feat(admin): cleanup page — remove 'Fichiers temporaires' level, promote sections to h2 TOC entries

docs/deployment.md

@@ -32,8 +32,8 @@ This chains (each step is also runnable individually):
    `/var/www/xamxam/.env` (idempotent; see below).
 2. `just deploy` — code + Composer deps + migrations + permissions.
 3. `just deploy-nginx` — install + apply the nginx config and fix permissions.
-4. `just deploy-backup`, `just deploy-cleanup-cron`, `just deploy-logrotate` —
-   install backup + cleanup cron jobs and log rotation.
+4. `just deploy-backup`, `just deploy-cleanup-cron`, `just deploy-tmp-cleanup-cron`, `just deploy-logrotate` —
+   install backup + cleanup (drafts + abandoned uploads) cron jobs and log rotation.
 
 It finishes by telling you what's left to do in `/admin/account` (set the admin
 password — a fresh DB starts unauthenticated — and configure SMTP/PeerTube
@@ -50,7 +50,7 @@ For a full initial rollout *without* the env/nginx steps (backup + cleanup cron
 only), when those are already handled:
 
 ```bash
-just deploy-all-first        # deploy + deploy-backup + deploy-cleanup-cron + deploy-logrotate
+just deploy-all-first        # deploy + deploy-backup + deploy-cleanup-cron + deploy-tmp-cleanup-cron + deploy-logrotate
 ```
 
 ### Server `APP_KEY` — idempotent, never overwrites
@@ -89,8 +89,9 @@ If you ever rotate `APP_KEY`, re-encrypt the SMTP password with
 | `just deploy-db` | Push local `xamxam.db` → remote (**refuses** if a remote DB already exists) |
 | `just deploy-verify-permissions` | Check ownership / permissions on the server |
 
-> ℹ️ **First deploy?** After `just deploy`, run `just deploy-backup` and
-> `just deploy-cleanup-cron` to install the backup/cleanup cron jobs, and
+> ℹ️ **First deploy?** After `just deploy`, run `just deploy-backup`,
+> `just deploy-cleanup-cron` and `just deploy-tmp-cleanup-cron` to install the
+> backup/cleanup cron jobs, and
 > `just deploy-logrotate` to install log rotation. A single `just deploy-all-first`
 > chains all of these together.
 > The app log directory `/var/log/xamxam/` is provisioned automatically by
@@ -136,6 +137,18 @@ Draft cleanup is handled by a separate cron (`/etc/cron.d/xamxam-cleanup`),
 installed via `just deploy-cleanup-cron`, logging to
 `/var/log/xamxam-cleanup-YYYY-MM-DD.log`. Verify with `just deploy-check-cleanup-log`.
 
+Abandoned FilePond uploads (staging dirs never linked to a published TFE) are
+garbage-collected hourly by `/etc/cron.d/xamxam-tmp-cleanup`, installed via
+`just deploy-tmp-cleanup-cron`, logging to
+`/var/log/xamxam-tmp-cleanup-YYYY-MM-DD.log`. Verify with
+`just deploy-check-tmp-cleanup-log`.
+
+Because abandoned uploads are removed automatically, the admin cleanup page
+(`/admin/cleanup.php`, titled *Nettoyage*) now only surfaces the manually-managed
+**Corbeille** (trashed files, with per-row restore/delete and bulk actions). The
+manual "Téléversements abandonnés" table was removed from the UI; those files
+are purged by the cron above.
+
 ---
 
 ## Permissions model
@@ -226,7 +239,8 @@ just deploy-verify-permissions            # expect "All permissions OK"
   unchanged; if that still fails, force a reinstall.
 - **Backup/schedule not running**
   Confirm the cron files are installed (`/etc/cron.d/xamxam-backup`,
-  `/etc/cron.d/xamxam-cleanup`) and the log files are writable by `www-data`.
+  `/etc/cron.d/xamxam-cleanup`, `/etc/cron.d/xamxam-tmp-cleanup`) and the log
+  files are writable by `www-data`.
 
 ---
 
@@ -238,6 +252,7 @@ just deploy-verify-permissions            # expect "All permissions OK"
 | `just deploy-nginx` | Apply nginx config |
 | `just deploy-backup` | Install backup script + cron |
 | `just deploy-cleanup-cron` | Install orphaned-draft cleanup cron |
+| `just deploy-tmp-cleanup-cron` | Install abandoned-upload GC cron |
 | `just deploy-list-backups` | List server backups |
 | `just trigger-backup` | Run backup now |
 | `just reencrypt-password <key>` | Re-encrypt SMTP password after key rotation |