feat: admin tag management, maintenance mode, TFE visibility states

Tags admin:
- Database: getAllTagsWithCount(), renameTag(), mergeTag(), deleteTag()
- public/admin/tags.php: table with inline rename/merge/delete forms, CSRF-guarded
- public/admin/actions/tag.php: routes on action=rename|merge|delete
- templates/admin/head.php: 'Mots-clés' nav link
- admin.css: admin-inline-form, admin-btn--sm/warning/danger variants

Maintenance mode:
- config/bootstrap.php: gate on MAINTENANCE_FLAG file; admin/ and maintenance.php exempt
- public/maintenance.php: 503 dark minimal page
- public/admin/actions/maintenance.php: enable/disable toggle
- public/admin/index.php: status bar with toggle button
- admin.css: admin-maintenance-bar styles

TFE Visibility (Libre/Interne/Interdit via existing access_type_id):
- migration 002_add_visibility.sql: seeds access_types if missing
- Database: setVisibility(), bulkSetVisibility(), getAccessTypes()
- public/media.php: blocks thesis files for access_type_id=3
- public/tfe.php: shows access_type, context_note; hides file panel for Interdit
- public/admin/edit.php: access_type_id select + context_note textarea; saves both
- public/admin/index.php: three-state badge (Libre/Interne/Interdit) per row
- public/admin/actions/visibility.php: single + bulk visibility action handler
- admin.css: status-access badge variants

public/admin/actions/maintenance.php

@@ -0,0 +1,28 @@
+<?php
+require_once __DIR__ . '/../../../config/bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST'
+    || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    die("Accès refusé.");
+}
+
+$action = $_POST['action'] ?? '';
+
+if ($action === 'enable_maintenance') {
+    file_put_contents(MAINTENANCE_FLAG, date('c'));
+    $_SESSION['success'] = "Mode maintenance activé.";
+} elseif ($action === 'disable_maintenance') {
+    if (file_exists(MAINTENANCE_FLAG)) {
+        unlink(MAINTENANCE_FLAG);
+    }
+    $_SESSION['success'] = "Mode maintenance désactivé.";
+} else {
+    $_SESSION['error'] = "Action inconnue.";
+}
+
+header('Location: /admin/');
+exit();

public/admin/actions/tag.php

@@ -0,0 +1,50 @@
+<?php
+require_once __DIR__ . '/../../../config/bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST'
+    || !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    die("Accès refusé.");
+}
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+try {
+    $db = new Database();
+    $action = $_POST['action'] ?? '';
+
+    switch ($action) {
+        case 'rename':
+            $id      = filter_var($_POST['tag_id'] ?? '', FILTER_VALIDATE_INT);
+            $newName = trim($_POST['new_name'] ?? '');
+            if (!$id || $newName === '') throw new Exception("Paramètres invalides.");
+            $db->renameTag($id, $newName);
+            break;
+
+        case 'merge':
+            $sourceId = filter_var($_POST['source_id'] ?? '', FILTER_VALIDATE_INT);
+            $targetId = filter_var($_POST['target_id'] ?? '', FILTER_VALIDATE_INT);
+            if (!$sourceId || !$targetId) throw new Exception("Paramètres invalides.");
+            $db->mergeTag($sourceId, $targetId);
+            break;
+
+        case 'delete':
+            $id = filter_var($_POST['tag_id'] ?? '', FILTER_VALIDATE_INT);
+            if (!$id) throw new Exception("ID invalide.");
+            $db->deleteTag($id);
+            break;
+
+        default:
+            throw new Exception("Action inconnue.");
+    }
+
+    $_SESSION['admin_success'] = "Opération effectuée.";
+} catch (Exception $e) {
+    $_SESSION['admin_error'] = $e->getMessage();
+}
+
+header('Location: /admin/tags.php');
+exit();

public/admin/actions/visibility.php

@@ -0,0 +1,55 @@
+<?php
+require_once __DIR__ . '/../../../config/bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    $_SESSION['error'] = "Erreur de sécurité : token invalide.";
+    header('Location: /admin/');
+    exit;
+}
+
+require_once __DIR__ . '/../../../src/Database.php';
+
+$action      = $_POST['action'] ?? '';          // 'set_visibility'
+$accessTypeId = filter_var($_POST['access_type_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
+$isBulk      = !empty($_POST['bulk']);
+
+$validAccess = [null, 1, 2, 3];
+if (!in_array($accessTypeId, $validAccess, true)) {
+    $_SESSION['error'] = "Valeur de visibilité invalide.";
+    header('Location: /admin/');
+    exit;
+}
+
+try {
+    $db = new Database();
+
+    if ($isBulk) {
+        $ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
+        if (empty($ids)) {
+            $_SESSION['error'] = "Aucun TFE sélectionné.";
+            header('Location: /admin/');
+            exit;
+        }
+        $db->bulkSetVisibility($ids, $accessTypeId);
+        $_SESSION['success'] = count($ids) . " TFE(s) mis à jour.";
+    } else {
+        $thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
+        if (!$thesisId) {
+            $_SESSION['error'] = "ID invalide.";
+            header('Location: /admin/');
+            exit;
+        }
+        $db->setVisibility($thesisId, $accessTypeId);
+        $_SESSION['success'] = "Visibilité mise à jour.";
+    }
+} catch (Exception $e) {
+    error_log("visibility.php error: " . $e->getMessage());
+    $_SESSION['error'] = "Erreur : " . $e->getMessage();
+}
+
+$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+header('Location: /admin/');
+exit;

public/admin/edit.php

@@ -36,7 +36,9 @@ try {
             $db->beginTransaction();
 
             // Update thesis basic info
-            $editLicenseId = filter_var($_POST['license_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
+            $editLicenseId   = filter_var($_POST['license_id']    ?? '', FILTER_VALIDATE_INT) ?: null;
+            $editAccessTypeId = filter_var($_POST['access_type_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
+            $editContextNote  = trim($_POST['context_note'] ?? '');
 
             $stmt = $pdo->prepare("
                 UPDATE theses SET
@@ -47,9 +49,11 @@ try {
                     ap_program_id = ?,
                     finality_id = ?,
                     synopsis = ?,
+                    context_note = ?,
                     file_size_info = ?,
                     baiu_link = ?,
                     license_id = ?,
+                    access_type_id = ?,
                     is_published = ?,
                     updated_at = CURRENT_TIMESTAMP
                 WHERE id = ?
@@ -63,9 +67,11 @@ try {
                 intval($_POST['ap']),
                 intval($_POST['finality']),
                 trim($_POST['synopsis']),
+                !empty($editContextNote) ? $editContextNote : null,
                 !empty($_POST['duration_info']) ? trim($_POST['duration_info']) : null,
                 !empty($_POST['lien']) ? trim($_POST['lien']) : null,
                 $editLicenseId,
+                $editAccessTypeId,
                 isset($_POST['is_published']) ? 1 : 0,
                 $thesisId
             ]);
@@ -208,11 +214,15 @@ try {
     $languages = $db->getAllLanguages();
     $formatTypes = $db->getAllFormatTypes();
     $licenseTypes = $db->getAllLicenseTypes();
+    $accessTypes  = $db->getAccessTypes();
 
-    // Fetch raw license_id FK (view only exposes license_type name string)
-    $licenseStmt = $pdo->prepare("SELECT license_id FROM theses WHERE id = ?");
-    $licenseStmt->execute([$thesisId]);
-    $currentLicenseId = $licenseStmt->fetchColumn();
+    // Fetch raw FK IDs (view only exposes name strings)
+    $rawStmt = $pdo->prepare("SELECT license_id, access_type_id, context_note FROM theses WHERE id = ?");
+    $rawStmt->execute([$thesisId]);
+    $rawRow = $rawStmt->fetch();
+    $currentLicenseId    = $rawRow['license_id']    ?? null;
+    $currentAccessTypeId = $rawRow['access_type_id'] ?? null;
+    $currentContextNote  = $rawRow['context_note']   ?? '';
 
