f"<div style='font-size:11px;opacity:.4;margin-bottom:8px;'>{lang}</div>" if lang else ""
-            html_parts.append(
-                f'<pre style="background:rgba(255,255,255,.05);padding:16px 20px;border-radius:8px;'
-                f'overflow-x:auto;font-size:14px;line-height:1.5;margin:12px 0;">'
-                f'{lang_label}'
-                f'<code>{c}</code></pre>'
-            )
-        elif t == "divider":
-            html_parts.append('<hr style="border:none;border-top:1px solid rgba(255,255,255,.1);margin:16px 0;">')
-        elif t == "image":
-            src = b.get("src", "")
-            alt = b.get("alt", "")
-            html_parts.append(
-                f'<figure style="margin:16px 0;text-align:center;">'
-                f'<img src="{src}" alt="{alt}" data-full="{src}" style="max-width:100%;border-radius:8px;cursor:zoom-in;">'
-                f'</figure>'
-            )
-        elif t == "video":
-            src = b.get("src", "")
-            if src:
-                html_parts.append(
-                    f'<video controls preload="metadata" style="max-width:100%;border-radius:8px;display:block;margin:12px auto;">'
-                    f'<source src="{src}"></video>'
-                )
-        elif t == "audio":
-            src = b.get("src", "")
-            if src:
-                html_parts.append(
-                    f'<audio controls preload="metadata" style="width:100%;margin:8px 0;"><source src="{src}"></audio>'
-                )
-        elif t == "bookmark":
-            url = b.get("url") or b.get("src") or ""
-            title = b.get("title") or url
-            desc = b.get("description") or ""
-            img = b.get("image") or ""
-            site = b.get("site_name") or ""
-            img_html = (
-                f'<img src="{img}" alt="" style="width:120px;height:90px;object-fit:cover;border-radius:8px;flex-shrink:0;">' if img else ""
-            )
-            desc_html = f'<div style="font-size:13px;opacity:.75;margin-top:4px;">{desc}</div>' if desc else ""
-            site_html = f'<div style="font-size:11px;opacity:.5;text-transform:uppercase;letter-spacing:.5px;margin-top:6px;">{site}</div>' if site else ""
-            html_parts.append(
-                f'<a href="{url}" target="_blank" rel="noopener noreferrer" style="text-decoration:none;color:inherit;">'
-                f'<div style="display:flex;gap:14px;align-items:center;border:1px solid rgba(255,255,255,.12);border-radius:10px;'
-                f'padding:14px 16px;margin:14px 0;background:rgba(255,255,255,.03);">'
-                f'<div style="flex:1;min-width:0;"><div style="font-weight:600;font-size:15px;">{title}</div>'
-                f'{desc_html}{site_html}</div>{img_html}</div></a>'
-            )
-        elif t == "embed":
-            url = b.get("src", "")
-            emb = b.get("embed_type") or ""
-            if emb in ("inline_dbs", "collection"):
-                html_parts.append('<div>[Embedded content]</div>')
-            elif emb == "download":
-                html_parts.append(
-                    f'<a href="{url}" download style="display:inline-block;margin:12px 0;color:var(--accent,#4c9aff);">⬇ {b.get("file_name") or "Download"}</a>'
-                )
-            elif emb == "pdf" and url:
-                html_parts.append(
-                    f'<iframe src="{url}" style="width:100%;height:70vh;border:none;border-radius:8px;margin:12px 0;"></iframe>'
-                )
-            elif url:
-                from app.services.embeds import embed_src
-                src = b.get("embed_src") or embed_src(url) or url
-                height = b.get("height") or 520
-                try:
-                    height = int(height)
-                except (ValueError, TypeError):
-                    height = 520
-                html_parts.append(
-                    f'<div style="position:relative;width:100%;height:{height}px;border-radius:8px;overflow:hidden;'
-                    f'background:#0a0a0a;"><iframe src="{src}" loading="lazy" frameborder="0" '
-                    f'style="position:absolute;inset:0;width:100%;height:100%;" allowfullscreen allow="autoplay; encrypted-media; picture-in-picture"></iframe></div>'
-                )
-        elif t == "synced":
-            # v6.5.0: render synced block instances (resolved server-side).
-            if b.get("_synced_deleted"):
-                html_parts.append(
-                    '<div style="margin:8px 0;padding:8px 12px;border-left:3px solid #e05e5e;'
-                    'background:rgba(224,94,94,.08);border-radius:4px;font-size:13px;opacity:.8;">'
-                    'Deleted synced block</div>'
-                )
-            else:
-                inner = b.get("_synced_content")
-                if not isinstance(inner, list) or not inner:
-                    try:
-                        import json as _sj
-                        parsed = _sj.loads(b.get("content") or "[]")
-                        inner = parsed if isinstance(parsed, list) else []
-                    except (ValueError, TypeError):
-                        inner = []
-                inner = [{"type": "paragraph", "content": str(x)} if not isinstance(x, dict) else x
-                         for x in inner]
-                if inner:
-                    html_parts.append(
-                        '<div style="margin:8px 0;padding-left:12px;'
-                        'border-left:3px solid var(--accent,#4c9aff);">'
-                        + _render_blocks_public(inner, titles) + '</div>'
-                    )
-        else:
-            html_parts.append(f'<p style="margin:4px 0;line-height:1.7;">{c}</p>')
-    return "\n".join(html_parts)
-
-
-# ═══════════ Library page actions API ═══════════
-
-
@@ -1,77 +0,0 @@
-"""FlowDeck — Dashboard : account_api.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-
-from app.db import get_conn
-
-from ._common import _require_user_id
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.put("/api/user/profile")
-def update_profile(request: Request, body: dict = Body(default={})):
-    full_name = body.get("full_name", "").strip()
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET full_name=? WHERE id=?", (full_name, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.put("/api/user/password")
-def update_password(request: Request, body: dict = Body(default={})):
-    from app.password_utils import hash_password, verify_password
-    password = body.get("password", "").strip()
-    if len(password) < 6:
-        return {"error": "Password must be at least 6 characters"}
-    uid = _require_user_id(request)
-    # A3 : le mot de passe actuel est exigé (session volée ≠ droit de changer le mdp).
-    current = body.get("current_password", "")
-    with get_conn() as conn:
-        row = conn.execute("SELECT password_hash FROM users WHERE id=?", (uid,)).fetchone()
-        if not row or not verify_password(current, row["password_hash"]):
-            raise HTTPException(403, "Current password is incorrect")
-        conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(password), uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/user/token")
-def generate_token(request: Request):
-    import secrets
-    uid = _require_user_id(request)
-    token = secrets.token_hex(32)
-    with get_conn() as conn:
-        conn.execute(
-            "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
-            (uid, token),
-        )
-        conn.commit()
-    return {"token": f"fd_{token}"}
-
-
-
-
-@router.delete("/api/user/forge/{provider}")
-def disconnect_forge(request: Request, provider: str):
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM user_oauth_tokens WHERE user_id=? AND provider=?", (uid, provider)
-        )
-        conn.commit()
-    return {"status": "ok"}
@@ -1,439 +0,0 @@
-"""FlowDeck — Dashboard : settings.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-from ._common import _format_size, _get_active_workspace, _get_user_id, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Settings Page ═══════════
-
-@router.get("/settings", response_class=HTMLResponse)
-def app_settings_page(request: Request):
-    """Settings & configuration page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("settings.html")
-    return template.render(**ctx)
-
-
-
-
-@router.post("/api/settings/avatar")
-async def upload_avatar(request: Request):
-    """Upload a user avatar image."""
-    import os
-    import uuid
-    from pathlib import Path
-    form = await request.form()
-    file = form.get("file")
-    if not file:
-        return {"error": "No file"}, 400
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return {"error": "Not authenticated"}, 401
-    # Save to data/avatars
-    avatars_dir = Path("/data/avatars")
-    avatars_dir.mkdir(parents=True, exist_ok=True)
-    ext = os.path.splitext(file.filename)[1] or ".png"
-    filename = f"{user['id']}_{uuid.uuid4().hex[:8]}{ext}"
-    filepath = avatars_dir / filename
-    content = await file.read()
-    filepath.write_bytes(content)
-    # Update user avatar_url
-    avatar_url = f"/api/settings/avatar/{filename}"
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET avatar_url = ? WHERE id = ?", (avatar_url, user["id"]))
-        conn.commit()
-    return {"avatar_url": avatar_url}
-
-
-
-
-@router.get("/api/settings/avatar/{filename:path}")
-def serve_avatar_file(filename: str):
-    """Serve an uploaded avatar image file."""
-    from pathlib import Path
-
-    from fastapi.responses import FileResponse
-    # A11 : garde path traversal (motif de serve_uploaded_file) — `:path` Starlette
-    # accepte les `/`, donc `..%2f` ressortirait du dossier avatars.
-    base_dir = Path("/data/avatars").resolve()
-    filepath = (base_dir / filename).resolve()
-    try:
-        filepath.relative_to(base_dir)
-    except ValueError:
-        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
-    if not filepath.is_file():
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    return FileResponse(filepath)
-
-
-
-
-@router.get("/api/avatar/{user_id:int}")
-def get_avatar(user_id: int):
-    """Redirect to the user's avatar."""
-    with get_conn() as conn:
-        row = conn.execute("SELECT avatar_url FROM users WHERE id = ?", (user_id,)).fetchone()
-    if row and row["avatar_url"]:
-        return RedirectResponse(row["avatar_url"], status_code=302)
-    return JSONResponse({"error": "No avatar"}, status_code=404)
-
-
-
-
-@router.post("/api/settings/avatar-color")
-def set_avatar_color(request: Request, body: dict = Body(default={})):
-    """Set the user's avatar background color."""
-    color = body.get("color", "#3A3A3A")
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return {"error": "Not authenticated"}, 401
-    with get_conn() as conn:
-        conn.execute("UPDATE users SET avatar_url = '', avatar_color = ? WHERE id = ?", (color, user["id"]))
-        conn.commit()
-    return {"status": "ok", "color": color}
-
-
-# ═══════════ Tag Management API (per-user) ═══════════
-
-
-
-
-# ═══════════ Tag Management API (per-user) ═══════════
-
-@router.post("/api/settings/tags")
-def create_tag_global(request: Request, body: dict = Body(default={})):
-    """Create a tag for the current user."""
-    tag_name = body.get("name", "").strip().lower()
-    color = body.get("color", "#787774")
-    uid = _get_user_id(request)
-    if not tag_name or not uid:
-        return {"error": "Tag name required"}, 400
-    with get_conn() as conn:
-        tag = conn.execute("SELECT id FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
-        if tag:
-            conn.execute("UPDATE tags SET color = ? WHERE id = ?", (color, tag["id"]))
-            conn.commit()
-            return {"tag": {"id": tag["id"], "name": tag_name, "color": color}}
-        cursor = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, color, uid))
-        conn.commit()
-        return {"tag": {"id": cursor.lastrowid, "name": tag_name, "color": color}}
-
-
-
-
-@router.put("/api/settings/tags/{tag_id:int}")
-def update_tag_global(tag_id: int, request: Request, body: dict = Body(default={})):
-    """Update a tag (name or color) — only if owned by user."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        if "name" in body:
-            conn.execute("UPDATE tags SET name = ? WHERE id = ? AND user_id = ?", (body["name"].strip().lower(), tag_id, uid))
-        if "color" in body:
-            conn.execute("UPDATE tags SET color = ? WHERE id = ? AND user_id = ?", (body["color"], tag_id, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/settings/tags/{tag_id:int}")
-def delete_tag_global(tag_id: int, request: Request):
-    """Delete a tag — only if owned by user."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        conn.execute("DELETE FROM page_tags WHERE tag_id = ?", (tag_id,))
-        conn.execute("DELETE FROM tags WHERE id = ? AND user_id = ?", (tag_id, uid))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/settings/tags/all")
-def list_all_tags_global(request: Request):
-    """List current user's tags with counts."""
-    uid = _get_user_id(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color, COUNT(pt.page_id) as count "
-            "FROM tags t LEFT JOIN page_tags pt ON pt.tag_id = t.id "
-            "WHERE t.user_id = ? GROUP BY t.id ORDER BY t.name",
-            (uid,),
-        ).fetchall()
-    return JSONResponse(
-        {"tags": [dict(r) for r in rows]},
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-# ═══════════ Workspace Tags API ═══════════
-
-
-
-
-# ═══════════ Workspace Tags API ═══════════
-
-@router.get("/api/local-workspace/tags")
-def list_tags(request: Request):
-    """List ALL user tags with counts scoped to the active workspace."""
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    uid = _get_user_id(request)
-    if not ws_id:
-        return {"tags": []}
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color, "
-            "(SELECT COUNT(*) FROM page_tags pt "
-            " JOIN pages p ON p.id = pt.page_id AND p.workspace_id = ? "
-            " WHERE pt.tag_id = t.id) as count "
-            "FROM tags t WHERE t.user_id = ? ORDER BY t.name",
-            (ws_id, uid),
-        ).fetchall()
-    return JSONResponse(
-        {"tags": [dict(r) for r in rows]},
-        headers={"Cache-Control": "no-store"},
-    )
-
-
-
-
-@router.get("/api/local-workspace/items/{item_id:int}/tags")
-def get_item_tags(item_id: int):
-    """Get tags for a specific item."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT t.id, t.name, t.color FROM tags t "
-            "JOIN page_tags pt ON pt.tag_id = t.id "
-            "WHERE pt.page_id = ? ORDER BY t.name",
-            (item_id,),
-        ).fetchall()
-    return {"tags": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/local-workspace/items/{item_id:int}/tags")
-def add_item_tag(request: Request, item_id: int, body: dict = Body(default={})):
-    """Add a tag to an item (creates tag if new, scoped to user)."""
-    tag_name = body.get("name", "").strip().lower()
-    tag_color = body.get("color", "#787774")
-    uid = _get_user_id(request)
-    if not tag_name:
-        return {"error": "Tag name required"}, 400
-
-    with get_conn() as conn:
-        # Get or create tag (per user)
-        tag = conn.execute("SELECT id, name, color FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
-        if not tag:
-            cursor = conn.execute(
-                "INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, tag_color, uid)
-            )
-            conn.commit()
-            tag_id = cursor.lastrowid
-            tag = {"id": tag_id, "name": tag_name, "color": tag_color}
-        else:
-            tag_id = tag["id"]
-
-        # Link tag to page (ignore duplicate)
-        try:
-            conn.execute(
-                "INSERT OR IGNORE INTO page_tags (page_id, tag_id) VALUES (?, ?)",
-                (item_id, tag_id),
-            )
-            conn.commit()
-        except Exception:
-            logger.exception("add_item_tag")
-
-    return {"tag": {"id": tag["id"], "name": tag["name"], "color": tag["color"]}}
-
-
-
-
-@router.delete("/api/local-workspace/items/{item_id:int}/tags/{tag_id:int}")
-def remove_item_tag(item_id: int, tag_id: int):
-    """Remove a tag from an item."""
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM page_tags WHERE page_id = ? AND tag_id = ?",
-            (item_id, tag_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/local-workspace/tags/search")
-def search_by_tags(request: Request, tags: str = ""):
-    """Search items by tags (comma-separated)."""
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"items": []}
-    tag_names = [t.strip().lower() for t in tags.split(",") if t.strip()]
-    if not tag_names:
-        return {"items": []}
-    with get_conn() as conn:
-        placeholders = ",".join("?" for _ in tag_names)
-        rows = conn.execute(
-            f"SELECT DISTINCT p.id, p.title, p.content_format, p.parent_section, "
-            f"p.content, p.created_at, p.updated_at "
-            f"FROM pages p "
-            f"JOIN page_tags pt ON pt.page_id = p.id "
-            f"JOIN tags t ON t.id = pt.tag_id "
-            f"WHERE t.name IN ({placeholders}) AND p.workspace_id = ? AND p.deleted_at IS NULL "
-            f"ORDER BY p.updated_at DESC",
-            tag_names + [ws_id],
-        ).fetchall()
-    items = []
-    for r in rows:
-        is_folder = r["parent_section"] == "Workspace"
-        size = len(r["content"] or "")
-        items.append({
-            "id": r["id"],
-            "name": r["title"] or "Untitled",
-            "is_folder": is_folder,
-            "content_format": r["content_format"],
-            "created_at": r["created_at"],
-            "updated_at": r["updated_at"],
-            "size": size,
-            "size_display": _format_size(size),
-        })
-    return {"items": items}
-
-
-# ── Account update ──
-
-
-
-
-# ── Account update ──
-@router.put("/api/settings/account")
-def update_account(request: Request, body: dict = Body(default={})):
-    """Update current user's profile: full_name, login, email, password."""
-    from app.password_utils import hash_password
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return JSONResponse({"error": "Not authenticated"}, status_code=401)
-    with get_conn() as conn:
-        uid = user["id"]
-        if "full_name" in body:
-            conn.execute("UPDATE users SET full_name=? WHERE id=?", (body["full_name"].strip(), uid))
-        if "login" in body:
-            new_login = body["login"].strip()
-            if new_login and new_login != user.get("login"):
-                existing = conn.execute("SELECT id FROM users WHERE login=? AND id!=?", (new_login, uid)).fetchone()
-                if existing:
-                    return JSONResponse({"error": "Username already taken"}, status_code=409)
-                conn.execute("UPDATE users SET login=? WHERE id=?", (new_login, uid))
-        if "email" in body:
-            conn.execute("UPDATE users SET email=? WHERE id=?", (body["email"].strip(), uid))
-        if "password" in body and body["password"].strip():
-            pw = body["password"].strip()
-            if len(pw) < 6:
-                return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
-            conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(pw), uid))
-        conn.commit()
-        row = conn.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
-        user_data = dict(row)
-    # Refresh session cookie with updated data (keeps the same session id)
-    cookie = request.cookies.get("flowdeck_session", "")
-    new_session = SessionManager.refresh_session(cookie, user_data, request)
-    response = JSONResponse({"status": "ok", "user": {k: user_data[k] for k in ("id","login","full_name","email","is_admin")}})
-    response.set_cookie("flowdeck_session", new_session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
-    return response
-
-
-# ═══════════ Sidebar Refresh API ═══════════
-
-
-
-
-# ═══════════ Sidebar Refresh API ═══════════
-
-@router.get("/api/sidebar/workspace-tree")
-def sidebar_workspace_tree(request: Request):
-    """Return the sidebar workspace tree as HTML fragment.
-
-    Called by appState().refreshSidebarTree() after CRUD operations
-    in the main content area to keep the sidebar in sync.
-    """
-    from app.routers.board import _load_workspace_pages
-    from app.templating import ENV
-
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return HTMLResponse("")
-
-    ws_cookie = request.cookies.get("flowdeck_workspace", "")
-    if not ws_cookie:
-        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">📄</span><span class="page-name text-dim">No pages yet</span></li>')
-
-    # Gitea workspace — no server-side tree, loaded client-side
-    if ws_cookie.startswith("gitea:"):
-        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">🔗</span><span class="page-name text-dim">Remote workspace</span></li>')
-
-    try:
-        ws_id = int(ws_cookie)
-        with get_conn() as conn:
-            # Verify workspace belongs to user
-            row = conn.execute(
-                "SELECT id FROM workspaces WHERE id=? AND owner_id=?",
-                (ws_id, user["id"])
-            ).fetchone()
-            if not row:
-                return HTMLResponse(
-                    '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-                    '<span class="page-name text-dim">No pages yet</span></li>'
-                )
-
-        pages = _load_workspace_pages(ws_cookie)
-        if not pages:
-            return HTMLResponse(
-                '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-                '<span class="page-name text-dim">No pages yet</span></li>'
-            )
-
-        # Render the tree using the extracted macro
-        env = ENV
-        template = env.from_string(
-            "{% from '_workspace_tree_macro.html' import render_workspace_tree %}"
-            "{{ render_workspace_tree(pages) }}"
-        )
-        html = template.render(pages=pages)
-        return HTMLResponse(html)
-    except (ValueError, Exception) as e:
-        logger.error(f"sidebar_workspace_tree failed: {e}", exc_info=True)
-        return HTMLResponse(
-            '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
-            '<span class="page-name text-dim">No pages yet</span></li>'
-        )
-
-
-# ═══════════ Public Published Page ═══════════
@@ -1,606 +0,0 @@
-"""FlowDeck — Dashboard : local_workspace.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-from datetime import UTC
-
-from fastapi import APIRouter, Body, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.config import settings
-from app.db import get_conn
-
-from ._common import (
-    WORKSPACE_COOKIE,
-    _build_breadcrumb,
-    _build_tree_children,
-    _file_page_disk_path,
-    _get_active_workspace,
-    _get_user_id,
-    _require_page_view,
-    _require_user_id,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Local Workspace (file/folder CRUD) ═══════════
-
-@router.get("/local-workspace", response_class=HTMLResponse)
-def local_workspace_page(request: Request, folder: int = None, ws: int = None):
-    """Local workspace page with file/folder tree.
-
-    If ?folder=ID is provided, shows that folder's contents with breadcrumb.
-    If ?ws=ID is provided, shows that workspace — c'est ce que fait le bouton
-    « Home » de la sidebar (``/local-workspace?ws=<id>``). Le paramètre était
-    produit par le sidebar mais **ignoré** par la route : le contenu affiché
-    restait celui du workspace *actif* (cookie), donc Home pouvait montrer un
-    autre workspace que celui annoncé dans l'URL. Un ``ws`` qui n'appartient
-    pas à l'utilisateur est ignoré (et le workspace actif conservé).
-    """
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-
-    ws_row = _get_active_workspace(request, user_id=user["id"])
-    if ws is not None:
-        # Workspace demandé par l'URL : on ne l'accepte que s'il appartient à
-        # l'utilisateur (même règle de propriété que _get_active_workspace).
-        with get_conn() as conn:
-            requested = conn.execute(
-                "SELECT id, name FROM workspaces WHERE id=? AND owner_id=?",
-                (ws, user["id"]),
-            ).fetchone()
-        if requested is not None:
-            ws_row = dict(requested)
-            # L'URL fait foi : on aligne le cookie pour que le reste de
-            # l'application (sidebar, API tree, breadcrumbs) suive le même
