feat: extract MediaController, wire into Dispatcher, delete media.php

2026-05-06 19:19:19 +02:00 · 2026-04-17 11:44:08 +02:00
parent b03be51b92
commit 75f808bee4
157 changed files with 1713 additions and 452 deletions
--- a/app/public/admin/.htaccess
+++ b/app/public/admin/.htaccess
@@ -0,0 +1,36 @@
+# Security headers
+<IfModule mod_headers.c>
+    # Prevent clickjacking
+    Header always set X-Frame-Options "SAMEORIGIN"
+
+    # Prevent MIME type sniffing
+    Header always set X-Content-Type-Options "nosniff"
+
+    # Enable XSS protection
+    Header always set X-XSS-Protection "1; mode=block"
+
+    # Referrer policy
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    # Content Security Policy (adjust as needed)
+    Header always set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
+</IfModule>
+
+# Prevent directory listing
+Options -Indexes
+
+# Protect sensitive files
+<FilesMatch "^\.">
+    Require all denied
+</FilesMatch>
+
+<FilesMatch "(composer\.(json|lock)|error\.log)$">
+    Require all denied
+</FilesMatch>
+
+# PHP security settings (if .htaccess can override)
+<IfModule mod_php.c>
+    php_flag display_errors Off
+    php_flag log_errors On
+    php_value error_log error.log
+</IfModule>
--- a/app/public/admin/README.md
+++ b/app/public/admin/README.md
@@ -0,0 +1,145 @@
+# Admin Panel Structure
+
+This directory contains the admin panel for managing Post-ERG thesis database.
+
+## Directory Structure
+
+```
+public/admin/
+├── index.php          # List all theses (main page)
+├── add.php            # Add new thesis form
+├── edit.php           # Edit existing thesis form
+├── import.php         # CSV import form
+├── thanks.php         # Thank you page after submission
+├── actions/           # Backend processing scripts (no HTML output)
+│   ├── formulaire.php # Process thesis submission from add.php
+│   └── publish.php    # Toggle publish/unpublish status
+├── inc/               # Shared templates
+│   ├── head.php       # HTML head, CSS, navigation
+│   └── footer.php     # HTML footer
+└── data/              # Upload directory (not in git)
+    ├── theses/        # PDF files
+    └── covers/        # Cover images
+```
+
+## File Types
+
+### User-Facing Templates (Root Directory)
+Files that display HTML to users:
+- **index.php** - Lists all theses with filters and bulk actions
+- **add.php** - Form to add a new thesis
+- **edit.php** - Form to edit an existing thesis
+- **import.php** - CSV import interface
+- **thanks.php** - Success confirmation page
+
+### Backend Scripts (actions/)
+Files that process forms and redirect (no HTML output):
+- **formulaire.php** - Processes thesis submission from add.php
+- **publish.php** - Handles publish/unpublish actions
+
+### Shared Templates (inc/)
+Reusable HTML components:
+- **head.php** - HTML head, CSS links, navigation menu
+- **footer.php** - HTML footer
+
+## Workflow
+
+### Adding a Thesis
+1. User visits `add.php` (displays form)
+2. User submits form to `actions/formulaire.php` (processes data)
+3. On success, redirects to `thanks.php?id=123`
+4. On error, redirects back to `add.php` with error message
+
+### Publishing/Unpublishing
+1. User clicks publish/unpublish button in `index.php`
+2. Form submits to `actions/publish.php` (processes action)
+3. Redirects back to `index.php` with success/error message
+
+## Security
+
+- All pages require HTTP Basic Auth (configured in nginx) — primary layer
+- All pages require PHP session auth (`AdminAuth::requireLogin()`) — defence-in-depth
+- CSRF tokens protect all forms
+- File uploads validated and sanitized
+- Database queries use prepared statements
+- Upload directory outside public/ in production
+
+See `nginx/PHP_AUTH_LAYER.md` for details on the dual-auth architecture.
+
+## Templates
+
+The `inc/` folder contains shared templates:
+- `head.php` - Included at the top of each page (DOCTYPE, CSS, nav)
+- `footer.php` - Included at the bottom of each page (closing tags)
+
+Usage:
+```php
+<?php include "inc/head.php" ?>
+<!-- Page content here -->
+<?php include "inc/footer.php" ?>
+```
+
+## URL Structure
+
+- `/admin/` - List theses (index.php)
+- `/admin/add.php` - Add new thesis
+- `/admin/edit.php?id=123` - Edit thesis #123
+- `/admin/import.php` - Import CSV
+- `/admin/thanks.php?id=123` - Thank you page
+
+Backend actions (not directly accessed):
+- `/admin/actions/formulaire.php` - Form processor
+- `/admin/actions/publish.php` - Publish toggle
+
+## Development
+
+### Adding a New Page
+
+1. Create the template in `/admin/yourpage.php`:
+```php
+<?php
+require_once __DIR__ . "/../../config/bootstrap.php";
+require_once __DIR__ . '/../../lib/AdminAuth.php';
+AdminAuth::requireLogin();
+$pageTitle = "Your Page Title";
+?>
+<?php include "inc/head.php" ?>
+
+<!-- Your content here -->
+
+<?php include "inc/footer.php" ?>
+```
+
+2. Add navigation link in `inc/head.php` if needed
+
+### Adding a New Action
+
+1. Create the script in `/admin/actions/youraction.php`:
+```php
+<?php
+require_once __DIR__ . "/../../config/bootstrap.php";
+require_once __DIR__ . '/../../lib/AdminAuth.php';
+AdminAuth::requireLogin();
+
+// Verify CSRF token
+if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    $_SESSION['error'] = "Security error";
+    header('Location: ../index.php');
+    exit;
+}
+
+// Process action...
+
+// Redirect
+header('Location: ../yourpage.php');
+exit;
+```
+
+2. Create form in template that posts to `actions/youraction.php`
+
+## Notes
+
+- Bootstrap path from actions/: `__DIR__ . "/../../config/bootstrap.php"`
+- Redirects from actions/: use `../` prefix (e.g., `../index.php`)
+- Database class: `require_once __DIR__ . '/../../lib/Database.php'`
+- All forms must include CSRF token from `$_SESSION['csrf_token']`
--- a/app/public/admin/acces-etudiante.php
+++ b/app/public/admin/acces-etudiante.php
@@ -0,0 +1,201 @@
+<?php
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+require_once __DIR__ . '/../../src/ShareLink.php';
+
+App::adminGuard();
+
+$shareLink = ShareLink::make();
+$links = $shareLink->listAll();
+
+$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
+$baseUrl  = $protocol . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
+$pageTitle = 'Accès étudiant·e';
+$isAdmin   = true;
+$bodyClass = 'admin-body';
+?>
+<?php require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+
+
+    <div class="admin-list-toolbar">
+        <h1>Accès étudiant·e</h1>
+        <div class="admin-list-toolbar__right">
+            <button type="button" class="admin-btn admin-btn--sm" id="open-create-dialog">
+                ＋ Créer un lien
+            </button>
+        </div>
+    </div>
+
+    <?php if (empty($links)): ?>
+        <p class="admin-empty">Aucun lien d'accès créé. Cliquez sur « Créer un lien » pour générer un lien partageable.</p>
+    <?php else: ?>
+    <table>
+        <thead>
+            <tr>
+                <th scope="col">Lien</th>
+                <th scope="col">Statut</th>
+                <th scope="col">Mot de passe</th>
+                <th scope="col">Utilisations</th>
+                <th scope="col">Expiration</th>
+                <th scope="col">Créé le</th>
+                <th scope="col">Actions</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($links as $link): ?>
+                <?php
+                    $isExpired = $link['expires_at'] !== null && strtotime($link['expires_at']) < time();
+                    $isActive  = (bool)$link['is_active'] && !$isExpired;
+                    $statusLabel = $isExpired ? 'Expiré' : ($link['is_active'] ? 'Actif' : 'Désactivé');
+                    if ($isExpired) {
+                        $statusClass = 'status-badge status-pending';
+                    } elseif ($link['is_active']) {
+                        $statusClass = 'status-badge status-published';
+                    } else {
+                        $statusClass = 'status-badge';
+                        $statusClass .= ' style="background:var(--error-muted-bg);color:var(--error);"';
+                    }
+                    $fullUrl = $baseUrl . '/partage/' . htmlspecialchars($link['slug']);
+                    $created = date('d/m/Y H:i', strtotime($link['created_at']));
+                    $expires = $link['expires_at'] ? date('d/m/Y', strtotime($link['expires_at'])) : '—';
+                    $hasPassword = !empty($link['password_hash']);
+                ?>
+                <tr>
+                    <td>
+                        <code style="font-size:var(--step--2);color:var(--text-secondary);"><?= htmlspecialchars($link['slug']) ?></code>
+                        <input type="hidden" id="url-<?= $link['id'] ?>" value="<?= $fullUrl ?>">
+                    </td>
+                    <td>
+                        <?php if ($isExpired): ?>
+                            <span class="status-badge status-pending"><?= $statusLabel ?></span>
+                        <?php elseif ($link['is_active']): ?>
+                            <span class="status-badge status-published"><?= $statusLabel ?></span>
+                        <?php else: ?>
+                            <span style="display:inline-block;padding:var(--space-3xs) var(--space-2xs);border-radius:3px;font-size:var(--step--2);font-weight:500;letter-spacing:0.04em;background:var(--error-muted-bg);color:var(--error);"><?= $statusLabel ?></span>
+                        <?php endif; ?>
+                    </td>
+                    <td><?= $hasPassword ? '🔒 Oui' : 'Non' ?></td>
+                    <td style="text-align:center;"><?= intval($link['usage_count']) ?></td>
+                    <td><?= $expires ?></td>
+                    <td><?= $created ?></td>
+                    <td>
+                        <div class="admin-actions">
+                            <button type="button" class="admin-btn-sm admin-btn-view"
+                                    onclick="copyUrl(<?= $link['id'] ?>)" title="Copier l'URL">
+                                Copier
+                            </button>
+                            <form method="post" action="actions/acces-etudiante.php" class="publish-form">
+                                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                                <input type="hidden" name="action" value="toggle">
+                                <input type="hidden" name="id" value="<?= $link['id'] ?>">
+                                <button type="submit"
+                                        class="admin-btn-sm <?= $link['is_active'] ? 'admin-btn-unpublish' : 'admin-btn-publish' ?>"
+                                        title="<?= $link['is_active'] ? 'Désactiver' : 'Activer' ?>">
+                                    <?= $link['is_active'] ? '⏸' : '▶' ?>
+                                </button>
+                            </form>
+                            <button type="button" class="admin-btn-sm admin-btn-edit"
+                                    onclick="openPasswordDialog(<?= $link['id'] ?>, <?= $hasPassword ? 'true' : 'false' ?>)"
+                                    title="Modifier le mot de passe">
+                                🔑
+                            </button>
+                            <form method="post" action="actions/acces-etudiante.php" class="publish-form"
+                                  onsubmit="return confirm('Supprimer ce lien ? Les soumissions via ce lien seront bloquées.')">
+                                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                                <input type="hidden" name="action" value="delete">
+                                <input type="hidden" name="id" value="<?= $link['id'] ?>">
+                                <button type="submit" class="admin-btn-sm admin-btn-delete" title="Supprimer">
+                                    🗑
+                                </button>
+                            </form>
+                        </div>
+                    </td>
+                </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+    <?php endif; ?>
+</main>
+
+<!-- ═══════════════════════ CREATE DIALOG ═══════════════════════ -->
+<dialog id="create-dialog" class="admin-dialog" aria-labelledby="create-dialog-title">
+    <div class="admin-dialog__header">
+        <h2 id="create-dialog-title">Créer un lien d'accès</h2>
+        <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                onclick="document.getElementById('create-dialog').close()">&#x2715;</button>
+    </div>
+    <form method="post" action="actions/acces-etudiante.php" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="action" value="create">
+        <div>
+            <label for="create-password">Mot de passe (optionnel)</label>
+            <input type="password" id="create-password" name="password" autocomplete="new-password">
+            <small>Laissez vide pour un lien sans mot de passe.</small>
+        </div>
+        <div>
+            <label for="create-expires">Expiration (optionnel)</label>
+            <input type="datetime-local" id="create-expires" name="expires_at">
+            <small>Laissez vide pour qu'il n'expire jamais.</small>
+        </div>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Créer le lien</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('create-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<!-- ═══════════════════════ PASSWORD DIALOG ═══════════════════════ -->
+<dialog id="password-dialog" class="admin-dialog" aria-labelledby="password-dialog-title">
+    <div class="admin-dialog__header">
+        <h2 id="password-dialog-title">Mot de passe</h2>
+        <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                onclick="document.getElementById('password-dialog').close()">&#x2715;</button>
+    </div>
+    <form method="post" action="actions/acces-etudiante.php" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="action" value="set_password">
+        <input type="hidden" name="id" id="password-link-id" value="">
+        <div>
+            <label for="password-input">Nouveau mot de passe</label>
+            <input type="password" id="password-input" name="password" autocomplete="new-password">
+            <small>Laissez vide pour supprimer le mot de passe.</small>
+            <p id="password-current-info" style="font-size:var(--step--2);color:var(--text-secondary);margin-top:var(--space-2xs);"></p>
+        </div>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Enregistrer</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('password-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<script>
+document.getElementById('open-create-dialog').addEventListener('click', () => {
+    document.getElementById('create-dialog').showModal();
+});
+
+function copyUrl(id) {
+    const input = document.getElementById('url-' + id);
+    navigator.clipboard.writeText(input.value).then(() => {
+        const btn = event.target.closest('button');
+        const orig = btn.textContent;
+        btn.textContent = '✓ Copié';
+        setTimeout(() => { btn.textContent = orig; }, 1200);
+    });
+}
+
+function openPasswordDialog(id, hasPassword) {
+    document.getElementById('password-link-id').value = id;
+    const info = document.getElementById('password-current-info');
+    info.textContent = hasPassword
+        ? 'Un mot de passe est actuellement configuré. Entrez-en un nouveau ou laissez vide pour le supprimer.'
+        : 'Aucun mot de passe configuré.';
+    document.getElementById('password-dialog').showModal();
+}
+</script>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/account.php
+++ b/app/public/admin/account.php
@@ -0,0 +1,108 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+$pageTitle = "Compte administrateur";
+
+$hasPassword     = AdminAuth::hasPassword();
+
+// Flash messages are consumed by the flash-messages partial below.
+
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+    <h1>Compte administrateur</h1>
+
+
+
+    <!-- Status info -->
+    <dl class="admin-account-status">
+        <div class="admin-account-status__row">
+            <dt class="admin-account-status__label">Authentification PHP</dt>
+            <dd><?php $badgeType = 'ok'; $badgeValue = $hasPassword; $badgeOkLabel = 'Active'; $badgeWarnLabel = 'Non configurée'; include APP_ROOT . '/templates/partials/status-badge.php'; ?></dd>
+        </div>
+        <div class="admin-account-status__row">
+            <dt class="admin-account-status__label">Stockage</dt>
+            <dd>
+                <code class="admin-account-status__code">site_settings (DB)</code>
+                <?php $badgeType = 'ok'; $badgeValue = $hasPassword; $badgeOkLabel = 'Présent'; $badgeWarnLabel = 'Absent'; include APP_ROOT . '/templates/partials/status-badge.php'; ?>
+            </dd>
+        </div>
+        <?php if (!$hasPassword): ?>
+        <p class="admin-account-status__note">
+            Aucun mot de passe PHP configuré. Le formulaire ci-dessous stockera
+                un hash bcrypt dans la base de données.
+        </p>
+        <?php endif; ?>
+    </dl>
+
+    <!-- Password change form -->
+    <h2 class="admin-section-title"><?= $hasPassword ? 'Changer le mot de passe' : 'Définir le mot de passe' ?></h2>
+
+    <form method="post" action="/admin/actions/account.php" class="admin-form" autocomplete="off">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+
+        <?php if ($hasPassword): ?>
+        <div>
+            <label for="current_password">Mot de passe actuel</label>
+            <div>
+                <input type="password" id="current_password"
+                       name="current_password" required autocomplete="current-password">
+            </div>
+        </div>
+        <?php endif; ?>
+
+        <div>
+            <label for="new_password">Nouveau mot de passe</label>
+            <div>
+                <input type="password" id="new_password"
+                       name="new_password" required autocomplete="new-password"
+                       minlength="12">
+                <small>Minimum 12 caractères.</small>
+            </div>
+        </div>
+
+        <div>
+            <label for="confirm_password">Confirmer le mot de passe</label>
+            <div>
+                <input type="password" id="confirm_password"
+                       name="confirm_password" required autocomplete="new-password">
+            </div>
+        </div>
+
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">
+                <?= $hasPassword ? 'Mettre à jour le mot de passe' : 'Définir le mot de passe' ?>
+            </button>
+        </div>
+    </form>
+
+    <?php if ($hasPassword): ?>
+    <!-- Danger zone: remove password -->
+    <h2 class="admin-section-title admin-section-title--danger">Zone de danger</h2>
+    <div class="admin-danger-zone">
+        <p class="admin-danger-zone__description">
+            <strong>Supprimer la configuration du mot de passe PHP</strong><br>
+            <small>
+                Supprime le hash de la base de données. L'accès admin
+                dépendra uniquement de l'authentification nginx Basic Auth si elle est configurée.
+            </small>
+        </p>
+        <form method="post" action="/admin/actions/account.php"
+              onsubmit="return confirm('Supprimer le mot de passe PHP ? L\'accès admin ne sera protégé que par nginx Basic Auth.')">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+            <input type="hidden" name="action" value="remove_credentials">
+            <input type="hidden" name="current_password_remove" id="current_password_remove" value="">
+            <button type="submit" class="admin-btn admin-btn--danger">Supprimer</button>
+        </form>
+    </div>
+    <?php endif; ?>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/actions/acces-etudiante.php
+++ b/app/public/admin/actions/acces-etudiante.php
@@ -0,0 +1,69 @@
+<?php
+/**
+ * Student-access link actions (create, toggle, set_password, delete).
