Split TODO.md into todo/ folder by topic (completed tasks removed)

todo/02-php-components.md

@@ -0,0 +1,31 @@
+# PHP Components (Reusable Partials)
+
+## Form field partials — `templates/partials/form/`
+
+- [ ] **`text-field.php`** — accepts `$name`, `$label`, `$value`, `$required`, `$placeholder`, `$hint`; renders the `<div>…<label>…<input>…<small>` pattern used ~15 times across `add.php` and `edit.php`
+- [ ] **`select-field.php`** — accepts `$name`, `$label`, `$options[]`, `$selected`, `$required`; renders `<div>…<label>…<select>…</div>` pattern used ~6 times
+- [ ] **`checkbox-list.php`** — accepts `$name`, `$label`, `$options[]`, `$checked[]`; renders the checkbox group pattern (languages, formats) used ~4 times across `add.php` and `edit.php`
+- [ ] **`file-field.php`** — accepts `$name`, `$label`, `$accept`, `$hint`, `$multiple`; renders file input pattern used 3 times
+- [ ] **`jury-fieldset.php`** — entire jury composition fieldset + JS duplicated verbatim between `add.php` and `edit.php`; extract into one partial accepting `$juryPresident`, `$juryPromoteur`, `$juryPromoteurExt`, `$juryLecteurs[]`
+
+## Shared UI partials — `templates/partials/`
+
+- [ ] **`pagination.php`** — pagination nav is duplicated between `index.php` and `search.php`; unify into one partial accepting `$page`, `$totalPages`, `$baseParams[]`
+- [ ] **`status-badge.php`** — published/pending badge + access badge pattern repeated in `index.php` admin table rows; extract into a partial
+- [ ] **`admin-alert.php`** — rename/merge `flash-messages.php` to also handle the 3 different legacy flash key patterns (`$_SESSION['error']`, `$_SESSION['admin_error']`, `$_SESSION['edit_error']`, etc.) that pages still consume manually instead of via `App::consumeFlash()`
+
+## Controller Extraction (In Progress)
+
+- [ ] Extract `SearchController` — most complex public page
+- [ ] Extract `SystemController` — biggest single-file win, 500→8 lines
+- [ ] Extract `ThesisEditController` — merges `edit.php` + `actions/edit.php`, deduplicates jury fieldset
+- [ ] Extract remaining controllers one by one
+- [ ] Consolidate action handlers into controller methods
+- [ ] Unify flash message keys project-wide to `_flash_error` / `_flash_success`
+- [ ] Move OG tag construction into controller logic
+- [ ] Extract inline CSS/JS from `system.php` into separate assets
+
+## Backend Maintenance
+
+- [ ] **`RateLimit` uses per-file JSON on disk** — consider switching to APCu or SQLite; at minimum move cache dir to `/tmp` or `storage/cache/` excluded from deploy rsync
+- [ ] **`apropos.php` contacts and credits are hardcoded** — names, roles, emails (Laurent Leprince, Xavier Gorgol, Brigitte Ledune) live in PHP/HTML; move into the `about` page Markdown or a config array