-            # workspace que celui affiché.
-            response = _render_local_workspace(env, sidebar, user, ws_row, folder)
-            response.set_cookie(WORKSPACE_COOKIE, str(ws_row["id"]),
-                                max_age=86400 * 30, httponly=True, path="/")
-            return response
-
-    ws_id = ws_row["id"] if ws_row else None
-
-    # If no workspace exists for this user, redirect to workspaces page
-    if not ws_id:
-        return RedirectResponse("/workspaces", status_code=302)
-
-    return _render_local_workspace(env, sidebar, user, ws_row, folder)
-
-
-def _render_local_workspace(env, sidebar: dict, user: dict, ws_row: dict,
-                             folder: int | None) -> HTMLResponse:
-    """Render the local-workspace page for ``ws_row`` (shared by both paths).
-
-    ``sidebar`` a été calculé **avant** le éventuel changement de workspace
-    (``?ws=``) : on force donc le nom affiché et la sidebar sur ``ws_row``,
-    sinon la page afficherait le contenu d'un workspace sous le titre d'un
-    autre.
-    """
-    ws_id = ws_row["id"]
-    ws_name = (ws_row.get("name") or sidebar.get("active_ws_name") or "My Workspace")
-
-    # Build breadcrumb if navigating into a folder
-    breadcrumb = []
-    current_folder_id = folder
-    if folder and ws_id:
-        with get_conn() as conn:
-            breadcrumb = _build_breadcrumb(conn, folder)
-
-    ctx = {
-        **sidebar,
-        "user": user,
-        "workspace_name": ws_name,
-        "active_ws_name": ws_name,
-        "active_workspace_id": ws_id,
-        "current_folder_id": current_folder_id or 0,
-        "workspace_id": ws_id or 0,
-        "nav_workspace_id": ws_id or 0,
-        "breadcrumb": breadcrumb,
-        "breadcrumbs": breadcrumb,
-    }
-    template = env.get_template("local_workspace.html")
-    return HTMLResponse(
-        content=template.render(**ctx),
-        headers={
-            "Cache-Control": "no-cache, no-store, must-revalidate",
-            "Pragma": "no-cache",
-            "Expires": "0",
-        }
-    )
-
-
-
-
-@router.get("/api/local-workspace/tree")
-def local_workspace_tree(request: Request, folder: int = None):
-    """Return the file/folder tree filtered by active workspace.
-
-    If ?folder=ID is provided, returns only that folder's children.
-    Otherwise returns the full recursive tree from root.
-    """
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"tree": [], "breadcrumb": []}
-    uid = _get_user_id(request)
-
-    with get_conn() as conn:
-        if folder:
-            # Show only this folder's children + build breadcrumb
-            children = _build_tree_children(conn, folder, ws_id, uid)
-            breadcrumb = _build_breadcrumb(conn, folder)
-            return {"tree": children, "breadcrumb": breadcrumb, "current_folder": folder}
-        else:
-            # Full tree from root
-            roots = _build_tree_children(conn, None, ws_id, uid)
-            return {"tree": roots, "breadcrumb": [], "current_folder": None}
-
-
-
-
-@router.get("/api/local-workspace/page-content/{page_id:int}")
-def get_page_content(page_id: int):
-    """Return the raw content of a page (for preview)."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT content, content_format FROM pages WHERE id=?", (page_id,)
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    fmt = row["content_format"]
-    if fmt == "file":
-        return JSONResponse({"content": "(uploaded file)", "format": fmt})
-    # v6.5.0: resolve synced blocks server-side (fresh content on read).
-    from app.services.synced_blocks import resolve_content_json
-    return {"content": resolve_content_json(row["content"] or "", fmt), "format": fmt}
-
-
-
-
-@router.get("/api/pages/{page_id}/download")
-def download_page_file(request: Request, page_id: int):
-    """Download the original uploaded file of a ``file`` page (attachment)."""
-    _require_page_view(request, page_id)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format FROM pages "
-            "WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    resolved = _file_page_disk_path(dict(row))
-    if not resolved:
-        return JSONResponse({"error": "No downloadable file"}, status_code=404)
-    full, filename, mime, _size = resolved
-    from fastapi.responses import FileResponse
-    return FileResponse(
-        str(full), media_type=mime or "application/octet-stream",
-        filename=filename, content_disposition_type="attachment",
-    )
-
-
-
-
-@router.get("/api/pages/{page_id}/file-content")
-def page_file_content(request: Request, page_id: int):
-    """Return the textual content of a ``file`` page (for copy to clipboard).
-
-    Binary files (PDF, images…) answer ``{ok: false}`` — the clipboard copy is
-    only meaningful for plain-text / code / markdown files.
-    """
-    from app.services.export import _file_text
-
-    _require_page_view(request, page_id)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format FROM pages "
-            "WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        return JSONResponse({"error": "Not found"}, status_code=404)
-    page = dict(row)
-    text = _file_text(page)
-    if text is None:
-        return JSONResponse(
-            {"ok": False, "error": "Not a textual file", "name": page.get("title", "")},
-            status_code=415,
-        )
-    return {"ok": True, "name": page.get("title") or "File", "content": text}
-
-
-
-
-@router.get("/api/local-workspace/breadcrumb")
-def local_workspace_breadcrumb(request: Request, folder: int):
-    """Return breadcrumb trail for a folder."""
-    with get_conn() as conn:
-        breadcrumb = _build_breadcrumb(conn, folder)
-    return {"breadcrumb": breadcrumb}
-
-
-
-
-@router.get("/api/nav/menu")
-def nav_menu(request: Request, workspace_id: int = None, parent_id: int = None):
-    """Return the pages at one level for the header breadcrumb navigation menu.
-
-    If ``parent_id`` is given, returns that page's children; otherwise the
-    workspace's root pages. Each item includes ``has_children`` so the frontend
-    can render an expandable sub-menu.
-    """
-    from app.routers.board import _file_icon
-    ws_id = workspace_id
-    if not ws_id:
-        ws = _get_active_workspace(request, user_id=_get_user_id(request))
-        ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return {"items": []}
-    with get_conn() as conn:
-        if parent_id:
-            rows = conn.execute(
-                "SELECT id, title, parent_section, content_format FROM pages "
-                "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
-                "ORDER BY sort_order ASC, created_at DESC",
-                (parent_id, ws_id),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, title, parent_section, content_format FROM pages "
-                "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
-                "ORDER BY sort_order ASC, created_at DESC",
-                (ws_id,),
-            ).fetchall()
-        ids = [r["id"] for r in rows]
-        child_counts = {}
-        if ids:
-            placeholders = ",".join("?" for _ in ids)
-            cc_rows = conn.execute(
-                f"SELECT parent_id, COUNT(*) AS c FROM pages "
-                f"WHERE parent_id IN ({placeholders}) AND deleted_at IS NULL "
-                f"GROUP BY parent_id",
-                ids,
-            ).fetchall()
-            for cr in cc_rows:
-                child_counts[cr["parent_id"]] = cr["c"]
-        items = []
-        for r in rows:
-            is_folder = r["parent_section"] == "Workspace"
-            title = r["title"] or "Untitled"
-            items.append({
-                "id": r["id"],
-                "name": title,
-                "icon": "folder" if is_folder else _file_icon(title, r["content_format"]),
-                "has_children": child_counts.get(r["id"], 0) > 0,
-                "url": f"/pages/{r['id']}",
-            })
-    return {"items": items}
-
-
-
-
-@router.post("/api/local-workspace/items")
-def create_local_workspace_item(request: Request, body: dict = Body(default={})):
-    """Create a new file in the active workspace."""
-    _require_user_id(request)  # A3/A4 : pas de creation de page anonyme
-    name = (body.get("name") or "").strip() or "Untitled"
-    item_type = body.get("type", "page")
-    parent_id = body.get("parent_id")
-    explicit_ws_id = body.get("workspace_id")
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ws_id = explicit_ws_id or (ws["id"] if ws else None)
-    ws_key = (ws["name"] if ws else "Workspace") if not explicit_ws_id else ""
-    section = 'Workspace' if item_type == 'folder' else 'Private'
-    with get_conn() as conn:
-        cursor = conn.execute(
-            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id) "
-            "VALUES (?, ?, ?, '', 'blocks', ?, ?)",
-            (ws_key, ws_id, name, section, parent_id)
-        )
-        conn.commit()
-        pid = cursor.lastrowid
-    return {"id": pid, "name": name, "type": item_type}
-
-
-
-
-@router.put("/api/local-workspace/items/{item_id:int}")
-def rename_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
-    """Rename a file."""
-    _require_user_id(request)
-    name = body.get("name", "Untitled").strip()
-    with get_conn() as conn:
-        conn.execute("UPDATE pages SET title=? WHERE id=?", (name, item_id))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/local-workspace/items/{item_id:int}")
-def delete_local_workspace_item(request: Request, item_id: int):
-    """Soft-delete a file/folder (sets deleted_at)."""
-    _require_user_id(request)
-    from datetime import datetime
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET deleted_at=? WHERE id=? AND deleted_at IS NULL",
-            (datetime.now(UTC).replace(tzinfo=None).isoformat(), item_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/local-workspace/items/{item_id:int}/restore")
-def restore_local_workspace_item(request: Request, item_id: int):
-    """Restore a soft-deleted file/folder."""
-    _require_user_id(request)
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET deleted_at=NULL WHERE id=?",
-            (item_id,),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.get("/api/files/{ws_id:int}/{filename:path}")
-def serve_uploaded_file(ws_id: int, filename: str):
-    """Serve an uploaded file from disk."""
-    import mimetypes
-    from pathlib import Path
-    root = Path(settings.data_dir)
-    base_dir = (root / f"uploads/workspace_{ws_id}").resolve()
-    fp = (base_dir / filename).resolve()
-    try:
-        fp.relative_to(base_dir)
-    except ValueError:
-        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
-    if not fp.exists():
-        return JSONResponse({"error": "File not found"}, status_code=404)
-    mime, _ = mimetypes.guess_type(str(fp))
-    content = fp.read_bytes()
-    from fastapi.responses import Response
-    return Response(content=content, media_type=mime or "application/octet-stream")
-
-
-
-
-@router.put("/api/local-workspace/items/{item_id:int}/move")
-def move_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
-    """Move an item to a new parent (drag & drop)."""
-    _require_user_id(request)
-    new_parent_id = body.get("parent_id")  # None = move to root
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET parent_id=? WHERE id=?",
-            (new_parent_id, item_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/local-workspace/upload")
-async def upload_local_workspace_file(request: Request):
-    """Upload one or more files via drag-and-drop.
-
-    Accepts multipart form with 'files' field (one or multiple files).
-    Optional: 'parent_id' to place files in a specific folder.
-    Stores files on disk at /data/uploads/workspace_{id}/ and creates DB records.
-    """
-    import json
-    from pathlib import Path
-
-    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
-    ws = _get_active_workspace(request, user_id=uid)
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return JSONResponse({"error": "No active workspace"}, status_code=400)
-
-    try:
-        form = await request.form()
-    except Exception:
-        return JSONResponse({"error": "Invalid form data"}, status_code=400)
-
-    parent_id_raw = form.get("parent_id")
-    parent_id = int(parent_id_raw) if parent_id_raw else None
-    files = form.getlist("files")
-
-    if not files:
-        return JSONResponse({"error": "No files provided"}, status_code=400)
-
-
-    from app.middleware.security import validate_upload
-
-    data_root = Path(settings.data_dir)
-    upload_dir = data_root / f"uploads/workspace_{ws_id}"
-    upload_dir.mkdir(parents=True, exist_ok=True)
-
-    results = []
-    with get_conn() as conn:
-        for f in files:
-            filename = f.filename or "untitled"
-            # Sanitize filename: only keep basename, prevent path traversal
-            safe_name = Path(filename).name
-            if not safe_name:
-                safe_name = "untitled"
-
-            # Unique filename on disk
-            file_path = upload_dir / safe_name
-            stem, suffix = file_path.stem, file_path.suffix
-            counter = 1
-            while file_path.exists():
-                file_path = upload_dir / f"{stem} ({counter}){suffix}"
-                counter += 1
-
-            content = await f.read()
-            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
-            if err:
-                results.append({"name": safe_name, "error": err})
-                continue
-            file_path.write_bytes(content)
-
-            # Determine if this is a folder marker or actual file
-            rel_path = str(file_path.relative_to(data_root))
-            size = len(content)
-            mime = f.content_type or "application/octet-stream"
-
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
-                (ws_id, file_path.name,
-                 json.dumps({"file_path": rel_path, "size": size, "mime_type": mime}),
-                 parent_id),
-            )
-            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": size})
-
-        conn.commit()
-
-    return {"status": "ok", "items": results}
-
-
-
-
-@router.post("/api/local-workspace/upload-folder")
-async def upload_local_workspace_folder(request: Request):
-    """Handle recursive folder upload.
-
-    Frontend walks the directory tree with webkitGetAsEntry and sends:
-    - 'structure': JSON array of {path: str, type: 'folder'|'file'}
-    - 'files': multipart files (one per file in the structure)
-    - 'parent_id': target folder (optional)
-
-    Creates folders first, then uploads files into their respective folders.
-    """
-    import json
-    from pathlib import Path
-
-    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
-    ws = _get_active_workspace(request, user_id=uid)
-    ws_id = ws["id"] if ws else None
-    if not ws_id:
-        return JSONResponse({"error": "No active workspace"}, status_code=400)
-
-    try:
-        form = await request.form()
-    except Exception:
-        return JSONResponse({"error": "Invalid form data"}, status_code=400)
-
-    parent_id_raw = form.get("parent_id")
-    root_parent_id = int(parent_id_raw) if parent_id_raw else None
-    structure_raw = form.get("structure")
-
-    if not structure_raw:
-        return JSONResponse({"error": "No structure provided"}, status_code=400)
-
-    try:
-        structure = json.loads(structure_raw)
-    except json.JSONDecodeError:
-        return JSONResponse({"error": "Invalid structure JSON"}, status_code=400)
-
-
-    from app.middleware.security import validate_upload
-
-    data_root = Path(settings.data_dir)
-    upload_dir = data_root / f"uploads/workspace_{ws_id}"
-    upload_dir.mkdir(parents=True, exist_ok=True)
-
-    results = []
-    created_folders = {}  # relative_path -> db_id
-
-    with get_conn() as conn:
-        # Phase 1: Create all folders
-        for item in structure:
-            if item.get("type") != "folder":
-                continue
-            path_parts = item["path"].strip("/").split("/")
-            folder_name = path_parts[-1]
-            # Determine parent: parent of this folder in the tree
-            if len(path_parts) == 1:
-                actual_parent = root_parent_id
-            else:
-                parent_path = "/".join(path_parts[:-1])
-                actual_parent = created_folders.get(parent_path)
-
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, '', 'blocks', 'Workspace', ?)""",
-                (ws_id, folder_name, actual_parent),
-            )
-            fid = cursor.lastrowid
-            created_folders[item["path"].strip("/")] = fid
-            results.append({"id": fid, "name": folder_name, "type": "folder"})
-
-        # Phase 2: Upload files into their respective folders
-        for item in structure:
-            if item.get("type") != "file":
-                continue
-            path_parts = item["path"].strip("/").split("/")
-            file_name = path_parts[-1]
-            if len(path_parts) == 1:
-                file_parent = root_parent_id
-            else:
-                parent_path = "/".join(path_parts[:-1])
-                file_parent = created_folders.get(parent_path)
-
-            # Find the matching file in multipart data
-            matched = None
-            for f in form.getlist("files"):
-                if f.filename and (f.filename == item["path"] or f.filename.endswith("/" + file_name)):
-                    matched = f
-                    break
-            if not matched:
-                continue
-
-            safe_name = Path(file_name).name
-            file_path = upload_dir / safe_name
-            stem, suffix = file_path.stem, file_path.suffix
-            counter = 1
-            while file_path.exists():
-                file_path = upload_dir / f"{stem} ({counter}){suffix}"
-                counter += 1
-
-            content = await matched.read()
-            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
-            if err:
-                results.append({"name": safe_name, "error": err})
-                continue
-            file_path.write_bytes(content)
-
-            rel_path = str(file_path.relative_to(data_root))
-            cursor = conn.execute(
-                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
-                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
-                (ws_id, file_path.name,
-                 json.dumps({"file_path": rel_path, "size": len(content), "mime_type": matched.content_type or "application/octet-stream"}),
-                 file_parent),
-            )
-            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": len(content)})
-
-        conn.commit()
-
-    return {"status": "ok", "items": results}
-
-
-# ═══════════ Workspaces CRUD ═══════════
@@ -1,249 +0,0 @@
-"""FlowDeck — Dashboard : pages_api.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Library page actions API ═══════════
-
-@router.get("/api/pages/{page_id:int}/content")
-def api_page_content(page_id: int):
-    """Get page content for side peek preview."""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT title, content, content_format FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-        if not row:
-            return JSONResponse({"error": "Not found"}, status_code=404)
-    # v6.5.0: resolve synced blocks server-side (fresh content on read).
-    from app.services.synced_blocks import resolve_content_json
-    return {
-        "title": row["title"],
-        "content": resolve_content_json(row["content"], row["content_format"]),
-        "format": row["content_format"] or "blocks",
-    }
-
-
-
-
-@router.put("/api/pages/{page_id:int}/rename")
-def api_rename_page(page_id: int, request: Request, body: dict = Body(default={})):
-    """Inline rename a page title."""
-    title = (body.get("title") or "").strip()
-    if not title:
-        return JSONResponse({"error": "Title required"}, status_code=400)
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=? AND deleted_at IS NULL",
-            (title, page_id),
-        )
-        # v6.5.0: renaming a database row's content page updates the row.
-        from app.services.row_pages import sync_page_title_to_row
-        sync_page_title_to_row(conn, page_id)
-        conn.commit()
-    return {"status": "ok", "title": title}
-
-
-
-
-@router.post("/api/pages/{page_id:int}/trash")
-def api_trash_page(page_id: int, request: Request):
-    """Soft-delete a page (move to trash).
-
-    v7.45.5 : ``parent_section`` n'est plus réécrit en 'Trash' — ``deleted_at``
-    est la seule source de vérité. L'ancienne écriture marquait définitivement
-    la page : à la restauration elle restait 'Trash' et disparaissait des
-    listings Library / Recents / Private (``parent_section != 'Trash'``).
-    """
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE pages SET deleted_at=CURRENT_TIMESTAMP WHERE id=?",
-            (page_id,),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.post("/api/pages/{page_id:int}/convert-to-database")
-def api_convert_to_database(page_id: int, request: Request, body: dict = Body(default={})):
-    """Convert a page into a full-page database (Notion-style).
-
-    Creates a collection linked to this page, adds the default 'Name' property,
-    and sets the page's content_format to 'collection'.
-    """
-    import json as _json
-    db_name = (body.get("name") or "").strip()
-
-    with get_conn() as conn:
-        page = conn.execute(
-            "SELECT id, title, workspace_id FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-        if not page:
-            return JSONResponse({"error": "Page not found"}, status_code=404)
-
-        if not db_name:
-            db_name = page["title"] or "New Database"
-
-        # Create the collection
-        cur = conn.execute(
-            """INSERT INTO collections
-               (name, description, icon, schema_json, is_inline, parent_page_id, workspace_id)
-               VALUES (?, '', '📋', '[]', 0, ?, ?)""",
-            (db_name, page_id, page["workspace_id"]),
-        )
-        collection_id = cur.lastrowid
-
-        # Create default "Name" property (text, position 0)
-        conn.execute(
-            """INSERT INTO collection_properties
-               (collection_id, name, prop_type, position, required, visible_in_views)
-               VALUES (?, 'Name', 'title', 0, 1, 1)""",
-            (collection_id,),
-        )
-
-        # Create default "Table" view
-        conn.execute(
-            """INSERT INTO collection_views
-               (collection_id, name, view_type, config_json, position)
-               VALUES (?, 'Table', 'table', ?, 0)""",
-            (collection_id, _json.dumps({"visible_properties": ["Name"]})),
-        )
-
-        # Update the page to be a database page
-        conn.execute(
-            "UPDATE pages SET content_format='collection', collection_id=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
-            (collection_id, page_id),
-        )
-
-        conn.commit()
-
-    return {
-        "status": "converted",
-        "collection_id": collection_id,
-        "name": db_name,
-        "view_url": f"/pages/{page_id}",
-    }
-
-
-
-
-@router.get("/api/collections/{collection_id:int}/table-data")
-def api_collection_table_data(collection_id: int):
-    """Get collection properties + pages for rendering the table view."""
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT * FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not coll:
-            return JSONResponse({"error": "Collection not found"}, status_code=404)
-
-        properties = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-        pages = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-        views = [
-            dict(r) for r in conn.execute(
-                "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-
-    return {
-        "collection": dict(coll),
-        "properties": properties,
-        "pages": pages,
-        "views": views,
-    }
-
-
-
-
-@router.post("/api/collections/{collection_id:int}/pages")
-def api_create_collection_page(collection_id: int, request: Request, body: dict = Body(default={})):
-    """Create a new page (row) in a collection."""
-    import json as _json
-    title = body.get("title", "New page").strip() or "New page"
-    icon = body.get("icon", "file")
-
-    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT id FROM collections WHERE id=?", (collection_id,)
