maintenance: allow /partage through gate, fix fragment routing, add visibility table in admin

Extract shared filepond logic into src/FilepondHandler.php class.
Admin filepond endpoints delegate to the handler after AdminAuth check.
New partage filepond endpoints at /partage/actions/filepond/ verify
share_active session flag + CSRF token, no admin auth required.

JS reads filepond-base meta tag to determine endpoint path:
- Admin pages: /admin/actions/filepond (via head.php isAdmin check)
- Partage form: /partage/actions/filepond (explicit meta)

partage/index.php sets share_active = true on form render, cleans up on
successful submit. Partage process endpoint rate-limited to 30/5min per
session. No nginx changes needed — /partage/ location already handles
PHP without auth_basic.

app/src/Controllers/SystemController.php

@@ -391,7 +391,7 @@ class SystemController
         $checks['maintenance'] = [
             'label'  => 'Mode maintenance',
             'status' => $maintenanceOn ? 'warn' : 'active',
-            'detail' => $maintenanceOn ? 'Activé — site public inaccessible' : 'Désactivé',
+            'detail' => $maintenanceOn ? 'Activé — site public inaccessible (sauf /admin et /partage)' : 'Désactivé',
         ];
 
         return $checks;