Add admin-only route to open Interdit thesis files from backoffice:

- reliable tab title /favicon wrapper,
- Content-Disposition filename,
- admin media route hardened to thesis-file prefixes only (defense-in-depth)

app/templates/admin/recapitulatif.php

@@ -243,7 +243,14 @@
                     } elseif ($isExternal) {
                         $mediaUrl = htmlspecialchars($filePath);
                     } else {
-                        $mediaUrl = '/media?path=' . urlencode($filePath);
+                        // Interdit (access_type_id=3): the public /media route returns
+                        // 403 for these. Open them via the dedicated admin viewer
+                        // (/admin/media-viewer.php), served under /admin so the
+                        // administrator's session cookie is sent and the tab title
+                        // shows the file name.
+                        $_isForbidden = ((int)($thesis['access_type_id'] ?? 0) === 3);
+                        $mediaUrl = ($_isForbidden ? '/admin/media-viewer.php' : '/media')
+                                  . '?path=' . urlencode($filePath);
                     }
 
                     $typeIcon = match (true) {