-        ).fetchone()
-        if not coll:
-            return JSONResponse({"error": "Collection not found"}, status_code=404)
-
-        # Get next position
-        max_pos = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-
-        # Load default property values from collection properties
-        props = [
-            dict(r) for r in conn.execute(
-                "SELECT id, name, prop_type FROM collection_properties WHERE collection_id=? ORDER BY position",
-                (collection_id,),
-            ).fetchall()
-        ]
-        default_values = {}
-        for p in props:
-            if p["prop_type"] == "title":
-                default_values[str(p["id"])] = title
-        # Caller-provided values (e.g. board "add card in column X") win.
-        incoming = body.get("properties") or {}
-        if isinstance(incoming, dict):
-            default_values.update(incoming)
-
-        from app.services.property_types import apply_auto_properties
-        user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {"login": "admin", "id": 1}
-        apply_auto_properties(props, default_values, user, is_create=True)
-
-        cur = conn.execute(
-            """INSERT INTO collection_pages
-               (collection_id, title, icon, cover_url, position, property_values_json)
-               VALUES (?, ?, ?, ?, ?, ?)""",
-            (collection_id, title, icon, body.get("cover_url", ""), max_pos,
-             _json.dumps(default_values)),
-        )
-        page_id = cur.lastrowid
-        conn.commit()
-
-    return {
-        "id": page_id,
-        "title": title,
-        "icon": icon,
-        "position": max_pos,
-        "property_values_json": default_values,
-        "status": "created",
-    }
@@ -1,488 +0,0 @@
-"""FlowDeck — Dashboard : pages_html.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-from ._common import _get_active_workspace, _get_user_id, _nav_breadcrumb, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.get("/trash", response_class=HTMLResponse)
-def trash_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
-    """Trash page — scoped to workspace if owner/repo provided."""
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    sidebar = board_sidebar(request, owner, repo)
-    with get_conn() as conn:
-        ws_key = f"{owner}/{repo}" if owner and repo else ""
-        # Pages are soft-deleted via deleted_at (parent_section n'est plus
-        # touché par le trash → source de vérité unique, v7.45.5)
-        if ws_key:
-            rows = conn.execute(
-                "SELECT id, title, workspace FROM pages WHERE deleted_at IS NOT NULL AND workspace=? ORDER BY updated_at DESC",
-                (ws_key,),
-            ).fetchall()
-        else:
-            rows = conn.execute(
-                "SELECT id, title, workspace FROM pages WHERE deleted_at IS NOT NULL ORDER BY updated_at DESC",
-            ).fetchall()
-    sidebar["trash_items"] = [{"id": r["id"], "name": r["title"] or "Untitled", "workspace": r["workspace"]} for r in rows]
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    sidebar["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("trash.html")
-    return template.render(**sidebar)
-
-
-
-
-@router.get("/library", response_class=HTMLResponse)
-def library_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
-    """Library page — tabbed view (recents, favorites, shared, published, private, workspace).
-
-    Sidebar data is kept intact. Tab content is loaded client-side via /api/library/* endpoints.
-    """
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    sidebar = board_sidebar(request, owner, repo)
-    # Pass active workspace for breadcrumb nav menu
-    ws_key_ws = f"{owner}/{repo}" if owner and repo else ""
-    if ws_key_ws:
-        with get_conn() as conn:
-            ws_row = conn.execute("SELECT id FROM workspaces WHERE name=? AND owner_id=?", (ws_key_ws, _get_user_id(request))).fetchone()
-            sidebar["nav_workspace_id"] = ws_row["id"] if ws_row else 0
-    else:
-        ws = _get_active_workspace(request, user_id=_get_user_id(request))
-        sidebar["nav_workspace_id"] = ws["id"] if ws else 0
-
-    template = env.get_template("library.html")
-    sidebar["active_workspace_id"] = sidebar.get("nav_workspace_id", 0)
-    # Gitea workspace context for Repository tab
-    sidebar["is_gitea_workspace"] = bool(owner and repo)
-    sidebar["gitea_workspace_owner"] = owner
-    sidebar["gitea_workspace_repo"] = repo
-    return template.render(**sidebar)
-
-
-
-
-@router.get("/pages/{page_id}", response_class=HTMLResponse)
-def view_page_root(request: Request, page_id: int):
-    """Render a Markdown page at root level with workspace context — or file viewer.
-    ?embed=1 — minimal mode for side peek (editor only, no header)."""
-    embed = request.query_params.get("embed") == "1"
-    from app.routers.board import _sidebar_data as board_sidebar
-    from app.templating import ENV
-    env = ENV
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            return RedirectResponse("/workspaces", status_code=302)
-    page = dict(row)
-    # v6.5.0: synced blocks resolve server-side at read time.
-    from app.services.synced_blocks import resolve_content_json
-    page["content"] = resolve_content_json(page.get("content", ""), page.get("content_format"))
-
-    ws = page.get("workspace", "")
-    parts = ws.split("/") if "/" in ws else ["", ""]
-    owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
-    sidebar = board_sidebar(request, owner, repo)
-    # Load sub-pages
-    with get_conn() as conn:
-        subs = conn.execute(
-            "SELECT id, title FROM pages WHERE parent_id=? ORDER BY updated_at DESC",
-            (page_id,),
-        ).fetchall()
-        fav = conn.execute(
-            "SELECT id FROM favorites WHERE user_id=? AND page_id=?",
-            (1, page_id),
-        ).fetchone()
-
-    # Build page_data, including file metadata for uploaded files
-    _locked = bool(page.get("is_locked", 0))
-    _locked_by = page.get("locked_by") if "locked_by" in page else None
-    _sess_user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    _uid = _sess_user.get("id") if _sess_user and _sess_user.get("id") else None
-    _can_edit = (not _locked) or bool(_sess_user and _sess_user.get("is_admin")) or (_locked_by and _uid and _locked_by == _uid)
-    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0)),
-                 "is_locked": _locked,
-                 "locked_by": _locked_by,
-                 "can_edit": _can_edit,
-                 "full_width": bool(page.get("full_width", 0)) if "full_width" in page else False,
-                 "font_small": bool(page.get("font_small", 0)) if "font_small" in page else False}
-
-    # For file pages, extract file metadata and add to page_data
-    if page.get("content_format") == "file":
-        import json as _json
-        try:
-            meta = _json.loads(page.get("content", "{}"))
-        except _json.JSONDecodeError:
-            meta = {}
-        file_path = meta.get("file_path", "").replace("\\", "/")
-        mime_type = meta.get("mime_type", "application/octet-stream")
-        file_size = meta.get("size", 0)
-        fp_parts = file_path.split("/")
-        ws_id = ""
-        for p in fp_parts:
-            if p.startswith("workspace_"):
-                ws_id = p.replace("workspace_", "")
-                break
-        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
-        from urllib.parse import quote
-        safe_name = quote(filename, safe='')
-        file_url = f"/api/files/{ws_id}/{safe_name}" if ws_id else ""
-        page_data["file_url"] = file_url
-        page_data["file_mime"] = mime_type
-        page_data["file_size"] = file_size
-        page_data["file_name"] = filename
-
-    # For collection (database) pages, load collection + properties + pages
-    collection_data = None
-    if page.get("content_format") == "collection" and page.get("collection_id"):
-        with get_conn() as conn:
-            col = conn.execute(
-                "SELECT * FROM collections WHERE id=?", (page["collection_id"],)
-            ).fetchone()
-            if col:
-                props = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                cpages = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                cviews = [
-                    dict(r) for r in conn.execute(
-                        "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
-                        (page["collection_id"],),
-                    ).fetchall()
-                ]
-                collection_data = {
-                    "collection": dict(col),
-                    "properties": props,
-                    "pages": cpages,
-                    "views": cviews,
-                }
-        page_data["collection_id"] = page["collection_id"]
-
-    with get_conn() as conn:
-        nav_crumbs = _nav_breadcrumb(conn, page_id)
-    # dérivé calculé UNE fois : ctx ET page_data (JSON) l'utilisent (A27)
-    page_is_shared = (
-        bool(page.get("is_shared", 0))
-        or page.get("share_mode", "private") != "private"
-        or bool(page.get("published", 0))
-    )
-    ctx = {**sidebar, "page": page, "sub_pages": [dict(s) for s in subs],
-           "page_favorited": fav is not None,
-           "page_share_mode": page.get("share_mode", "private"),
-           "page_published": bool(page.get("published", 0)),
-           "page_is_shared": page_is_shared,
-           "page_data": page_data,
-           "collection_data": collection_data,
-           "breadcrumb_items": nav_crumbs,
-           "nav_workspace_id": page.get("workspace_id") or 0,
-           "nav_page_id": page_id,
-           "embed_mode": embed}
-    # A27 phase 2 : le JS de l'éditeur lit ces valeurs dans page-data (JSON)
-    # au lieu des interpolations Jinja — une seule source, même calculs que le
-    # ctx ci-dessus.
-    from app.templating import ENV as _ENV27
-    page_data.update(
-        updated_at=page.get("updated_at", ""),
-        created_at=page.get("created_at", ""),
-        user_id=_uid or 0,
-        is_shared=page_is_shared,
-        clip_icon=_ENV27.from_string(
-            "{% from '_icons.html' import fd_icon %}{{ fd_icon('paperclip', 14) }}"
-        ).render(),
-    )
-    # Select template: collection pages use database table view (aussi en
-    # mode embed : `page_editor_collection.html` + body.embed-mode = le
-    # tableau SANS sidebar ni barre — le peek d'une base reste le tableau).
-    if page.get("content_format") == "collection":
-        template = env.get_template("page_editor_collection.html")
-    else:
-        template = env.get_template("page_editor_embed.html" if embed else "page_editor.html")
-    response = template.render(**ctx)
-    return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})
-
-
-
-
-@router.get("/accounts", response_class=HTMLResponse)
-def accounts_page(request: Request):
-    """Account management panel."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    with get_conn() as conn:
-        users = conn.execute(
-            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
-            "is_admin, is_active, created_at FROM users ORDER BY created_at DESC"
-        ).fetchall()
-    ctx = {**sidebar, "user": user, "users": [dict(u) for u in users]}
-    template = env.get_template("accounts.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/help", response_class=HTMLResponse)
-def help_page(request: Request):
-    """Comprehensive help & documentation page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    # Render via a block-based template so content_html lands in {% block content %}
-    block_tpl = env.from_string(
-        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
-    )
-    return HTMLResponse(block_tpl.render(
-        **sidebar,
-        request=request,
-        page_title="Help",
-        title_prefix="Help",
-        page_icon="❓",
-        content_html="""<style>
-.help-page{max-width:900px;margin:0 auto;padding:40px 24px 80px;}
-.help-hero{text-align:center;margin-bottom:48px;}
-.help-hero h1{font-size:32px;font-weight:800;margin:0 0 8px;}
-.help-hero p{font-size:16px;color:var(--text-dim);max-width:500px;margin:0 auto;}
-.help-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin-bottom:48px;}
-.help-card{background:var(--bg-card);border:1px solid var(--border);border-radius:12px;padding:24px;transition:border-color .15s;}
-.help-card:hover{border-color:rgba(255,255,255,.12);}
-.help-card h3{font-size:15px;font-weight:600;margin:0 0 4px;display:flex;align-items:center;gap:8px;}
-.help-card .icon{font-size:20px;}
-.help-card p{font-size:13px;color:var(--text-dim);line-height:1.5;margin:8px 0 0;}
-.help-card ul{list-style:none;padding:0;margin:12px 0 0;}
-.help-card li{font-size:13px;padding:3px 0;color:var(--text-dim);}
-.help-card li::before{content:'• ';color:var(--accent);}
-.help-section{margin-bottom:48px;}
-.help-section h2{font-size:20px;font-weight:700;margin:0 0 16px;padding-bottom:8px;border-bottom:1px solid var(--border);}
-.help-kbd{display:inline-block;padding:2px 8px;background:var(--bg-tertiary);border:1px solid var(--border);border-radius:4px;font-family:monospace;font-size:12px;color:var(--text);min-width:16px;text-align:center;}
-.help-shortcut-row{display:flex;align-items:center;gap:12px;padding:8px 12px;border-radius:6px;margin-bottom:2px;}
-.help-shortcut-row:hover{background:var(--bg-hover);}
-.help-shortcut-row .keys{display:flex;gap:4px;min-width:140px;}
-.help-shortcut-row .desc{font-size:13px;color:var(--text-dim);}
-.help-badge{display:inline-block;padding:2px 10px;border-radius:20px;font-size:11px;font-weight:600;}
-.help-badge.local{background:rgba(35,131,226,.15);color:#2C8CEB;}
-.help-badge.gitea{background:rgba(0,200,100,.15);color:#00CC66;}
-.help-badge.github{background:rgba(130,80,220,.15);color:#A060F0;}
-.help-badge.sso{background:rgba(217,115,13,.18);color:#E0952B;}
-</style>
-<div class="help-page">
-<div class="help-hero">
-<h1>❓ FlowDeck Help</h1>
-<p>Everything you need to know about your Notion-style workspace with Gitea & GitHub integration.</p>
-</div>
-
-<div class="help-grid">
-<div class="help-card">
-<h3><span class="icon">🚀</span>Getting Started</h3>
-<p>FlowDeck is your private, self-hosted workspace. Create pages, organize projects, and integrate with your Git forge.</p>
-<ul>
-<li>Create a workspace from the <b>Workspaces</b> page</li>
-<li>Click <b>📄 New Page</b> in the sidebar to start writing</li>
-<li>Use <span class="help-kbd">Ctrl+N</span> anywhere to create a page</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📝</span>Pages & Editor</h3>
-<p>Notion-style block editor with slash commands, markdown shortcuts, and rich formatting.</p>
-<ul>
-<li>Type <span class="help-kbd">/</span> for the slash command menu</li>
-<li>Drag & drop pages in the sidebar to reorganize</li>
-<li>Right-click for context menu (duplicate, rename, delete)</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">{{ fd_icon("folder",16) }}</span>Workspaces</h3>
-<p>Organize your work into separate workspaces. Each has its own pages and files.</p>
-<ul>
-<li><span class="help-badge local">Local</span> Files stored on your server</li>
-<li><span class="help-badge gitea">Gitea</span> Connect to browse & edit repos</li>
-<li><span class="help-badge github">GitHub</span> Connect via Settings → Integrations</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">🦎</span>Gitea Integration</h3>
-<p>Connect your Gitea account to access repositories directly from FlowDeck.</p>
-<ul>
-<li>Go to <b>Settings → Integrations</b> to connect</li>
-<li>Browse repo file trees in the sidebar</li>
-<li>Create & edit files with commit messages</li>
-<li>Sync labels as tags</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">🌐</span>Sharing & Publishing</h3>
-<p>Share pages with collaborators or publish them to the web.</p>
-<ul>
-<li>Click <b>Share</b> in the page editor top-right</li>
-<li>Share with specific users or get a public link</li>
-<li>Publish to make a page visible at <code>/p/your-slug</code></li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📚</span>Library, Trash & Tasks</h3>
-<p>Find all your content in one place with powerful filtering.</p>
-<ul>
-<li><b>Library</b> — Tabs for Recents, Favorites, Shared, Published</li>
-<li><b>Trash</b> — Soft-deleted pages (30-day retention)</li>
-<li><b>My Tasks</b> — Aggregated tasks from all collections</li>
-</ul>
-</div>
-
-<div class="help-card">
-<h3><span class="icon">📶</span>Offline & PWA</h3>
-<p>Install FlowDeck as an app and keep working without a connection.</p>
-<ul>
-<li><b>Install</b> — browser menu → <i>Install app</i> / <i>Add to Home Screen</i></li>
-<li>Edits made offline are queued locally and synced automatically</li>
-<li>A <b>⟳</b> marker shows pages with pending changes</li>
-</ul>
-</div>
-</div>
-
-<div class="help-section">
-<h2>⌨️ Keyboard Shortcuts</h2>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">N</span></div><div class="desc">Create new page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">K</span></div><div class="desc">Quick find / command palette</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">S</span></div><div class="desc">Save current page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">F2</span></div><div class="desc">Rename selected item</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Delete</span></div><div class="desc">Move selected item to trash</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Escape</span></div><div class="desc">Close modal / cancel editing</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Enter</span></div><div class="desc">Open selected page</div></div>
-<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">O</span></div><div class="desc">New AI chat (in footer)</div></div>
-</div>
-
-<div class="help-section">
-<h2>🔐 Authentication</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck supports three authentication methods:<br>
-<span class="help-badge local">Local</span> Email + password — create an account on the login page.<br>
-<span class="help-badge gitea">Gitea OAuth</span> Login with your Gitea account. Your repos appear as workspaces.<br>
-<span class="help-badge github">GitHub OAuth</span> Login or link your GitHub account in Settings → Integrations.<br><br>
-<b>Tip:</b> You can connect Gitea/GitHub to an existing local account — your identity stays as your local user.
-</p>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-<span class="help-badge sso">SSO</span> <b>Enterprise SSO</b> (v6.7.0) — sign in with your organization account.<br>
-<i>For administrators:</i> open <b>Settings → Admin → SSO / Enterprise</b> and pick a provider:<br>
-• <b>SAML 2.0</b> — paste the IdP <i>Entity ID</i>, <i>SSO URL</i> and signing certificate, then give the IdP this
-<code>/auth/saml/metadata</code> link (it contains the SP Entity ID, ACS URL and certificate).<br>
-• <b>OpenID Connect</b> — paste the <i>Issuer URL</i>, <i>Client ID</i> and <i>Client Secret</i> (PKCE is used, scopes default to <code>openid profile email</code>).<br>
-• <b>Provisioning</b> — accounts are created automatically on first login, groups from the IdP map to workspace roles,
-and <i>SSO only</i> disables local login (admins keep their local door). Every attempt is audited in
-<b>Settings → Admin → SSO / Enterprise</b> (login history).
-</p>
-</div>
-
-<div class="help-section">
-<h2>📶 Offline mode (PWA)</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck is a Progressive Web App: pages you visited stay available offline and your
-edits are saved locally, then synchronised when the connection returns.<br><br>
-<b>Install:</b> open your browser menu and choose <i>Install app</i> (Chrome/Edge) or
-<i>Add to Home Screen</i> (Safari/iOS). FlowDeck then opens in its own window.<br>
-<b>Offline editing:</b> while offline, the editor stores changes in the browser
-(IndexedDB) and shows an offline banner with the number of pending changes. A
-<b>⟳</b> icon appears next to pages that have unsynced edits.<br>
-<b>Reconnection:</b> the queue is replayed automatically (and via Background Sync).
-A spinner badge appears while syncing, followed by a confirmation toast.<br>
-<b>Conflicts:</b> if a page changed on the server, the latest edit wins and a notice is
-shown. If a page was deleted server-side, your offline copy is recreated as an orphan
-page. If a page with the same title already exists, the offline copy is renamed
-<i>“Title (copie offline)”</i>.
-</p>
-</div>
-
-<div class="help-section">
-<h2>🔌 API publique v2</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-FlowDeck exposes a full REST API under <b>/api/v2</b> for third-party integrations.<br>
-<b>Auth:</b> create a token in Settings → API tokens, then send it as
-<code>Authorization: Bearer &lt;token&gt;</code>. Tokens carry scopes
-<code>read</code>, <code>write</code> or <code>admin</code> (a higher scope implies the lower ones).<br>
-<b>Features:</b> CRUD on collections, pages, properties, views, comments, notifications,
-favorites, tags, sharing, sprints and templates; pagination (<code>?limit=&amp;offset=</code> +
-<code>X-Total-Count</code>), filters (<code>filter[prop]=value</code>), sorting, full-text search
-(<code>/api/v2/search</code>), idempotency (<code>Idempotency-Key</code>) and RFC 7807 error bodies.<br>
-<b>Reference:</b> interactive OpenAPI docs at <a href="/docs" target="_blank" rel="noopener">/docs</a>
-(also <code>/redoc</code>, <code>docs/openapi-v2.json</code>).
-</p>
-</div>
-
-<div class="help-section">
-<h2>💡 Tips</h2>
-<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
-• Toggle the sidebar with the <b>«</b> button in the top-left corner.<br>
-• Switch between workspaces using the dropdown menu in the sidebar header.<br>
-• The <b>Private</b> section appears when a remote workspace is active — files here stay local.<br>
-• Hover over any sidebar item to see action buttons (favorite, share, delete).<br>
-• Use <b>Ctrl+Click</b> or <b>Shift+Click</b> to multi-select items in the sidebar.
-</p>
-</div>
-
-</div>"""
-    ))
-
-
-
-
-@router.get("/accounts/settings", response_class=HTMLResponse)
-def settings_page(request: Request):
-    """User settings page — profile, forges, tokens."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        from fastapi.responses import RedirectResponse
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    # Check forge connections
-    gitea_connected = False
-    github_connected = False
-    if user.get("id"):
-        with get_conn() as conn:
-            tokens = conn.execute(
-                "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
-            ).fetchall()
-            for t in tokens:
-                if t["provider"] == "gitea":
-                    gitea_connected = True
-                elif t["provider"] == "github":
-                    github_connected = True
-    ctx = {**sidebar, "user": user, "gitea_connected": gitea_connected, "github_connected": github_connected}
-    template = env.get_template("settings.html")
-    response = template.render(**ctx)
-    return HTMLResponse(content=response)
-
-
-# ═══════════ User API endpoints ═══════════
@@ -1,78 +0,0 @@
-"""FlowDeck — Dashboard : public.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Request
-from fastapi.responses import HTMLResponse
-
-from app.db import get_conn
-
-from ._common import _render_blocks_public
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-# ═══════════ Public Published Page ═══════════
-
-
-@router.get("/p/{slug}", response_class=HTMLResponse)
-def public_published_page(request: Request, slug: str):
-    """Serve a published page at /p/<slug> — no auth required."""
-    from app.templating import ENV
-
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, title, content, content_format, updated_at, created_at, cover_url, page_icon "
-            "FROM pages WHERE publish_slug=? AND is_published=1",
-            (slug,),
-        ).fetchone()
-
-    if not row:
-        return HTMLResponse(
-            """<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
-<title>Not Found — FlowDeck</title>
-<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;
-justify-content:center;height:100vh;margin:0;background:#191919;color:#ccc;}
-h1{font-size:3rem;opacity:.3}</style></head><body><h1>404</h1></body></html>""",
-            status_code=404,
-        )
-
-    page = dict(row)
-    env = ENV
-
-    # Convert blocks to HTML for rendering
-    content_html = ""
