Implement TFE file access restriction feature (complete)

Requirements:
- parametres.php toggle: 'restricted_files_enabled' enables/disables the feature
- Public TFE page: when enabled + access_type=Interne, hides files, shows French
  restriction message + access request form (metadata/synopsis still visible)
- ERG emails (@erg.school / @erg.be): auto-approve, send 24h access link immediately
- External emails: show justification textarea, create pending request, notify admin
- Admin panel /admin/file-access.php: approve/reject requests with optional notes,
  sends access email on approval (linked from admin nav with pending count badge)

Security:
- One-time 24h email tokens (used_at + is_valid=0 on first click)
- Token redeemed via POST /validate-access (GET shows confirmation page only)
- Long-lived 30-day browser session in file_access_sessions table
- Cookie: HttpOnly + Secure + SameSite=Strict
- CSRF on all mutations, rate limiting on request submission
- Audit trail: IP, UA, event, timestamp in file_access_audit

Bug fixes:
- admin/file-access.php: $vars never extract()ed → page was blank
- Template had self-contained head/footer includes (double-include)
- Admin approval URL used $requestId instead of $request['thesis_id']
- App::boot() now starts session so CSRF token works on public pages
- Dispatcher routes /validate-access and /request-access through front controller

app/src/Dispatcher.php

@@ -48,6 +48,9 @@ class Dispatcher {
      * execute the action, and render the view.
      */
     public function dispatch(): void {
+        // Ensure session + CSRF token are initialised for all public requests
+        require_once APP_ROOT . '/src/App.php';
+        App::boot();
         // 1. Direct-response endpoints (render their own output)
         $direct = $this->matchDirect();
         if ($direct) {
@@ -125,6 +128,20 @@ class Dispatcher {
             };
         }
 
+        // /validate-access  (GET: confirmation page, POST: token redemption)
+        if ($path === '/validate-access' || $path === '/validate-access.php') {
+            return function() {
+                require APP_ROOT . '/public/validate-access.php';
+            };
+        }
+
+        // /request-access  (POST: submit access request)
+        if ($path === '/request-access' || $path === '/request-access.php') {
+            return function() {
+                require APP_ROOT . '/public/request-access.php';
+            };
+        }
+
         return null;
     }