+ */
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+require_once __DIR__ . '/../../../src/ShareLink.php';
+
+App::adminGuard();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST'
+    || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    exit('CSRF token invalide.');
+}
+
+$action = $_POST['action'] ?? '';
+$id     = isset($_POST['id']) ? intval($_POST['id']) : 0;
+$shareLink = ShareLink::make();
+
+switch ($action) {
+    case 'create':
+        $password   = !empty($_POST['password']) ? trim($_POST['password']) : null;
+        $expiresRaw = !empty($_POST['expires_at']) ? trim($_POST['expires_at']) : null;
+        $expiresAt  = null;
+        if ($expiresRaw) {
+            // datetime-local gives "YYYY-MM-DDTHH:MM"
+            $expiresAt = date('Y-m-d H:i:s', strtotime($expiresRaw));
+            if ($expiresAt <= date('Y-m-d H:i:s')) {
+                App::redirect('/admin/acces-etudiante.php', error: "La date d'expiration doit être dans le futur.");
+            }
+        }
+        $shareLink->create(1, $password, $expiresAt);
+        App::redirect('/admin/acces-etudiante.php', success: 'Lien d\'accès créé.');
+        break;
+
+    case 'toggle':
+        if ($id > 0) {
+            $shareLink->toggleActive($id);
+            App::redirect('/admin/acces-etudiante.php', success: 'Statut du lien modifié.');
+        } else {
+            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+        }
+        break;
+
+    case 'set_password':
+        if ($id > 0) {
+            $password = isset($_POST['password']) && $_POST['password'] !== '' ? trim($_POST['password']) : null;
+            $shareLink->setPassword($id, $password);
+            App::redirect('/admin/acces-etudiante.php', success: 'Mot de passe mis à jour.');
+        } else {
+            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+        }
+        break;
+
+    case 'delete':
+        if ($id > 0) {
+            $shareLink->delete($id);
+            App::redirect('/admin/acces-etudiante.php', success: 'Lien supprimé.');
+        } else {
+            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+        }
+        break;
+
+    default:
+        App::redirect('/admin/acces-etudiante.php', error: 'Action inconnue.');
+        break;
+}
--- a/app/public/admin/actions/account.php
+++ b/app/public/admin/actions/account.php
@@ -0,0 +1,94 @@
+<?php
+/**
+ * Admin account action — update or remove admin password.
+ *
+ * Actions:
+ *   POST (default)       — set/change the PHP admin password
+ *   POST action=remove_credentials — remove the password from DB
+ */
+
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+require_once __DIR__ . '/../../../src/Database.php';
+
+AdminAuth::requireLogin();
+
+// ── CSRF ──────────────────────────────────────────────────────────────────────
+if (empty($_SESSION['csrf_token']) || ($_POST['csrf_token'] ?? '') !== $_SESSION['csrf_token']) {
+    http_response_code(403);
+    die('Invalid CSRF token.');
+}
+
+$hasPassword     = AdminAuth::hasPassword();
+$action          = $_POST['action'] ?? 'change_password';
+
+// ── Remove credential ────────────────────────────────────────────────────────
+if ($action === 'remove_credentials') {
+    $backUrl = $_POST['redirect'] ?? '/admin/parametres.php';
+    if (!preg_match('#^/admin/#', $backUrl)) { $backUrl = '/admin/parametres.php'; }
+
+    if (!$hasPassword) {
+        App::flash('error', 'Aucun mot de passe à supprimer.');
+        header('Location: ' . $backUrl);
+        exit;
+    }
+
+    AdminAuth::removePasswordHash();
+    // Destroy session so the user is forced to re-authenticate.
+    AdminAuth::logout();
+    header('Location: /admin/login.php');
+    exit;
+}
+
+// ── Change / set password ─────────────────────────────────────────────────────
+
+// 1. If a password is already set, verify the current one.
+$backUrl = $_POST['redirect'] ?? '/admin/parametres.php';
+if (!preg_match('#^/admin/#', $backUrl)) { $backUrl = '/admin/parametres.php'; }
+
+if ($hasPassword) {
+    $currentPassword = $_POST['current_password'] ?? '';
+    if (!AdminAuth::login($currentPassword)) {
+        App::flash('error', 'Mot de passe actuel incorrect.');
+        header('Location: ' . $backUrl);
+        exit;
+    }
+}
+
+// 2. Validate new password.
+$newPassword     = $_POST['new_password']     ?? '';
+$confirmPassword = $_POST['confirm_password'] ?? '';
+
+if (strlen($newPassword) < 12) {
+    App::flash('error', 'Le nouveau mot de passe doit contenir au moins 12 caractères.');
+    header('Location: ' . $backUrl);
+    exit;
+}
+
+if ($newPassword !== $confirmPassword) {
+    App::flash('error', 'Les mots de passe ne correspondent pas.');
+    header('Location: ' . $backUrl);
+    exit;
+}
+
+// 3. Generate bcrypt hash (cost 12).
+$hash = password_hash($newPassword, PASSWORD_BCRYPT, ['cost' => 12]);
+if ($hash === false) {
+    App::flash('error', 'Erreur lors du hachage du mot de passe.');
+    header('Location: ' . $backUrl);
+    exit;
+}
+
+// 4. Store hash in DB.
+AdminAuth::setPasswordHash($hash);
+
+// 5. Regenerate session (password changed — invalidate old sessions).
+session_regenerate_id(true);
+$_SESSION['admin_authenticated'] = true;
+
+App::flash('success', $hasPassword
+    ? 'Mot de passe mis à jour avec succès.'
+    : 'Mot de passe défini avec succès. L\'authentification PHP est maintenant active.');
+
+header('Location: ' . $backUrl);
+exit;
--- a/app/public/admin/actions/apropos.php
+++ b/app/public/admin/actions/apropos.php
@@ -0,0 +1,76 @@
+<?php
+/**
+ * Save handler for apropos contents (contacts, credits).
+ * Structure: groups[] with label/role, each having entries[] of {text, url, email}.
+ */
+require_once __DIR__ . "/../../../bootstrap.php";
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+// CSRF check
+if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) ||
+    !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    die("Erreur de sécurité : token invalide.");
+}
+
+$allowedKeys = ['contacts', 'credits'];
+$aproposKey  = $_POST['apropos_key'] ?? '';
+if (!in_array($aproposKey, $allowedKeys)) {
+    die("Clé invalide.");
+}
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+try {
+    $db = new Database();
+    $groups = $_POST['groups'] ?? [];
+    $cleaned = [];
+
+    foreach ($groups as $group) {
+        if ($aproposKey === 'credits') {
+            $label = trim($group['label'] ?? '');
+            if ($label === '') continue;
+            $entries = [];
+            foreach ($group['entries'] ?? [] as $entry) {
+                $text = trim($entry['text'] ?? '');
+                if ($text === '') continue;
+                $e = ['text' => $text];
+                $url = trim($entry['url'] ?? '');
+                if ($url !== '') $e['url'] = $url;
+                $entries[] = $e;
+            }
+            if (empty($entries)) continue;
+            $cleaned[] = ['label' => $label, 'entries' => $entries];
+        } else { // contacts
+            $role = trim($group['role'] ?? '');
+            if ($role === '') continue;
+            $entries = [];
+            foreach ($group['entries'] ?? [] as $entry) {
+                $text = trim($entry['text'] ?? '');
+                if ($text === '') continue;
+                $e = [
+                    'text'  => $text,
+                    'email' => trim($entry['email'] ?? ''),
+                ];
+                $url = trim($entry['url'] ?? '');
+                if ($url !== '') $e['url'] = $url;
+                $entries[] = $e;
+            }
+            if (empty($entries)) continue;
+            $cleaned[] = ['role' => $role, 'entries' => $entries];
+        }
+    }
+
+    if (empty($cleaned)) {
+        die("Au moins un groupe avec des entrées est requis.");
+    }
+
+    $db->saveAproposContent($aproposKey, $cleaned);
+    App::flash('success', "Contenu « $aproposKey » mis à jour avec succès.");
+} catch (Exception $e) {
+    error_log("Apropos save error: " . $e->getMessage());
+    die("Erreur lors de la sauvegarde : " . htmlspecialchars($e->getMessage()));
+}
+
+header('Location: /admin/contenus.php');
+exit;
--- a/app/public/admin/actions/delete.php
+++ b/app/public/admin/actions/delete.php
@@ -0,0 +1,60 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+
+AdminAuth::requireLogin();
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+// CSRF validation
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    App::flash('error', 'Erreur de sécurité : token invalide.');
+    header('Location: ../index.php');
+    exit;
+}
+
+$isBulk      = !empty($_POST['bulk']);
+$isDeleteAll = !empty($_POST['delete_all']);
+
+try {
+    $db = new Database();
+
+    if ($isDeleteAll) {
+        $count = $db->deleteAllTheses();
+        App::flash('success', "$count TFE(s) supprimé(s) avec succès.");
+
+    } elseif ($isBulk) {
+        $ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
+
+        if (empty($ids)) {
+            App::flash('error', 'Aucun TFE sélectionné.');
+            header('Location: ../index.php');
+            exit;
+        }
+
+        $db->bulkDeleteTheses($ids);
+        $count = count($ids);
+        App::flash('success', "$count TFE(s) supprimé(s) avec succès.");
+
+    } else {
+        $thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
+
+        if (!$thesisId || $thesisId <= 0) {
+            App::flash('error', 'ID invalide.');
+            header('Location: ../index.php');
+            exit;
+        }
+
+        $db->deleteThesis($thesisId);
+        App::flash('success', 'TFE supprimé avec succès.');
+    }
+
+} catch (Exception $e) {
+    error_log('delete.php error: ' . $e->getMessage());
+    App::flash('error', 'Erreur lors de la suppression : ' . $e->getMessage());
+}
+
+$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+header('Location: ../index.php');
+exit;
--- a/app/public/admin/actions/edit.php
+++ b/app/public/admin/actions/edit.php
@@ -0,0 +1,53 @@
+<?php
+// Bootstrap application
+require_once __DIR__ . "/../../../bootstrap.php";
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+
+// PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
+AdminAuth::requireLogin();
+
+// Only handle POST requests
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header('Location: ../index.php');
+    exit();
+}
+
+// Verify CSRF token
+if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) ||
+    !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    error_log("CSRF token validation failed in edit action");
+    die("Erreur de sécurité : token invalide. Veuillez recharger le formulaire.");
+}
+
+$thesisId = isset($_POST['thesis_id']) ? intval($_POST['thesis_id']) : 0;
+if ($thesisId <= 0) {
+    die("ID de TFE invalide.");
+}
+
+require_once APP_ROOT . '/src/Controllers/ThesisEditController.php';
+
+try {
+    $ctrl = ThesisEditController::create();
+    $ctrl->save($thesisId, $_POST, $_FILES);
+
+    // Regenerate CSRF token after successful save
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+
+    App::flash('success', "TFE mis à jour avec succès!");
+    header('Location: ../edit.php?id=' . $thesisId);
+    exit();
+
+} catch (Exception $e) {
+    error_log("Edit action error: " . $e->getMessage());
+
+    App::flash('error', $e->getMessage());
+
+    // WCAG 3.3.1 — map error message to field name for autofocus on re-render.
+    $autofocusField = ThesisEditController::autofocusFieldForError($e->getMessage());
+    if ($autofocusField !== null) {
+        App::flashAutofocus($autofocusField);
+    }
+
+    header('Location: ../edit.php?id=' . $thesisId);
+    exit();
+}
--- a/app/public/admin/actions/export-csv.php
+++ b/app/public/admin/actions/export-csv.php
@@ -0,0 +1,36 @@
+<?php
+/**
+ * Export TFE listings as CSV.
+ *
+ * Thin dispatcher — delegates all data assembly to ExportController,
+ * then streams the response.
+ */
+require_once __DIR__ . "/../../../bootstrap.php";
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+require_once APP_ROOT . '/src/Controllers/ExportController.php';
+$controller = ExportController::create();
+
+$filename = 'posterg-export-' . date('Y-m-d') . '.csv';
+
+header('Content-Type: text/csv; charset=UTF-8');
+header('Content-Disposition: attachment; filename="' . $filename . '"');
+header('Cache-Control: no-cache, must-revalidate');
+
+// UTF-8 BOM for Excel compatibility
+echo "\xEF\xBB\xBF";
+
+$out = fopen('php://output', 'w');
+
+// Column headers
+fputcsv($out, ExportController::CSV_HEADERS, ',', '"', '');
+
+// Data rows
+$rows = $controller->exportAllTheses();
+foreach ($rows as $csvLine) {
+    fputcsv($out, $csvLine, ',', '"', '');
+}
+
+fclose($out);
+exit;
--- a/app/public/admin/actions/export-db.php
+++ b/app/public/admin/actions/export-db.php
@@ -0,0 +1,29 @@
+<?php
+/**
+ * Export the whole SQLite database as a file download.
+ *
+ * Thin dispatcher — delegates to ExportController.
+ */
+require_once __DIR__ . "/../../../bootstrap.php";
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+require_once APP_ROOT . '/src/Controllers/ExportController.php';
+$controller = ExportController::create();
+
+$dbPath = $controller->getDatabasePath();
+
+if (!file_exists($dbPath)) {
+    http_response_code(500);
+    exit('Base de données introuvable.');
+}
+
+$filename = 'posterg-db-' . date('Y-m-d') . '.sqlite';
+
+header('Content-Type: application/octet-stream');
+header('Content-Disposition: attachment; filename="' . $filename . '"');
+header('Content-Length: ' . filesize($dbPath));
+header('Cache-Control: no-cache, must-revalidate');
+
+readfile($dbPath);
+exit;
--- a/app/public/admin/actions/formulaire.php
+++ b/app/public/admin/actions/formulaire.php
@@ -0,0 +1,47 @@
+<?php
+// Bootstrap application
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+ini_set('error_log', 'error.log');
+
+AdminAuth::requireLogin();
+
+// Verify CSRF token
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    error_log('CSRF token validation failed in formulaire.php');
+    die('Erreur de sécurité : token invalide. Veuillez recharger le formulaire.');
+}
+
+error_log('FILES array: ' . print_r($_FILES, true));
+
+require_once APP_ROOT . '/src/Controllers/ThesisCreateController.php';
+
+try {
+    $ctrl     = ThesisCreateController::make();
+    $thesisId = $ctrl->submit($_POST, $_FILES);
+
+    unset($_SESSION['csrf_token']);
+
+    header('Location: ' . $redirect);
+    exit();
+
+} catch (Exception $e) {
+    error_log('ThesisCreateController error: ' . $e->getMessage());
+
+    App::flash('error', $e->getMessage());
+    $_SESSION['form_data'] = $_POST;
+
+    $redirect = '../add.php';
+
+    $autofocusField = ThesisCreateController::autofocusFieldForError($e->getMessage());
+    if ($autofocusField !== null) {
+        App::flashAutofocus($autofocusField);
+    }
+
+    header('Location: ' . $redirect);
+    exit();
+}
--- a/app/public/admin/actions/maintenance.php
+++ b/app/public/admin/actions/maintenance.php
@@ -0,0 +1,33 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST'
+    || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    die("Accès refusé.");
+}
+
+$action = $_POST['action'] ?? '';
+
+if ($action === 'enable_maintenance') {
+    file_put_contents(MAINTENANCE_FLAG, date('c'));
+    App::flash('success', "Mode maintenance activé.");
+} elseif ($action === 'disable_maintenance') {
+    if (file_exists(MAINTENANCE_FLAG)) {
+        unlink(MAINTENANCE_FLAG);
+    }
+    App::flash('success', "Mode maintenance désactivé.");
+} else {
+    App::flash('error', "Action inconnue.");
+}
+
+$redirect = isset($_POST['redirect']) ? $_POST['redirect'] : '/admin/';
+// Allow only internal admin redirects for safety
+if (!preg_match('#^/admin/#', $redirect)) {
+    $redirect = '/admin/';
+}
+header('Location: ' . $redirect);
+exit();
--- a/app/public/admin/actions/publish.php
+++ b/app/public/admin/actions/publish.php
@@ -0,0 +1,65 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+
+AdminAuth::requireLogin();
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    App::flash('error', 'Erreur de sécurité : token invalide.');
+    header('Location: ../index.php');
+    exit;
+}
+
+$action = $_POST['action'] ?? '';
+$isBulk = !empty($_POST['bulk']);
+
+if (!in_array($action, ['publish', 'unpublish'], true)) {
+    App::flash('error', 'Action invalide.');
+    header('Location: ../index.php');
+    exit;
+}
+
+$published = ($action === 'publish');
+
+try {
+    $db = new Database();
+
+    if ($isBulk) {
+        $ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
+
+        if (empty($ids)) {
+            App::flash('error', 'Aucun TFE sélectionné.');
+            header('Location: ../index.php');
+            exit;
+        }
+
+        $db->bulkSetPublished($ids, $published);
+        $count = count($ids);
+        App::flash('success', $published
+            ? "$count TFE(s) publié(s) avec succès."