     // Set page title for header
     $pageTitle = "Éditer TFE - " . htmlspecialchars($thesis['title']);
@@ -380,6 +390,31 @@ try {
         }
         </script>
 
+        <div class="admin-form-row">
+            <label class="admin-label" for="access_type_id">Visibilité / Accès :</label>
+            <select class="admin-select" id="access_type_id" name="access_type_id">
+                <option value="">— Non défini —</option>
+                <?php foreach ($accessTypes as $at): ?>
+                    <option value="<?= (int)$at['id'] ?>"
+                        <?= ($currentAccessTypeId == $at['id']) ? 'selected' : '' ?>>
+                        <?= htmlspecialchars($at['name']) ?>
+                        <?php if (!empty($at['description'])): ?>
+                            — <?= htmlspecialchars(mb_strimwidth($at['description'], 0, 60, '…')) ?>
+                        <?php endif; ?>
+                    </option>
+                <?php endforeach; ?>
+            </select>
+        </div>
+
+        <div class="admin-form-row" style="align-items:start;">
+            <label class="admin-label" for="context_note">Note contextuelle :</label>
+            <div>
+                <textarea class="admin-textarea" id="context_note" name="context_note"
+                          rows="4" maxlength="1500"><?= htmlspecialchars($currentContextNote ?? '') ?></textarea>
+                <p class="admin-hint">Visible publiquement pour les TFE Interne ou Interdit. Max 1 500 caractères.</p>
+            </div>
+        </div>
+
         <div class="admin-form-row">
             <label class="admin-label" for="license_id">Licence :</label>
             <select class="admin-select" id="license_id" name="license_id">

public/admin/index.php

@@ -72,6 +72,29 @@ document.addEventListener('DOMContentLoaded', () => {
     <div class="admin-alert admin-alert--success">✓ <?= htmlspecialchars($_SESSION['success']); unset($_SESSION['success']); ?></div>
     <?php endif; ?>
 
+    <!-- Maintenance mode toggle -->
+    <?php $maintenanceOn = file_exists(APP_ROOT . '/storage/maintenance.flag'); ?>
+    <div class="admin-maintenance-bar <?= $maintenanceOn ? 'admin-maintenance-bar--active' : '' ?>">
+        <?php if ($maintenanceOn): ?>
+            <span>⚠ Mode maintenance <strong>activé</strong> — le site public est inaccessible.</span>
+            <form method="post" action="actions/maintenance.php" style="display:inline;">
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="action" value="disable_maintenance">
+                <button type="submit" class="admin-btn admin-btn--sm">Désactiver la maintenance</button>
+            </form>
+        <?php else: ?>
+            <span>Site public : <strong>en ligne</strong></span>
+            <form method="post" action="actions/maintenance.php" style="display:inline;">
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="action" value="enable_maintenance">
+                <button type="submit" class="admin-btn admin-btn--sm admin-btn--warning"
+                        onclick="return confirm('Mettre le site en maintenance ? Les visiteurs verront une page 503.')">
+                    Activer la maintenance
+                </button>
+            </form>
+        <?php endif; ?>
+    </div>
+
     <!-- Stats -->
     <div class="admin-stats">
         <div class="admin-stat">
@@ -167,6 +190,11 @@ document.addEventListener('DOMContentLoaded', () => {
                     <?php else: ?>
                         <span class="status-badge status-pending">En attente</span>
                     <?php endif; ?>
+                    <?php if (!empty($thesis['access_type'])): ?>
+                    <br><span class="status-badge status-access status-access--<?= strtolower(preg_replace('/[^a-z]/i', '', $thesis['access_type'])) ?>">
+                        <?= htmlspecialchars($thesis['access_type']) ?>
+                    </span>
+                    <?php endif; ?>
                 </td>
                 <td>
                     <div class="admin-actions">

