security: add PHP session auth guard for admin panel (item #2, CRITICAL)

- lib/AdminAuth.php: new class with requireLogin(), login(), logout(),
  isAuthenticated(); starts session with hardened cookie params
  (HttpOnly, SameSite=Strict, Secure, Path=/admin) — also resolves
  item #8 (session cookie hardening)
- requireLogin() auto-authenticates from nginx Basic Auth credentials
  ($_SERVER['PHP_AUTH_PW']) so the user only sees one browser prompt;
  falls back to /admin/login.php if the proxy is absent/misconfigured
- config/admin_credentials.php: gitignored credential store; define
  ADMIN_PASSWORD_HASH with a bcrypt hash to enable PHP auth
- config/admin_credentials.example.php: template for the above
- config/bootstrap.php: auto-loads admin_credentials.php if present
- .gitignore: exclude config/admin_credentials.php
- public/admin/login.php: fallback login form (shown only when nginx
  Basic Auth is bypassed / proxy absent)
- public/admin/logout.php: session destruction + redirect to login
- All 7 admin PHP files: replace session_start() with
  AdminAuth::requireLogin() (defence-in-depth behind nginx Basic Auth)
- public/admin/inc/head.php: Déconnexion button when ADMIN_PASSWORD_HASH
  is defined
- nginx/PHP_AUTH_LAYER.md: documents dual-auth architecture, UX flow,
  and setup instructions
- docs/TODO.SECURITY.md: items #2 and #8 moved to Resolved; priority
  order updated (all CRITICAL done)

public/admin/README.md

@@ -57,12 +57,15 @@ Reusable HTML components:
 
 ## Security
 
-- All pages require HTTP Basic Auth (configured in nginx)
+- All pages require HTTP Basic Auth (configured in nginx) — primary layer
+- All pages require PHP session auth (`AdminAuth::requireLogin()`) — defence-in-depth
 - CSRF tokens protect all forms
 - File uploads validated and sanitized
 - Database queries use prepared statements
 - Upload directory outside public/ in production
 
+See `nginx/PHP_AUTH_LAYER.md` for details on the dual-auth architecture.
+
 ## Templates
 
 The `inc/` folder contains shared templates:
@@ -96,7 +99,8 @@ Backend actions (not directly accessed):
 ```php
 <?php
 require_once __DIR__ . "/../../config/bootstrap.php";
-session_start();
+require_once __DIR__ . '/../../lib/AdminAuth.php';
+AdminAuth::requireLogin();
 $pageTitle = "Your Page Title";
 ?>
 <?php include "inc/head.php" ?>
@@ -114,7 +118,8 @@ $pageTitle = "Your Page Title";
 ```php
 <?php
 require_once __DIR__ . "/../../config/bootstrap.php";
-session_start();
+require_once __DIR__ . '/../../lib/AdminAuth.php';
+AdminAuth::requireLogin();
 
 // Verify CSRF token
 if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {