feat: admin tag management, maintenance mode, TFE visibility states

Tags admin:
- Database: getAllTagsWithCount(), renameTag(), mergeTag(), deleteTag()
- public/admin/tags.php: table with inline rename/merge/delete forms, CSRF-guarded
- public/admin/actions/tag.php: routes on action=rename|merge|delete
- templates/admin/head.php: 'Mots-clés' nav link
- admin.css: admin-inline-form, admin-btn--sm/warning/danger variants

Maintenance mode:
- config/bootstrap.php: gate on MAINTENANCE_FLAG file; admin/ and maintenance.php exempt
- public/maintenance.php: 503 dark minimal page
- public/admin/actions/maintenance.php: enable/disable toggle
- public/admin/index.php: status bar with toggle button
- admin.css: admin-maintenance-bar styles

TFE Visibility (Libre/Interne/Interdit via existing access_type_id):
- migration 002_add_visibility.sql: seeds access_types if missing
- Database: setVisibility(), bulkSetVisibility(), getAccessTypes()
- public/media.php: blocks thesis files for access_type_id=3
- public/tfe.php: shows access_type, context_note; hides file panel for Interdit
- public/admin/edit.php: access_type_id select + context_note textarea; saves both
- public/admin/index.php: three-state badge (Libre/Interne/Interdit) per row
- public/admin/actions/visibility.php: single + bulk visibility action handler
- admin.css: status-access badge variants

config/bootstrap.php

@@ -28,3 +28,17 @@ if (php_sapi_name() === 'cli-server') {
 if (file_exists(APP_ROOT . '/config/admin_credentials.php')) {
     require_once APP_ROOT . '/config/admin_credentials.php';
 }
+
+// Maintenance mode gate — block public pages; allow /admin/ through.
+// The flag file lives in storage/ (outside webroot) to avoid web exposure.
+define('MAINTENANCE_FLAG', APP_ROOT . '/storage/maintenance.flag');
+if (file_exists(MAINTENANCE_FLAG)) {
+    // Allow admin panel through (by path prefix) and the maintenance page itself
+    $requestPath = $_SERVER['REQUEST_URI'] ?? '';
+    $isAdmin = str_starts_with($requestPath, '/admin');
+    $isMaintenance = str_contains($requestPath, 'maintenance.php');
+    if (!$isAdmin && !$isMaintenance) {
+        require APP_ROOT . '/public/maintenance.php';
+        exit();
+    }
+}