fix(admin): stats bar always shows whole-DB counts, not filtered counts

admin/index.php showed "TFE total / Publiés / En attente" by running
array_filter() over the already-filtered $theses array returned by
getThesesList(). When any search or year filter was active the three
numbers reflected only the matching subset, making the stats misleading
(e.g. searching for a single student would show "1 total, 0 publiés").

Add Database::getThesesStats(): array — a single SQL aggregation query:
  SELECT COUNT(*), SUM(is_published), SUM(NOT is_published) FROM theses

This runs against the raw theses table with no filters, so the counters
always display the true whole-database figures regardless of what filter
the admin has active. admin/index.php now calls getThesesStats() and
reads $stats['total'], $stats['published'], $stats['pending'] instead
of the array_filter expressions.

TODO.md

@@ -555,7 +555,7 @@ Goal: rename the tables and column to the canonical M2M pattern (`tags`, `thesis
       manually prepare `SELECT … FROM thesis_files WHERE thesis_id = ?` instead of calling
       `$db->getThesisFiles($thesisId)` which already exists. Replace with the DB method.
 
-- [ ] **`admin/index.php` stats computed via PHP `array_filter` on full result set** — "total",
+- [x] **`admin/index.php` stats computed via PHP `array_filter` on full result set** — "total",
       "publiés", "en attente" counts are derived by filtering the already-fetched `$theses` array
       in PHP. When a filter is active the stats reflect only filtered rows, which is misleading.
       Add `Database::getThesesStats(): array` returning three counts from SQL