Add admin-only route to open Interdit thesis files from backoffice:

- reliable tab title /favicon wrapper,
- Content-Disposition filename,
- admin media route hardened to thesis-file prefixes only (defense-in-depth)

app/src/Database.php

@@ -2087,6 +2087,26 @@ class Database
         return ($val !== false) ? (int)$val : null;
     }
 
+    /**
+     * Return the human-facing display name (thesis_files.file_name) for a file
+     * path, or null when the path does not belong to a stored thesis file.
+     *
+     * file_name preserves the original filename the submitter uploaded, which
+     * is nicer than the sanitised on-disk path when the browser uses it as a
+     * tab title / download name (e.g. via Content-Disposition).
+     */
+    public function getFileDisplayName(string $filePath): ?string
+    {
+        $stmt = $this->pdo->prepare('
+            SELECT tf.file_name FROM thesis_files tf
+            WHERE tf.file_path = ?
+            LIMIT 1
+        ');
+        $stmt->execute([$filePath]);
+        $val = $stmt->fetchColumn();
+        return ($val !== false && $val !== '') ? (string)$val : null;
+    }
+
     /**
      * Return total number of rows in the theses table (for system status display).
      */