feat: admin tag management, maintenance mode, TFE visibility states

Tags admin:
- Database: getAllTagsWithCount(), renameTag(), mergeTag(), deleteTag()
- public/admin/tags.php: table with inline rename/merge/delete forms, CSRF-guarded
- public/admin/actions/tag.php: routes on action=rename|merge|delete
- templates/admin/head.php: 'Mots-clés' nav link
- admin.css: admin-inline-form, admin-btn--sm/warning/danger variants

Maintenance mode:
- config/bootstrap.php: gate on MAINTENANCE_FLAG file; admin/ and maintenance.php exempt
- public/maintenance.php: 503 dark minimal page
- public/admin/actions/maintenance.php: enable/disable toggle
- public/admin/index.php: status bar with toggle button
- admin.css: admin-maintenance-bar styles

TFE Visibility (Libre/Interne/Interdit via existing access_type_id):
- migration 002_add_visibility.sql: seeds access_types if missing
- Database: setVisibility(), bulkSetVisibility(), getAccessTypes()
- public/media.php: blocks thesis files for access_type_id=3
- public/tfe.php: shows access_type, context_note; hides file panel for Interdit
- public/admin/edit.php: access_type_id select + context_note textarea; saves both
- public/admin/index.php: three-state badge (Libre/Interne/Interdit) per row
- public/admin/actions/visibility.php: single + bulk visibility action handler
- admin.css: status-access badge variants

public/admin/index.php

@@ -72,6 +72,29 @@ document.addEventListener('DOMContentLoaded', () => {
     <div class="admin-alert admin-alert--success">✓ <?= htmlspecialchars($_SESSION['success']); unset($_SESSION['success']); ?></div>
     <?php endif; ?>
 
+    <!-- Maintenance mode toggle -->
+    <?php $maintenanceOn = file_exists(APP_ROOT . '/storage/maintenance.flag'); ?>
+    <div class="admin-maintenance-bar <?= $maintenanceOn ? 'admin-maintenance-bar--active' : '' ?>">
+        <?php if ($maintenanceOn): ?>
+            <span>⚠ Mode maintenance <strong>activé</strong> — le site public est inaccessible.</span>
+            <form method="post" action="actions/maintenance.php" style="display:inline;">
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="action" value="disable_maintenance">
+                <button type="submit" class="admin-btn admin-btn--sm">Désactiver la maintenance</button>
+            </form>
+        <?php else: ?>
+            <span>Site public : <strong>en ligne</strong></span>
+            <form method="post" action="actions/maintenance.php" style="display:inline;">
+                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                <input type="hidden" name="action" value="enable_maintenance">
+                <button type="submit" class="admin-btn admin-btn--sm admin-btn--warning"
+                        onclick="return confirm('Mettre le site en maintenance ? Les visiteurs verront une page 503.')">
+                    Activer la maintenance
+                </button>
+            </form>
+        <?php endif; ?>
+    </div>
+
     <!-- Stats -->
     <div class="admin-stats">
         <div class="admin-stat">
@@ -167,6 +190,11 @@ document.addEventListener('DOMContentLoaded', () => {
                     <?php else: ?>
                         <span class="status-badge status-pending">En attente</span>
                     <?php endif; ?>
+                    <?php if (!empty($thesis['access_type'])): ?>
+                    <br><span class="status-badge status-access status-access--<?= strtolower(preg_replace('/[^a-z]/i', '', $thesis['access_type'])) ?>">
+                        <?= htmlspecialchars($thesis['access_type']) ?>
+                    </span>
+                    <?php endif; ?>
                 </td>
                 <td>
                     <div class="admin-actions">