feat: admin audit logging across all admin actions

- AdminLogger: JSON-lines → /var/log/xamxam.log (prod) / storage/logs/admin.log (dev)
  + best-effort DB mirror to admin_audit_log table
- DB: admin_audit_log table, share_links.is_archived column
- ShareLink: archive() replaces delete(), toggleActive() returns new state,
  listActive()/listArchived() split, validateLink blocks archived slugs
- All action handlers wired: publish, unpublish, visibility, delete, csv/db export,
  tfe add/edit, tags, pages, apropos, form-help, access-request, maintenance,
  settings (formulaire toggles, objet types, smtp update), smtp-test
- acces.php: archive button replaces delete; collapsible archived links section
- setup-server.sh: provision /var/log/xamxam.log (www-data:xamxam 640)

app/public/admin/actions/access-request.php

@@ -17,8 +17,10 @@ if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
 
 require_once APP_ROOT . '/src/Database.php';
 require_once APP_ROOT . '/src/SmtpRelay.php';
+require_once APP_ROOT . '/src/AdminLogger.php';
 
-$db = Database::getInstance();
+$db     = Database::getInstance();
+$logger = AdminLogger::make();
 
 $requestId = isset($_POST['request_id']) ? (int)$_POST['request_id'] : 0;
 $action    = $_POST['action'] ?? '';
@@ -54,9 +56,11 @@ try {
 
         try {
             SmtpRelay::send($db, $request['email'], $subject, $body, $plain);
+            $logger->logAccessRequest($requestId, 'approve', $request['email'], $request['title']);
             App::flash('success', "Demande approuvée. Email envoyé à {$request['email']}.");
         } catch (SmtpSendException $e) {
             error_log('[access-request] Email delivery failed after approval: ' . $e->getMessage());
+            $logger->logAccessRequest($requestId, 'approve', $request['email'], $request['title']);
             $smtpMsg = $e->isRecipientRejected()
                 ? "Demande approuvée, mais l'email n'a pas pu être délivré : adresse inconnue ({$request['email']})."
                 : "Demande approuvée, mais l'envoi de l'email a échoué (erreur SMTP). L'utilisateur devra relancer une demande.";
@@ -65,8 +69,7 @@ try {
 
     } elseif ($action === 'reject') {
         $db->rejectAccessRequest($requestId, $notes);
-
-        // Optionally send rejection email (not implemented for now)
+        $logger->logAccessRequest($requestId, 'reject', $request['email'], $request['title']);
 
         App::flash('success', "Demande rejetée.");
     }