maintenance: allow /partage through gate, fix fragment routing, add visibility table in admin

Extract shared filepond logic into src/FilepondHandler.php class.
Admin filepond endpoints delegate to the handler after AdminAuth check.
New partage filepond endpoints at /partage/actions/filepond/ verify
share_active session flag + CSRF token, no admin auth required.

JS reads filepond-base meta tag to determine endpoint path:
- Admin pages: /admin/actions/filepond (via head.php isAdmin check)
- Partage form: /partage/actions/filepond (explicit meta)

partage/index.php sets share_active = true on form render, cleans up on
successful submit. Partage process endpoint rate-limited to 30/5min per
session. No nginx changes needed — /partage/ location already handles
PHP without auth_basic.

TODO.md

@@ -1,5 +1,10 @@
 # Current tasks
 
+- [x] Fix: partage FilePond asks admin password — shared handler + separate partage endpoints with share_active session gate
+- [ ] Deploy: just deploy (includes new partage/actions/filepond/ + FilepondHandler.php)
+
+# Current tasks
+
 - [x] Mandatory auto-generated passwords on share links (no custom passwords, regenerate-only in edit, rate limit on password gate)
 - [x] .gitignore / .ignore: exclude *.db-wal and *.db-shm
 - [x] CSS: FilePond pool file block border yellow → green on upload complete
@@ -31,6 +36,14 @@
 - [x] Update `partage/index.php` routing for new fragments
 - [x] Keep old fragment files as thin delegates to new `fragments/` for backward compat
 - [x] Update nginx config for partage fragment PHP handling
+
+# Maintenance mode + partage fragment fix
+
+- [x] `bootstrap.php`: add `/partage` as allowed path prefix in maintenance gate
+- [x] `SystemController.php`: update maintenance detail message
+- [x] `admin/parametres.php`: always-visible accessibility table (Normal vs Maintenance)
+- [x] `admin.css`: `.param-access-table` styles (border-radius via overflow:hidden, green/secondary colours)
+- [x] `partage/index.php`: fix fragment routing — `$slug` was `'fragments'` but check used `str_starts_with($slug, 'fragments/')`, causing HTMX fragments to redirect to / (main page)
 - [ ] Deploy: `just deploy` + `just deploy-nginx`
 
 ## Previous items