+            : "$count TFE(s) retiré(s) de la publication.");
+
+    } else {
+        $thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
+
+        if (!$thesisId || $thesisId <= 0) {
+            App::flash('error', 'ID invalide.');
+            header('Location: ../index.php');
+            exit;
+        }
+
+        $db->setPublished($thesisId, $published);
+        App::flash('success', $published ? 'TFE publié avec succès.' : 'TFE retiré de la publication.');
+    }
+
+} catch (Exception $e) {
+    error_log('publish.php error: ' . $e->getMessage());
+    App::flash('error', 'Erreur lors de la modification : ' . $e->getMessage());
+}
+
+$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+header('Location: ../index.php');
+exit;
--- a/app/public/admin/actions/settings.php
+++ b/app/public/admin/actions/settings.php
@@ -0,0 +1,49 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    App::flash('error', "Erreur de sécurité : token invalide.");
+    header('Location: /admin/parametres.php');
+    exit;
+}
+
+require_once APP_ROOT . '/src/Database.php';
+require_once APP_ROOT . '/src/SmtpRelay.php';
+$db = new Database();
+
+$section = $_POST['section'] ?? '';
+
+if ($section === 'formulaire') {
+    // Save access-type toggle settings
+    $allowed = ['access_type_libre_enabled', 'access_type_interne_enabled', 'access_type_interdit_enabled'];
+    foreach ($allowed as $key) {
+        $value = isset($_POST[$key]) ? '1' : '0';
+        $db->setSetting($key, $value);
+    }
+    App::flash('success', "Paramètres du formulaire mis à jour.");
+} elseif ($section === 'smtp') {
+    $smtpData = [
+        'host'       => $_POST['smtp_host'] ?? '',
+        'port'       => $_POST['smtp_port'] ?? 587,
+        'encryption' => $_POST['smtp_encryption'] ?? 'tls',
+        'username'   => $_POST['smtp_username'] ?? '',
+        'from_email' => $_POST['smtp_from_email'] ?? '',
+        'from_name'  => $_POST['smtp_from_name'] ?? 'Post-ERG',
+    ];
+    // Only update password when user actually typed something.
+    $pwd = $_POST['smtp_password'] ?? '';
+    if ($pwd !== '') {
+        $smtpData['password'] = $pwd;
+    }
+    SmtpRelay::updateSettings($db, $smtpData);
+    App::flash('success', "Paramètres SMTP mis à jour.");
+} else {
+    App::flash('error', "Section inconnue.");
+}
+
+$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+header('Location: /admin/parametres.php');
+exit;
--- a/app/public/admin/actions/tag.php
+++ b/app/public/admin/actions/tag.php
@@ -0,0 +1,50 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST'
+    || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    die("Accès refusé.");
+}
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+try {
+    $db = new Database();
+    $action = $_POST['action'] ?? '';
+
+    switch ($action) {
+        case 'rename':
+            $id      = filter_var($_POST['tag_id'] ?? '', FILTER_VALIDATE_INT);
+            $newName = trim($_POST['new_name'] ?? '');
+            if (!$id || $newName === '') throw new Exception("Paramètres invalides.");
+            $db->renameTag($id, $newName);
+            break;
+
+        case 'merge':
+            $sourceId = filter_var($_POST['source_id'] ?? '', FILTER_VALIDATE_INT);
+            $targetId = filter_var($_POST['target_id'] ?? '', FILTER_VALIDATE_INT);
+            if (!$sourceId || !$targetId) throw new Exception("Paramètres invalides.");
+            $db->mergeTag($sourceId, $targetId);
+            break;
+
+        case 'delete':
+            $id = filter_var($_POST['tag_id'] ?? '', FILTER_VALIDATE_INT);
+            if (!$id) throw new Exception("ID invalide.");
+            $db->deleteTag($id);
+            break;
+
+        default:
+            throw new Exception("Action inconnue.");
+    }
+
+    App::flash('success', "Opération effectuée.");
+} catch (Exception $e) {
+    App::flash('error', $e->getMessage());
+}
+
+header('Location: /admin/tags.php');
+exit();
--- a/app/public/admin/actions/visibility.php
+++ b/app/public/admin/actions/visibility.php
@@ -0,0 +1,55 @@
+<?php
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    App::flash('error', "Erreur de sécurité : token invalide.");
+    header('Location: /admin/');
+    exit;
+}
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+$action      = $_POST['action'] ?? '';          // 'set_visibility'
+$accessTypeId = filter_var($_POST['access_type_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
+$isBulk      = !empty($_POST['bulk']);
+
+$validAccess = [null, 1, 2, 3];
+if (!in_array($accessTypeId, $validAccess, true)) {
+    App::flash('error', "Valeur de visibilité invalide.");
+    header('Location: /admin/');
+    exit;
+}
+
+try {
+    $db = new Database();
+
+    if ($isBulk) {
+        $ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
+        if (empty($ids)) {
+            App::flash('error', "Aucun TFE sélectionné.");
+            header('Location: /admin/');
+            exit;
+        }
+        $db->bulkSetVisibility($ids, $accessTypeId);
+        App::flash('success', count($ids) . " TFE(s) mis à jour.");
+    } else {
+        $thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
+        if (!$thesisId) {
+            App::flash('error', "ID invalide.");
+            header('Location: /admin/');
+            exit;
+        }
+        $db->setVisibility($thesisId, $accessTypeId);
+        App::flash('success', "Visibilité mise à jour.");
+    }
+} catch (Exception $e) {
+    error_log("visibility.php error: " . $e->getMessage());
+    App::flash('error', "Erreur : " . $e->getMessage());
+}
+
+$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+header('Location: /admin/');
+exit;
--- a/app/public/admin/add.php
+++ b/app/public/admin/add.php
@@ -0,0 +1,160 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (empty($_SESSION["csrf_token"])) {
+    $_SESSION["csrf_token"] = bin2hex(random_bytes(32));
+}
+
+$pageTitle = "Ajouter un TFE";
+
+require_once __DIR__ . '/../../src/Controllers/ThesisCreateController.php';
+
+try {
+    $ctrl = ThesisCreateController::make();
+    extract($ctrl->loadFormData());
+} catch (Exception $e) {
+    error_log('Failed to load form data: ' . $e->getMessage());
+    die('Erreur lors du chargement du formulaire.');
+}
+
+$formData      = $_SESSION['form_data'] ?? [];
+unset($_SESSION['form_data']);
+$autofocusField = App::consumeAutofocus();
+
+/**
+ * Merge autofocus into the $attrs array for a given field.
+ */
+function withAutofocus(string $fieldName, array $attrs = []): array {
+    global $autofocusField;
+    if ($autofocusField === $fieldName) {
+        $attrs['autofocus'] = true;
+    }
+    return $attrs;
+}
+
+function old($key, $default = "") {
+    global $formData;
+    return isset($formData[$key]) ? htmlspecialchars($formData[$key]) : $default;
+}
+function wasSelected($key, $value) {
+    global $formData;
+    if (!isset($formData[$key])) return false;
+    if (is_array($formData[$key])) return in_array($value, $formData[$key]);
+    return $formData[$key] == $value;
+}
+?>
+<?php
+$isAdmin = true;
+$bodyClass = 'admin-body';
+require_once APP_ROOT . '/templates/head.php';
+include APP_ROOT . '/templates/header.php';
+?>
+
+<main id="main-content">
+    <div class="thesis-add-header">
+        <h1>Ajouter un TFE</h1>
+    </div>
+
+
+
+    <form action="actions/formulaire.php" method="post" enctype="multipart/form-data" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION["csrf_token"]) ?>">
+
+        <!-- ═══════════════════ Informations du TFE ═══════════════════ -->
+        <fieldset>
+            <legend>Informations du TFE</legend>
+
+            <?php $name = 'titre';     $label = 'Titre :';                          $value = old('titre');     $required = true;  $attrs = withAutofocus('titre');     include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+            <?php $name = 'subtitle';  $label = 'Sous-titre (si applicable) :';     $value = old('subtitle');  $required = false; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+            <?php $name = 'auteurice'; $label = 'Auteur·ice(s) :';                  $value = old('auteurice'); $required = true;  $attrs = withAutofocus('auteurice', ['autocomplete' => 'name']); include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+            <?php $name = 'mail';      $label = 'Contact(s) (optionnel) [mail/site/insta/etc.] :'; $value = old('mail'); $attrs = ['autocomplete' => 'email']; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+            <div class="admin-form-group">
+                <label class="admin-checkbox-label">
+                    <input type="checkbox" name="contact_public" value="1"
+                           <?= isset($formData['contact_public']) ? 'checked' : '' ?>>
+                    Je veux que mon contact soit accessible à toustes depuis la plateforme xamxam
+                </label>
+                <small>Si cette case est cochée, votre contact apparaîtra sur la page publique de votre TFE.</small>
+            </div>
+
+            <div>
+                <label for="synopsis">Synopsis :</label>
+                <textarea id="synopsis" name="synopsis"
+                          rows="7" required
+                          <?= $autofocusField === 'synopsis' ? 'autofocus' : '' ?>><?= old('synopsis') ?></textarea>
+            </div>
+        </fieldset>
+
+        <!-- ═══════════════════ Composition du jury ═══════════════════ -->
+        <?php require APP_ROOT . '/templates/partials/form/jury-fieldset.php'; ?>
+
+        <!-- ═══════════════════ Cadre académique ═══════════════════ -->
+        <fieldset>
+            <legend>Cadre académique</legend>
+
+            <?php
+                $name  = 'année'; $label = 'Année :'; $value = old('année'); $required = true;
+                $type  = 'number';
+                $placeholder = date('Y');
+                $attrs = withAutofocus('année', ['min' => 2000, 'max' => date('Y') + 1]);
+                include APP_ROOT . '/templates/partials/form/text-field.php';
+            ?>
+
+            <?php $name = 'orientation'; $label = 'Orientation :';             $options = $orientations;    $selected = $formData['orientation'] ?? ''; $required = true; $placeholder = ''; $attrs = withAutofocus('orientation'); include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+            <?php $name = 'ap';          $label = 'Atelier pluridisciplinaire :'; $options = $apPrograms;    $selected = $formData['ap'] ?? '';            $required = true; $placeholder = ''; $attrs = withAutofocus('ap');          include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+            <?php $name = 'finality';   $label = 'Finalité du master :';       $options = $finalityTypes;   $selected = $formData['finality'] ?? '';    $required = true; $placeholder = ''; $attrs = withAutofocus('finality');    include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+            <?php $name = 'languages'; $label = 'Langue(s) :'; $options = $languages; $checked = $formData['languages'] ?? []; include APP_ROOT . '/templates/partials/form/checkbox-list.php'; ?>
+            <?php $name = 'formats';   $label = 'Format(s) :'; $options = $formatTypes; $checked = $formData['formats'] ?? [];   include APP_ROOT . '/templates/partials/form/checkbox-list.php'; ?>
+
+            <?php $name = 'tag'; $label = 'Mots-clés :'; $value = old('tag'); $placeholder = 'sociologie, anthropologie, ...'; $hint = 'Séparez par des virgules. Max 10 mots-clés.'; $attrs = withAutofocus('tag'); include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+        </fieldset>
+
+        <!-- ═══════════════════ Fichiers ═══════════════════ -->
+        <fieldset>
+            <legend>Fichiers</legend>
+
+            <?php $name = 'couverture'; $label = 'Image de couverture :';       $accept = 'image/jpeg,image/png';          $hint = 'JPG, PNG. Taille max : 10 MB.';  include APP_ROOT . '/templates/partials/form/file-field.php'; ?>
+            <?php $name = 'banner';     $label = 'Image bannière (accueil) :';  $accept = 'image/jpeg,image/png,image/webp'; $hint = 'JPG, PNG ou WEBP. Format paysage recommandé (4:1). Max 5 MB.'; include APP_ROOT . '/templates/partials/form/file-field.php'; ?>
+            <?php $name = 'files';      $label = 'Fichiers du TFE :';           $accept = '.pdf,.jpg,.jpeg,.png,.mp4,.zip,.vtt'; $hint = 'PDF, JPG, PNG, MP4, ZIP. Max 50 MB par fichier. Pour les vidéos, un fichier .vtt de sous-titres peut être joint (il sera associé automatiquement à la vidéo correspondante).'; $multiple = true; include APP_ROOT . '/templates/partials/form/file-field.php'; ?>
+        </fieldset>
+
+        <!-- ═══════════════════ Métadonnées complémentaires ═══════════════════ -->
+        <fieldset>
+            <legend>Métadonnées complémentaires</legend>
+
+            <?php $name = 'license_id';    $label = 'Licence :';    $options = $licenseTypes; $selected = $formData['license_id'] ?? '';    $placeholder = '— Inconnue —'; include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+            <?php $name = 'duration_info'; $label = 'Durée / Taille :'; $value = old('duration_info'); $placeholder = 'Ex : 84 pages'; $hint = 'Durée (minutes) ou nombre de pages.'; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+            <?php $name = 'lien'; $label = 'Lien (site / ressource) :'; $value = old('lien'); $type = 'url'; $placeholder = 'https://...'; $attrs = withAutofocus('lien'); include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+            <?php
+                $accessOptions = array_map(function($at) {
+                    return ['id' => $at['id'], 'name' => $at['name']];
+                }, $enabledAccessTypes);
+                $defaultAccessType    = 2;
+                $selectedAccessType   = isset($formData['access_type_id'])
+                    ? (int)$formData['access_type_id']
+                    : $defaultAccessType;
+                $name      = 'access_type_id';
+                $label     = 'Visibilité / Accès :';
+                $options   = $accessOptions;
+                $selected  = $selectedAccessType;
+                $placeholder = null;
+                $required  = true;
+                $attrs     = [];
+                include APP_ROOT . '/templates/partials/form/select-field.php';
+            ?>
+        </fieldset>
+
+        <div class="form-footer">
+            <button type="submit" name="go">Soumettre</button>
+        </div>
+    </form>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/contenus-edit.php
+++ b/app/public/admin/contenus-edit.php
@@ -0,0 +1,232 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+require_once __DIR__ . '/../../src/Database.php';
+
+if (empty($_SESSION["csrf_token"])) {
+    $_SESSION["csrf_token"] = bin2hex(random_bytes(32));
+}
+
+$allowedPageSlugs = ["about", "licenses", "charte"];
+$allowedApropos   = ["contacts", "credits"];
+
+$pageSlug   = $_GET["slug"] ?? "";
+$aproposKey = $_GET["apropos"] ?? "";
+
+// Exactly one target must be specified
+if ($pageSlug && !in_array($pageSlug, $allowedPageSlugs)) {
+    $pageSlug = "";
+}
+if ($aproposKey && !in_array($aproposKey, $allowedApropos)) {
+    $aproposKey = "";
+}
+
+if (!$pageSlug && !$aproposKey) {
+    header("Location: /admin/contenus.php");
+    exit();
+}
+
+try {
+    $db = new Database();
+
+    if ($pageSlug) {
+        $page = $db->getPage($pageSlug);
+        if (!$page) {
+            die("Page introuvable.");
+        }
+        $editTitle = $page["title"];
+        $editType  = "page";
+    } else {
+        $editType  = "apropos";
+        $value     = $db->getAproposContent($aproposKey);
+        $editTitle = match($aproposKey) {
+            'contacts' => 'Contacts',
+            'credits'  => 'Crédits',
+        };
+    }
+} catch (Exception $e) {
+    die("Erreur: " . htmlspecialchars($e->getMessage()));
+}
+
+$pageTitle = "Éditer : " . $editTitle;
+$extraJs = ["/assets/js/overtype.min.js"];
+$extraJsInline = <<<'JS'
+var OT = window.OverType.default || window.OverType;
+var hidden = document.getElementById('content');
+var editor = new OT(document.getElementById('editor'), {
+    value: hidden.value,
+    minHeight: '400px',
+    spellcheck: false,
+    onChange: function(value) { hidden.value = value; }
+});
+JS;
+$aproposEditorJs = null;
+if ($editType === 'apropos' && in_array($aproposKey, ['contacts', 'credits'])) {
+    // Rich textarea for JSON arrays rendered as structured form
+    $aproposEditorJs = <<<'JS'
+// Auto-format JSON in the hidden field for display purposes
+JS;
+}
+
+$initialContent = '';
+if ($editType === 'page') {
+    $initialContent = $page["content"] ?? "";
+} else {
+    // For apropos, show structured form
+}
+?>
+<?php
+$isAdmin = true;
+$bodyClass = "admin-body";
+require_once APP_ROOT . "/templates/head.php";
+?>
+    <?php include APP_ROOT . "/templates/header.php"; ?>
+
+<main id="main-content">
+    <h1>Éditer : <?= htmlspecialchars($editTitle) ?></h1>
+
+    <?php if ($editType === 'page'): ?>
+    <form action="/admin/actions/page.php" method="post" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION["csrf_token"]) ?>">
+        <input type="hidden" name="slug" value="<?= htmlspecialchars($pageSlug) ?>">
+
+        <label for="editor">Contenu (Markdown) :</label>
+        <input type="hidden" id="content" name="content"
+               value="<?= htmlspecialchars($initialContent) ?>">
+        <div id="editor"></div>
+
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Enregistrer</button>
+            <a href="/admin/contenus.php" class="admin-btn-secondary admin-cancel-link">Annuler</a>
+        </div>
+    </form>
+
+    <?php else: ?>
+    <?php
+    $groups = is_array($value) ? $value : [];
+    ?>
+    <form action="/admin/actions/apropos.php" method="post" class="admin-form" id="apropos-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION["csrf_token"]) ?>">
+        <input type="hidden" name="apropos_key" value="<?= htmlspecialchars($aproposKey) ?>">
+
+        <?php foreach ($groups as $gi => $group): ?>
+        <fieldset class="apropos-group">
+            <legend><?= htmlspecialchars($aproposKey === 'contacts' ? 'Contact' : 'Crédit') ?> <?= $gi + 1 ?></legend>
+            <?php if ($aproposKey === 'contacts'): ?>
+                <label for="group_<?= $gi ?>_role">Rôle :</label>
+                <input type="text" id="group_<?= $gi ?>_role"
+                       name="groups[<?= $gi ?>][role]"
+                       value="<?= htmlspecialchars($group['role'] ?? '') ?>">
+            <?php else: ?>
+                <label for="group_<?= $gi ?>_label">Label :</label>
+                <input type="text" id="group_<?= $gi ?>_label"
+                       name="groups[<?= $gi ?>][label]"
+                       value="<?= htmlspecialchars($group['label'] ?? '') ?>">
+            <?php endif; ?>
+
+            <?php $entries = is_array($group['entries'] ?? null) ? $group['entries'] : []; ?>
+            <?php foreach ($entries as $ei => $entry): ?>
+            <div class="apropos-entry">
+                <label for="entry_<?= $gi ?>_<?= $ei ?>_text"><?= $aproposKey === 'contacts' ? 'Nom' : 'Texte' ?> :</label>
+                <input type="text" id="entry_<?= $gi ?>_<?= $ei ?>_text"
+                       name="groups[<?= $gi ?>][entries][<?= $ei ?>][text]"
+                       value="<?= htmlspecialchars($entry['text'] ?? '') ?>">
+                <?php if ($aproposKey === 'contacts'): ?>
+                    <label for="entry_<?= $gi ?>_<?= $ei ?>_email">Email :</label>
+                    <input type="email" id="entry_<?= $gi ?>_<?= $ei ?>_email"
+                           name="groups[<?= $gi ?>][entries][<?= $ei ?>][email]"
+                           value="<?= htmlspecialchars($entry['email'] ?? '') ?>">
+                <?php endif; ?>
+                <label for="entry_<?= $gi ?>_<?= $ei ?>_url">Lien (optionnel) :</label>
+                <input type="url" id="entry_<?= $gi ?>_<?= $ei ?>_url"
+                       name="groups[<?= $gi ?>][entries][<?= $ei ?>][url]"
+                       value="<?= htmlspecialchars($entry['url'] ?? '') ?>">
+            </div>
+            <?php endforeach; ?>
+
+            <button type="button" class="admin-btn admin-btn--sm add-entry-btn" data-group="<?= $gi ?>">+ Ajouter une entrée</button>
+        </fieldset>
+        <?php endforeach; ?>
+
+        <button type="button" class="admin-btn" id="add-group-btn">+ Ajouter un <?= $aproposKey === 'contacts' ? 'contact' : 'groupe de crédit' ?></button>
+
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Enregistrer</button>
+            <a href="/admin/contenus.php" class="admin-btn-secondary admin-cancel-link">Annuler</a>
+        </div>
+
+        <template id="entry-template-<?= $aproposKey ?>">
+            <div class="apropos-entry">
+                <label>Entrée :</label>
+                <input type="text" name="groups[{{gi}}][entries][{{ei}}][text]">
+                <?php if ($aproposKey === 'contacts'): ?>
+                    <label>Email :</label>
+                    <input type="email" name="groups[{{gi}}][entries][{{ei}}][email]">
+                <?php endif; ?>
+                <label>Lien (optionnel) :</label>
+                <input type="url" name="groups[{{gi}}][entries][{{ei}}][url]">
+            </div>
+        </template>
+
+        <template id="group-template-<?= $aproposKey ?>">
+            <fieldset class="apropos-group">
+                <legend><?= htmlspecialchars($aproposKey === 'contacts' ? 'Contact' : 'Crédit') ?> {{gi}}</legend>
+                <?php if ($aproposKey === 'contacts'): ?>
+                    <label>Rôle :</label>
+                    <input type="text" name="groups[{{gi}}][role]">
+                <?php else: ?>
+                    <label>Label :</label>
+                    <input type="text" name="groups[{{gi}}][label]">
+                <?php endif; ?>
+                <button type="button" class="admin-btn admin-btn--sm add-entry-btn" data-group="{{gi}}">+ Ajouter une entrée</button>
+            </fieldset>
+        </template>
+    </form>
+
+    <script>
+    (function() {
+        const aproposKey = '<?= $aproposKey ?>';
+        let groupCount = <?= count($groups) ?>;
+        const entryTpl = document.getElementById('entry-template-' + aproposKey).innerHTML;
+        const groupTpl = document.getElementById('group-template-' + aproposKey).innerHTML;
+
+        // Add entry to a group
+        document.querySelectorAll('.add-entry-btn').forEach(btn => {
+            btn.addEventListener('click', function() {
+                const gi = parseInt(this.dataset.group);
+                const fieldset = this.closest('fieldset');
+                const entryCount = fieldset.querySelectorAll('.apropos-entry').length;
+                const html = entryTpl.replaceAll('{{gi}}', gi).replaceAll('{{ei}}', entryCount);
+                this.insertAdjacentHTML('beforebegin', html);
+            });
+        });
+
+        // Add new group
+        document.getElementById('add-group-btn').addEventListener('click', function() {
+            groupCount++;
+            const html = groupTpl.replaceAll('{{gi}}', groupCount);
+            this.insertAdjacentHTML('beforebegin', html);
+
+            // Re-bind add-entry buttons for the new group
+            const newGroup = this.previousElementSibling;
+            if (newGroup && newGroup.classList.contains('apropos-group')) {
+                const btn = newGroup.querySelector('.add-entry-btn');
+                if (btn) {
+                    btn.dataset.group = groupCount;
+                    btn.addEventListener('click', function() {
+                        const gi = parseInt(this.dataset.group);
+                        const fieldset = this.closest('fieldset');
+                        const entryCount = fieldset.querySelectorAll('.apropos-entry').length;
+                        const html = entryTpl.replaceAll('{{gi}}', gi).replaceAll('{{ei}}', entryCount);
+                        this.insertAdjacentHTML('beforebegin', html);
+                    });
+                }
+            }
+        });
+    })();
+    </script>
+    <?php endif; ?>
+</main>
+<?php require_once APP_ROOT . "/templates/admin/footer.php"; ?>
--- a/app/public/admin/contenus.php
+++ b/app/public/admin/contenus.php
@@ -0,0 +1,85 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+require_once __DIR__ . '/../../src/Database.php';
+
+$pageTitle = "Contenus";
+
+try {
+    $db = new Database();
+    $pages = $db->getAllPages();
+    $aproposKeys = $db->getAllAproposContents();
+} catch (Exception $e) {
+    error_log("Error loading contenus: " . $e->getMessage());
+    die("Erreur lors du chargement des contenus.");
+}
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+    <h1>Contenus</h1>
+
+
+
+    <h2>Pages statiques</h2>
+
+    <table>
+        <thead>
+            <tr>
+                <th scope="col">Slug</th>
+                <th scope="col">Titre</th>
+                <th scope="col">Mis à jour</th>
+                <th scope="col">Action</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($pages as $p): ?>
+            <tr>
+                <td><code><?= htmlspecialchars($p['slug']) ?></code></td>
+                <td><?= htmlspecialchars($p['title']) ?></td>
+                <td><?= htmlspecialchars($p['updated_at'] ?? '—') ?></td>
+                <td>
+                    <a href="/admin/contenus-edit.php?slug=<?= urlencode($p['slug']) ?>"
+                       class="admin-btn admin-btn--sm">Éditer</a>
+                </td>
+            </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+
+    <h2 style="margin-top:2rem;">À propos</h2>
+
+    <table>
+        <thead>
+            <tr>
+                <th scope="col">Clé</th>
+                <th scope="col">Type</th>
+                <th scope="col">Mis à jour</th>
+                <th scope="col">Action</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($aproposKeys as $a): ?>
+            <?php
+                $typeLabel = match($a['key']) {
+                    'contacts' => 'Contacts',
+                    'credits'  => 'Crédits',
+                };
+            ?>
+            <tr>
+                <td><code><?= htmlspecialchars($a['key']) ?></code></td>
+                <td><?= htmlspecialchars($typeLabel) ?></td>
+                <td><?= htmlspecialchars($a['updated_at'] ?? '—') ?></td>
+                <td>
+                    <a href="/admin/contenus-edit.php?apropos=<?= urlencode($a['key']) ?>"
+                       class="admin-btn admin-btn--sm">Éditer</a>
+                </td>
+            </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/edit.php
+++ b/app/public/admin/edit.php
@@ -0,0 +1,172 @@
+<?php
+// Bootstrap application
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+
+// PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
+AdminAuth::requireLogin();
+
+// Generate CSRF token
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+require_once APP_ROOT . '/src/Controllers/ThesisEditController.php';
+
+$thesisId = isset($_GET['id']) ? intval($_GET['id']) : 0;
+
+if ($thesisId <= 0) {
+    die("ID invalide");
+}
+
+// WCAG 3.3.1 — consume the autofocus hint stored by the edit action on
+// validation failure.
+$autofocusField = App::consumeAutofocus();
+
+try {
+    $ctrl = ThesisEditController::create();
+    $view = $ctrl->load($thesisId);
+    extract($view); // thesis, currentLanguages, currentFormats, jury, lookup tables, pageTitle …
+} catch (Exception $e) {
+    error_log("Error loading edit page: " . $e->getMessage());
+    die("Erreur lors du chargement: " . $e->getMessage());
+}
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+    <h1>Modifier un TFE</h1>
+
+
+
+    <form method="post" action="/admin/actions/edit.php" class="admin-form" enctype="multipart/form-data">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="thesis_id"  value="<?= $thesisId ?>">
+
+        <?php $name = 'auteurice'; $label = 'Auteur·ice(s) :'; $value = htmlspecialchars($thesis['authors']); $required = true; $attrs = array_merge(['autocomplete' => 'name'], $autofocusField === 'auteurice' ? ['autofocus' => true] : []);  include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+        <?php $name = 'mail';      $label = 'Contact :';        $value = htmlspecialchars($currentAuthorEmail ?? ''); $attrs = ['autocomplete' => 'email']; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+        <!-- Contact visibility -->
+        <div class="admin-form-group">
+            <label class="admin-checkbox-label">
+                <input type="checkbox" name="contact_public" value="1"
+                       <?= !empty($currentAuthorShowContact) ? 'checked' : '' ?>>
+                Je veux que mon contact soit accessible à toustes depuis la plateforme xamxam
+            </label>
+            <small>Si cette case est cochée, le contact apparaît sur la page publique du TFE.</small>
+        </div>
+
+        <?php
+            $name  = 'année'; $label = 'Année :'; $value = htmlspecialchars((string)$thesis['year']); $required = true;
+            $type  = 'number';
+            $attrs = $autofocusField === 'année' ? ['autofocus' => true] : [];
+            include APP_ROOT . '/templates/partials/form/text-field.php';
+        ?>
+
+        <?php $name = 'orientation'; $label = 'Orientation :'; $options = $orientations; $selected = $thesis['orientation']; $required = true; $placeholder = null; include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+        <?php $name = 'ap'; $label = 'Atelier pluridisciplinaire :'; $options = $apPrograms; $selected = $thesis['ap_program']; $required = true; $placeholder = null; include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+        <?php $name = 'finality'; $label = 'Finalité du master :'; $options = $finalityTypes; $selected = $thesis['finality_type']; $required = true; $placeholder = null; include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+        <!-- Composition du jury -->
+        <?php
+            $juryPresident    = null;
+            $juryPromoteur    = null;
+            $juryPromoteurExt = 0;
+            $juryLecteurs     = [];
+            foreach ($jury as $jm) {
+                if ($jm['role'] === 'president') {
+                    $juryPresident = $jm['name'];
+                } elseif ($jm['role'] === 'promoteur') {
+                    $juryPromoteur    = $jm['name'];
+                    $juryPromoteurExt = (int)$jm['is_external'];
+                } elseif ($jm['role'] === 'lecteur') {
+                    $juryLecteurs[] = $jm;
+                }
+            }
+        ?>
+        <?php require APP_ROOT . '/templates/partials/form/jury-fieldset.php'; ?>
+
+        <?php
+            // Access type select: options need 'id'+'name'; description appended inline
+            $accessOptions = array_map(function($at) {
+                $label = $at['name'];
+                if (!empty($at['description'])) {
+                    $label .= ' — ' . $at['description'];
+                }
+                return ['id' => $at['id'], 'name' => $label];
+            }, $accessTypes);
+            $name = 'access_type_id'; $label = 'Visibilité / Accès :'; $options = $accessOptions; $selected = $currentAccessTypeId; $placeholder = '- Non défini -';
+            include APP_ROOT . '/templates/partials/form/select-field.php';
+        ?>
+
+        <!-- Context note (textarea — no text-field partial for textarea) -->
+        <div>
+            <label for="context_note">Note contextuelle :</label>
+            <div>
+                <textarea id="context_note" name="context_note"
+                          rows="4" maxlength="1500"><?= htmlspecialchars($currentContextNote ?? '') ?></textarea>
+                <small>Visible publiquement pour les TFE Interne ou Interdit. Max 1 500 caractères.</small>
+            </div>
+        </div>
+
+        <?php $name = 'license_id'; $label = 'Licence :'; $options = $licenseTypes; $selected = $currentLicenseId; $placeholder = '- Inconnue -'; include APP_ROOT . '/templates/partials/form/select-field.php'; ?>
+
+        <?php $name = 'titre';    $label = 'Titre :';      $value = htmlspecialchars($thesis['title']);           $required = true; $attrs = $autofocusField === 'titre' ? ['autofocus' => true] : []; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+        <?php $name = 'subtitle'; $label = 'Sous-titre :'; $value = htmlspecialchars($thesis['subtitle'] ?? ''); include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+        <!-- Synopsis (textarea — not covered by text-field partial) -->
+        <div>
+            <label for="synopsis">Synopsis :</label>
+            <textarea id="synopsis" name="synopsis" rows="7" required
+                      <?= $autofocusField === 'synopsis' ? 'autofocus' : '' ?>><?= htmlspecialchars($thesis['synopsis'] ?? '') ?></textarea>
+        </div>
+
+        <?php $name = 'languages'; $label = 'Langue(s) :'; $options = $languages; $checked = $currentLanguages; include APP_ROOT . '/templates/partials/form/checkbox-list.php'; ?>
+
+        <?php $name = 'formats'; $label = 'Format(s) :'; $options = $formatTypes; $checked = $currentFormats; include APP_ROOT . '/templates/partials/form/checkbox-list.php'; ?>
+
+        <?php $name = 'tag'; $label = 'Mots-clés :'; $value = htmlspecialchars($thesis['keywords'] ?? ''); $hint = 'Séparer par des virgules. Max 10.'; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+        <?php $name = 'duration_info'; $label = 'Durée / Taille :'; $value = htmlspecialchars($thesis['file_size_info'] ?? ''); include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+        <?php $name = 'lien'; $label = 'Lien externe :'; $value = htmlspecialchars($thesis['baiu_link'] ?? ''); $type = 'url'; include APP_ROOT . '/templates/partials/form/text-field.php'; ?>
+
+        <!-- Image bannière (custom: includes current banner preview + remove checkbox) -->
+        <div>
+            <label>Image bannière (accueil) :</label>
+            <div>
+                <?php if (!empty($thesis['banner_path'])): ?>
+                <div class="admin-banner-preview">
+                    <img src="/media.php?path=<?= urlencode($thesis['banner_path']) ?>"
+                         alt="Bannière actuelle">
+                    <label class="admin-checkbox-label">
+                        <input type="checkbox" name="remove_banner" value="1"> Supprimer la bannière
+                    </label>
+                </div>
+                <?php endif; ?>
+                <input type="file" name="banner" accept="image/jpeg,image/png,image/webp">
+                <small>JPG, PNG ou WEBP. Format paysage recommandé (4:1). Max 5 MB.</small>
+            </div>
+        </div>
+
+        <!-- Publication toggle -->
+        <div>
+            <label>Publication :</label>
+            <label class="admin-checkbox-label">
+                <input type="checkbox" name="is_published" value="1"
+                       <?= $thesis['is_published'] ? 'checked' : '' ?>>
+                Publier ce TFE sur le site public
+            </label>
+        </div>
+
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Enregistrer</button>
+            <a href="/admin/thanks.php?id=<?= $thesisId ?>" class="admin-btn-secondary admin-cancel-link">Annuler</a>
+        </div>
+    </form>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/import.php
+++ b/app/public/admin/import.php
@@ -0,0 +1,5 @@
+<?php
+// import.php is no longer a standalone page.
+// CSV import is handled inline on the list page via a dialog.