public/admin/tags.php

@@ -0,0 +1,97 @@
+<?php
+require_once __DIR__ . '/../../config/bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+require_once __DIR__ . '/../../src/Database.php';
+
+$pageTitle = "Gestion des mots-clés";
+
+try {
+    $db   = new Database();
+    $tags = $db->getAllTagsWithCount();
+} catch (Exception $e) {
+    die("Erreur : " . htmlspecialchars($e->getMessage()));
+}
+
+$error   = $_SESSION['admin_error']   ?? null;
+$success = $_SESSION['admin_success'] ?? null;
+unset($_SESSION['admin_error'], $_SESSION['admin_success']);
+?>
+<?php require_once APP_ROOT . '/templates/admin/head.php'; ?>
+
+<main class="admin-main">
+    <h1 class="admin-page-title">Mots-clés (<?= count($tags) ?>)</h1>
+
+    <?php if ($error): ?>
+    <div class="admin-alert admin-alert--error">⚠ <?= htmlspecialchars($error) ?></div>
+    <?php endif; ?>
+    <?php if ($success): ?>
+    <div class="admin-alert admin-alert--success">✓ <?= htmlspecialchars($success) ?></div>
+    <?php endif; ?>
+
+    <table class="admin-table" style="margin-top:1.5rem;">
+        <thead>
+            <tr>
+                <th style="width:40%;">Nom</th>
+                <th style="width:12%;text-align:center;">TFE associés</th>
+                <th style="width:48%;">Actions</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php foreach ($tags as $tag): ?>
+            <tr>
+                <td><?= htmlspecialchars($tag['name']) ?></td>
+                <td style="text-align:center;"><?= (int)$tag['thesis_count'] ?></td>
+                <td>
+                    <!-- Rename -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="rename">
+                        <input type="hidden" name="tag_id" value="<?= (int)$tag['id'] ?>">
+                        <input class="admin-input admin-input--inline" type="text" name="new_name"
+                               value="<?= htmlspecialchars($tag['name']) ?>" required style="width:160px;">
+                        <button type="submit" class="admin-btn admin-btn--sm">Renommer</button>
+                    </form>
+
+                    <!-- Merge into another tag -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form" style="margin-top:.35rem;">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="merge">
+                        <input type="hidden" name="source_id" value="<?= (int)$tag['id'] ?>">
+                        <select name="target_id" class="admin-select admin-select--inline" style="width:160px;" required>
+                            <option value="">— Fusionner dans… —</option>
+                            <?php foreach ($tags as $other): ?>
+                                <?php if ($other['id'] !== $tag['id']): ?>
+                                <option value="<?= (int)$other['id'] ?>"><?= htmlspecialchars($other['name']) ?></option>
+                                <?php endif; ?>
+                            <?php endforeach; ?>
+                        </select>
+                        <button type="submit" class="admin-btn admin-btn--sm admin-btn--warning"
+                                onclick="return confirm('Fusionner ce tag dans la cible ? Le tag source sera supprimé.')">
+                            Fusionner
+                        </button>
+                    </form>
+
+                    <!-- Delete -->
+                    <form method="post" action="actions/tag.php" class="admin-inline-form" style="margin-top:.35rem;display:inline;">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                        <input type="hidden" name="action" value="delete">
+                        <input type="hidden" name="tag_id" value="<?= (int)$tag['id'] ?>">
+                        <button type="submit" class="admin-btn admin-btn--sm admin-btn--danger"
+                                onclick="return confirm('Supprimer le tag « <?= htmlspecialchars(addslashes($tag['name'])) ?> » ? Cette action est irréversible.')">
+                            Supprimer
+                        </button>
+                    </form>
+                </td>
+            </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+</main>
+
+<?php require_once APP_ROOT . '/templates/admin/footer.php'; ?>