fix(admin): stats bar always shows whole-DB counts, not filtered counts

admin/index.php showed "TFE total / Publiés / En attente" by running
array_filter() over the already-filtered $theses array returned by
getThesesList(). When any search or year filter was active the three
numbers reflected only the matching subset, making the stats misleading
(e.g. searching for a single student would show "1 total, 0 publiés").

Add Database::getThesesStats(): array — a single SQL aggregation query:
  SELECT COUNT(*), SUM(is_published), SUM(NOT is_published) FROM theses

This runs against the raw theses table with no filters, so the counters
always display the true whole-database figures regardless of what filter
the admin has active. admin/index.php now calls getThesesStats() and
reads $stats['total'], $stats['published'], $stats['pending'] instead
of the array_filter expressions.

src/Database.php

@@ -540,6 +540,30 @@ class Database {
         return $stmt->fetchAll(PDO::FETCH_COLUMN);
     }
 
+    /**
+     * Return whole-database thesis counts, independent of any active filter.
+     *
+     * Always reflects the full theses table so the stats bar in admin/index.php
+     * shows accurate numbers even when a search or year filter is active.
+     *
+     * @return array{total: int, published: int, pending: int}
+     */
+    public function getThesesStats(): array {
+        $stmt = $this->pdo->query(
+            "SELECT
+                COUNT(*)                           AS total,
+                SUM(CASE WHEN is_published = 1 THEN 1 ELSE 0 END) AS published,
+                SUM(CASE WHEN is_published = 0 THEN 1 ELSE 0 END) AS pending
+             FROM theses"
+        );
+        $row = $stmt->fetch();
+        return [
+            'total'     => (int) $row['total'],
+            'published' => (int) $row['published'],
+            'pending'   => (int) $row['pending'],
+        ];
+    }
+
     // ========================================================================
     // CRUD METHODS (from formulaire)
     // ========================================================================

src/cache/rate_limit/ad921d60486366258809553a3db49a4a.json

@@ -1 +1 @@
-[1774615474]
+[1774694544]