+header('Location: /admin/');
+exit();
--- a/app/public/admin/index.php
+++ b/app/public/admin/index.php
@@ -0,0 +1,559 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+$pageTitle = "Liste des TFE";
+require_once __DIR__ . '/../../src/Database.php';
+
+// ── CSV Import (inline, submitted to this same page) ─────────────────────────
+$importMessage = '';
+$importErrors  = [];
+$importResults = [];
+$importDone    = false;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['csv_file'])) {
+    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+        $importErrors[] = "Erreur de sécurité : token invalide.";
+    } else {
+        $importedCount = 0;
+        $skippedCount  = 0;
+        try {
+            $importDb  = new Database();
+            $importPdo = $importDb->getPDO();
+
+            if ($_FILES['csv_file']['error'] !== UPLOAD_ERR_OK) {
+                throw new Exception("Erreur lors du téléversement du fichier.");
+            }
+
+            $handle = fopen($_FILES['csv_file']['tmp_name'], 'r');
+            if (!$handle) throw new Exception("Impossible d'ouvrir le fichier CSV.");
+
+            fgetcsv($handle, 0, ',', '"', '');
+            fgetcsv($handle, 0, ',', '"', '');
+            fgetcsv($handle, 0, ',', '"', '');
+            fgetcsv($handle, 0, ',', '"', ''); // skip 4 header rows
+
+            $orientationMap = [
+                'SC'=>'Sculpture','VI'=>'Vidéographie','CA'=>"Cinéma d'animation",
+                'IP'=>'Installation-Performance','PE'=>'Peinture','PH'=>'Photographie',
+                'DE'=>'Dessin','AN'=>'Arts Numériques','GR'=>'Graphisme',
+                'TY'=>'Typographie','DN'=>'Design Numérique','IL'=>'Illustration',
+                'BD'=>'Bande-Dessinée','SE'=>'Sérigraphie','GV'=>'Gravure',
+            ];
+
+            $lineNumber = 5;
+            while (($row = fgetcsv($handle, 0, ',', '"', '')) !== false) {
+                $lineNumber++;
+                if (empty($row[0]) && empty($row[1])) continue;
+                try {
+                    $importDb->beginTransaction();
+
+                    $identifier      = trim($row[0]  ?? '');
+                    $title           = trim($row[1]  ?? '');
+                    $subtitle        = trim($row[2]  ?? '');
+                    $authorsRaw      = trim($row[3]  ?? '');
+                    $contact         = trim($row[4]  ?? '');
+                    $supervisorsRaw  = trim($row[5]  ?? '');
+                    $formatsRaw      = trim($row[6]  ?? '');
+                    $year            = intval($row[7] ?? 0);
+                    $apCode          = trim($row[8]  ?? '');
+                    $orientationCode = trim($row[9]  ?? '');
+                    $finalityName    = trim($row[10] ?? '');
+                    $keywordsRaw     = trim($row[11] ?? '');
+                    $synopsis        = trim($row[12] ?? '');
+                    $context         = trim($row[13] ?? '');
+                    $remarks         = trim($row[14] ?? '');
+                    $languageRaw     = trim($row[15] ?? '');
+                    $access          = trim($row[16] ?? '');
+                    $license         = trim($row[17] ?? '');
+                    $sizeInfo        = trim($row[18] ?? '');
+                    $juryPoints      = !empty($row[19]) ? floatval($row[19]) : null;
+                    $baiuLink        = trim($row[20] ?? '');
+
+                    if (empty($title) || empty($year)) throw new Exception("Titre et année requis.");
+
+                    $orientationName = $orientationMap[$orientationCode] ?? null;
+                    $orientationId   = null;
+                    if ($orientationName) {
+                        $s = $importPdo->prepare("SELECT id FROM orientations WHERE name = ?");
+                        $s->execute([$orientationName]);
+                        $r = $s->fetch(); $orientationId = $r ? $r['id'] : null;
+                    }
+
+                    $apProgramId = null;
+                    if (!empty($apCode)) {
+                        $s = $importPdo->prepare("SELECT id FROM ap_programs WHERE code = ?");
+                        $s->execute([$apCode]);
+                        $r = $s->fetch(); $apProgramId = $r ? $r['id'] : null;
+                    }
+
+                    $finalityId = null;
+                    if (!empty($finalityName)) {
+                        $s = $importPdo->prepare("SELECT id FROM finality_types WHERE name = ?");
+                        $s->execute([$finalityName]);
+                        $r = $s->fetch(); $finalityId = $r ? $r['id'] : null;
+                    }
+
+                    $accessTypeId = null;
+                    if (!empty($access)) {
+                        $s = $importPdo->prepare("SELECT id FROM access_types WHERE name = ?");
+                        $s->execute([ucfirst(strtolower($access))]);
+                        $r = $s->fetch(); $accessTypeId = $r ? $r['id'] : null;
+                    }
+                    if ($accessTypeId === null) $accessTypeId = 1;
+
+                    if (!empty($identifier)) {
+                        $s = $importPdo->prepare("SELECT id FROM theses WHERE identifier = ?");
+                        $s->execute([$identifier]);
+                        if ($s->fetch()) {
+                            $importDb->rollback();
+                            $skippedCount++;
+                            $importResults[] = ['type'=>'skip', 'msg'=>"Ligne $lineNumber: identifiant \"$identifier\" déjà présent, ignoré."];
+                            continue;
+                        }
+                    }
+
+                    $s = $importPdo->prepare("
+                        INSERT INTO theses (
+                            identifier, title, subtitle, year,
+                            orientation_id, ap_program_id, finality_id,
+                            synopsis, context_note, remarks,
+                            file_size_info, jury_points, baiu_link,
+                            access_type_id, is_published, submitted_at
+                        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,CURRENT_TIMESTAMP)
+                    ");
+                    $s->execute([
+                        !empty($identifier) ? $identifier : null, $title,
+                        !empty($subtitle)   ? $subtitle   : null, $year,
+                        $orientationId, $apProgramId, $finalityId,
+                        !empty($synopsis)  ? $synopsis  : null,
+                        !empty($context)   ? $context   : null,
+                        !empty($remarks)   ? $remarks   : null,
+                        !empty($sizeInfo)  ? $sizeInfo  : null,
+                        $juryPoints,
+                        !empty($baiuLink)  ? $baiuLink  : null,
+                        $accessTypeId,
+                    ]);
+                    $thesisId = $importPdo->lastInsertId();
+
+                    if (!empty($authorsRaw)) {
+                        foreach (array_map('trim', explode(',', $authorsRaw)) as $idx => $name) {
+                            if ($name) {
+                                $aId = $importDb->findOrCreateAuthor($name, $idx === 0 ? $contact : null);
+                                $s = $importPdo->prepare("INSERT INTO thesis_authors (thesis_id, author_id, author_order) VALUES (?,?,?)");
+                                $s->execute([$thesisId, $aId, $idx + 1]);
+                            }
+                        }
+                    }
+                    if (!empty($supervisorsRaw)) {
+                        foreach (array_map('trim', explode(',', $supervisorsRaw)) as $idx => $name) {
+                            if ($name) {
+                                $sId = $importDb->findOrCreateSupervisor($name);
+                                $s = $importPdo->prepare("INSERT INTO thesis_supervisors (thesis_id, supervisor_id, supervisor_order) VALUES (?,?,?)");
+                                $s->execute([$thesisId, $sId, $idx + 1]);
+                            }
+                        }
+                    }
+                    if (!empty($keywordsRaw)) {
+                        foreach (array_slice(array_map('trim', explode(',', $keywordsRaw)), 0, 10) as $kw) {
+                            if ($kw) {
+                                $tId = $importDb->findOrCreateTag($kw);
+                                if ($tId) {
+                                    $s = $importPdo->prepare("INSERT INTO thesis_tags (thesis_id, tag_id) VALUES (?,?)");
+                                    $s->execute([$thesisId, $tId]);
+                                }
+                            }
+                        }
+                    }
+                    if (!empty($languageRaw)) {
+                        $s = $importPdo->prepare("SELECT id FROM languages WHERE name = ?");
+                        $s->execute([ucfirst(strtolower($languageRaw))]);
+                        $r = $s->fetch();
+                        if ($r) {
+                            $s2 = $importPdo->prepare("INSERT INTO thesis_languages (thesis_id, language_id) VALUES (?,?)");
+                            $s2->execute([$thesisId, $r['id']]);
+                        }
+                    }
+                    if (!empty($formatsRaw)) {
+                        foreach (array_map('trim', explode(',', $formatsRaw)) as $fmt) {
+                            if ($fmt) {
+                                $s = $importPdo->prepare("SELECT id FROM format_types WHERE name = ?");
+                                $s->execute([ucfirst(strtolower($fmt))]);
+                                $r = $s->fetch();
+                                if ($r) {
+                                    $s2 = $importPdo->prepare("INSERT INTO thesis_formats (thesis_id, format_id) VALUES (?,?)");
+                                    $s2->execute([$thesisId, $r['id']]);
+                                }
+                            }
+                        }
+                    }
+
+                    $importDb->commit();
+                    $importedCount++;
+                    $importResults[] = ['type'=>'ok', 'msg'=>"\"$title\" (ID: $thesisId)"];
+
+                } catch (Exception $e) {
+                    $importDb->rollback();
+                    $skippedCount++;
+                    $importResults[] = ['type'=>'error', 'msg'=>"Ligne $lineNumber: " . $e->getMessage()];
+                    error_log("Import error on line $lineNumber: " . $e->getMessage());
+                }
+            }
+            fclose($handle);
+            $importMessage = "Import terminé : $importedCount TFE importés, $skippedCount ignorés.";
+            $importDone = true;
+        } catch (Exception $e) {
+            $importErrors[] = $e->getMessage();
+            error_log("CSV import error: " . $e->getMessage());
+        }
+    }
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+try {
+    $db = new Database();
+    $searchQuery       = isset($_GET['search'])      ? trim($_GET['search'])       : '';
+    $yearFilter        = isset($_GET['year'])         ? intval($_GET['year'])        : null;
+    $orientationFilter = isset($_GET['orientation']) ? intval($_GET['orientation']) : null;
+    $apFilter          = isset($_GET['ap'])           ? intval($_GET['ap'])          : null;
+
+    $sortCol  = isset($_GET['sort'])  ? trim($_GET['sort'])  : 'submitted_at';
+    $sortDir  = isset($_GET['dir'])   ? trim($_GET['dir'])   : 'desc';
+
+    $filters = [];
+    if ($searchQuery)       $filters['search']      = $searchQuery;
+    if ($yearFilter)        $filters['year']        = $yearFilter;
+    if ($orientationFilter) $filters['orientation'] = $orientationFilter;
+    if ($apFilter)          $filters['ap']          = $apFilter;
+    $filters['sort'] = $sortCol;
+    $filters['dir']  = $sortDir;
+
+    $perPage    = 25;
+    $page       = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;
+    $totalCount = $db->getThesesListCount($filters);
+    $totalPages = $totalCount > 0 ? (int) ceil($totalCount / $perPage) : 1;
+    $page       = min($page, $totalPages);
+    $offset     = ($page - 1) * $perPage;
+
+    $theses       = $db->getThesesList($filters, $perPage, $offset);
+    $stats        = $db->getThesesStats();
+    $years        = $db->getAllYears();
+    $orientations = $db->getAllOrientations();
+    $apPrograms   = $db->getAllAPPrograms();
+} catch (Exception $e) {
+    error_log("Error loading theses list: " . $e->getMessage());
+    die("Erreur lors du chargement de la liste.");
+}
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<script>
+function toggleAll(src) {
+    document.querySelectorAll('input[name="selected_theses[]"]').forEach(cb => cb.checked = src.checked);
+    updateBulk();
+}
+function updateBulk() {
+    const checked = document.querySelectorAll('input[name="selected_theses[]"]:checked');
+    const bulk = document.getElementById('bulk-actions');
+    document.getElementById('selected-count').textContent = checked.length;
+    bulk.style.display = checked.length > 0 ? 'flex' : 'none';
+}
+function bulkAction(action) {
+    const checked = document.querySelectorAll('input[name="selected_theses[]"]:checked');
+    if (!checked.length) { alert('Sélectionnez au moins un TFE.'); return; }
+    let word, endpoint;
+    if (action === 'publish')   { word = 'publier';    endpoint = 'actions/publish.php'; }
+    else if (action === 'unpublish') { word = 'dépublier'; endpoint = 'actions/publish.php'; }
+    else if (action === 'delete')   { word = 'supprimer'; endpoint = 'actions/delete.php'; }
+    else return;
+    if (action === 'delete') {
+        if (!confirm(`Supprimer définitivement ${checked.length} TFE(s) ? Cette action est irréversible.`)) return;
+    } else {
+        if (!confirm(`${word.charAt(0).toUpperCase()+word.slice(1)} ${checked.length} TFE(s) ?`)) return;
+    }
+    document.getElementById('bulk-action-input').value = action;
+    document.getElementById('bulk-form').action = endpoint;
+    const container = document.getElementById('bulk-checkboxes');
+    container.innerHTML = '';
+    checked.forEach(cb => {
+        const inp = document.createElement('input');
+        inp.type = 'hidden'; inp.name = 'selected_theses[]'; inp.value = cb.value;
+        container.appendChild(inp);
+    });
+    document.getElementById('bulk-form').submit();
+}
+function deleteThesis(id, title) {
+    if (!confirm(`Supprimer « ${title} » ?\nCette action est irréversible.`)) return;
+    const form = document.getElementById('delete-form-' + id);
+    if (form) form.submit();
+}
+document.addEventListener('DOMContentLoaded', () => {
+    document.querySelectorAll('input[name="selected_theses[]"]').forEach(cb => cb.addEventListener('change', updateBulk));
+});
+</script>
+
+<main id="main-content">
+    <!-- Title + filters + stats + import all in one toolbar row -->
+    <div class="admin-list-toolbar">
+        <h1>Liste des TFE</h1>
+
+        <form class="admin-filters" method="get" action="/admin/">
+            <input type="text" name="search" placeholder="Titre, auteur..."
+                   value="<?= htmlspecialchars($searchQuery) ?>">
+            <select name="year">
+                <option value="">Année</option>
+                <?php foreach ($years as $y): ?>
+                    <option value="<?= $y ?>" <?= $yearFilter == $y ? 'selected' : '' ?>><?= $y ?></option>
+                <?php endforeach; ?>
+            </select>
+            <select name="orientation">
+                <option value="">Orientation</option>
+                <?php foreach ($orientations as $o): ?>
+                    <option value="<?= $o['id'] ?>" <?= $orientationFilter == $o['id'] ? 'selected' : '' ?>>
+                        <?= htmlspecialchars($o['name']) ?>
+                    </option>
+                <?php endforeach; ?>
+            </select>
+            <select name="ap">
+                <option value="">AP</option>
+                <?php foreach ($apPrograms as $ap): ?>
+                    <option value="<?= $ap['id'] ?>" <?= $apFilter == $ap['id'] ? 'selected' : '' ?>>
+                        <?= htmlspecialchars($ap['name']) ?>
+                    </option>
+                <?php endforeach; ?>
+            </select>
+            <button type="submit" class="admin-filters-btn">Filtrer</button>
+            <?php if ($searchQuery || $yearFilter || $orientationFilter || $apFilter): ?>
+                <button type="button" class="admin-filters-reset"
+                        onclick="window.location='/admin/'">&#x2715; Réinitialiser</button>
+            <?php endif; ?>
+        </form>
+
+        <div class="admin-list-toolbar__right">
+            <dl class="admin-stats">
+                <div class="admin-stat">
+                    <dt class="admin-stat__label">Total</dt>
+                    <dd class="admin-stat__number"><?= $stats['total'] ?></dd>
+                </div>
+                <div class="admin-stat">
+                    <dt class="admin-stat__label">Publiés</dt>
+                    <dd class="admin-stat__number"><?= $stats['published'] ?></dd>
+                </div>
+                <div class="admin-stat">
+                    <dt class="admin-stat__label">Attente</dt>
+                    <dd class="admin-stat__number"><?= $stats['pending'] ?></dd>
+                </div>
+            </dl>
+            <a href="/admin/add.php" class="admin-btn admin-btn--sm">Ajouter un TFE</a>
+            <button type="button" class="admin-btn admin-btn--sm" id="import-dialog-btn"
+                    onclick="document.getElementById('import-dialog').showModal()">
+                Importer un CSV
+            </button>
+            <a href="/admin/actions/export-csv.php" class="admin-btn admin-btn--sm">
+                Exporter CSV
+            </a>
+        </div>
+    </div>
+
+    <!-- Bulk actions bar -->
+    <div id="bulk-actions" class="admin-bulk-actions" role="toolbar" aria-label="Actions groupées">
+        <strong><span id="selected-count">0</span> TFE(s) sélectionné(s)</strong>
+        <div class="admin-bulk-btns">
+            <button type="button" class="admin-btn-sm admin-btn-publish" onclick="bulkAction('publish')">Publier</button>
+            <button type="button" class="admin-btn-sm admin-btn-unpublish" onclick="bulkAction('unpublish')">Dépublier</button>
+            <button type="button" class="admin-btn-sm admin-btn-delete" onclick="bulkAction('delete')">Supprimer</button>
+        </div>
+    </div>
+
+    <form id="bulk-form" method="post" action="actions/publish.php">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" id="bulk-action-input" name="action" value="">
+        <input type="hidden" name="bulk" value="1">
+        <div id="bulk-checkboxes"></div>
+    </form>
+
+    <!-- Table -->
+    <?php if (empty($theses)): ?>
+        <p class="admin-empty">Aucun TFE trouvé.</p>
+    <?php else: ?>
+    <p class="admin-list-meta">
+        <?php
+        $from = $offset + 1;
+        $to   = min($offset + $perPage, $totalCount);
+        if ($totalPages > 1) {
+            echo "{$from}-{$to} sur {$totalCount} TFE";
+        } else {
+            echo "$totalCount TFE";
+        }
+        ?>
+    </p>
+    <?php
+    $sortParams = array_filter([
+        'search'      => $searchQuery,
+        'year'        => $yearFilter ?: '',
+        'orientation' => $orientationFilter ?: '',
+        'ap'          => $apFilter ?: '',
+    ]);
+
+    $sortLink = function(string $col) use ($sortCol, $sortDir, $sortParams): string {
+        $params = $sortParams;
+        $params['sort'] = $col;
+        $params['dir']  = ($sortCol === $col && $sortDir === 'desc') ? 'asc' : 'desc';
+        return '/admin/?' . http_build_query($params);
+    };
+
+    $sortArrow = function(string $col) use ($sortCol, $sortDir): string {
+        if ($sortCol !== $col) return '';
+        return $sortDir === 'asc' ? ' ↑' : ' ↓';
+    };
+    ?>
+    <table>
+        <thead>
+            <tr>
+                <th scope="col"><input type="checkbox" onchange="toggleAll(this)"></th>
+                <th scope="col"><a href="<?= $sortLink('identifier') ?>" class="admin-sort-link">ID<?= $sortArrow('identifier') ?></a></th>
+                <th scope="col"><a href="<?= $sortLink('title') ?>" class="admin-sort-link">Titre<?= $sortArrow('title') ?></a></th>
+                <th scope="col">Auteur(s)</th>
+                <th scope="col"><a href="<?= $sortLink('year') ?>" class="admin-sort-link">Année<?= $sortArrow('year') ?></a></th>
+                <th scope="col"><a href="<?= $sortLink('orientation') ?>" class="admin-sort-link">Orientation<?= $sortArrow('orientation') ?></a></th>
+                <th scope="col"><a href="<?= $sortLink('ap_program') ?>" class="admin-sort-link">AP<?= $sortArrow('ap_program') ?></a></th>
+                <th scope="col"><a href="<?= $sortLink('is_published') ?>" class="admin-sort-link">Statut<?= $sortArrow('is_published') ?></a></th>
+                <th scope="col">Actions</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($theses as $thesis): ?>
+            <tr>
+                <td><input type="checkbox" name="selected_theses[]" value="<?= $thesis['id'] ?>"></td>