-    if page.get("content_format") == "blocks" and page.get("content"):
-        import json as _json
-        try:
-            blocks = _json.loads(page["content"])
-            from app.services.synced_blocks import resolve_synced_block
-            blocks = resolve_synced_block(blocks)
-            from app.db import get_conn as _gc
-            from app.services.wiki_links import token_labels
-            with _gc() as conn:
-                wiki_titles_map = token_labels(conn, page["content"])
-            content_html = _render_blocks_public(blocks, wiki_titles_map)
-        except (_json.JSONDecodeError, Exception):
-            content_html = f"<p>{page.get('content', '')}</p>"
-    elif page.get("content"):
-        # Plain text / markdown
-        text = page["content"]
-        content_html = f"<pre style='white-space:pre-wrap;font-family:system-ui;font-size:16px;line-height:1.6;'>{text}</pre>"
-
-    template = env.get_template("public_page.html")
-    return template.render(
-        title=page["title"] or "Untitled",
-        content_html=content_html,
-        updated_at=page.get("updated_at", ""),
-        created_at=page.get("created_at", ""),
-        cover_url=page.get("cover_url", ""),
-        page_icon=page.get("page_icon", ""),
-    )
@@ -1,321 +0,0 @@
-"""FlowDeck — Dashboard : workspace.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, Query, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.gitea_client import get_user_gitea_client, gitea
-
-from ._common import _get_active_workspace, _get_user_id, _sidebar_data
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-
-
-@router.get("/", response_class=HTMLResponse)
-async def dashboard(
-    request: Request,
-    search: str = Query(default=""),
-    show_archived: bool = Query(default=False),
-):
-    """Smart root route: landing for visitors, local workspace for new users, dashboard for Gitea users."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-
-    # ── Not authenticated → show landing page ──
-    if not user:
-        # Allow through if DB is empty (fresh install)
-        try:
-            with get_conn() as conn:
-                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-                if count == 0:
-                    from app.templating import ENV
-                    env = ENV
-                    template = env.get_template("landing.html")
-                    return template.render()
-        except Exception:
-            logger.exception("dashboard")
-        from app.templating import ENV
-        env = ENV
-        template = env.get_template("landing.html")
-        return template.render()
-
-    # ── Authenticated ──
-    user_id = user.get("id", 1)
-    has_gitea = False
-    try:
-        with get_conn() as conn:
-            tok = conn.execute(
-                "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider='gitea'",
-                (user_id,),
-            ).fetchone()
-            has_gitea = bool(tok)
-    except Exception:
-        logger.exception("dashboard")
-
-    if not has_gitea:
-        # Check if user has any workspace
-        try:
-            with get_conn() as conn:
-                ws_count = conn.execute(
-                    "SELECT COUNT(*) FROM workspaces WHERE owner_id=?", (user_id,)
-                ).fetchone()[0]
-                if ws_count == 0:
-                    # v5.2.0: first-launch → onboarding wizard
-                    return RedirectResponse("/welcome", status_code=302)
-        except Exception:
-            logger.exception("dashboard")
-        return RedirectResponse("/local-workspace", status_code=302)
-
-    # ── Gitea user → full dashboard ──
-    try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
-        if search:
-            q = search.lower()
-            repos = [r for r in repos if q in r.get("full_name", "").lower()
-                     or q in (r.get("description") or "").lower()]
-        if not show_archived:
-            repos = [r for r in repos if not r.get("archived", False)]
-        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
-    except Exception as e:
-        logger.error("Dashboard error: %s", e)
-        repos = []
-
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, repos)
-    template = env.get_template("dashboard.html")
-    return template.render(request=request, repos=repos, search=search,
-                           show_archived=show_archived, **sidebar)
-
-
-# ═══════════ Workspace ═══════════
-
-
-
-
-# ═══════════ Workspace ═══════════
-
-@router.get("/workspace", response_class=HTMLResponse)
-def workspace_page(request: Request):
-    """Unified workspace showing all projects."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("workspace.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/gitea-workspace", response_class=HTMLResponse)
-def gitea_workspace_page(request: Request):
-    """Gitea workspace — browse repo files."""
-    import json
-
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    owner = request.query_params.get("owner", "")
-    repo = request.query_params.get("repo", "")
-    ws_key = f"{owner}/{repo}" if owner and repo else ""
-    ws_name = ws_key or "Gitea Workspace"
-    # Auto-create local workspace mirror for storing local files
-    local_ws_id = None
-    if ws_key:
-        with get_conn() as conn:
-            existing = conn.execute(
-                "SELECT id, owner_id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
-                (user["id"], ws_key, "%gitea_repo%")
-            ).fetchone()
-            if existing:
-                local_ws_id = existing["id"]
-            else:
-                c = conn.execute(
-                    "INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)",
-                    (ws_key, user["id"], json.dumps({"gitea_repo": ws_key, "gitea_owner": owner}))
-                )
-                local_ws_id = c.lastrowid
-                conn.execute(
-                    "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
-                    (local_ws_id, user["id"], "admin")
-                )
-                conn.commit()
-    ctx = {
-        **sidebar,
-        "user": user,
-        "active_ws_name": ws_name,
-        "workspace_key": ws_key,
-        "gitea_workspace": True,  # always true on this page
-        "gitea_owner": owner,
-        "gitea_repo": repo,
-        "workspace_name": ws_name,
-        "workspace_initial": repo[0].upper() if repo else "G",
-        "owner": owner,
-        "repo": repo,
-        "nav_workspace_id": local_ws_id or 0,  # for breadcrumb nav menu
-    }
-    template = env.get_template("gitea_workspace.html")
-    resp = HTMLResponse(content=template.render(**ctx))
-    resp.set_cookie("flowdeck_workspace", f"gitea:{owner}:{repo}", path="/", samesite="lax")
-    return resp
-
-
-
-
-@router.get("/api/workspace/projects")
-async def list_workspace_projects(request: Request):
-    """List all projects: built-in + Gitea + GitHub.
-    Uses the user's own Gitea token if connected, not the global admin token."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-
-    builtin = []
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, title FROM pages WHERE parent_id IS NULL AND collection_row_id IS NULL ORDER BY updated_at DESC LIMIT 20"
-        ).fetchall()
-        # A23 : une seule agrégation GROUP BY au lieu d'un COUNT par ligne.
-        counts = {}
-        if rows:
-            for c in conn.execute(
-                "SELECT parent_id, COUNT(*) AS c FROM pages WHERE parent_id IN ({}) GROUP BY parent_id".format(
-                    ",".join("?" * len(rows))
-                ),
-                [r["id"] for r in rows],
-            ).fetchall():
-                counts[c["parent_id"]] = c["c"]
-        for r in rows:
-            builtin.append({"id": str(r["id"]), "name": r["title"] or "Untitled", "pageCount": counts.get(r["id"], 0), "forge": "builtin"})
-
-    gitea_repos = []
-    # Use per-user token if available, otherwise return empty
-    user_gitea = get_user_gitea_client(request) if user else None
-    if user_gitea:
-        try:
-            repos = await user_gitea.get_user_repos(page=1, limit=50)
-            for repo in repos:
-                gitea_repos.append({
-                    "id": str(repo.get("id", "")),
-                    "name": repo.get("name", ""),
-                    "full_name": repo.get("full_name", ""),
-                    "description": repo.get("description", ""),
-                    "html_url": repo.get("html_url", ""),
-                    "language": repo.get("language", ""),
-                    "forge": "gitea",
-                })
-        except Exception:
-            logger.exception("list_workspace_projects")
-
-    return {"builtin": builtin, "gitea": gitea_repos, "github": []}
-
-
-
-
-@router.post("/api/workspace/projects")
-def create_workspace_project(request: Request, body: dict = Body(default={})):
-    name = body.get("name", "").strip()
-    if not name:
-        return {"error": "Name required"}
-    with get_conn() as conn:
-        cursor = conn.execute(
-            "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')",
-            (name,),
-        )
-        conn.commit()
-        pid = cursor.lastrowid
-    return {"id": pid, "name": name, "forge": "builtin"}
-
-
-# ═══════════ Workspace Members API ═══════════
-
-
-
-
-# ═══════════ Workspace Members API ═══════════
-
-@router.get("/api/workspace/{ws_id:int}/members")
-def list_members(request: Request, ws_id: int):
-    """List all members of a workspace."""
-    with get_conn() as conn:
-        rows = conn.execute(
-            """SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at
-               FROM workspace_members wm JOIN users u ON u.id = wm.user_id
-               WHERE wm.workspace_id=? ORDER BY wm.joined_at""", (ws_id,)
-        ).fetchall()
-    return {"members": [dict(r) for r in rows]}
-
-
-
-
-@router.post("/api/workspace/{ws_id:int}/members")
-def invite_member(request: Request, ws_id: int, body: dict = Body(default={})):
-    """Invite a user to a workspace by email."""
-    email = body.get("email", "").strip()
-    role = body.get("role", "editor")
-    if role not in ("owner", "admin", "editor", "viewer"):
-        return {"error": "Invalid role"}, 400
-    with get_conn() as conn:
-        user = conn.execute("SELECT id FROM users WHERE login=? OR email=?", (email, email)).fetchone()
-        if not user:
-            return {"error": "User not found"}, 404
-        try:
-            conn.execute(
-                "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
-                (ws_id, user["id"], role),
-            )
-            conn.commit()
-        except Exception:
-            return {"error": "Already a member"}, 409
-    return {"status": "ok", "user_id": user["id"], "role": role}
-
-
-
-
-@router.put("/api/workspace/{ws_id:int}/members/{user_id:int}")
-def update_member_role(request: Request, ws_id: int, user_id: int, body: dict = Body(default={})):
-    """Change a member's role."""
-    role = body.get("role", "editor")
-    if role not in ("owner", "admin", "editor", "viewer"):
-        return {"error": "Invalid role"}
-    with get_conn() as conn:
-        conn.execute(
-            "UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?",
-            (role, ws_id, user_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/workspace/{ws_id:int}/members/{user_id:int}")
-def remove_member(request: Request, ws_id: int, user_id: int):
-    """Remove a member from a workspace."""
-    with get_conn() as conn:
-        conn.execute(
-            "DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?",
-            (ws_id, user_id),
-        )
-        conn.commit()
-    return {"status": "ok"}
-
-
-# ═══════════ Local Workspace (file/folder CRUD) ═══════════
@@ -1,167 +0,0 @@
-"""FlowDeck — Dashboard : workspaces.
-
-Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
-"""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.collection_lifecycle import (
-    delete_collections,
-    workspace_collection_ids,
-)
-
-from ._common import (
-    WORKSPACE_COOKIE,
-    _get_active_workspace,
-    _get_user_id,
-    _require_user_id,
-    _sidebar_data,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-def _require_ws_owner(request: Request, ws_id: int) -> int:
-    """A3/A4 — session obligatoire + l'appelant doit posseder l'espace
-    (ou être admin global). Sans ce garde, un POST/DELETE anonyme créait ou
-    supprimait des espaces au nom de l'utilisateur 1."""
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT owner_id FROM workspaces WHERE id=?", (ws_id,)
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "Workspace not found")
-        is_admin = conn.execute(
-            "SELECT is_admin FROM users WHERE id=?", (uid,)
-        ).fetchone()
-    if row["owner_id"] != uid and not (is_admin and is_admin["is_admin"]):
-        raise HTTPException(403, "Not your workspace")
-    return uid
-
-
-
-
-@router.get("/workspaces", response_class=HTMLResponse)
-def workspaces_page(request: Request):
-    """Workspaces list page."""
-    from app.templating import ENV
-    env = ENV
-    sidebar = _sidebar_data(request, [], include_workspace=False)
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user:
-        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
-    ctx = {**sidebar, "user": user}
-    # Pass active workspace for breadcrumb nav menu (null on workspaces home)
-    ws = _get_active_workspace(request, user_id=_get_user_id(request))
-    ctx["nav_workspace_id"] = ws["id"] if ws else 0
-    template = env.get_template("workspaces.html")
-    return template.render(**ctx)
-
-
-
-
-@router.get("/api/workspaces")
-def list_workspaces(request: Request):
-    """List all workspaces for the current user."""
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT w.*, (SELECT COUNT(*) FROM pages WHERE workspace_id=w.id AND collection_row_id IS NULL) as page_count "
-            "FROM workspaces w WHERE w.owner_id=? ORDER BY w.created_at DESC",
-            (uid,),
-        ).fetchall()
-    workspaces = []
-    for r in rows:
-        d = dict(r)
-        workspaces.append(d)
-    active = _get_active_workspace(request, user_id=_get_user_id(request))
-    return {"workspaces": workspaces, "active_id": active["id"] if active else None}
-
-
-
-
-@router.post("/api/workspaces")
-def create_workspace(request: Request, body: dict = Body(default={})):
-    """Create a new workspace."""
-    name = body.get("name", "New Workspace").strip()
-    if not name:
-        return {"error": "Name required"}
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = _require_user_id(request)
-    with get_conn() as conn:
-        # Ensure user exists (FK constraint)
-        uid_ok = conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone()
-        if not uid_ok:
-            conn.execute(
-                "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?, ?, ?, 1)",
-                (uid, user.get("login", "admin") if user else "admin",
-                 user.get("full_name", "Admin") if user else "Admin"),
-            )
-        cursor = conn.execute(
-            "INSERT INTO workspaces (name, owner_id) VALUES (?, ?)",
-            (name, uid),
-        )
-        ws_id = cursor.lastrowid
-        # Add owner as member
-        conn.execute(
-            "INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')",
-            (ws_id, uid),
-        )
-        conn.commit()
-    return {"id": ws_id, "name": name}
-
-
-
-
-@router.put("/api/workspaces/{ws_id:int}")
-def rename_workspace(request: Request, ws_id: int, body: dict = Body(default={})):
-    """Rename a workspace."""
-    name = body.get("name", "").strip()
-    if not name:
-        return {"error": "Name required"}
-    _require_ws_owner(request, ws_id)
-    with get_conn() as conn:
-        conn.execute("UPDATE workspaces SET name=? WHERE id=?", (name, ws_id))
-        conn.commit()
-    return {"status": "ok"}
-
-
-
-
-@router.delete("/api/workspaces/{ws_id:int}")
-def delete_workspace(request: Request, ws_id: int):
-    """Delete a workspace, its pages and its databases."""
-    _require_ws_owner(request, ws_id)
-    with get_conn() as conn:
-        # Les bases du workspace partaient avec ses pages : les laisser créait
-        # des collections orphelines (workspace_id pointant sur rien) que
-        # /db et My Tasks continuaient de lister.
-        collections = workspace_collection_ids(conn, ws_id)
-        delete_collections(conn, collections)
-        conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws_id,))
-        conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws_id,))
-        conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
-        conn.commit()
-    return {"status": "ok", "collections": len(collections)}
-
-
-
-
-@router.post("/api/workspaces/{ws_id:int}/select")
-def select_workspace(request: Request, ws_id: int):
-    """Set the active workspace via cookie."""
-    _require_ws_owner(request, ws_id)
-    response = JSONResponse({"status": "ok", "workspace_id": ws_id})
-    response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
-    return response
-
-
-# ═══════════ Settings Page ═══════════
@@ -1,100 +0,0 @@
-"""FlowDeck — custom workspace emojis (v5.6.0).
-
-Uploaded emoji images stored per-workspace and usable as page icons. Kept on a
-prefix-less router so the paths stay ``/api/custom-emojis`` (the board router's
-``/{owner}/{repo}`` HTML catch-all would otherwise shadow them).
-"""
-from __future__ import annotations
-
-import datetime
-import re
-from pathlib import Path
-
-from fastapi import APIRouter, HTTPException, Request
-
-from app.config import settings
-from app.db import get_conn
-
-router = APIRouter(tags=["emojis"])
-
-_IMAGE_EXTS = {"png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico", "avif"}
-
-
-def _upload_root() -> Path:
-
-    return Path(settings.data_dir)
-
-
-def _active_ws(request: Request) -> int:
-    """Workspace id from the active-workspace cookie, fallback 1."""
-    try:
-        ws_id = int(request.cookies.get("flowdeck_workspace", "") or 0)
-        if ws_id > 0:
-            return ws_id
-    except (ValueError, TypeError):
-        pass
-    return 1
-
-
-@router.get("/api/custom-emojis")
-def list_custom_emojis(request: Request):
-    """List the current workspace's custom emojis."""
-    ws_id = _active_ws(request)
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, name, url FROM custom_emojis WHERE workspace_id=? ORDER BY created_at DESC",
-            (ws_id,),
-        ).fetchall()
-    return {"status": "ok", "emojis": [dict(r) for r in rows]}
-
-
-@router.post("/api/custom-emojis")
-async def create_custom_emoji(request: Request):
-    """Upload a custom emoji image (multipart: ``name`` + ``file``)."""
-    form = await request.form()
-    name = (form.get("name") or "").strip()[:40] or "emoji"
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    original = (upload.filename or "emoji.png").replace("\\", "/").rsplit("/", 1)[-1]
-    safe = re.sub(r"[^A-Za-z0-9._-]", "_", original)[:80]
-    ext = safe.rsplit(".", 1)[-1].lower() if "." in safe else "png"
-    if ext not in _IMAGE_EXTS:
-        raise HTTPException(400, "Unsupported image format")
-    ws_id = _active_ws(request)
-    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S%f")
-    folder = _upload_root() / f"uploads/workspace_{ws_id}"
-    folder.mkdir(parents=True, exist_ok=True)
-    final = f"emoji_{stamp}_{safe}"
-    (folder / final).write_bytes(await upload.read())
-    url = f"/api/files/{ws_id}/{final}"
-    with get_conn() as conn:
-        cur = conn.execute(
-            "INSERT INTO custom_emojis (workspace_id, name, url) VALUES (?, ?, ?)",
-            (ws_id, name, url),
-        )
-        conn.commit()
-        emoji_id = cur.lastrowid
-    return {"status": "ok", "emoji": {"id": emoji_id, "name": name, "url": url}}
-
-
-@router.delete("/api/custom-emojis/{emoji_id}")
-def delete_custom_emoji(request: Request, emoji_id: int):
-    """Delete a custom emoji (and its stored file)."""
-    ws_id = _active_ws(request)
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT url FROM custom_emojis WHERE id=? AND workspace_id=?",
-            (emoji_id, ws_id),
-        ).fetchone()
-        if not row:
-            raise HTTPException(404, "emoji not found")
-        conn.execute("DELETE FROM custom_emojis WHERE id=?", (emoji_id,))
-        conn.commit()
-    try:
-        fname = (row["url"] or "").rsplit("/", 1)[-1]
-        if fname:
-            (_upload_root() / f"uploads/workspace_{ws_id}" / fname).unlink(missing_ok=True)
-    except OSError:
-        pass
-    return {"status": "ok", "id": emoji_id}
@@ -1,103 +0,0 @@
-"""FlowDeck — Export endpoints (v4.7.0).
-
-Routes /api/export/* — generate Markdown, HTML, PDF and static-site (zip)
-exports server-side for a given page.
-"""
-from __future__ import annotations
-
-import logging
-import re
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import Response
-
-from app.db import get_conn
-from app.services.export import (
-    build_static_site_bytes,
-    page_to_markdown,
-    page_to_pdf_bytes,
-    page_to_standalone_html,
-)
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["export"], prefix="/api/export")
-
-
-def _load_page_or_404(request: Request, page_id: int) -> dict:
-    """A16 : session obligatoire + `PermissionManager.can_view_page` — l'export ne
-    doit pas délivrer le contenu d'une page énumérable par id."""
-    from app.auth.session import SessionManager
-    from app.services.permission_manager import PermissionManager
-
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT * FROM pages WHERE id=? AND deleted_at IS NULL",
-            (page_id,),
-        ).fetchone()
-    if not row:
-        raise HTTPException(status_code=404, detail="Page not found")
-    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
-        raise HTTPException(status_code=404, detail="Page not found")
-    return dict(row)
-
-
-def _download_header(filename: str, media_type: str) -> dict:
-    ascii_name = re.sub(r"[^\x00-\x7F]", "_", filename)
-    quoted = filename.replace('"', '')
-    return {
-        "Content-Disposition": f'attachment; filename="{ascii_name}"; filename*=UTF-8\'\'{quoted}',
-        "Cache-Control": "no-store",
-        "Content-Type": media_type,
-    }
-
-
-def _safe_filename(page: dict, ext: str) -> str:
-    title = (page.get("title") or "Untitled").strip() or "Untitled"
-    title = re.sub(r'[\\/:*?"<>|]+', "_", title)
-    return f"{title}.{ext}"
-
-
-@router.get("/markdown/{page_id}")
-def export_markdown(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    md = page_to_markdown(page)
-    filename = _safe_filename(page, "md")
-    headers = _download_header(filename, "text/markdown")
-    return Response(content=md.encode("utf-8"), status_code=200, headers=headers)
-
-
-@router.get("/html/{page_id}")
-def export_html(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    html = page_to_standalone_html(page)
-    filename = _safe_filename(page, "html")
-    headers = _download_header(filename, "text/html")
-    return Response(content=html.encode("utf-8"), status_code=200, headers=headers)
-
-
-@router.get("/pdf/{page_id}")
-def export_pdf(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    try:
-        pdf_bytes = page_to_pdf_bytes(page)
-    except ImportError:
-        raise HTTPException(status_code=501, detail="PDF export requires 'weasyprint' or 'xhtml2pdf'") from None
-    except Exception as exc:  # noqa: BLE001
-        logger.error("PDF export failed for page %s: %s", page_id, exc)
-        raise HTTPException(status_code=500, detail="PDF generation failed") from exc
-    filename = _safe_filename(page, "pdf")
-    headers = _download_header(filename, "application/pdf")
-    return Response(content=pdf_bytes, status_code=200, headers=headers)
-
-
-@router.get("/site/{page_id}")
-def export_site(page_id: int, request: Request):
-    page = _load_page_or_404(request, page_id)
-    site_bytes = build_static_site_bytes(page)
-    title = _safe_filename(page, "site").replace(".site", "") or "flowdeck-site"
-    filename = f"{title}_site.zip"
-    headers = _download_header(filename, "application/zip")
-    return Response(content=site_bytes, status_code=200, headers=headers)
@@ -1,5 +1,5 @@
 """FlowDeck — Gitea integration API routes."""
-from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi import APIRouter, Request, HTTPException
 from fastapi.responses import JSONResponse

