fix: use local storage/ in dev, create upload dirs, gitignore uploads

.gitignore

@@ -10,6 +10,10 @@ app/storage/test.db
 error.log
 app/storage/cache/*
 !app/storage/cache/.gitkeep
+app/storage/covers/*
+!app/storage/covers/.gitkeep
+app/storage/theses/*
+!app/storage/theses/.gitkeep
 
 # Nix
 .direnv/

TODO.md

@@ -2,7 +2,10 @@
 
 ## Dev / Debug Fixes
 
-- [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets noise
+- [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets/connection noise
+- [x] Fix `STORAGE_ROOT` — use local `app/storage/` in dev (cli-server), `/var/www/posterg/storage` in prod
+- [x] Create `app/storage/covers/` and `app/storage/theses/` with `.gitkeep`
+- [x] Add gitignore rules for uploaded files in dev storage dirs
 - [x] Fix `error_log` path in `formulaire.php` (was relative, now absolute)
 - [x] Fix CSRF debug: log both tokens on mismatch
 - [x] Fix undefined `$redirect` on success path in `formulaire.php`

app/bootstrap.php

@@ -10,7 +10,12 @@ define('APP_ROOT', __DIR__);
 // Storage directory for uploaded files — intentionally outside the webroot
 // so no uploaded content is ever directly web-accessible (items #3 & #4).
 // Files are served through MediaController which validates paths and MIME types.
-define('STORAGE_ROOT', '/var/www/posterg/storage');
+// In dev (cli-server) use the local storage/ directory; in production use the
+// absolute path outside the webroot.
+define('STORAGE_ROOT', php_sapi_name() === 'cli-server'
+    ? __DIR__ . '/storage'
+    : '/var/www/posterg/storage'
+);
 
 // Error reporting
 if (php_sapi_name() === 'cli-server') {