+                <td class="admin-table-id"><?= htmlspecialchars($thesis['identifier'] ?? $thesis['id']) ?></td>
+                <td>
+                    <div class="thesis-title"><?= htmlspecialchars($thesis['title']) ?></div>
+                    <?php if ($thesis['subtitle']): ?>
+                        <div class="thesis-subtitle"><?= htmlspecialchars($thesis['subtitle']) ?></div>
+                    <?php endif; ?>
+                </td>
+                <td><?= htmlspecialchars($thesis['authors'] ?? 'N/A') ?></td>
+                <td><?= $thesis['year'] ?></td>
+                <td><?= htmlspecialchars($thesis['orientation'] ?? 'N/A') ?></td>
+                <td><?= htmlspecialchars($thesis['ap_program'] ?? 'N/A') ?></td>
+                <td>
+                    <?php $badgeType = 'publish'; $badgeValue = $thesis['is_published']; include APP_ROOT . '/templates/partials/status-badge.php'; ?>
+                    <?php if (!empty($thesis['access_type'])): ?>
+                    <br><?php $badgeType = 'access'; $badgeValue = $thesis['access_type']; include APP_ROOT . '/templates/partials/status-badge.php'; ?>
+                    <?php endif; ?>
+                </td>
+                <td>
+                    <div class="admin-actions">
+                        <a href="/admin/thanks.php?id=<?= $thesis['id'] ?>" class="admin-btn-sm admin-btn-view">Voir</a>
+                        <a href="/admin/edit.php?id=<?= $thesis['id'] ?>" class="admin-btn-sm admin-btn-edit">Éditer</a>
+                        <form method="post" action="actions/publish.php" class="publish-form">
+                            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                            <input type="hidden" name="thesis_id" value="<?= $thesis['id'] ?>">
+                            <?php if ($thesis['is_published']): ?>
+                                <input type="hidden" name="action" value="unpublish">
+                                <button type="submit" class="admin-btn-sm admin-btn-unpublish"
+                                        onclick="return confirm('Retirer de la publication ?')">Dépublier</button>
+                            <?php else: ?>
+                                <input type="hidden" name="action" value="publish">
+                                <button type="submit" class="admin-btn-sm admin-btn-publish">Publier</button>
+                            <?php endif; ?>
+                        </form>
+                        <form method="post" action="actions/delete.php" id="delete-form-<?= $thesis['id'] ?>" class="publish-form">
+                            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                            <input type="hidden" name="thesis_id" value="<?= $thesis['id'] ?>">
+                            <button type="button" class="admin-btn-sm admin-btn-delete"
+                                    onclick="deleteThesis(<?= $thesis['id'] ?>, <?= htmlspecialchars(json_encode($thesis['title']), ENT_QUOTES) ?>)">Supprimer</button>
+                        </form>
+                    </div>
+                </td>
+            </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+    <?php endif; ?>
+
+    <?php
+    $baseParams = array_filter([
+        'search'      => $searchQuery,
+        'year'        => $yearFilter ?: '',
+        'orientation' => $orientationFilter ?: '',
+        'ap'          => $apFilter ?: '',
+        'sort'        => $sortCol,
+        'dir'         => $sortDir,
+    ]);
+    include APP_ROOT . '/templates/partials/pagination.php';
+    ?>
+</main>
+
+<!-- ══════════════════════════════════════════════════════════════
+     IMPORT DIALOG
+══════════════════════════════════════════════════════════════ -->
+<dialog id="import-dialog" class="admin-dialog" aria-labelledby="import-dialog-title">
+    <div class="admin-dialog__header">
+        <h2 id="import-dialog-title">Importer une liste de TFE</h2>
+        <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                onclick="document.getElementById('import-dialog').close()">&#x2715;</button>
+    </div>
+
+    <?php if ($importMessage || !empty($importErrors)): ?>
+    <div class="admin-import-status-card">
+        <?php if (!empty($importErrors)): ?>
+        <div class="toast admin-import-status-card__errors" role="alert" data-type="error">
+            <strong>⚠ Erreurs :</strong>
+            <ul class="admin-error-list">
+                <?php foreach ($importErrors as $err): ?>
+                    <li><?= htmlspecialchars($err) ?></li>
+                <?php endforeach; ?>
+            </ul>
+        </div>
+        <?php endif; ?>
+        <?php if ($importMessage): ?>
+        <p class="toast admin-import-status-card__success" role="status" data-type="success">✓ <?= htmlspecialchars($importMessage) ?></p>
+        <?php endif; ?>
+    </div>
+    <?php endif; ?>
+
+    <form method="post" enctype="multipart/form-data" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+
+        <div>
+            <label for="csv_file">Fichier CSV</label>
+            <div class="admin-file-input">
+                <input type="file" id="csv_file" name="csv_file" accept=".csv" required>
+                <small class="admin-file-hint">
+                    Colonnes : Identifiant, Titre, Sous-titre, Auteur·ice(s), Contact, Promoteur·ice(s), Format, Année, AP, Orientation, Finalité, Mots-clés, Synopsis, Contexte, Remarques, Langue, Autorisation, License, taille, Points sur 20, lien BAIU<br>
+                    Quatre premières lignes ignorées — Séparateur : virgule — UTF-8
+                </small>
+            </div>
+        </div>
+
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Importer</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('import-dialog').close()">Annuler</button>
+        </div>
+    </form>
+
+    <?php if (!empty($importResults)): ?>
+    <details class="admin-import-log-details">
+        <summary>Logs d'importation (<?= count($importResults) ?> entrées)</summary>
+        <ul class="admin-import-log">
+            <?php foreach ($importResults as $r): ?>
+            <li class="admin-import-log__item admin-import-log__item--<?= $r['type'] ?>"><?= htmlspecialchars($r['msg']) ?></li>
+            <?php endforeach; ?>
+        </ul>
+    </details>
+    <?php endif; ?>
+</dialog>
+
+<?php if ($importMessage || !empty($importErrors)): ?>
+<script>document.getElementById('import-dialog').showModal();</script>
+<?php endif; ?>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/login.php
+++ b/app/public/admin/login.php
@@ -0,0 +1,49 @@
+<?php
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+
+if (!AdminAuth::hasPassword()) {
+    header('Location: /admin/');
+    exit;
+}
+if (AdminAuth::isAuthenticated()) {
+    header('Location: /admin/');
+    exit;
+}
+
+$error = '';
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $password = $_POST['password'] ?? '';
+    if (AdminAuth::login($password)) {
+        header('Location: /admin/');
+        exit;
+    }
+    $error = 'Mot de passe incorrect.';
+}
+
+$pageTitle = 'Connexion';
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+    <main id="main-content">
+    <div class="admin-login-wrap">
+        <div class="admin-login-box">
+            <h2>Administration</h2>
+            <?php if ($error): ?>
+                <p class="toast" role="alert" data-type="error">⚠ <?= htmlspecialchars($error) ?></p>
+            <?php endif; ?>
+            <form method="post" action="/admin/login.php" class="admin-form">
+                <div>
+                    <label for="password">Mot de passe</label>
+                    <input type="password" id="password" name="password" required autofocus>
+                </div>
+                <div class="admin-form-footer">
+                    <button type="submit" class="admin-btn">Se connecter</button>
+                </div>
+            </form>
+        </div>
+    </div>
+    </main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/logout.php
+++ b/app/public/admin/logout.php
@@ -0,0 +1,8 @@
+<?php
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+
+AdminAuth::logout();
+
+header('Location: /admin/login.php');
+exit;
--- a/app/public/admin/logs.php
+++ b/app/public/admin/logs.php
@@ -0,0 +1,4 @@
+<?php
+// Redirects legacy /admin/logs.php → /admin/system.php?tab=nginx_access
+header('Location: /admin/system.php?tab=nginx_access', true, 301);
+exit;
--- a/app/public/admin/parametres.php
+++ b/app/public/admin/parametres.php
@@ -0,0 +1,317 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+$pageTitle = "Paramètres";
+
+$hasPassword     = AdminAuth::hasPassword();
+$maintenanceOn   = file_exists(APP_ROOT . '/storage/maintenance.flag');
+
+require_once APP_ROOT . '/src/Database.php';
+require_once APP_ROOT . '/src/SmtpRelay.php';
+$db = new Database();
+$siteSettings = $db->getAllSettings();
+$stats = $db->getThesesStats();
+$smtpSettings = SmtpRelay::getSettings($db);
+$smtpConfigured = SmtpRelay::isConfigured($db);
+
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+    <h1>Paramètres</h1>
+
+
+
+    <!-- ══════════════════════════════════════════════════════════════
+         MAINTENANCE
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-maintenance-title">
+        <h2 id="settings-maintenance-title">Maintenance</h2>
+
+        <div class="param-maintenance-row">
+            <?php if ($maintenanceOn): ?>
+                <p>
+                    <strong>⚠ Mode maintenance activé</strong> — le site public est inaccessible.
+                </p>
+                <form method="post" action="actions/maintenance.php">
+                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                    <input type="hidden" name="action" value="disable_maintenance">
+                    <input type="hidden" name="redirect" value="/admin/parametres.php">
+                    <button type="submit">Désactiver la maintenance</button>
+                </form>
+            <?php else: ?>
+                <p>Site public : <strong>en ligne</strong></p>
+                <form method="post" action="actions/maintenance.php">
+                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                    <input type="hidden" name="action" value="enable_maintenance">
+                    <input type="hidden" name="redirect" value="/admin/parametres.php">
+                    <button type="submit" class="param-btn-warning"
+                            onclick="return confirm('Mettre le site en maintenance ? Les visiteurs verront une page 503.')">
+                        Activer la maintenance
+                    </button>
+                </form>
+            <?php endif; ?>
+        </div>
+
+        <!-- Export database -->
+        <fieldset class="param-export-zone">
+            <legend>Exporter la base de données</legend>
+            <p>Télécharger une copie complète de la base de données SQLite.
+               Cela inclut tous les TFE, auteurs, jury, mots-clés, paramètres, etc.</p>
+            <button type="button" class="param-btn-export"
+                    onclick="document.getElementById('export-db-dialog').showModal()">
+                Exporter la base de données
+            </button>
+        </fieldset>
+
+        <!-- Danger zone: delete all TFE → now inside maintenance -->
+        <fieldset class="param-danger-zone">
+            <legend>Supprimer tous les TFE</legend>
+            <p>
+                Supprime définitivement tous les TFE de la base de données, y compris auteurs,
+                promoteurs, tags, fichiers associés. Cette action est <strong>irréversible</strong>.
+            </p>
+            <form method="post" action="actions/delete.php"
+                  onsubmit="return confirm('⚠ Supprimer définitivement TOUS les TFE ? Cette action est IRRÉVERSIBLE.')">
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="delete_all" value="1">
+                <button type="submit" class="param-btn-danger">Supprimer tous les TFE (<?= $stats['total'] ?? '?' ?>)</button>
+            </form>
+        </fieldset>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         FORMULAIRE
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-formulaire-title">
+        <h2 id="settings-formulaire-title">Formulaire</h2>
+        <p>Options de visibilité disponibles dans le formulaire d'ajout de TFE.</p>
+        <p class="param-note">L'option <strong>Libre</strong> ne sera activée qu'à partir de l'année académique prochaine.</p>
+
+        <form method="post" action="actions/settings.php" class="param-form">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+            <input type="hidden" name="section" value="formulaire">
+
+            <fieldset>
+                <legend>Types d'accès</legend>
+
+                <label class="param-checkbox">
+                    <input type="checkbox" name="access_type_interdit_enabled" value="1"
+                           <?= ($siteSettings['access_type_interdit_enabled'] ?? '1') === '1' ? 'checked' : '' ?>>
+                    <span>
+                        <strong>Interdit</strong><br>
+                        <small>TFE non disponible en physique ni sur le site</small>
+                    </span>
+                </label>
+
+                <label class="param-checkbox">
+                    <input type="checkbox" name="access_type_interne_enabled" value="1"
+                           <?= ($siteSettings['access_type_interne_enabled'] ?? '1') === '1' ? 'checked' : '' ?>>
+                    <span>
+                        <strong>Interne</strong><br>
+                        <small>TFE accessible uniquement sur place en physique</small>
+                    </span>
+                </label>
+
+                <label class="param-checkbox param-checkbox--disabled">
+                    <input type="checkbox" name="access_type_libre_enabled" value="1"
+                           <?= ($siteSettings['access_type_libre_enabled'] ?? '0') === '1' ? 'checked' : '' ?>>
+                    <span>
+                        <strong>Libre</strong><br>
+                        <small>Libre accès — disponible à partir de l'année académique prochaine</small>
+                    </span>
+                </label>
+            </fieldset>
+
+            <button type="submit">Enregistrer</button>
+        </form>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         RELAY SMTP
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-smtp-title">
+        <h2 id="settings-smtp-title">Relay SMTP</h2>
+        <p>
+            Identifiants du serveur SMTP utilisé pour l'envoi d'e-mails
+            (notifications, partage de TFE, etc.).
+        </p>
+        <div class="param-smtp-status">
+            <?php if ($smtpConfigured): ?>
+                <span class="param-badge-ok">✓ Configuré</span>
+                <span><?= htmlspecialchars($smtpSettings['host']) ?>:<?= (int)$smtpSettings['port'] ?> (<?= htmlspecialchars($smtpSettings['encryption']) ?>)</span>
+            <?php else: ?>
+                <span class="param-badge-warn">✗ Non configuré</span>
+            <?php endif; ?>
+        </div>
+
+        <form method="post" action="actions/settings.php" class="param-form">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+            <input type="hidden" name="section" value="smtp">
+
+            <div class="param-grid">
+                <div>
+                    <label for="smtp_host">Hôte SMTP</label>
+                    <input type="text" id="smtp_host" name="smtp_host"
+                           value="<?= htmlspecialchars($smtpSettings['host']) ?>"
+                           placeholder="smtp.example.com">
+                </div>
+
+                <div>
+                    <label for="smtp_port">Port</label>
+                    <input type="number" id="smtp_port" name="smtp_port"
+                           value="<?= (int)$smtpSettings['port'] ?>"
+                           min="1" max="65535">
+                </div>
+
+                <div>
+                    <label for="smtp_encryption">Chiffrement</label>
+                    <select id="smtp_encryption" name="smtp_encryption">
+                        <option value="tls" <?= $smtpSettings['encryption'] === 'tls' ? 'selected' : '' ?>>TLS (STARTTLS)</option>
+                        <option value="ssl" <?= $smtpSettings['encryption'] === 'ssl' ? 'selected' : '' ?>>SSL (SMTPS)</option>
+                        <option value="none" <?= $smtpSettings['encryption'] === 'none' ? 'selected' : '' ?>>Aucun</option>
+                    </select>
+                </div>
+
+                <div>
+                    <label for="smtp_username">Nom d'utilisateur</label>
+                    <input type="text" id="smtp_username" name="smtp_username"
+                           value="<?= htmlspecialchars($smtpSettings['username']) ?>">
+                </div>
+
+                <div>
+                    <label for="smtp_password">Mot de passe</label>
+                    <input type="password" id="smtp_password" name="smtp_password"
+                           value="<?= htmlspecialchars($smtpSettings['password']) ?>"
+                           autocomplete="new-password"
+                           placeholder="Laissez vide pour ne pas modifier">
+                </div>
+            </div>
+
+            <fieldset class="param-fieldset-inline">
+                <legend>Expéditeur par défaut</legend>
+                <div class="param-grid">
+                    <div>
+                        <label for="smtp_from_email">Adresse e-mail</label>
+                        <input type="email" id="smtp_from_email" name="smtp_from_email"
+                               value="<?= htmlspecialchars($smtpSettings['from_email']) ?>"
+                               placeholder="noreply@example.com">
+                    </div>
+                    <div>
+                        <label for="smtp_from_name">Nom d'expéditeur</label>
+                        <input type="text" id="smtp_from_name" name="smtp_from_name"
+                               value="<?= htmlspecialchars($smtpSettings['from_name']) ?>">
+                    </div>
+                </div>
+            </fieldset>
+
+            <button type="submit">Enregistrer</button>
+        </form>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         COMPTE ADMINISTRATEUR
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-account-title">
+        <h2 id="settings-account-title">Compte administrateur</h2>
+
+        <dl class="param-account-status">
+            <div>
+                <dt>Authentification PHP</dt>
+                <dd><?php $badgeType = 'ok'; $badgeValue = $hasPassword; $badgeOkLabel = 'Active'; $badgeWarnLabel = 'Non configurée'; include APP_ROOT . '/templates/partials/status-badge.php'; ?></dd>
+            </div>
+            <div>
+                <dt>Stockage du hash</dt>
+                <dd>
+                    <code>site_settings (DB)</code>
+                    <?php $badgeType = 'ok'; $badgeValue = $hasPassword; $badgeOkLabel = 'Présent'; $badgeWarnLabel = 'Absent'; include APP_ROOT . '/templates/partials/status-badge.php'; ?>
+                </dd>
+            </div>
+        </dl>
+
+        <?php if (!$hasPassword): ?>
+        <p class="param-note">
+            Aucun mot de passe PHP configuré. Le formulaire ci-dessous stockera
+            un hash bcrypt dans la base de données.
+        </p>
+        <?php endif; ?>
+
+        <form method="post" action="/admin/actions/account.php" class="param-form" autocomplete="off">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+            <input type="hidden" name="redirect" value="/admin/parametres.php">
+
+            <?php if ($hasPassword): ?>
+            <div>
+                <label for="current_password">Mot de passe actuel</label>
+                <input type="password" id="current_password"
+                       name="current_password" required autocomplete="current-password">
+            </div>
+            <?php endif; ?>
+
+            <div>
+                <label for="new_password">Nouveau mot de passe</label>
+                <input type="password" id="new_password"
+                       name="new_password" required autocomplete="new-password"
+                       minlength="12">
+                <small>Minimum 12 caractères.</small>
+            </div>
+
+            <div>
+                <label for="confirm_password">Confirmer le mot de passe</label>
+                <input type="password" id="confirm_password"
+                       name="confirm_password" required autocomplete="new-password">
+            </div>
+
+            <button type="submit">
+                <?= $hasPassword ? 'Mettre à jour le mot de passe' : 'Définir le mot de passe' ?>
+            </button>
+        </form>
+
+        <!-- Danger zone: remove credentials -->
+        <?php if ($hasPassword): ?>
+        <fieldset class="param-danger-zone">
+            <legend>Supprimer la configuration du mot de passe PHP</legend>
+            <p>
+                Supprime le hash de la base de données. L'accès admin
+                dépendra uniquement de l'authentification nginx Basic Auth si elle est configurée.
