feat: prevent duplicate TFE submissions with logging and user feedback

- Add DuplicateThesisException (typed, carries existing thesis metadata)
- Add Database::findDuplicateThesis(): matches on year + author + normalised
  title (exact, prefix, Levenshtein ≤10% of longer string)
- ThesisCreateController::submit() runs duplicate check before any DB write
  and throws DuplicateThesisException on match
- AppLogger::logDuplicate() writes status=duplicate entries to the JSON-lines
  log for audit purposes
- App::flash/consumeFlash extended to support 'warning' flash type
- admin/actions/formulaire.php: catches DuplicateThesisException, logs it,
  flashes an HTML warning toast with a clickable link to the existing thesis,
  and repopulates the form fields
- partage/index.php: same catch block; surfaces a plain-text flash-warning
  banner on the student form with identifier, title, and year of the match;
  form is repopulated via session
- toast.php: renders toast--warning variant
- admin.css: .toast--warning + link colour rules
- form.css: .flash-warning style for the partage form

app/src/App.php

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Thin application helper — centralises bootstrap, auth gating, CSRF lifecycle,
  * flash messages, redirect, and template rendering.
@@ -79,7 +80,7 @@ class App
     /**
      * Store a flash message in the session.
      *
-     * @param 'success'|'error' $type
+     * @param 'success'|'error'|'warning' $type
      */
     public static function flash(string $type, string $message): void
     {
@@ -109,17 +110,18 @@ class App
     /**
      * Consume and return flash messages, then clear them from the session.
      *
-     * @return array{error: ?string, success: ?string}
+     * @return array{error: ?string, success: ?string, warning: ?string}
      */
     public static function consumeFlash(): array
     {
         $error   = $_SESSION['_flash_error']   ?? null;
         $success = $_SESSION['_flash_success'] ?? null;
+        $warning = $_SESSION['_flash_warning'] ?? null;
 
-        unset($_SESSION['_flash_error'], $_SESSION['_flash_success']);
+        unset($_SESSION['_flash_error'], $_SESSION['_flash_success'], $_SESSION['_flash_warning']);
 
         // Note: autofocus is consumed separately via consumeAutofocus().
-        return ['error' => $error, 'success' => $success];
+        return ['error' => $error, 'success' => $success, 'warning' => $warning];
     }
 
     // ── Redirect ──────────────────────────────────────────────────────────────