 router = APIRouter(tags=["gitea"], prefix="/api/gitea")
@@ -7,7 +7,7 @@ router = APIRouter(tags=["gitea"], prefix="/api/gitea")

 def _require_gitea(request: Request):
    """Return a per-user GiteaClient or raise 401.
-
+    
    Only returns a client if the user has personally connected their Gitea
    account (OAuth token). No fallback to admin token — each user must link
    their own Gitea account to see Gitea projects.
@@ -19,8 +19,16 @@ def _require_gitea(request: Request):
    return client


+def _require_user_gitea(request: Request):
+    """Return a per-user GiteaClient or raise 401 (required for write ops)."""
+    from app.services.gitea_client import get_user_gitea_client
+    client = get_user_gitea_client(request)
+    if not client:
+        raise HTTPException(status_code=401, detail="Gitea not connected. Go to Settings → Integrations or register with Gitea.")
+    return client


+# ── Orgs ──
@router.get("/orgs")
 async def list_orgs(request: Request):
    """List organizations the user belongs to."""
@@ -84,6 +92,7 @@ async def get_file(request: Request, owner: str, repo: str, path: str):
@router.put("/projects/{owner}/{repo}/file")
 async def save_file(request: Request, owner: str, repo: str):
    """Create or update a file in the repo."""
+    import json
    gitea = _require_gitea(request)  # admin token can write too
    try:
        body = await request.json()
@@ -131,6 +140,7 @@ async def upload_file(request: Request, owner: str, repo: str):
@router.delete("/projects/{owner}/{repo}/file")
 async def delete_file(request: Request, owner: str, repo: str):
    """Delete a file from the repo."""
+    import json
    gitea = _require_gitea(request)  # admin token can write too
    path = request.query_params.get("path", "")
    sha = request.query_params.get("sha", "")
@@ -152,8 +162,8 @@ async def get_labels(request: Request, owner: str, repo: str):
    try:
        labels = await gitea.get_labels(owner, repo)
        return {"labels": [
-            {"id": lbl["id"], "name": lbl["name"], "color": lbl.get("color", "#787774")}
-            for lbl in labels
+            {"id": l["id"], "name": l["name"], "color": l.get("color", "#787774")}
+            for l in labels
        ]}
    except Exception as e:
        return JSONResponse({"error": str(e)}, status_code=502)
@@ -162,7 +172,7 @@ async def get_labels(request: Request, owner: str, repo: str):
 # ── Account linking ──

@router.get("/status")
-def gitea_status(request: Request):
+async def gitea_status(request: Request):
    """Check if the current user has Gitea linked."""
    from app.services.gitea_client import get_user_gitea_client
    client = get_user_gitea_client(request)
@@ -170,7 +180,7 @@ def gitea_status(request: Request):


@router.delete("/disconnect")
-def disconnect_gitea(request: Request):
+async def disconnect_gitea(request: Request):
    """Remove all Gitea OAuth tokens for the current user."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -186,7 +196,7 @@ def disconnect_gitea(request: Request):
 # ── Private Pages (local FlowDeck pages linked to Gitea project) ──

@router.get("/projects/{owner}/{repo}/private-pages")
-def list_private_pages(owner: str, repo: str, request: Request):
+async def list_private_pages(owner: str, repo: str, request: Request):
    """List private pages for this Gitea project."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -202,14 +212,18 @@ def list_private_pages(owner: str, repo: str, request: Request):


@router.post("/projects/{owner}/{repo}/private-pages")
-def create_private_page(owner: str, repo: str, request: Request, body: dict = Body(default={})):
+async def create_private_page(owner: str, repo: str, request: Request):
    """Create a new private page for this Gitea project."""
-
    from app.auth.session import SessionManager
    from app.db import get_conn
+    import json
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    title = body.get("title", "Untitled").strip() or "Untitled"
    with get_conn() as conn:
        cursor = conn.execute(
@@ -221,7 +235,7 @@ def create_private_page(owner: str, repo: str, request: Request, body: dict = Bo


@router.get("/projects/{owner}/{repo}/private-pages/{page_id}")
-def get_private_page(owner: str, repo: str, page_id: int, request: Request):
+async def get_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Get a single private page."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -239,14 +253,18 @@ def get_private_page(owner: str, repo: str, page_id: int, request: Request):


@router.put("/projects/{owner}/{repo}/private-pages/{page_id}")
-def update_private_page(owner: str, repo: str, page_id: int, request: Request, body: dict = Body(default={})):
+async def update_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Update a private page."""
-
    from app.auth.session import SessionManager
    from app.db import get_conn
+    import json
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
    title = body.get("title", "").strip()
    content = body.get("content", "")
    with get_conn() as conn:
@@ -264,7 +282,7 @@ def update_private_page(owner: str, repo: str, page_id: int, request: Request, b


@router.delete("/projects/{owner}/{repo}/private-pages/{page_id}")
-def delete_private_page(owner: str, repo: str, page_id: int, request: Request):
+async def delete_private_page(owner: str, repo: str, page_id: int, request: Request):
    """Delete a private page."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -298,7 +316,7 @@ async def sync_labels(request: Request, owner: str, repo: str):
    """Sync Gitea labels to FlowDeck tags for the current user."""
    from app.auth.session import get_current_user as gcu
    from app.db import get_conn
-    user = gcu(request)
+    user = await gcu(request)
    if not user:
        return JSONResponse({"error": "Not authenticated"}, status_code=401)
    gitea = _require_gitea(request)
@@ -311,8 +329,7 @@ async def sync_labels(request: Request, owner: str, repo: str):
        for label in labels:
            name = label.get("name", "")
            color = label.get("color", "#787774")
-            if not name:
-                continue
+            if not name: continue
            existing = conn.execute(
                "SELECT id FROM tags WHERE name=? AND user_id=?", (name, user["id"])
            ).fetchone()
@@ -6,7 +6,7 @@ router = APIRouter(tags=["github"], prefix="/api/github")


@router.get("/status")
-def github_status(request: Request):
+async def github_status(request: Request):
    """Check if the current user has GitHub linked."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -22,7 +22,7 @@ def github_status(request: Request):