+            </p>
+            <form method="post" action="/admin/actions/account.php"
+                  onsubmit="return confirm('Supprimer le mot de passe PHP ? L\'accès admin ne sera protégé que par nginx Basic Auth.')">>
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="action" value="remove_credentials">
+                <input type="hidden" name="redirect" value="/admin/parametres.php">
+                <input type="hidden" name="current_password_remove" value="">
+                <button type="submit" class="param-btn-danger">Supprimer le mot de passe</button>
+            </form>
+        </fieldset>
+        <?php endif; ?>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════════
+         EXPORT DATABASE DIALOG
+    ═══════════════════════════════════════════════════════════════ -->
+    <dialog id="export-db-dialog" class="admin-dialog" aria-labelledby="export-db-dialog-title">
+        <div class="admin-dialog__header">
+            <h2 id="export-db-dialog-title">Exporter la base de données</h2>
+            <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                    onclick="document.getElementById('export-db-dialog').close()">&#x2715;</button>
+        </div>
+
+        <p>Télécharger une copie complète de la base de données SQLite.
+           Cela inclut tous les TFE, auteurs, jury, mots-clés, paramètres, etc.</p>
+
+        <div class="admin-form-footer">
+            <a href="/admin/actions/export-db.php" class="admin-btn">Exporter la base de données</a>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('export-db-dialog').close()">Annuler</button>
+        </div>
+    </dialog>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/status.php
+++ b/app/public/admin/status.php
@@ -0,0 +1,4 @@
+<?php
+// Redirects legacy /admin/status.php → /admin/system.php?tab=status
+header('Location: /admin/system.php?tab=status', true, 301);
+exit;
--- a/app/public/admin/system-fragment.php
+++ b/app/public/admin/system-fragment.php
@@ -0,0 +1,146 @@
+<?php
+/**
+ * system-fragment.php — returns only the tab-panel HTML for the admin system page.
+ *
+ * Called by fetch() from system.php JS when switching tabs or changing line count.
+ * With JS disabled the user never hits this URL directly; the tab <a> hrefs still
+ * point at system.php?tab=… so navigation degrades gracefully.
+ *
+ * Response: text/html fragment (no <html>/<head>/<body> wrapper).
+ * On any auth failure or bad request: 403 / 400 with a plain-text body.
+ */
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+require_once APP_ROOT . '/src/Database.php';
+require_once APP_ROOT . '/src/SystemCache.php';
+require_once APP_ROOT . '/src/Controllers/SystemController.php';
+
+if (!AdminAuth::isAuthenticated()) {
+    http_response_code(403);
+    header('Content-Type: text/plain; charset=utf-8');
+    echo 'Non autorisé';
+    exit;
+}
+
+// ── Validate inputs ────────────────────────────────────────────────────────
+$tab = $_GET['tab'] ?? 'nginx_access';
+if ($tab !== 'nginx_config' && !array_key_exists($tab, SystemController::LOG_FILES)) {
+    $tab = 'nginx_access';
+}
+
+$n = isset($_GET['n']) ? (int) $_GET['n'] : 100;
+if (!in_array($n, SystemController::ALLOWED_LINES, true)) {
+    $n = 100;
+}
+
+header('Content-Type: text/html; charset=utf-8');
+header('X-Robots-Tag: noindex');
+
+// ── Build data via controller ──────────────────────────────────────────────
+$_db         = new Database();
+$_cache      = new SystemCache($_db->getPDO());
+$_controller = new SystemController($_db, $_cache);
+
+// ── Render ─────────────────────────────────────────────────────────────────
+if ($tab === 'nginx_config') {
+    $data   = $_controller->getNginxConfigData();
+    $lines  = $data['lines'];
+    $source = $data['source'];
+    $meta   = $data['meta'];
+    $error  = $data['error'];
+
+    if ($meta): ?>
+<div class="log-meta">
+    <span data-label="Fichier"><?= htmlspecialchars($meta['path']) ?></span>
+    <span data-label="Taille"><?= $meta['size'] ?></span>
+    <span data-label="Modifié"><?= $meta['mtime'] ?></span>
+    <?php if ($source === 'live'): ?>
+    <span class="nginx-source-badge nginx-source-badge--live">● Config déployée</span>
+    <?php else: ?>
+    <span class="nginx-source-badge nginx-source-badge--local">⚠ Référence locale (config live inaccessible)</span>
+    <?php endif; ?>
+</div>
+<?php endif;
+
+    if ($error !== null): ?>
+<div class="log-unavailable">
+    <strong>Configuration nginx non disponible</strong>
+    <div class="log-unavail-path"><?= htmlspecialchars($error) ?></div>
+    <?php if (php_sapi_name() === 'cli-server'): ?>
+    <div class="log-unavail-dev">
+        En développement, <code>/etc/nginx/sites-available/posterg</code> n'existe pas.
+        La config de référence se trouve dans <code>nginx/posterg.conf</code>.
+    </div>
+    <?php endif; ?>
+</div>
+<?php elseif (empty($lines)): ?>
+<div class="log-empty">Le fichier de configuration est vide.</div>
+<?php else: ?>
+<div class="log-output" id="log-output" role="region" aria-label="Configuration nginx">
+    <button class="log-copy-btn" id="log-copy-btn" type="button" title="Copier la configuration"
+            onclick="copyLogContent(this);return false">Copier</button>
+    <?php foreach ($lines as $i => $line): ?>
+    <span class="log-line <?= SystemController::nginxLineClass($line) ?>"
+          data-n="<?= $i + 1 ?>"><?= htmlspecialchars($line, ENT_QUOTES | ENT_SUBSTITUTE) ?></span>
+    <?php endforeach; ?>
+</div>
+<?php endif;
+
+} else {
+    // ── Log tab ────────────────────────────────────────────────────────────
+    $data     = $_controller->getLogData($tab, $n);
+    $logLines = $data['lines'];
+    $logError = $data['error'];
+    $logMeta  = $data['meta'];
+    ?>
+<div class="log-toolbar">
+    <form id="lines-form" hx-get="/admin/system-fragment.php"
+          hx-target="#sys-tab-panel"
+          hx-swap="innerHTML"
+          hx-indicator="#sys-tab-panel"
+          hx-trigger="change"
+          hx-vals='{"tab":"<?= htmlspecialchars($tab) ?>"}'>
+      <label for="lines-select">Afficher</label>
+      <select id="lines-select" name="n" aria-label="Nombre de lignes">
+        <?php foreach (SystemController::ALLOWED_LINES as $opt): ?>
+        <option value="<?= $opt ?>" <?= $opt === $n ? 'selected' : '' ?>><?= $opt ?> dernières lignes</option>
+        <?php endforeach; ?>
+      </select>
+    </form>
+    <?php if ($logLines !== null && count($logLines) > 0): ?>
+    <span class="log-count-badge"><?= count($logLines) ?> ligne(s)</span>
+    <?php endif; ?>
+</div>
+
+<?php if ($logMeta): ?>
+<div class="log-meta">
+    <span data-label="Fichier"><?= htmlspecialchars($logMeta['path']) ?></span>
+    <span data-label="Taille"><?= $logMeta['size'] ?></span>
+    <span data-label="Modifié"><?= $logMeta['mtime'] ?></span>
+</div>
+<?php endif; ?>
+
+<?php if ($logError !== null): ?>
+<div class="log-unavailable">
+    <strong>Journaux non disponibles</strong>
+    <div class="log-unavail-path"><?= $logError ?></div>
+    <?php if (php_sapi_name() === 'cli-server'): ?>
+    <div class="log-unavail-dev">
+        En environnement de développement, les logs nginx ne sont pas disponibles.
+        Cette page est pleinement fonctionnelle sur le serveur de production.
+    </div>
+    <?php endif; ?>
+</div>
+<?php elseif (empty($logLines)): ?>
+<div class="log-empty">Le fichier journal est vide.</div>
+<?php else: ?>
+<div class="log-output" id="log-output" role="log" aria-live="off" aria-label="Contenu du journal">
+    <button class="log-copy-btn" id="log-copy-btn" type="button" title="Copier le contenu"
+            onclick="copyLogContent(this);return false">Copier</button>
+    <?php foreach ($logLines as $i => $line): ?>
+    <span class="log-line <?= SystemController::logLineClass($line) ?>"
+          data-n="<?= count($logLines) - $i ?>"><?= htmlspecialchars($line, ENT_QUOTES | ENT_SUBSTITUTE) ?></span>
+    <?php endforeach; ?>
+</div>
+<?php endif;
+}
--- a/app/public/admin/system.php
+++ b/app/public/admin/system.php
@@ -0,0 +1,358 @@
+<?php
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+require_once APP_ROOT . '/src/Database.php';
+require_once APP_ROOT . '/src/SystemCache.php';
+require_once APP_ROOT . '/src/Controllers/SystemController.php';
+AdminAuth::requireLogin();
+
+$pageTitle = "Système";
+
+$_db         = new Database();
+$_cache      = new SystemCache($_db->getPDO());
+$_controller = new SystemController($_db, $_cache);
+
+// ?refresh=1 force-busts all cached sections
+if (isset($_GET['refresh']) && $_GET['refresh'] === '1') {
+    $_controller->invalidateAll();
+}
+
+// ── Status / PHP / Disk data ──────────────────────────────────────────────────
+$statusData    = $_controller->getStatusData();
+$checks        = $statusData['checks'];
+$statusCached  = $statusData['cached'];
+$statusCacheAge = $statusData['cacheAge'];
+
+$phpInfo = $_controller->getPhpInfo();
+$diskInfo = $_controller->getDiskInfo();
+
+$diskTotal = $diskInfo['total'];
+$diskFree  = $diskInfo['free'];
+$diskUsed  = $diskInfo['used'];
+$diskPct   = $diskInfo['pct'];
+$diskColor = SystemController::diskColor($diskPct);
+
+// ── Active tab + line count ───────────────────────────────────────────────────
+$activeTab = $_GET['tab'] ?? 'nginx_access';
+if ($activeTab === 'status') {
+    $activeTab = 'nginx_access'; // legacy redirect
+} elseif ($activeTab !== 'nginx_config' && !array_key_exists($activeTab, SystemController::LOG_FILES)) {
+    $activeTab = 'nginx_access';
+}
+
+$selectedN = isset($_GET['n']) ? (int) $_GET['n'] : 100;
+if (!in_array($selectedN, SystemController::ALLOWED_LINES, true)) {
+    $selectedN = 100;
+}
+
+// ── Tab content data ──────────────────────────────────────────────────────────
+$logLines       = null;
+$logError       = null;
+$logFileMeta    = null;
+
+$nginxConfigLines  = null;
+$nginxConfigSource = null;
+$nginxConfigError  = null;
+$nginxConfigMeta   = null;
+
+if ($activeTab === 'nginx_config') {
+    $nginxData         = $_controller->getNginxConfigData();
+    $nginxConfigLines  = $nginxData['lines'];
+    $nginxConfigSource = $nginxData['source'];
+    $nginxConfigMeta   = $nginxData['meta'];
+    $nginxConfigError  = $nginxData['error'];
+} else {
+    $logData     = $_controller->getLogData($activeTab, $selectedN);
+    $logLines    = $logData['lines'];
+    $logError    = $logData['error'];
+    $logFileMeta = $logData['meta'];
+}
+
+$isAdmin = true; $bodyClass = 'admin-body';
+$extraCss = ['/assets/css/system.css'];
+// HTMX loaded once in footer; status collapse + copy via inline JS
+require_once APP_ROOT . '/templates/head.php';
+
+// Restore collapsed state from cookie
+$collapsed = $_COOKIE['sys_collapsed'] ?? null;
+$statusInitiallyCollapsed = $collapsed === '1';
+?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+
+
+<main id="main-content">
+    <h1>Système</h1>
+
+    <p class="sys-refresh-note">
+        Affiché le <?= date('d/m/Y à H:i:s') ?> —
+        <a href="?tab=<?= htmlspecialchars($activeTab) ?>&amp;n=<?= $selectedN ?>">Rafraîchir</a> —
+        <a href="?tab=<?= htmlspecialchars($activeTab) ?>&amp;n=<?= $selectedN ?>&amp;refresh=1">Forcer actualisation</a>
+    </p>
+
+    <!-- ════════════════════════════════════════════════════════════════════
+         STATUS SECTION — always visible above tabs
+    ════════════════════════════════════════════════════════════════════ -->
+    <section class="sys-status-section" aria-label="Statut du système">
+        <div class="sys-status-header">
+            <h2 class="srv-section-title srv-section-title--compact">Statut
+                <?php if ($statusCached && $statusCacheAge !== null): ?>
+                <span class="sys-cache-badge sys-cache-badge--hit" title="Données en cache">
+                    ⚡ Cache — il y a <?= $statusCacheAge ?>s
+                </span>
+                <?php else: ?>
+                <span class="sys-cache-badge sys-cache-badge--miss" title="Données fraîches">
+                    ⟳ Actualisé
+                </span>
+                <?php endif; ?>
+            </h2>
+            <button id="sys-status-toggle" class="sys-status-toggle"
+                    aria-expanded="<?= $statusInitiallyCollapsed ? 'false' : 'true' ?>" aria-controls="sys-status-body"
+                    type="button"
+                    onclick="var b=document.getElementById('sys-status-body');var c=b.hidden;b.hidden=!c;this.setAttribute('aria-expanded',c);this.textContent=c?'▲ Réduire':'▼ Développer';document.cookie='sys_collapsed='+(!c)+';path=/;max-age=31536000';return false">
+              <?= $statusInitiallyCollapsed ? '▼ Développer' : '▲ Réduire' ?>
+        </button>
+        </div>
+
+        <div id="sys-status-body"<?= $statusInitiallyCollapsed ? ' hidden' : '' ?>>
+            <div class="srv-grid">
+                <?php foreach ($checks as $check): ?>
+                <?php $st = $check['status'] ?? 'unknown'; ?>
+                <div class="srv-card">
+                    <div class="srv-card__header">
+                        <span class="srv-card__name"><?= htmlspecialchars($check['label']) ?></span>
+                        <span class="<?= SystemController::statusClass($st) ?>"><?= SystemController::statusLabel($st) ?></span>
+                    </div>
+                    <?php if (!empty($check['detail'])): ?>
+                    <div class="srv-card__detail"><?= htmlspecialchars($check['detail']) ?></div>
+                    <?php endif; ?>
+                </div>
+                <?php endforeach; ?>
+            </div>
+
+            <div class="sys-status-meta">
+                <div>
+                    <h3 class="srv-section-title srv-section-title--sub">Environnement PHP</h3>
+                    <div class="php-grid php-grid--flush">
+                        <?php foreach ($phpInfo as $key => $val): ?>
+                        <div class="php-item">
+                            <div class="php-item__key"><?= htmlspecialchars($key) ?></div>
+                            <div class="php-item__val"><?= htmlspecialchars($val) ?></div>
+                        </div>
+                        <?php endforeach; ?>
+                    </div>
+                </div>
+                <div>
+                    <h3 class="srv-section-title srv-section-title--sub">Espace disque</h3>
+                    <div class="disk-bar-wrap">
+                        <div class="disk-bar" style="--disk-pct:<?= $diskPct ?>%;--disk-color:<?= $diskColor ?>"></div>
+                    </div>
+                    <div class="disk-stats">
+                        <span><?= SystemController::humanBytes($diskUsed) ?> utilisé (<?= $diskPct ?>%)</span>
+                        <span><?= SystemController::humanBytes($diskFree) ?> libre / <?= SystemController::humanBytes($diskTotal) ?></span>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
+    <!-- ── Tab bar ─────────────────────────────────────────────────────── -->
+    <nav class="sys-tabs" aria-label="Journaux et configuration">
+        <?php foreach (SystemController::LOG_FILES as $key => $def): ?>
+        <a href="?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+           class="sys-tab <?= $activeTab === $key ? 'active' : '' ?>"
+           hx-get="/admin/system-fragment.php?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+           hx-target="#sys-tab-panel"
+           hx-push-url="?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+           hx-swap="innerHTML"
+           hx-indicator="#sys-tab-panel"
+           data-tab="<?= htmlspecialchars($key) ?>"
+           <?= $activeTab === $key ? 'aria-current="page"' : '' ?>>
+            <?= htmlspecialchars($def['label']) ?>
+        </a>
+        <?php endforeach; ?>
+        <a href="?tab=nginx_config"
+           class="sys-tab <?= $activeTab === 'nginx_config' ? 'active' : '' ?>"
+           hx-get="/admin/system-fragment.php?tab=nginx_config"
+           hx-target="#sys-tab-panel"
+           hx-push-url="?tab=nginx_config"
+           hx-swap="innerHTML"
+           hx-indicator="#sys-tab-panel"
+           data-tab="nginx_config"
+           <?= $activeTab === 'nginx_config' ? 'aria-current="page"' : '' ?>>nginx — config</a>
+    </nav>
+
+    <!-- Tab panel — content swapped by HTMX -->
+    <div id="sys-tab-panel">
+
+    <?php if ($activeTab === 'nginx_config'): ?>
+    <!-- ════════════════════════════════════════════════════════════════════
+         NGINX CONFIG PANEL
+    ════════════════════════════════════════════════════════════════════ -->
+
+    <?php if ($nginxConfigMeta): ?>
+    <div class="log-meta">
+        <span data-label="Fichier"><?= htmlspecialchars($nginxConfigMeta['path']) ?></span>
+        <span data-label="Taille"><?= $nginxConfigMeta['size'] ?></span>
+        <span data-label="Modifié"><?= $nginxConfigMeta['mtime'] ?></span>
+        <?php if ($nginxConfigSource === 'live'): ?>
+        <span class="nginx-source-badge nginx-source-badge--live">● Config déployée</span>
+        <?php else: ?>
+        <span class="nginx-source-badge nginx-source-badge--local">⚠ Référence locale (config live inaccessible)</span>
+        <?php endif; ?>
+    </div>
+    <?php endif; ?>
+
+    <?php if ($nginxConfigError !== null): ?>
+        <div class="log-unavailable">
+            <strong>Configuration nginx non disponible</strong>
+            <div class="log-unavail-path"><?= htmlspecialchars($nginxConfigError) ?></div>
+            <?php if (php_sapi_name() === 'cli-server'): ?>
+            <div class="log-unavail-dev">
+                En développement, <code>/etc/nginx/sites-available/posterg</code> n'existe pas.
