Add admin-only route to open Interdit thesis files from backoffice:

- reliable tab title /favicon wrapper,
- Content-Disposition filename,
- admin media route hardened to thesis-file prefixes only (defense-in-depth)

app/public/admin/media.php

@@ -0,0 +1,24 @@
+<?php
+/**
+ * Dedicated admin file viewer — lets a backoffice user open files whose owning
+ * thesis is marked 'Interdit' (access_type_id=3).
+ *
+ * Security:
+ *   - Auth-gated by AdminAuth::requireLogin() → only an authenticated admin
+ *     session (cookie scoped to /admin) can reach the handler below.
+ *   - Delegates to MediaController::handle(adminBypass: true), which bypasses
+ *     ONLY the Interdit visibility gate. The strict path-whitelist, realpath()
+ *     storage jail and MIME allow-list remain fully enforced, so an admin
+ *     cannot read arbitrary files on the server.
+ *
+ * Usage: /admin/media.php?path=tfe/2025/2025-001/rapport.pdf
+ */
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+
+AdminAuth::requireLogin();
+
+require_once APP_ROOT . '/src/Controllers/MediaController.php';
+
+$controller = new MediaController();
+$controller->handle(adminBypass: true);