@router.delete("/disconnect")
-def disconnect_github(request: Request):
+async def disconnect_github(request: Request):
    """Remove all GitHub OAuth tokens for the current user."""
    from app.auth.session import SessionManager
    from app.db import get_conn
@@ -1,90 +0,0 @@
-"""FlowDeck — agent governance API (v7.2.0): policies + approval queue."""
-from __future__ import annotations
-
-import json
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import agent_policies as policies
-from app.services.api_v2_helpers import audit_log
-
-router = APIRouter(tags=["governance"])
-
-
-def _owner_or_admin(request: Request) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if not user or not user.get("id"):
-        raise HTTPException(401, "Authentication required")
-    with get_conn() as conn:
-        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
-        is_admin = bool(row and row["is_admin"])
-        if not is_admin and request.query_params.get("workspace_id"):
-            member = conn.execute(
-                "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
-                (request.query_params.get("workspace_id"), user["id"])).fetchone()
-            owner = conn.execute("SELECT id FROM workspaces WHERE id=? AND owner_id=?",
-                                 (request.query_params.get("workspace_id"),
-                                  user["id"])).fetchone()
-            if not member and not owner:
-                raise HTTPException(403, "Workspace access required")
-            if member and member["role"] not in ("admin", "editor", "owner"):
-                raise HTTPException(403, "Editor role required")
-    user["is_admin"] = is_admin
-    return user
-
-
-@router.get("/api/v2/agent-policies")
-def list_policies(request: Request):
-    _owner_or_admin(request)
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM agent_policies ORDER BY workspace_id").fetchall()
-    return {"policies": [dict(r) for r in rows]}
-
-
-@router.post("/api/v2/agent-policies")
-def upsert_policy(request: Request, body: dict = Body(default={})):
-    user = _owner_or_admin(request)
-    wid = body.get("workspace_id")
-    tools = body.get("allowed_tools")
-    if tools is not None and not isinstance(tools, list):
-        raise HTTPException(400, "allowed_tools must be a list or null")
-    with get_conn() as conn:
-        conn.execute(
-            """INSERT INTO agent_policies (workspace_id, allowed_tools_json, max_steps,
-                                           require_approval)
-               VALUES (?,?,?,?)
-               ON CONFLICT(workspace_id) DO UPDATE SET
-                 allowed_tools_json=excluded.allowed_tools_json,
-                 max_steps=excluded.max_steps, require_approval=excluded.require_approval""",
-            (wid, json.dumps(tools) if tools is not None else None,
-             max(1, min(int(body.get("max_steps") or 12), 50)),
-             1 if body.get("require_approval") else 0))
-        conn.commit()
-        row = conn.execute("SELECT * FROM agent_policies WHERE workspace_id IS ?",
-                           (wid,)).fetchone()
-    audit_log(user, "agent.policy.upsert", "workspace", wid or 0, "", request)
-    return JSONResponse(status_code=201, content=dict(row))
-
-
-@router.get("/api/v2/agent-approvals")
-def list_approvals(request: Request):
-    _owner_or_admin(request)
-    status = request.query_params.get("status", "pending")
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM agent_approvals WHERE status=? ORDER BY id DESC"
-                            " LIMIT 100", (status,)).fetchall()
-    return {"approvals": [dict(r) for r in rows]}
-
-
-@router.post("/api/v2/agent-approvals/{approval_id}/decide")
-def decide_approval(approval_id: int, request: Request, body: dict = Body(default={})):
-    user = _owner_or_admin(request)
-    out = policies.decide_approval(approval_id, user["id"], bool(body.get("approve")))
-    if out is None:
-        raise HTTPException(404, "Pending approval not found")
-    audit_log(user, "agent.approval.decide", "agent_approval", approval_id,
-              out["status"], request)
-    return out
@@ -1,378 +0,0 @@
-"""FlowDeck — unified import API (v5.6.0, Phase 0/1/2).
-
-Exposes the importer registry, a dry-run preview, a synchronous run and an
-optional background job with polling. Works with the existing workspace cookie
-(``flowdeck_workspace``) and session.
-"""
-from __future__ import annotations
-
-import json
-import logging
-
-from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import HTMLResponse, RedirectResponse, Response
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services.automations import fire_event
-from app.services.importers import (
-    get_job,
-    list_jobs,
-    list_sources,
-    parse_upload,
-    preview_result,
-    resolve_relations,
-    run_import,
-    start_import_job,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/api/import", tags=["import"])
-page_router = APIRouter(tags=["import"])
-
-MAX_UPLOAD_BYTES = 200 * 1024 * 1024
-
-
-def _current_user(request: Request) -> dict:
-    return SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {}
-
-
-@page_router.get("/import", response_class=HTMLResponse)
-def import_page(request: Request):
-    """Standalone import wizard (source picker, dry-run, mapping, progress)."""
-    user = _current_user(request)
-    if not user:
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-    from app.templating import ENV
-
-    env = ENV
-    return HTMLResponse(content=env.get_template("import.html").render(user=user))
-
-
-def _workspace(request: Request) -> tuple[int | None, str]:
-    """Resolve (workspace_id, login) from the workspace cookie + session."""
-    ws_id: int | None = None
-    cookie = request.cookies.get("flowdeck_workspace", "")
-    try:
-        value = int(cookie)
-        if value > 0:
-            ws_id = value
-    except (ValueError, TypeError):
-        pass
-    user = _current_user(request)
-    login = user.get("login", "") if user else ""
-    return ws_id, login
-
-
-async def _read_upload(request: Request) -> tuple[str, bytes, str | None]:
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
-    data = await upload.read()
-    if len(data) > MAX_UPLOAD_BYTES:
-        raise HTTPException(413, "File too large (max 200 MB)")
-    source_id = form.get("source") or None
-    return filename, data, source_id
-
-
-@router.get("/sources")
-def import_sources(request: Request):
-    """List every available importer for the UI source picker."""
-    return {"sources": list_sources()}
-
-
-@router.post("/preview")
-async def import_preview(request: Request):
-    """Dry-run: parse the upload and describe what would be created."""
-    filename, data, source_id = await _read_upload(request)
-    imp, result = parse_upload(filename, data, source_id)
-    if imp is None:
-        raise HTTPException(400, "Format non reconnu — choisissez une source")
-    out = preview_result(result)
-    out["detected_source"] = imp.source_id
-    out["source_label"] = imp.label
-    return out
-
-
-@router.post("/run")
-async def import_run(request: Request):
-    """Import an upload (synchronously, or as a background job when async=true)."""
-    form = await request.form()
-    upload = form.get("file")
-    if upload is None or not hasattr(upload, "filename"):
-        raise HTTPException(400, "file field required")
-    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
-    data = await upload.read()
-    if len(data) > MAX_UPLOAD_BYTES:
-        raise HTTPException(413, "File too large (max 200 MB)")
-
-    source_id = form.get("source") or None
-    parent_id = _int_or_none(form.get("parent_id"))
-    target = _int_or_none(form.get("target_collection_id"))
-    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
-    async_mode = str(form.get("async", "false")).lower() in ("true", "1", "yes")
-    mapping = _parse_mapping(form.get("mapping"))
-    mode = _parse_mode(form.get("mode"))
-    ws_id, login = _workspace(request)
-
-    if async_mode:
-        job = start_import_job(
-            filename=filename, data=data, source_id=source_id,
-            workspace_id=ws_id, workspace_name=login, user_login=login,
-            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-            mapping=mapping, mode=mode,
-        )
-        return {"status": "queued", "job_id": job["id"]}
-
-    imp, result = parse_upload(filename, data, source_id)
-    if imp is None:
-        raise HTTPException(400, "Format non reconnu — choisissez une source")
-    report = run_import(
-        result, workspace_id=ws_id, workspace_name=login, user_login=login,
-        parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-        mapping=mapping, mode=mode,
-    )
-    report["detected_source"] = imp.source_id
-    if imp.source_id == "notion":
-        with get_conn() as conn:
-            report["relations"] = resolve_relations(conn, ws_id)
-    for page_id in report.get("page_ids", [])[:100]:
-        try:
-            await fire_event("page.created", {"page_id": page_id, "title": "", "workspace": login})
-        except Exception:  # noqa: BLE001 - events are best-effort
-            pass
-    return report
-
-
-@router.post("/forge")
-async def import_forge(request: Request):
-    """Import a forge repo's issues (+ labels/milestones) into collections."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    provider = str(body.get("provider") or "gitea").lower()
-    owner = str(body.get("owner") or "").strip()
-    repo = str(body.get("repo") or "").strip()
-    if not owner or not repo:
-        raise HTTPException(400, "owner and repo are required")
-    state = str(body.get("state") or "all")
-    include_labels = bool(body.get("include_labels", True))
-    include_milestones = bool(body.get("include_milestones", True))
-    ws_id, login = _workspace(request)
-
-    if provider == "gitea":
-        from app.services.gitea_client import get_user_gitea_client
-        from app.services.importers.forge import GiteaForgeAdapter
-        client = get_user_gitea_client(request)
-        if client is None:
-            raise HTTPException(400, "Gitea non connecté")
-        adapter = GiteaForgeAdapter(client)
-    elif provider == "github":
-        from app.services.github_adapter import GitHubAdapter
-        token = _user_oauth_token(request, "github")
-        if not token:
-            raise HTTPException(400, "GitHub non connecté")
-        adapter = GitHubAdapter(token)
-    else:
-        raise HTTPException(400, "provider must be 'gitea' or 'github'")
-
-    from app.services.importers.forge import fetch_forge_issues
-    result = await fetch_forge_issues(
-        adapter, owner, repo, provider=provider, state=state,
-        include_labels=include_labels, include_milestones=include_milestones,
-    )
-    report = run_import(
-        result, workspace_id=ws_id, workspace_name=login, user_login=login,
-    )
-    report["detected_source"] = f"forge:{provider}"
-    return report
-
-
-@router.post("/forge-repo")
-async def import_forge_repo(request: Request):
-    """Import a forge repo's text files as pages (folder hierarchy preserved)."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    provider = str(body.get("provider") or "gitea").lower()
-    owner = str(body.get("owner") or "").strip()
-    repo = str(body.get("repo") or "").strip()
-    if not owner or not repo:
-        raise HTTPException(400, "owner and repo are required")
-    path = str(body.get("path") or "")
-    max_files = min(int(body.get("max_files") or 200), 1000)
-    ws_id, login = _workspace(request)
-
-    adapter = _forge_adapter(request, provider)
-
-    from app.services.importers.forge_repo import fetch_forge_repo
-    result = await fetch_forge_repo(
-        adapter, owner, repo, provider=provider, path=path, max_files=max_files,
-    )
-    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
-    report["detected_source"] = f"forge-repo:{provider}"
-    return report
-
-
-@router.post("/url")
-async def import_url(request: Request):
-    """Web clipper: fetch a URL and create a page (bookmark card + content)."""
-    try:
-        body = await request.json()
-    except Exception:
-        raise HTTPException(400, "Invalid JSON body") from None
-    url = str(body.get("url") or "").strip()
-    if not url:
-        raise HTTPException(400, "url is required")
-    ws_id, login = _workspace(request)
-
-    from app.services.importers.url_fetch import fetch_url_result
-    try:
-        result = await fetch_url_result(url)
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    if not result.pages:
-        raise HTTPException(422, "; ".join(result.warnings) or "Page introuvable")
-    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
-    report["detected_source"] = "url"
-    return report
-
-
-@router.post("/run-batch")
-async def import_run_batch(request: Request):
-    """Import several uploaded files sequentially, returning one report each."""
-    form = await request.form()
-    uploads = form.getlist("file")
-    if not uploads:
-        raise HTTPException(400, "file field required")
-    source_id = form.get("source") or None
-    parent_id = _int_or_none(form.get("parent_id"))
-    target = _int_or_none(form.get("target_collection_id"))
-    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
-    mode = _parse_mode(form.get("mode"))
-    mapping = _parse_mapping(form.get("mapping"))
-    ws_id, login = _workspace(request)
-
-    results: list[dict] = []
-    summary = {"files": 0, "pages_created": 0, "rows_created": 0, "errors": 0}
-    for upload in uploads:
-        filename = (getattr(upload, "filename", "") or "import").replace("\\", "/").rsplit("/", 1)[-1]
-        data = await upload.read()
-        if len(data) > MAX_UPLOAD_BYTES:
-            results.append({"filename": filename, "report": {"status": "error",
-                            "errors": [{"title": filename, "error": "File too large"}]}})
-            summary["errors"] += 1
-            continue
-        imp, result = parse_upload(filename, data, source_id)
-        if imp is None:
-            results.append({"filename": filename, "report": {"status": "error",
-                            "errors": [{"title": filename, "error": "Format non reconnu"}]}})
-            summary["errors"] += 1
-            continue
-        report = run_import(
-            result, workspace_id=ws_id, workspace_name=login, user_login=login,
-            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
-            mapping=mapping, mode=mode,
-        )
-        report["detected_source"] = imp.source_id
-        results.append({"filename": filename, "report": report})
-        summary["files"] += 1
-        summary["pages_created"] += report.get("pages_created", 0)
-        summary["rows_created"] += report.get("rows_created", 0)
-        summary["errors"] += len(report.get("errors", []))
-    return {"status": "ok", "summary": summary, "results": results}
-
-
-@router.post("/relations/resolve")
-def import_resolve_relations(request: Request):
-    """Convert text columns referencing another collection into relation props."""
-    ws_id, _ = _workspace(request)
-    with get_conn() as conn:
-        return resolve_relations(conn, ws_id)
-
-
-@router.get("/jobs")
-def import_jobs(request: Request):
-    return {"jobs": list_jobs()}
-
-
-@router.get("/jobs/{job_id}")
-def import_job(job_id: str):
-    job = get_job(job_id)
-    if not job:
-        raise HTTPException(404, "Job not found")
-    return job
-
-
-@router.get("/jobs/{job_id}/report")
-def import_job_report(job_id: str):
-    """Download a job's import report as JSON."""
-    job = get_job(job_id)
-    if not job:
-        raise HTTPException(404, "Job not found")
-    payload = json.dumps(job.get("report") or {}, ensure_ascii=False, indent=2)
-    return Response(
-        content=payload,
-        media_type="application/json",
-        headers={"Content-Disposition": f'attachment; filename="import-{job_id}.json"'},
-    )
-
-
-def _forge_adapter(request: Request, provider: str):
-    if provider == "gitea":
-        from app.services.gitea_client import get_user_gitea_client
-        from app.services.importers.forge import GiteaForgeAdapter
-        client = get_user_gitea_client(request)
-        if client is None:
-            raise HTTPException(400, "Gitea non connecté")
-        return GiteaForgeAdapter(client)
-    if provider == "github":
-        from app.services.github_adapter import GitHubAdapter
-        token = _user_oauth_token(request, "github")
-        if not token:
-            raise HTTPException(400, "GitHub non connecté")
-        return GitHubAdapter(token)
-    raise HTTPException(400, "provider must be 'gitea' or 'github'")
-
-
-def _int_or_none(value) -> int | None:
-    try:
-        ivalue = int(value)
-        return ivalue if ivalue > 0 else None
-    except (ValueError, TypeError):
-        return None
-
-
-def _parse_mapping(value) -> dict[str, str] | None:
-    if not value:
-        return None
-    try:
-        parsed = json.loads(value)
-    except (ValueError, TypeError):
-        return None
-    if isinstance(parsed, dict):
-        return {str(k): str(v) for k, v in parsed.items() if v}
-    return None
-
-
-def _parse_mode(value) -> str | None:
-    mode = str(value or "").strip().lower()
-    return mode if mode in ("skip", "update", "duplicate") else None
-
-
-def _user_oauth_token(request: Request, provider: str) -> str:
-    user = _current_user(request)
-    if not user or not user.get("id"):
-        return ""
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider=? "
-            "ORDER BY updated_at DESC LIMIT 1",
-            (user["id"], provider),
-        ).fetchone()
-    return row["access_token"] if row else ""
@@ -3,10 +3,11 @@ from __future__ import annotations

 import logging

-from fastapi import APIRouter, Query, Request
+from fastapi import APIRouter, Request, Query
+from fastapi.responses import JSONResponse

-from app.auth.session import SessionManager
 from app.db import get_conn
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["library"], prefix="/api/library")
@@ -59,12 +60,9 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
    elif content_format == "file":
        icon = "📄"
        fn = title.lower()
-        if fn.endswith(".pdf"):
-            icon = "📕"
-        elif any(fn.endswith(e) for e in [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]):
-            icon = "🖼️"
-        elif any(fn.endswith(e) for e in [".py", ".js", ".ts", ".go", ".rs"]):
-            icon = "📜"
+        if fn.endswith(".pdf"): icon = "📕"
+        elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+        elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
    else:
        icon = "📝"

@@ -72,7 +70,6 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
        "id": page_id,
        "title": title,
        "icon": icon,
-        "page_icon": db_row.get("page_icon") or "",
        "is_folder": bool(db_row.get("is_folder", 0)),
        "source_type": source_type,
        "source_label": _source_label(source_type, workspace),
@@ -87,8 +84,6 @@ def _build_item(db_row: dict, uid: int = 1) -> dict:
        "url": url,
        "content_format": content_format,
        "favorited": bool(db_row.get("favorited", 0)),
-        "share_mode": db_row.get("share_mode", "private"),
-        "tags": [],
    }


@@ -103,30 +98,7 @@ def _apply_source_filter(query: str, params: list, source_type: str) -> tuple[st


 def _rows_to_items(rows, uid: int = 1) -> list:
-    items = [_build_item(dict(r), uid) for r in rows]
-    return _attach_tags(items)
-
-
-def _attach_tags(items: list) -> list:
-    """Batch-load page tags for library items."""
-    if not items:
-        return items
-    ids = [it["id"] for it in items]
-    placeholders = ",".join("?" for _ in ids)
-    with get_conn() as conn:
-        rows = conn.execute(
-            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
-            f"JOIN tags t ON t.id = pt.tag_id WHERE pt.page_id IN ({placeholders})",
-            ids,
-        ).fetchall()
-    tag_map: dict = {}
-    for r in rows:
-        tag_map.setdefault(r["page_id"], []).append({
-            "id": r["id"], "name": r["name"], "color": r["color"],
-        })
-    for it in items:
-        it["tags"] = tag_map.get(it["id"], [])
-    return items
+    return [_build_item(dict(r), uid) for r in rows]


 def _enrich_children(items: list) -> list:
@@ -152,12 +124,12 @@ def _enrich_children(items: list) -> list:

 BASE_SELECT = (
    "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
-    "p.parent_id, p.share_mode, p.parent_section, p.page_icon"
+    "p.parent_id, p.share_mode, p.parent_section"
 )


@router.get("/recents")
-def library_recents(
+async def library_recents(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -191,7 +163,7 @@ def library_recents(


@router.get("/favorites")
-def library_favorites(
+async def library_favorites(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -201,10 +173,10 @@ def library_favorites(

    uid = _get_user_id(request)
    query = (
-        "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
-        "p.parent_id, p.share_mode, p.parent_section, 1 as favorited "
-        "FROM favorites f JOIN pages p ON p.id = f.page_id "
-        "WHERE f.user_id = ? AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+        f"SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
+        f"p.parent_id, p.share_mode, p.parent_section, 1 as favorited "
+        f"FROM favorites f JOIN pages p ON p.id = f.page_id "
+        f"WHERE f.user_id = ? AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
    )
    params: list = [uid]
    if tree:
@@ -221,58 +193,17 @@ def library_favorites(


@router.get("/shared")
-def library_shared(
+async def library_shared(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
-    dir: str = Query(default="all"),
 ):
    if source_type not in SOURCE_TYPES:
        source_type = "all"
-    if dir not in ("made", "received", "all"):
-        dir = "all"

    uid = _get_user_id(request)
-
-    # Page ids the user shares toward others (nominal page_shares) or receives
-    # (direct shares + group shares via group_members)
-    with get_conn() as conn:
-        made_rows = conn.execute(
-            "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.created_by=?",
-            (uid,),
-        ).fetchall()
-        try:
-            recv_rows = conn.execute(
-                """SELECT DISTINCT s.page_id FROM page_shares s
-                   LEFT JOIN group_members gm ON gm.group_id = s.shared_with_group_id AND gm.user_id=?
-                   WHERE s.shared_with_user_id=? OR gm.user_id=?""",
-                (uid, uid, uid),
-            ).fetchall()
-        except Exception:
-            recv_rows = conn.execute(
-                "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.shared_with_user_id=?",
-                (uid,),
-            ).fetchall()
-    made_ids = {r[0] for r in made_rows}
-    recv_ids = {r[0] for r in recv_rows}
-
-    conds: list[str] = []
+    query = f"{BASE_SELECT} FROM pages p WHERE p.share_mode != 'private' AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
    params: list = []
-    if dir in ("all", "made"):
-        conds.append("p.share_mode != 'private'")
-    if dir in ("all", "made") and made_ids:
-        conds.append(f"p.id IN ({','.join('?' for _ in made_ids)})")
-        params.extend(made_ids)
-    if dir in ("all", "received") and recv_ids:
-        conds.append(f"p.id IN ({','.join('?' for _ in recv_ids)})")
-        params.extend(recv_ids)
-    if dir == "received" and not recv_ids:
-        return {"items": []}
-
-    query = (
-        f"{BASE_SELECT} FROM pages p "
-        f"WHERE ({' OR '.join(conds)}) AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
-    )
    if tree:
        query += " AND p.parent_id IS NULL"
    query, params = _apply_source_filter(query, params, source_type)
@@ -282,17 +213,12 @@ def library_shared(
        rows = conn.execute(query, params).fetchall()

    items = _rows_to_items(rows, uid)
-    for it in items:
-        sid = it["id"]
-        is_made = sid in made_ids or it.get("share_mode", "private") != "private"
-        is_recv = sid in recv_ids
-        it["share_dir"] = "both" if (is_made and is_recv) else ("made" if is_made else ("received" if is_recv else ""))
    _enrich_children(items)
    return {"items": items}


