Extract apropos contacts/credits to config/apropos.php

Names, roles, emails, and credits on the À propos page were hardcoded
directly in apropos.php HTML. To update a contact meant editing a
template file — risky for non-developers and easy to introduce a typo
or broken mailto link.

Changes:
- config/apropos.php: new config array with erg_url, contacts[] (name,
  role, email per person) and credits[] (label/value pairs); follows
  the same pattern as config/admin_credentials.php
- public/apropos.php: loads config via require; aside section now loops
  over $apropos['contacts'] and $apropos['credits'] with htmlspecialchars
  throughout; hardcoded HTML strings removed entirely

Also audited todo/02-php-components.md and marked 8 stale items as done:
all 5 form field partials were already implemented and in use, the
flash-message consolidation was already handled by App::consumeFlash(),
and the RateLimit cache dir was already at storage/cache/rate_limit
(excluded from deploy rsync).

todo/02-php-components.md

@@ -2,17 +2,17 @@
 
 ## Form field partials — `templates/partials/form/`
 
-- [ ] **`text-field.php`** — accepts `$name`, `$label`, `$value`, `$required`, `$placeholder`, `$hint`; renders the `<div>…<label>…<input>…<small>` pattern used ~15 times across `add.php` and `edit.php`
-- [ ] **`select-field.php`** — accepts `$name`, `$label`, `$options[]`, `$selected`, `$required`; renders `<div>…<label>…<select>…</div>` pattern used ~6 times
-- [ ] **`checkbox-list.php`** — accepts `$name`, `$label`, `$options[]`, `$checked[]`; renders the checkbox group pattern (languages, formats) used ~4 times across `add.php` and `edit.php`
-- [ ] **`file-field.php`** — accepts `$name`, `$label`, `$accept`, `$hint`, `$multiple`; renders file input pattern used 3 times
-- [ ] **`jury-fieldset.php`** — entire jury composition fieldset + JS duplicated verbatim between `add.php` and `edit.php`; extract into one partial accepting `$juryPresident`, `$juryPromoteur`, `$juryPromoteurExt`, `$juryLecteurs[]`
+- [x] **`text-field.php`** — already implemented; used across `add.php` and `edit.php` for all single-line fields
+- [x] **`select-field.php`** — already implemented; used for orientation, ap, finality, license, access type, etc.
+- [x] **`checkbox-list.php`** — already implemented with `<fieldset>/<legend class="sr-only">/<ul>` structure for WCAG 1.3.1
+- [x] **`file-field.php`** — already implemented; used for cover image, banner, and TFE files
+- [x] **`jury-fieldset.php`** — already implemented; single partial shared by `add.php` and `edit.php`; includes all WCAG aria-labels and JS for dynamic rows
 
 ## Shared UI partials — `templates/partials/`
 
 - [x] **`pagination.php`** — partial created and used in both `search.php` and (now) `admin/index.php`; `admin/index.php` also gained proper server-side pagination (25/page) with filter-aware `$baseParams`
 - [x] **`status-badge.php`** — partial fully implemented (`templates/partials/status-badge.php`) with `$badgeType`/`$badgeValue` API; CSS rules in `admin.css`; used in `admin/index.php` for publish + access badges
-- [ ] **`admin-alert.php`** — rename/merge `flash-messages.php` to also handle the 3 different legacy flash key patterns (`$_SESSION['error']`, `$_SESSION['admin_error']`, `$_SESSION['edit_error']`, etc.) that pages still consume manually instead of via `App::consumeFlash()`
+- [x] **`admin-alert.php`** — already done; `flash-messages.php` calls `App::consumeFlash()` which handles all legacy key variants (`_flash_error`, `error`, `admin_error`, `edit_error`, `form_error`, `success`, `admin_success`, `edit_success`) and clears them all
 
 ## Controller Extraction (In Progress)
 
@@ -27,5 +27,5 @@
 
 ## Backend Maintenance
 
-- [ ] **`RateLimit` uses per-file JSON on disk** — consider switching to APCu or SQLite; at minimum move cache dir to `/tmp` or `storage/cache/` excluded from deploy rsync
-- [ ] **`apropos.php` contacts and credits are hardcoded** — names, roles, emails (Laurent Leprince, Xavier Gorgol, Brigitte Ledune) live in PHP/HTML; move into the `about` page Markdown or a config array
+- [x] **`RateLimit` cache dir** — already in `storage/cache/rate_limit`; `justfile` deploy excludes `storage/cache/*` from rsync. APCu/SQLite migration deferred (not blocking).
+- [x] **`apropos.php` contacts and credits** — moved to `config/apropos.php` config array (`contacts[]`, `credits[]`, `erg_url`); `apropos.php` loops over the config with `htmlspecialchars`; update names/emails by editing only the config file