feat: admin audit logging across all admin actions

- AdminLogger: JSON-lines → /var/log/xamxam.log (prod) / storage/logs/admin.log (dev)
  + best-effort DB mirror to admin_audit_log table
- DB: admin_audit_log table, share_links.is_archived column
- ShareLink: archive() replaces delete(), toggleActive() returns new state,
  listActive()/listArchived() split, validateLink blocks archived slugs
- All action handlers wired: publish, unpublish, visibility, delete, csv/db export,
  tfe add/edit, tags, pages, apropos, form-help, access-request, maintenance,
  settings (formulaire toggles, objet types, smtp update), smtp-test
- acces.php: archive button replaces delete; collapsible archived links section
- setup-server.sh: provision /var/log/xamxam.log (www-data:xamxam 640)

app/public/admin/actions/visibility.php

@@ -11,6 +11,7 @@ if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
 }
 
 require_once __DIR__ . '/../../../src/Database.php';
+require_once __DIR__ . '/../../../src/AdminLogger.php';
 
 $action      = $_POST['action'] ?? '';          // 'set_visibility'
 $accessTypeId = filter_var($_POST['access_type_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
@@ -26,6 +27,8 @@ if (!in_array($accessTypeId, $validAccess, true)) {
 try {
     $db = new Database();
 
+    $logger = AdminLogger::make();
+
     if ($isBulk) {
         $ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
         if (empty($ids)) {
@@ -34,6 +37,7 @@ try {
             exit;
         }
         $db->bulkSetVisibility($ids, $accessTypeId);
+        $logger->logVisibility($accessTypeId, array_values($ids));
         App::flash('success', count($ids) . " TFE(s) mis à jour.");
     } else {
         $thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
@@ -43,6 +47,7 @@ try {
             exit;
         }
         $db->setVisibility($thesisId, $accessTypeId);
+        $logger->logVisibility($accessTypeId, [$thesisId]);
         App::flash('success', "Visibilité mise à jour.");
     }
 } catch (Exception $e) {