@router.get("/published")
-def library_published(
+async def library_published(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -317,7 +243,7 @@ def library_published(


@router.get("/private")
-def library_private(
+async def library_private(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -341,8 +267,71 @@ def library_private(
    return {"items": items}


+@router.get("/local-workspace-children/{item_id:int}")
+async def library_local_workspace_children(item_id: int, request: Request):
+    """Return children of a local workspace item for tree expansion."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        # Get the item to find its workspace
+        item = conn.execute(
+            "SELECT workspace_id FROM local_workspace_items WHERE id=? AND deleted_at IS NULL",
+            [item_id],
+        ).fetchone()
+        if not item:
+            return {"items": []}
+
+        rows = conn.execute(
+            "SELECT id, name, is_folder, parent_id, content_format, size, "
+            "COALESCE(updated_at, created_at) as updated_at "
+            "FROM local_workspace_items "
+            "WHERE parent_id = ? AND deleted_at IS NULL "
+            "ORDER BY is_folder DESC, name COLLATE NOCASE",
+            [item_id],
+        ).fetchall()
+
+    items = []
+    for r in rows:
+        name = r["name"] or "Untitled"
+        is_folder = bool(r["is_folder"])
+        icon = "📁" if is_folder else "📄"
+        fn = name.lower()
+        if not is_folder:
+            if fn.endswith(".pdf"): icon = "📕"
+            elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+            elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
+
+        with get_conn() as conn:
+            child_count = conn.execute(
+                "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
+                [r["id"]],
+            ).fetchone()[0]
+
+        items.append({
+            "id": r["id"],
+            "title": name,
+            "icon": icon,
+            "is_folder": is_folder,
+            "source_type": "local-ws",
+            "source_label": "",
+            "workspace": "",
+            "workspace_name": "",
+            "author": "",
+            "author_initial": "?",
+            "updated_at": r["updated_at"] or "",
+            "visited_at": "",
+            "has_children": child_count > 0,
+            "children": [],
+            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
+            "content_format": r["content_format"] or "file",
+            "favorited": False,
+            "size_display": _format_size(r["size"]) if r["size"] else "",
+        })
+
+    return {"items": items}
+
+
@router.get("/children/{page_id:int}")
-def library_children(page_id: int, request: Request):
+async def library_children(page_id: int, request: Request):
    """Return child pages for a given parent page (for tree expansion in Library)."""
    uid = _get_user_id(request)
    with get_conn() as conn:
@@ -358,7 +347,7 @@ def library_children(page_id: int, request: Request):


@router.get("/repository")
-def library_repository(
+async def library_repository(
    request: Request,
    gitea_owner: str = Query(default=""),
    gitea_repo: str = Query(default=""),
@@ -381,8 +370,84 @@ def library_repository(
    return {"items": items}


+@router.get("/local-workspace")
+async def library_local_workspace(
+    request: Request,
+    workspace_id: int = Query(default=0),
+):
+    """Return local workspace items (files/folders) formatted for Library display."""
+    from app.routers.dashboard import _get_active_workspace
+    uid = _get_user_id(request)
+
+    # Get the active workspace
+    ws = _get_active_workspace(request, user_id=uid)
+    if not ws:
+        return {"items": []}
+
+    ws_id = workspace_id or ws["id"]
+
+    # Query local workspace tree
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, name, is_folder, parent_id, content_format, size, "
+            "COALESCE(updated_at, created_at) as updated_at "
+            "FROM local_workspace_items "
+            "WHERE workspace_id = ? AND deleted_at IS NULL "
+            "ORDER BY is_folder DESC, name COLLATE NOCASE",
+            [ws_id],
+        ).fetchall()
+
+    items = []
+    for r in rows:
+        name = r["name"] or "Untitled"
+        is_folder = bool(r["is_folder"])
+        icon = "📁" if is_folder else "📄"
+        fn = name.lower()
+        if not is_folder:
+            if fn.endswith(".pdf"): icon = "📕"
+            elif any(fn.endswith(e) for e in [".png",".jpg",".jpeg",".gif",".webp",".svg"]): icon = "🖼️"
+            elif any(fn.endswith(e) for e in [".py",".js",".ts",".go",".rs"]): icon = "📜"
+
+        # Check for children
+        child_count = conn.execute(
+            "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
+            [r["id"]],
+        ).fetchone()[0]
+
+        items.append({
+            "id": r["id"],
+            "title": name,
+            "icon": icon,
+            "is_folder": is_folder,
+            "source_type": "local-ws",
+            "source_label": ws.get("name", "Workspace"),
+            "workspace": ws.get("name", ""),
+            "workspace_name": ws.get("name", ""),
+            "author": "",
+            "author_initial": "?",
+            "updated_at": r["updated_at"] or "",
+            "visited_at": "",
+            "has_children": child_count > 0,
+            "children": [],
+            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
+            "content_format": r["content_format"] or "file",
+            "favorited": False,
+            "size_display": _format_size(r["size"]) if r["size"] else "",
+        })
+
+    return {"items": items}
+
+
+def _format_size(size_bytes):
+    if not size_bytes: return ""
+    if size_bytes < 1024: return f"{size_bytes} B"
+    if size_bytes < 1048576: return f"{size_bytes/1024:.1f} KB"
+    if size_bytes < 1073741824: return f"{size_bytes/1048576:.1f} MB"
+    return f"{size_bytes/1073741824:.1f} GB"
+
+
@router.get("/workspace")
-def library_workspace(
+async def library_workspace(
    request: Request,
    source_type: str = Query(default="all"),
    tree: int = Query(default=0),
@@ -1,266 +0,0 @@
-"""FlowDeck — Calendar links + Meetings API (v7.1.0).
-
-``/api/v2/calendar-links*`` — Google/CalDAV link CRUD (session or Bearer
-``write``), manual sync trigger. ``GET /db/{id}/calendar/freebusy`` —
-weekday availability. ``/api/v2/meetings/*`` — audio upload, manual
-transcript, AI summary (fires ``meeting.summarized``).
-
-See ``docs/V71_Calendar_Meetings.md``.
-"""
-from __future__ import annotations
-
-import json
-import secrets
-from datetime import UTC, date, datetime, timedelta
-
-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import JSONResponse
-
-from app.auth.session import SessionManager
-from app.db import get_conn
-from app.services import calendar_sync as cal
-from app.services import meetings as meet
-from app.services.api_v2_helpers import (
-    audit_log,
-    has_scope,
-    resolve_bearer_token,
-    row_to_dict,
-)
-
-router = APIRouter(tags=["calendar-meetings"])
-
-
-def _auth_user(request: Request, *, require_write: bool = False) -> dict:
-    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    if sess:
-        return sess
-    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
-    if auth.lower().startswith("bearer "):
-        user = resolve_bearer_token(auth[7:].strip())
-        if not user:
-            raise HTTPException(401, "Invalid or expired API token")
-        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
-            raise HTTPException(403, "Insufficient scope. Required: write")
-        return user
-    raise HTTPException(401, "Authentication required")
-
-
-# ── calendar links ─────────────────────────────────────────────────────────
-
-@router.post("/api/v2/calendar-links")
-def create_link(request: Request, body: dict = Body(default={})):
-    user = _auth_user(request, require_write=True)
-    provider = (body.get("provider") or "").lower()
-    if provider not in cal.PROVIDERS:
-        raise HTTPException(400, "provider must be google|caldav")
-    try:
-        collection_id = int(body.get("collection_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(400, "collection_id required") from None
-    creds = body.get("credentials") or {}
-    if provider == "google" and not creds.get("access_token"):
-        raise HTTPException(400, "google needs credentials.access_token")
-    if provider == "caldav" and not creds.get("url"):
-        raise HTTPException(400, "caldav needs credentials.url")
-    try:
-        out = cal.save_link(user["id"], provider, collection_id, creds,
-                            body.get("calendar_id") or "primary",
-                            body.get("date_property") or "")
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    audit_log(user, "calendar.link", "collection", collection_id, provider, request)
-    return JSONResponse(status_code=201, content=out)
-
-
-@router.get("/api/v2/calendar-links")
-def get_links(request: Request):
-    user = _auth_user(request)
-    return {"links": cal.list_links(user["id"])}
-
-
-@router.delete("/api/v2/calendar-links/{link_id}")
-def remove_link(link_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    if not cal.delete_link(user["id"], link_id):
-        raise HTTPException(404, "Link not found")
-    audit_log(user, "calendar.unlink", "calendar_link", link_id, "", request)
-    return {"status": "deleted", "id": link_id}
-
-
-@router.post("/api/v2/calendar-links/{link_id}/sync")
-async def sync_now(link_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM calendar_links WHERE id=?", (link_id,)).fetchone()
-    if not row or (row["user_id"] != user["id"] and not user.get("is_admin")):
-        raise HTTPException(404, "Link not found")
-    try:
-        stats = await cal.sync_link(link_id)
-    except (cal.SyncError, ValueError) as exc:
-        raise HTTPException(502 if isinstance(exc, cal.SyncError) else 400,
-                            str(exc)) from None
-    audit_log(user, "calendar.sync", "calendar_link", link_id, str(stats), request)
-    return {"link_id": link_id, **stats}
-
-
-# ── free/busy ──────────────────────────────────────────────────────────────
-
-@router.get("/db/{collection_id}/calendar/freebusy")
-def freebusy(collection_id: int, request: Request):
-    _auth_user(request)
-    qp = request.query_params
-    try:
-        out = cal.freebusy(collection_id, qp.get("from", ""), qp.get("to", ""),
-                           qp.get("date_property", ""))
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    return out
-
-
-# ── upcoming (sidebar "Meeting" tab) ────────────────────────────────────────
-
-@router.get("/api/v2/meetings/upcoming")
-def upcoming_meetings(request: Request, days: int = 30):
-    """Upcoming calendar events for the sidebar Meeting tab.
-
-    Reads every calendar collection linked to the current user, extracts the
-    date property of each linked row and returns the ones falling in the next
-    ``days`` days (today included), sorted chronologically. Rows imported from
-    Google/CalDAV carry an ``external_event_id`` and are flagged ``synced``.
-    """
-    user = _auth_user(request)
-    horizon = max(1, min(days, 365))
-    today = datetime.now(UTC).date()
-    end = today + timedelta(days=horizon)
-    events: list[dict] = []
-    with get_conn() as conn:
-        links = conn.execute(
-            "SELECT id, collection_id, date_property, calendar_id, provider "
-            "FROM calendar_links WHERE user_id=? ORDER BY id",
-            (user["id"],),
-        ).fetchall()
-        for link in links:
-            collection_id = link["collection_id"]
-            if not collection_id:
-                continue
-            date_prop = cal.date_prop_id(conn, collection_id,
-                                         link["date_property"] or "")
-            if not date_prop:
-                continue
-            prop_id, prop_name = date_prop
-            rows = conn.execute(
-                "SELECT id, title, property_values_json, external_event_id "
-                "FROM collection_pages WHERE collection_id=?",
-                (collection_id,),
-            ).fetchall()
-            for row in rows:
-                try:
-                    values = json.loads(row["property_values_json"] or "{}")
-                except (TypeError, ValueError):
-                    continue
-                raw = cal.row_date(values, prop_id, prop_name)[:10]
-                if len(raw) != 10:
-                    continue
-                try:
-                    day = date.fromisoformat(raw)
-                except ValueError:
-                    continue
-                if not (today <= day <= end):
-                    continue
-                events.append({
-                    "id": row["id"],
-                    "title": row["title"] or "Untitled",
-                    "date": raw,
-                    "today": day == today,
-                    "collection_id": collection_id,
-                    "calendar_id": link["calendar_id"] or "primary",
-                    "provider": link["provider"],
-                    "synced": bool(row["external_event_id"]),
-                    "url": f"/db/{collection_id}",
-                })
-    events.sort(key=lambda e: (e["date"], e["title"].lower()))
-    return {"today": today.isoformat(), "days": horizon,
-            "events": events[:200], "count": len(events)}
-
-
-# ── meetings ───────────────────────────────────────────────────────────────
-
-@router.post("/api/v2/meetings/transcribe")
-async def upload_and_transcribe(request: Request):
-    user = _auth_user(request, require_write=True)
-    try:
-        form = await request.form()
-    except Exception:
-        raise HTTPException(400, "multipart upload required") from None
-    upload = form.get("audio")
-    try:
-        page_id = int(form.get("page_id", 0))
-    except (TypeError, ValueError):
-        raise HTTPException(400, "page_id required") from None
-    language = (form.get("language") or "fr")[:10]
-    manual = (form.get("transcript") or "").strip()
-    if upload is None and not manual:
-        raise HTTPException(400, "audio file or transcript required")
-    audio_path = ""
-    if upload is not None:
-        filename = (upload.filename or "").lower()
-        ext = filename.rsplit(".", 1)[-1] if "." in filename else ""
-        if ext not in meet.AUDIO_EXTENSIONS:
-            raise HTTPException(400, f"audio must be one of {sorted(meet.AUDIO_EXTENSIONS)}")
-        data = await upload.read()
-        if len(data) > meet.MAX_AUDIO_BYTES:
-            raise HTTPException(413, "audio exceeds 100 MB")
-        if not data:
-            raise HTTPException(400, "empty audio file")
-        audio_path = str(meet.meetings_dir()
-                         / f"{page_id}_{secrets.token_hex(8)}.{ext}")
-        with open(audio_path, "wb") as fh:
-            fh.write(data)
-    transcript = manual
-    if not transcript and audio_path:
-        try:
-            transcript = meet.transcribe_audio(audio_path, language)
-        except meet.TranscriptionUnavailable as exc:
-            transcript = ""  # stored; client transcribes or posts manual text later
-            _ = exc
-    try:
-        tid = meet.save_transcript(page_id, transcript, language, audio_path)
-    except ValueError as exc:
-        raise HTTPException(404, str(exc)) from None
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?", (tid,)).fetchone()
-    audit_log(user, "meeting.transcribe", "page", page_id, f"transcript={tid}", request)
-    return JSONResponse(status_code=201, content={
-        **row_to_dict(row), "transcribed": bool(transcript)})
-
-
-@router.post("/api/v2/meetings/transcripts/{transcript_id}/text")
-def set_transcript_text(transcript_id: int, request: Request, body: dict = Body(default={})):
-    """Store a client-side (manual) transcript on an existing row."""
-    _auth_user(request, require_write=True)
-    text = (body.get("transcript") or "").strip()
-    if not text:
-        raise HTTPException(400, "transcript required")
-    with get_conn() as conn:
-        if not conn.execute("SELECT id FROM meeting_transcripts WHERE id=?",
-                            (transcript_id,)).fetchone():
-            raise HTTPException(404, "Transcript not found")
-        conn.execute("UPDATE meeting_transcripts SET transcript=? WHERE id=?",
-                     (text, transcript_id))
-        conn.commit()
-        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?",
-                           (transcript_id,)).fetchone()
-    return row_to_dict(row)
-
-
-@router.post("/api/v2/meetings/transcripts/{transcript_id}/summarize")
-async def summarize(transcript_id: int, request: Request):
-    user = _auth_user(request, require_write=True)
-    try:
-        out = await meet.summarize_transcript(transcript_id, user.get("id"))
-    except ValueError as exc:
-        raise HTTPException(400, str(exc)) from None
-    except RuntimeError as exc:
-        raise HTTPException(502, str(exc)) from None
-    audit_log(user, "meeting.summarize", "transcript", transcript_id, "", request)
-    return out
@@ -1,423 +1,147 @@
-"""FlowDeck — My Tasks (tableau de bord de tâches façon Notion).
-
-Contrairement à Notion, où *My Tasks* vit dans l'onglet **Home** sans être
-rattaché à une page, cette page est un **tableau de bord transverse** : elle
-réunit toutes les tâches qui vous sont assignées, **tous workspaces
-confondus**. Le cookie `flowdeck_workspace` ne cadre donc plus cette vue (il
-reste utilisé par la sidebar).
-
-Les sources sont opt-in : une base n'alimente My Tasks qu'après conversion
-explicite (`collections.is_task` + mapping des trois propriétés requises —
-`app/services/task_databases.py`).
-
-Trois vues (tableau / kanban / calendrier), filtres globaux (échéance
-aujourd'hui, masquer les terminées), tri (échéance, statut, source), édition
-en direct du statut et de l'échéance, et création rapide dans n'importe
-quelle base connectée.
-"""
+"""FlowDeck — My Tasks router (v1.9.0)."""
 from __future__ import annotations

-import html
 import json
 import logging

-from fastapi import APIRouter, Body, HTTPException, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi import APIRouter, Request, HTTPException, Query
+from fastapi.responses import HTMLResponse
+from jinja2 import Environment, FileSystemLoader

-from app.auth.session import SessionManager
 from app.db import get_conn
-from app.services.property_types import apply_auto_properties
-from app.services.task_databases import (
-    MAX_TASK_SOURCES,
-    collect_tasks,
-    filter_and_sort,
-    list_task_sources,
-    user_today,
-)
-from app.templating import ENV
+from app.auth.session import SessionManager

 logger = logging.getLogger(__name__)
-
 router = APIRouter(tags=["my-tasks"], prefix="/my-tasks")

-VIEWS = ("table", "board", "calendar")
-DUE_FILTERS = ("all", "today", "overdue", "week")
-SORTS = ("due", "status", "source", "created")
-
-
-# ── Session ──────────────────────────────────────────────────────────────

 def _get_current_user(request: Request) -> dict | None:
    session = request.cookies.get("flowdeck_session", "")
    return SessionManager.decode_session(session)


-def _require_user(request: Request) -> dict:
-    """Session obligatoire, sans repli « admin » (id 1) : ce tableau de bord
-    est strictement celui de l'appelant."""
+@router.get("", response_class=HTMLResponse)
+async def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
+    """My Tasks — aggregates all pages assigned to the current user across all collections."""
    user = _get_current_user(request)
-    if not user or not user.get("id"):
-        raise HTTPException(status_code=401, detail="Authentication required")
-    return user
+    user_login = user.get("login", "admin") if user else "admin"

+    with get_conn() as conn:
+        collections = conn.execute("SELECT * FROM collections ORDER BY name").fetchall()
+        grouped: dict[str, list[dict]] = {}

-# ── Données ──────────────────────────────────────────────────────────────
+        for col in collections:
+            col_id = col["id"]
+            pages = conn.execute(
+                "SELECT * FROM collection_pages WHERE collection_id=? AND parent_id IS NULL ORDER BY position",
+                (col_id,),
+            ).fetchall()

-def _workspace_names(conn, user_id: int) -> dict[int, str]:
-    rows = conn.execute(
-        "SELECT id, name FROM workspaces WHERE owner_id = ?", (user_id,)
-    ).fetchall()
-    return {r["id"]: r["name"] for r in rows}
+            collection_tasks = []
+            for p in pages:
+                props = {}
+                try:
+                    props = json.loads(p["property_values_json"] or "{}")
+                except (json.JSONDecodeError, TypeError):
+                    pass
+                due_date = props.get("due_date", "")
+                status = props.get("status", "—")
+                assignee = props.get("assignee", "")
+                if view != "all" and assignee and assignee != user_login:
+                    continue
+                collection_tasks.append({
+                    "id": p["id"],
+                    "title": p["title"] or "Untitled",
+                    "icon": p["icon"] or "📋",
+                    "status": status,
+                    "due_date": due_date,
+                })
+            if collection_tasks:
+                grouped[col["name"]] = collection_tasks

