Replace Psalm with PHPStan + PHP‑CS‑Fixer + Biome, add linting configs & cleanup

- Removed the `vimeo/psalm` dependency and all related files
(`psalm.xml`, `psalm‑baseline.xml`, suppress annotations).  
- Added **PHPStan** (v2.1.54) and **PHP‑CS‑Fixer** (v3.95.1) to
`vendor/bin/`.  
- Created `phpstan.neon` (level 5, bootstraps `app/bootstrap.php`,
scans `Parsedown.php`).  
- Created `phpstan‑baseline.neon` with 10 pre‑existing errors.  
- Added `.php‑cs‑fixer.dist.php` (PSR‑12 + PHP80Migration, targets
 `app/src` & `app/tests`).  
- Added `biome.json` and updated `justfile` to replace the old Psalm
recipes with `phpstan`, `cs‑check`, and `cs‑fix`.  
- Updated `.gitignore` to exclude PHPStan and PHP‑CS‑Fixer cache files.  
- Updated several JS files (`file‑preview.js`, `file‑upload‑queue.js`)
eand PHP controllers (`MediaController.php`, `SearchController.php`,
`SystemController.php`).  
- Minor adjustments to `TODO.md`, `app/src/Database.php`,
`app/src/Parsedown.php`, `app/src/ShareLink.php`, and
`app/src/SmtpRelay.php`.

app/public/assets/js/file-upload-queue.js

@@ -15,9 +15,7 @@
  *  2. Legacy single-file previews (data-preview="CONTAINER_ID")
  *     - Backward-compatible with cover-image and banner inputs.
  */
-(function () {
-  'use strict';
-
+(() => {
   /* ── Helpers ──────────────────────────────────────────────────────────── */
 
   const ICONS = {
@@ -43,10 +41,10 @@
   }
 
   function humanSize(bytes) {
-    if (bytes >= 1073741824) return (bytes / 1073741824).toFixed(2) + ' GB';
-    if (bytes >= 1048576)   return (bytes / 1048576).toFixed(2) + ' MB';
-    if (bytes >= 1024)      return (bytes / 1024).toFixed(1) + ' KB';
-    return bytes + ' B';
+    if (bytes >= 1073741824) return `${(bytes / 1073741824).toFixed(2)} GB`;
+    if (bytes >= 1048576)   return `${(bytes / 1048576).toFixed(2)} MB`;
+    if (bytes >= 1024)      return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${bytes} B`;
   }
 
   function esc(str) {
@@ -60,9 +58,9 @@
   function syncInputFiles(input, fileArray) {
     try {
       const dt = new DataTransfer();
-      fileArray.forEach(f => dt.items.add(f));
+      for (const f of fileArray) dt.items.add(f);
       input.files = dt.files;
-    } catch (e) {
+    } catch {
       // DataTransfer not available in older browsers — graceful degradation.
     }
   }
@@ -80,9 +78,9 @@
     let fileArray = [];
 
     // Keep SortableJS instance reference
-    let sortable = null;
+    let _sortable = null;
     if (typeof Sortable !== 'undefined') {
-      sortable = Sortable.create(queue, {
+      _sortable = Sortable.create(queue, {
         animation: 150,
         handle:    '.fq-drag-handle',
         ghostClass: 'fq-ghost',
@@ -90,7 +88,7 @@
       });
     }
 
-    picker.addEventListener('change', function () {
+    picker.addEventListener('change', () => {
       const newFiles = Array.from(picker.files);
       fileArray = fileArray.concat(newFiles);
       renderQueue();
@@ -108,7 +106,7 @@
       }
       empty.style.display = 'none';
 
-      fileArray.forEach(function (file, idx) {
+      fileArray.forEach((file, idx) => {
         const li = document.createElement('li');
         li.className = 'fq-item';
         li.setAttribute('data-idx', idx);
@@ -125,7 +123,7 @@
           '<button type="button" class="admin-btn-remove fq-remove" aria-label="Retirer ' + esc(file.name) + '">✕</button>';
 
         // Remove button
-        li.querySelector('.fq-remove').addEventListener('click', function () {
+        li.querySelector('.fq-remove').addEventListener('click', () => {
           fileArray.splice(idx, 1);
           renderQueue();
         });
@@ -150,12 +148,12 @@
       // Remove previous hidden fields
       const form = picker.closest('form');
       if (!form) return;
-      form.querySelectorAll('.fq-hidden-label, .fq-hidden-order').forEach(el => el.remove());
+      for (const el of form.querySelectorAll('.fq-hidden-label, .fq-hidden-order')) el.remove();
 
       // Inject current labels and order indices
       // We use the queue DOM (post-sort) as the source of truth.
       const items = Array.from(queue.querySelectorAll('.fq-item'));
-      items.forEach(function (li, sortedIdx) {
+      items.forEach((li, sortedIdx) => {
         const labelVal = li.querySelector('.fq-label').value;
 
         const lInput = document.createElement('input');
@@ -177,7 +175,7 @@
     // Before form submit, inject hidden fields so labels are up-to-date
     const form = picker.closest('form');
     if (form) {
-      form.addEventListener('submit', function () {
+      form.addEventListener('submit', () => {
         syncInputFiles(picker, fileArray);
         injectHiddenFields();
       });
@@ -194,11 +192,11 @@
       animation: 150,
       handle:    '.admin-file-drag-handle',
       ghostClass: 'fq-ghost',
-      onEnd: function () {
+      onEnd: () => {
         // Update the hidden file_sort_order[] inputs to reflect new order
         const items = list.querySelectorAll('.admin-file-list-item[data-file-id]');
-        list.querySelectorAll('input[name="file_sort_order[]"]').forEach(el => el.remove());
-        items.forEach(function (li) {
+        for (const el of list.querySelectorAll('input[name="file_sort_order[]"]')) el.remove();
+        items.forEach((li) => {
           const inp = document.createElement('input');
           inp.type  = 'hidden';
           inp.name  = 'file_sort_order[]';
@@ -212,7 +210,7 @@
   /* ── Legacy single-file preview (data-preview="CONTAINER_ID") ─────────── */
 
   function initLegacyPreviews() {
-    document.querySelectorAll('input[type="file"][data-preview]').forEach(function (input) {
+    document.querySelectorAll('input[type="file"][data-preview]').forEach((input) => {
       // Skip the TFE multi-file picker (handled by queue above)
       if (input.id === 'tfe-files-input') return;
 
@@ -220,7 +218,7 @@
       const container   = document.getElementById(containerId);
       if (!container) return;
 
-      input.addEventListener('change', function () {
+      input.addEventListener('change', () => {
         renderLegacyPreview(input, container);
       });
     });
@@ -231,7 +229,7 @@
     const files = Array.from(input.files);
     if (!files.length) return;
 
-    files.forEach(function (file) {
+    files.forEach((file) => {
       const item = document.createElement('div');
       item.className = 'fp-item';
 
@@ -240,7 +238,7 @@
         img.className = 'fp-thumb';
         img.alt = file.name;
         const reader = new FileReader();
-        reader.onload = function (e) { img.src = e.target.result; };
+        reader.onload = (e) => { img.src = e.target.result; };
         reader.readAsDataURL(file);
         item.appendChild(img);
       } else {