+                La config de référence se trouve dans <code>nginx/posterg.conf</code>.
+            </div>
+            <?php endif; ?>
+        </div>
+
+    <?php elseif (empty($nginxConfigLines)): ?>
+        <div class="log-empty">Le fichier de configuration est vide.</div>
+
+    <?php else: ?>
+        <div class="log-output" id="log-output" role="region" aria-label="Configuration nginx">
+            <button class="log-copy-btn" id="log-copy-btn" type="button" title="Copier la configuration"
+                    onclick="copyLogContent(this);return false">
+                Copier
+            </button>
+            <?php foreach ($nginxConfigLines as $i => $line): ?>
+            <span class="log-line <?= SystemController::nginxLineClass($line) ?>"
+                  data-n="<?= $i + 1 ?>"><?= htmlspecialchars($line, ENT_QUOTES | ENT_SUBSTITUTE) ?></span>
+            <?php endforeach; ?>
+        </div>
+    <?php endif; ?>
+
+    <?php else: ?>
+    <!-- ════════════════════════════════════════════════════════════════════
+         LOG PANEL
+    ════════════════════════════════════════════════════════════════════ -->
+
+    <!-- Lines selector (submits via JS on change; no button needed) -->
+    <div class="log-toolbar">
+        <label for="lines-select">Afficher</label>
+    <form id="lines-form" hx-get="/admin/system-fragment.php"
+          hx-target="#sys-tab-panel"
+          hx-swap="innerHTML"
+          hx-indicator="#sys-tab-panel"
+          hx-trigger="change"
+          hx-vals='{"tab":"<?= htmlspecialchars($activeTab) ?>"}'>
+      <label for="lines-select">Afficher</label>
+      <select id="lines-select" name="n" aria-label="Nombre de lignes">
+            <?php foreach (SystemController::ALLOWED_LINES as $n): ?>
+            <option value="<?= $n ?>" <?= $n === $selectedN ? 'selected' : '' ?>>
+                <?= $n ?> dernières lignes
+            </option>
+            <?php endforeach; ?>
+        </select>
+    </form>
+        <?php if ($logLines !== null && count($logLines) > 0): ?>
+            <span class="log-count-badge"><?= count($logLines) ?> ligne(s)</span>
+        <?php endif; ?>
+    </div>
+
+    <!-- File metadata -->
+    <?php if ($logFileMeta): ?>
+    <div class="log-meta">
+        <span data-label="Fichier"><?= htmlspecialchars(SystemController::LOG_FILES[$activeTab]['path']) ?></span>
+        <span data-label="Taille"><?= $logFileMeta['size'] ?></span>
+        <span data-label="Modifié"><?= $logFileMeta['mtime'] ?></span>
+    </div>
+    <?php endif; ?>
+
+    <!-- Log output -->
+    <?php if ($logError !== null): ?>
+        <div class="log-unavailable">
+            <strong>Journaux non disponibles</strong>
+            <div class="log-unavail-path"><?= $logError ?></div>
+            <?php if (php_sapi_name() === 'cli-server'): ?>
+            <div class="log-unavail-dev">
+                En environnement de développement, les logs nginx ne sont pas disponibles.
+                Cette page est pleinement fonctionnelle sur le serveur de production.
+            </div>
+            <?php endif; ?>
+        </div>
+
+    <?php elseif (empty($logLines)): ?>
+        <div class="log-empty">Le fichier journal est vide.</div>
+
+    <?php else: ?>
+        <div class="log-output" id="log-output" role="log" aria-live="off" aria-label="Contenu du journal">
+            <button class="log-copy-btn" id="log-copy-btn" type="button" title="Copier le contenu"
+                    onclick="copyLogContent(this);return false">
+                Copier
+            </button>
+            <?php foreach ($logLines as $i => $line): ?>
+            <span class="log-line <?= SystemController::logLineClass($line) ?>"
+                  data-n="<?= count($logLines) - $i ?>"><?= htmlspecialchars($line, ENT_QUOTES | ENT_SUBSTITUTE) ?></span>
+            <?php endforeach; ?>
+        </div>
+    <?php endif; ?>
+
+    <?php endif; ?>
+
+    </div><!-- #sys-tab-panel -->
+
+</main>
+
+<script>
+function copyLogContent(btn) {
+    var logOut = document.querySelector('#log-output');
+    if (!logOut) return;
+    var text = Array.from(logOut.querySelectorAll('.log-line'))
+        .map(function(el){ return el.textContent; }).join('\n');
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(function(){
+            btn.textContent = '\u2713 Copi\u00e9';
+            btn.classList.add('copied');
+            setTimeout(function(){ btn.textContent = 'Copier'; btn.classList.remove('copied'); }, 2000);
+        });
+    } else {
+        fallbackCopy(text, btn);
+    }
+}
+function fallbackCopy(text, btn) {
+    var ta = document.createElement('textarea');
+    ta.value = text;
+    ta.style.cssText = 'position:fixed;opacity:0';
+    document.body.appendChild(ta); ta.select();
+    try { document.execCommand('copy'); btn.textContent = '\u2713 Copi\u00e9'; btn.classList.add('copied');
+        setTimeout(function(){ btn.textContent = 'Copier'; btn.classList.remove('copied'); }, 2000);
+    } catch(e) {}
+    document.body.removeChild(ta);
+}
+// Update active tab class after each HTMX swap on #sys-tab-panel
+document.body.addEventListener('htmx:afterSwap', function(evt) {
+    if (evt.detail.target && evt.detail.target.id === 'sys-tab-panel') {
+        var rc = evt.detail.requestConfig;
+        var tab = null;
+        // Tab clicks carry ?tab=… in the path
+        var qIdx = rc.path.indexOf('?');
+        if (qIdx !== -1) {
+            tab = new URLSearchParams(rc.path.substring(qIdx + 1)).get('tab');
+        }
+        // Line-count form sends tab via hx-vals in parameters
+        if (!tab && rc.parameters && rc.parameters.tab) {
+            tab = rc.parameters.tab;
+        }
+        if (tab) {
+            document.querySelectorAll('.sys-tabs .sys-tab').forEach(function(a) {
+                var isActive = a.getAttribute('data-tab') === tab;
+                a.classList.toggle('active', isActive);
+                if (isActive) a.setAttribute('aria-current', 'page');
+                else a.removeAttribute('aria-current');
+            });
+        }
+    }
+});
+</script>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/tags.php
+++ b/app/public/admin/tags.php
@@ -0,0 +1,91 @@
+<?php
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+require_once __DIR__ . '/../../src/Database.php';
+
+$pageTitle = "Gestion des mots-clés";
+
+try {
+    $db   = new Database();
+    $tags = $db->getAllTagsWithCount();
+} catch (Exception $e) {
+    die("Erreur : " . htmlspecialchars($e->getMessage()));
+}
+
+// Flash messages are consumed by the flash-messages partial below.
+?>
+<?php $isAdmin = true; $bodyClass = 'admin-body'; require_once APP_ROOT . '/templates/head.php'; ?>
+    <?php include APP_ROOT . '/templates/header.php'; ?>
+
+<main id="main-content">
+    <h1>Mots-clés (<?= count($tags) ?>)</h1>
+
+
+
+    <table>
+        <thead>
+            <tr>
+                <th scope="col">Nom</th>
+                <th scope="col">TFE associés</th>
+                <th scope="col">Actions</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($tags as $tag): ?>
+            <tr>
+                <td><?= htmlspecialchars($tag['name']) ?></td>
+                <td class="admin-tags-count"><?= (int)$tag['thesis_count'] ?></td>
+                <td>
+                    <!-- Rename -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="rename">
+                        <input type="hidden" name="tag_id" value="<?= (int)$tag['id'] ?>">
+                        <input class="admin-input--inline" type="text" name="new_name"
+                               value="<?= htmlspecialchars($tag['name']) ?>" required>
+                        <button type="submit" class="admin-btn admin-btn--sm">Renommer</button>
+                    </form>
+
+                    <!-- Merge into another tag -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="merge">
+                        <input type="hidden" name="source_id" value="<?= (int)$tag['id'] ?>">
+                        <select name="target_id" class="admin-select--inline" required>
+                            <option value="">— Fusionner dans… —</option>
+                            <?php foreach ($tags as $other): ?>
+                                <?php if ($other['id'] !== $tag['id']): ?>
+                                <option value="<?= (int)$other['id'] ?>"><?= htmlspecialchars($other['name']) ?></option>
+                                <?php endif; ?>
+                            <?php endforeach; ?>
+                        </select>
+                        <button type="submit" class="admin-btn admin-btn--sm admin-btn--warning"
+                                onclick="return confirm('Fusionner ce tag dans la cible ? Le tag source sera supprimé.')">
+                            Fusionner
+                        </button>
+                    </form>
+
+                    <!-- Delete -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="delete">
+                        <input type="hidden" name="tag_id" value="<?= (int)$tag['id'] ?>">
+                        <button type="submit" class="admin-btn admin-btn--sm admin-btn--danger"
+                                onclick="return confirm('Supprimer le tag « <?= htmlspecialchars(addslashes($tag['name'])) ?> » ? Cette action est irréversible.')">
+                            Supprimer
+                        </button>
+                    </form>
+                </td>
+            </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>
--- a/app/public/admin/thanks.php
+++ b/app/public/admin/thanks.php
@@ -0,0 +1,195 @@
+<?php
+// Bootstrap application
+require_once __DIR__ . "/../../bootstrap.php";
+require_once __DIR__ . '/../../src/AdminAuth.php';
+
+// Configure error reporting
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+ini_set('error_log', 'error.log');
+
+$studentMode = isset($_GET['mode']) && $_GET['mode'] === 'student';
+if (!$studentMode) {
+    AdminAuth::requireLogin();
+}
+
+require_once __DIR__ . '/../../src/Database.php';
+
+// Security: Validate thesis ID parameter
+$thesisId = null;
+$thesis = null;
+$files = [];
+$error = null;
+
+if (isset($_GET['id'])) {
+    $thesisId = filter_var($_GET['id'], FILTER_VALIDATE_INT);
+
+    if ($thesisId !== false && $thesisId > 0) {
+        try {
+            $db = new Database();
+
+            // Get thesis data
+            $thesis = $db->getThesis($thesisId);
+
+            if (!$thesis) {
+                $error = "TFE non trouvé.";
+            } else {
+                $files = $db->getThesisFiles($thesisId);
+            }
+        } catch (Exception $e) {
+            error_log("Error loading thesis: " . $e->getMessage());
+            $error = "Erreur lors de la lecture des données.";
+        }
+    } else {
+        error_log("Invalid thesis ID: " . $_GET['id']);
+        $error = "Identifiant invalide.";
+    }
+} else {
+    $error = "Aucun identifiant spécifié.";
+}
+
+// Helper function to format file size
+function formatFileSize($bytes) {
+    if ($bytes >= 1073741824) {
+        return number_format($bytes / 1073741824, 2) . ' GB';
+    } elseif ($bytes >= 1048576) {
+        return number_format($bytes / 1048576, 2) . ' MB';
+    } elseif ($bytes >= 1024) {
+        return number_format($bytes / 1024, 2) . ' KB';
+    } else {
+        return $bytes . ' bytes';
+    }
+}
+
+// Set page title for header
+$pageTitle = "Récapitulatif TFE";
+?>
+<?php
+$isAdmin = true;
+if ($studentMode) {
+    $bodyClass = 'admin-body student-body';
+    require_once APP_ROOT . '/templates/head.php';
+} else {
+    $bodyClass = 'admin-body';
+    require_once APP_ROOT . '/templates/head.php';
+    include APP_ROOT . '/templates/header.php';
+}
+?>
+
+<main id="main-content">
+    <?php if ($studentMode): ?>
+    <!-- ═══════════════════ STUDENT MODE: Thank you page ═══════════════════ -->
+    <div class="thanks-student-page">
+        <?php if ($error): ?>
+            <div class="thanks-error">
+                <h1>⚠ Oups…</h1>
+                <p><?= htmlspecialchars($error) ?></p>
+                <a href="/admin/add.php?mode=student" class="btn-new-form">← Retour au formulaire</a>
+            </div>
+
+        <?php elseif ($thesis): ?>
+            <div class="thanks-success">
+                <h1>Merci 🎉</h1>
+                <p class="thanks-message">
+                    Ton TFE <strong><?= htmlspecialchars($thesis['title']) ?></strong> a bien été soumis.
+                </p>
+                <a href="/admin/add.php?mode=student" class="btn-new-form">+ Ajouter un nouveau TFE</a>
+            </div>
+        <?php else: ?>
+            <div class="thanks-error">
+                <h1>Erreur</h1>
+                <p>Aucune donnée à afficher.</p>
+                <a href="/admin/add.php?mode=student" class="btn-new-form">← Retour au formulaire</a>
+            </div>
+        <?php endif; ?>
+    </div>
+
+    <?php else: ?>
+    <!-- ═══════════════════ ADMIN MODE: Recap page ═══════════════════ -->
+    <h1>Récapitulatif TFE</h1>
+
+    <?php if ($error): ?>
+        <p class="toast" role="alert" data-type="error">⚠ <?= htmlspecialchars($error) ?></p>
+        <p><a href="/admin/add.php" class="admin-btn-secondary">Retour au formulaire</a></p>
+
+    <?php elseif ($thesis): ?>
+        <section>
+            <h2>Informations de base</h2>
+            <dl>
+                <dt>Identifiant</dt><dd><?= htmlspecialchars($thesis['identifier']) ?></dd>
+                <dt>Titre</dt><dd><?= htmlspecialchars($thesis['title']) ?></dd>
+                <?php if ($thesis['subtitle']): ?>
+                <dt>Sous-titre</dt><dd><?= htmlspecialchars($thesis['subtitle']) ?></dd>
+                <?php endif; ?>
+                <dt>Auteur·ice(s)</dt><dd><?= htmlspecialchars($thesis['authors']) ?></dd>
+                <dt>Année</dt><dd><?= htmlspecialchars($thesis['year']) ?></dd>
+            </dl>
+        </section>
+
+        <section>
+            <h2>Détails académiques</h2>
+            <dl>
+                <dt>Orientation</dt><dd><?= htmlspecialchars($thesis['orientation'] ?? '–') ?></dd>
+                <dt>Atelier pratique</dt><dd><?= htmlspecialchars($thesis['ap_program'] ?? '–') ?></dd>
+                <dt>Finalité</dt><dd><?= htmlspecialchars($thesis['finality_type'] ?? '–') ?></dd>
+                <?php if ($thesis['supervisors']): ?>
+                <dt>Promoteur·ice(s)</dt><dd><?= htmlspecialchars($thesis['supervisors']) ?></dd>
+                <?php endif; ?>
+            </dl>
+        </section>
+
+        <section>
+            <h2>Contenu</h2>
+            <dl>
+                <?php if ($thesis['languages']): ?>
+                <dt>Langue(s)</dt><dd><?= htmlspecialchars($thesis['languages']) ?></dd>
+                <?php endif; ?>
+                <?php if ($thesis['formats']): ?>
+                <dt>Format(s)</dt><dd><?= htmlspecialchars($thesis['formats']) ?></dd>
+                <?php endif; ?>
+                <?php if ($thesis['keywords']): ?>
+                <dt>Mots-clés</dt><dd><?= htmlspecialchars($thesis['keywords']) ?></dd>
+                <?php endif; ?>
+                <?php if ($thesis['file_size_info']): ?>
+                <dt>Durée / Taille</dt><dd><?= htmlspecialchars($thesis['file_size_info']) ?></dd>
+                <?php endif; ?>
+                <?php if ($thesis['baiu_link']): ?>
+                <dt>Lien</dt><dd><a href="<?= htmlspecialchars($thesis['baiu_link']) ?>" target="_blank" rel="noopener"><?= htmlspecialchars($thesis['baiu_link']) ?></a></dd>
+                <?php endif; ?>
+            </dl>
+        </section>
+
+        <?php if (!empty($files)): ?>
+        <section>
+            <h2>Fichiers</h2>
+            <table>
+                <thead><tr><th scope="col">Type</th><th scope="col">Fichier</th><th scope="col">Taille</th><th scope="col">Date</th></tr></thead>
+                <tbody>
+                    <?php foreach ($files as $f): ?>
+                    <tr>
+                        <td><?= htmlspecialchars($f['file_type']) ?></td>
+                        <td><?= htmlspecialchars($f['file_name']) ?></td>
+                        <td><?= formatFileSize($f['file_size']) ?></td>
+                        <td><?= date('d/m/Y H:i', strtotime($f['uploaded_at'])) ?></td>
+                    </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        </section>
+        <?php endif; ?>
+
+        <div class="admin-action-bar">
+            <a href="/admin/edit.php?id=<?= $thesisId ?>" class="admin-btn">Modifier</a>
+            <a href="/admin/add.php" class="admin-btn-secondary">Ajouter un autre TFE</a>
+            <a href="/admin/" class="admin-btn-secondary">Retour à la liste</a>
+        </div>
+
+    <?php else: ?>
+        <p class="admin-muted">Aucune donnée à afficher.</p>
+        <p><a href="/admin/add.php" class="admin-btn-secondary">Retour au formulaire</a></p>
+    <?php endif; ?>
+
+    <?php endif; ?>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>