+    total = sum(len(t) for t in grouped.values())

-def _validated(view: str, due: str, sort: str) -> tuple[str, str, str]:
-    """Paramètres d'URL bornés aux valeurs réellement implémentées."""
-    return (
-        view if view in VIEWS else "table",
-        due if due in DUE_FILTERS else "all",
-        sort if sort in SORTS else "due",
-    )
+    # Build content HTML
+    sections = ""
+    for col_name, tasks in grouped.items():
+        items = ""
+        for t in tasks:
+            due_badge = f"<span class='mt-due'>{t['due_date']}</span>" if t.get("due_date") else ""
+            status_cls = t['status'].lower().replace(' ', '-') if t.get('status') else 'none'
+            status_badge = f"<span class='mt-status mt-{status_cls}'>{t.get('status', '—')}</span>"
+            items += f"<div class='mt-item'><span class='mt-icon'>{t['icon']}</span><span class='mt-title'>{t['title']}</span>{status_badge}{due_badge}</div>"

+        sections += f"<div class='mt-section'><div class='mt-section-header'>{col_name} <span class='mt-count'>{len(tasks)}</span></div>{items}</div>"

-def _public_source(s: dict) -> dict:
-    return {
-        "id": s["id"],
-        "name": s["name"],
-        "icon": s["icon"],
-        "workspace_id": s["workspace_id"],
-        "workspace_name": s.get("workspace_name") or "",
-        "configured": s["configured"],
-        "missing_roles": s["missing_roles"],
-        "status_options": s["status_options"],
-    }
+    content_html = f"""<div style="max-width:800px;margin:0 auto;padding:40px 24px;">
+<h1 style="font-size:24px;margin:0 0 8px;">📋 My Tasks</h1>
+<p style="color:var(--text-dim);font-size:14px;margin-bottom:24px;">{total} tasks across {len(grouped)} collections</p>
+<div class="view-tabs" style="display:flex;gap:4px;margin-bottom:24px;border-bottom:1px solid var(--border);padding-bottom:12px;">
+<a class="tab{' active' if view=='all' else ''}" href="/my-tasks?view=all" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">All</a>
+<a class="tab{' active' if view=='today' else ''}" href="/my-tasks?view=today" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Today</a>
+<a class="tab{' active' if view=='overdue' else ''}" href="/my-tasks?view=overdue" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Overdue</a>
+<a class="tab{' active' if view=='upcoming' else ''}" href="/my-tasks?view=upcoming&days=7" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Next 7 days</a>
+</div>
+<style>
+.tab.active{{background:var(--accent);color:#fff!important;}}
+.tab:hover{{background:var(--bg-hover);color:var(--text);}}
+.mt-section{{margin-bottom:24px;}}
+.mt-section-header{{font-size:13px;font-weight:600;color:var(--text-dim);margin-bottom:8px;text-transform:uppercase;letter-spacing:.5px;}}
+.mt-count{{color:var(--text-dim);font-weight:400;opacity:.5;}}
+.mt-item{{display:flex;align-items:center;gap:10px;padding:10px 12px;background:var(--bg-card);border-radius:8px;margin-bottom:3px;border:1px solid var(--border);}}
+.mt-item:hover{{border-color:var(--accent);}}
+.mt-icon{{font-size:16px;}}
+.mt-title{{flex:1;font-size:14px;}}
+.mt-status{{font-size:11px;padding:2px 8px;border-radius:4px;}}
+.mt-due{{font-size:11px;color:var(--text-dim);}}
+.mt-todo,.mt-none{{background:rgba(255,255,255,.05);color:var(--text-dim);}}
+.mt-in-progress{{background:rgba(35,131,226,.15);color:#2C8CEB;}}
+.mt-done,.mt-completed,.mt-complete{{background:rgba(0,200,100,.15);color:#00CC66;}}
+</style>
+{sections}
+</div>"""

-
-def _payload(conn, request: Request, user_id: int, *, due: str, sort: str,
-             hide_done: bool) -> dict:
-    """Charge et normalise tout ce dont les trois vues ont besoin."""
-    user = _get_current_user(request) or {}
-    tasks = collect_tasks(conn, user_id, mine_only=True,
-                          login=user.get("login", ""))
-    # Même jour de référence que `due_state` (fuseau de l'utilisateur).
-    tasks = filter_and_sort(tasks, due=due, hide_done=hide_done, sort=sort,
-                            today=user_today(conn, user_id))
-    sources = list_task_sources(conn, user_id)
-    return {
-        "tasks": tasks,
-        "total": len(tasks),
-        "sources": [_public_source(s) for s in sources],
-        "sources_total": len(sources),
-        "sources_configured": sum(1 for s in sources if s["configured"]),
-        "max_sources": MAX_TASK_SOURCES,
-        "filters": {"due": due, "sort": sort, "hide_done": hide_done},
-    }
-
-
-# ── Rendu HTML ───────────────────────────────────────────────────────────
-
-def _render_shell(request: Request, content_html: str, *, app_js: bool = True):
-    """Enveloppe le contenu dans le layout commun (sidebar + base.html).
-
-    `static/css/my_tasks.css` est lié par `base.html` (le shell, jamais swappé)
-    : un `<link>` placé dans la zone swappée pouvait être retiré par htmx lors
-    d'une navigation partielle, et la page revenait sans aucun style. Seul
-    `static/js/my_tasks.js` reste conditionné à ``app_js`` : sans base
-    connectée, il n'y a rien à monter côté client.
-    """
    from app.routers.dashboard import _sidebar_data
-
+    env = Environment(loader=FileSystemLoader("app/templates"))
    sidebar = _sidebar_data(request, [])
-    # `assets` est rendu par un mini-template : `asset_version` (cache-busting)
-    # n'est pas substitutionné si on le concatène à la main.
-    assets = ENV.from_string(
-        "{% if app_js %}"
-        '<script src="/static/js/my_tasks.js?v={{ asset_version }}" defer></script>'
-        "{% endif %}"
-    ).render(app_js=app_js)
-
-    block_tpl = ENV.from_string(
-        '{% extends "base.html" %}'
-        "{% block content %}{{ assets|safe }}{{ content_html|safe }}{% endblock %}"
+    block_tpl = env.from_string(
+        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
    )
    return block_tpl.render(
        **sidebar,
        request=request,
        content_html=content_html,
-        assets=assets,
        page_title="My Tasks",
        title_prefix="My Tasks",
        page_icon="📋",
    )


-def _json_attr(obj) -> str:
-    """JSON échappé pour un attribut HTML."""
-    return html.escape(json.dumps(obj, ensure_ascii=False), quote=True)
-
-
-def _render_app(data: dict, view: str) -> str:
-    """Coquille du tableau de bord : barre d'outils, filtres et zone de vue
-    sont rendus côté client à partir de la configuration ci-dessous."""
-    config = {
-        "view": view,
-        "filters": data["filters"],
-        "sources": data["sources"],
-        "maxSources": data["max_sources"],
-        "views": list(VIEWS),
-    }
-    return ('<div id="my-tasks-app" class="my-tasks-app" '
-            f'data-config="{_json_attr(config)}"></div>')
-
-
-def _render_empty(data: dict) -> str:
-    """État vide « aucune source » : explique la conversion en base de tâches.
-
-    Gabarit centré (`my_tasks-empty*` dans `static/css/my_tasks.css`), sans
-    style inline : la mise en page suit le thème clair/sombre et reste
-    modifiable en un seul endroit. Les autres états vides (filtres actifs,
-    rien à faire) sont rendus par le client, qui connaît l'état des filtres.
-    """
-    return f"""<div class="my-tasks-empty">
-<div class="my-tasks-empty-icon">📋</div>
-<h2>My Tasks</h2>
-<p>Aucune base n'alimente encore ce tableau de bord. Pour en ajouter une :</p>
-<ol class="my-tasks-empty-steps">
-<li><span class="n">1</span><span>Ouvrez une base de données depuis
-<a href="/db">la liste de vos bases</a>.</span></li>
-<li><span class="n">2</span><span>Dans la barre de la base, cliquez sur
-<b>« Convertir en base de tâches »</b> — il se trouve à gauche du bouton
-<b>New</b>.</span></li>
-<li><span class="n">3</span><span>Reliez les colonnes <b>Assigné à</b>,
-<b>Statut</b> et <b>Échéance</b>, puis validez.</span></li>
-</ol>
-<p class="my-tasks-empty-hint">Jusqu'à {data["max_sources"]} bases
-peuvent alimenter ce tableau de bord.</p>
-<a href="/db" class="my-tasks-empty-btn">Ouvrir mes bases</a>
-</div>"""
-
-
-def _render_no_workspace() -> str:
-    return """<div class="my-tasks-empty">
-<div class="my-tasks-empty-icon">📋</div>
-<h2>My Tasks</h2>
-<p>Aucun workspace. Créez un workspace, puis une base de tâches : elle
-alimentera ce tableau de bord.</p>
-<a href="/workspaces" class="my-tasks-empty-btn">Créer un workspace</a>
-</div>"""
-
-
-
-# ── Routes ───────────────────────────────────────────────────────────────
-
-@router.get("", response_class=HTMLResponse)
-def my_tasks_dashboard(request: Request, view: str = "table", due: str = "all",
-                       sort: str = "due", hide_done: bool = False):
-    """My Tasks — toutes vos tâches, tous workspaces confondus."""
-    user = _get_current_user(request)
-    if not user or not user.get("id"):
-        return RedirectResponse("/auth/login?provider=local", status_code=302)
-
-    view, due, sort = _validated(view, due, sort)
-    with get_conn() as conn:
-        if not _workspace_names(conn, user["id"]):
-            return _render_shell(request, _render_no_workspace(), app_js=False)
-        data = _payload(conn, request, user["id"], due=due, sort=sort,
-                        hide_done=hide_done)
-
-    # Dès qu'au moins une base alimente le tableau de bord, le rendu est pris
-    # en charge par le client (3 vues + états vides contextualisés). Sans
-    # aucune source, le serveur affiche l'invite à convertir une base — le
-    # fichier JS n'est alors pas chargé.
-    if data["total"] or data["sources_total"]:
-        return _render_shell(request, _render_app(data, view))
-    return _render_shell(request, _render_empty(data), app_js=False)
-
-
@router.get("/api")
-def my_tasks_api(request: Request, view: str = "table", due: str = "all",
-                 sort: str = "due", hide_done: bool = False):
-    """API: tâches normalisées + sources connectées (alimente les 3 vues)."""
-    user = _require_user(request)
-    view, due, sort = _validated(view, due, sort)
-    with get_conn() as conn:
-        return _payload(conn, request, user["id"], due=due, sort=sort,
-                        hide_done=hide_done)
-
-
-@router.post("/api/task")
-def my_tasks_create(request: Request, body: dict = Body(default={})):
-    """Création rapide multi-destinations : la tâche part dans la base choisie.
-
-    Elle est **auto-assignée** : sans colonne « Assigné à » renseignée, une
-    tâche nouvelle n'apparaîtrait pas dans « mes tâches », ce qui serait
-    illisible pour l'utilisateur qui vient de la créer.
-    """
-    user = _require_user(request)
-    collection_id = body.get("collection_id")
-    title = str(body.get("title") or "").strip()
-    if not collection_id:
-        raise HTTPException(status_code=400, detail="collection_id is required")
-    if not title:
-        raise HTTPException(status_code=400, detail="title is required")
+async def my_tasks_api(request: Request, view: str = "all", days: int = 7):
+    """API: return my tasks as JSON."""
+    user = _get_current_user(request)
+    user_login = user.get("login", "admin") if user else "admin"

    with get_conn() as conn:
-        coll = conn.execute(
-            "SELECT id, task_assignee_prop, task_due_prop FROM collections "
-            "WHERE id=? AND is_task=1",
-            (collection_id,),
-        ).fetchone()
-        if coll is None:
-            raise HTTPException(status_code=400,
-                                detail="This database does not feed My Tasks")
+        collections = conn.execute("SELECT * FROM collections ORDER BY name").fetchall()
+        result = {}

-        props_meta = [
-            dict(p) for p in conn.execute(
-                "SELECT id, name, prop_type FROM collection_properties "
-                "WHERE collection_id=?",
-                (collection_id,),
+        for col in collections:
+            pages = conn.execute(
+                "SELECT * FROM collection_pages WHERE collection_id=? AND parent_id IS NULL ORDER BY position",
+                (col["id"],),
            ).fetchall()
-        ]

-        properties: dict = {}
-        title_prop = next((p for p in props_meta if p["prop_type"] == "title"), None)
-        if title_prop:
-            properties[str(title_prop["id"])] = title
+            tasks = []
+            for p in pages:
+                props = json.loads(p["property_values_json"])
+                tasks.append({
+                    "id": p["id"], "title": p["title"], "icon": p["icon"],
+                    "properties": props,
+                })

-        if body.get("due") and coll["task_due_prop"]:
-            properties[str(coll["task_due_prop"])] = str(body["due"])[:10]
+            if tasks:
+                result[col["name"]] = tasks

-        if coll["task_assignee_prop"]:
-            member = conn.execute(
-                "SELECT id, login, full_name, avatar_url, avatar_color "
-                "FROM users WHERE id=?",
-                (user["id"],),
-            ).fetchone()
-            if member:
-                properties[str(coll["task_assignee_prop"])] = [{
-                    "id": member["id"],
-                    "login": member["login"],
-                    "full_name": member["full_name"],
-                    "avatar_url": member["avatar_url"] or "",
-                    "avatar_color": member["avatar_color"] or "",
-                }]
-
-        apply_auto_properties(props_meta, properties, user, is_create=True)
-
-        nxt = conn.execute(
-            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages "
-            "WHERE collection_id=?",
-            (collection_id,),
-        ).fetchone()[0]
-        cur = conn.execute(
-            """INSERT INTO collection_pages
-               (collection_id, title, icon, position, property_values_json)
-               VALUES (?, ?, '📄', ?, ?)""",
-            (collection_id, title, nxt, json.dumps(properties)),
-        )
-        page_id = cur.lastrowid
-        conn.commit()
-
-        if title_prop:
-            from app.services.row_pages import sync_row_title_to_page
-
-            sync_row_title_to_page(conn, page_id)
-            conn.commit()
-
-    logger.info("my-tasks: task %s created in collection %s", page_id, collection_id)
-    return {"status": "created", "id": page_id, "collection_id": collection_id,
-            "title": title}
-
-
-@router.put("/api/task/{page_id}")
-def my_tasks_update(request: Request, page_id: int, body: dict = Body(default={})):
-    """Édition en direct du statut / de l'échéance / du titre.
-
-    L'écriture passe par le **mapping enregistré de la base source** (et non
-    par une devinette « première colonne de type X »), puis la tâche est relue
-    et renvoyée normalisée : le front n'a rien à recalculer.
-    """
-    user = _require_user(request)
-    field = body.get("field")
-    if field not in ("status", "due", "title", "assignee"):
-        raise HTTPException(status_code=400, detail="Unsupported field")
-
-    with get_conn() as conn:
-        row = conn.execute(
-            "SELECT id, collection_id, title, property_values_json "
-            "FROM collection_pages WHERE id=?",
-            (page_id,),
-        ).fetchone()
-        if row is None:
-            raise HTTPException(status_code=404, detail="Task not found")
-
-        coll = conn.execute(
-            "SELECT id, is_task, task_assignee_prop, task_status_prop, task_due_prop "
-            "FROM collections WHERE id=?",
-            (row["collection_id"],),
-        ).fetchone()
-        if coll is None:
-            raise HTTPException(status_code=404, detail="Source not found")
-        if not coll["is_task"]:
-            raise HTTPException(status_code=400,
-                                detail="This database no longer feeds My Tasks")
-
-        column = {"status": coll["task_status_prop"],
-                  "due": coll["task_due_prop"],
-                  "assignee": coll["task_assignee_prop"]}.get(field)
-        if field != "title" and not column:
-            raise HTTPException(status_code=400,
-                                detail=f"This database has no {field} column")
-
-        try:
-            pv = json.loads(row["property_values_json"] or "{}")
-        except (json.JSONDecodeError, TypeError):
-            pv = {}
-        if not isinstance(pv, dict):
-            pv = {}
-
-        new_title = None
-        if field == "title":
-            new_title = str(body.get("value") or "").strip()
-            title_prop = conn.execute(
-                "SELECT id FROM collection_properties "
-                "WHERE collection_id=? AND prop_type='title' ORDER BY position LIMIT 1",
-                (coll["id"],),
-            ).fetchone()
-            if title_prop:
-                pv[str(title_prop["id"])] = new_title
-        elif field == "assignee":
-            # La valeur est une liste de personnes : elle est écrite telle
-            # quelle (booleenner écraserait la colonne).
-            pv[str(column)] = body.get("value") or []
-        elif field == "due":
-            pv[str(column)] = str(body.get("value") or "")[:10]
-        else:
-            pv[str(column)] = str(body.get("value") or "")
-
-        if new_title is not None:
-            conn.execute(
-                "UPDATE collection_pages SET title=?, property_values_json=?, "
-                "updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (new_title, json.dumps(pv), page_id),
-            )
-            from app.services.row_pages import sync_row_title_to_page
-
-            sync_row_title_to_page(conn, page_id)
-        else:
-            conn.execute(
-                "UPDATE collection_pages SET property_values_json=?, "
-                "updated_at=CURRENT_TIMESTAMP WHERE id=?",
-                (json.dumps(pv), page_id),
-            )
-        conn.commit()
-
-        tasks = collect_tasks(conn, user["id"], mine_only=True,
-                              login=user.get("login", ""))
-        updated = next((t for t in tasks if t["id"] == page_id), None)
-
-    if updated is None:
-        # La tâche vient de cesser d'être « mienne » (désassignée) : le front
-        # doit la retirer, pas la re-rendre à l'identique.
-        return {"status": "updated", "task": None, "left_mytasks": True}
-
-    return {"status": "updated", "task": updated, "left_mytasks": False}
+    return {"tasks": result, "total": sum(len(t) for t in result.values())}
@@ -13,7 +13,7 @@ router = APIRouter(tags=["notes"], prefix="/notes")


@router.get("/{owner}/{repo}", response_class=HTMLResponse)
-def get_notes(request: Request, owner: str, repo: str):
+async def get_notes(request: Request, owner: str, repo: str):
    with get_conn() as conn:
        row = conn.execute(
            "SELECT content FROM notes WHERE project_owner=? AND project_name=? AND title='Notes'",
@@ -21,9 +21,9 @@ def get_notes(request: Request, owner: str, repo: str):
        ).fetchone()
    content = row["content"] if row else ""

+    from jinja2 import Environment, FileSystemLoader
    from app.auth.session import SessionManager
-    from app.templating import ENV
-    env = ENV
+    env = Environment(loader=FileSystemLoader("app/templates"))
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    template = env.get_template("notes.html")
    return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
@@ -44,9 +44,9 @@ async def save_notes(request: Request, owner: str, repo: str):
        )
        conn.commit()

+    from jinja2 import Environment, FileSystemLoader
    from app.auth.session import SessionManager
-    from app.templating import ENV
-    env = ENV
+    env = Environment(loader=FileSystemLoader("app/templates"))
    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
    template = env.get_template("notes.html")
    return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
--- a/Show More
+++ b/Show More