diff --git a/TODO.md b/TODO.md
index a99517e..3866314 100644
--- a/TODO.md
+++ b/TODO.md
@@ -14,19 +14,19 @@ third-party dependencies. The tasks below are ordered from critical to nice-to-h
 
 ## Critical Bugs (broken at runtime)
 
-- [ ] **Fix broken `lib/` require paths in all admin pages**
+- [x] **Fix broken `lib/` require paths in all admin pages**
   Admin pages (`add.php`, `edit.php`, `import.php`, `thanks.php`, `login.php`,
   `logout.php`, `actions/formulaire.php`, `actions/publish.php`) all require
   `../../lib/AdminAuth.php` and `../../lib/Database.php`, but the `lib/` directory
   **does not exist**. The actual files live in `src/`. This means the entire admin
   panel is broken. Fix: change all `lib/` references to `src/`.
 
-- [ ] **Fix missing `modern-normalize.css` (no `.min` variant)**
+- [x] **Fix missing `modern-normalize.css` (no `.min` variant)**
   `templates/header.php`, `templates/head.php`, and `public/search.php` reference
   `assets/modern-normalize.css` (without `.min`), but only `modern-normalize.min.css`
   exists. Either rename the file or update the references to be consistent.
 
-- [ ] **Fix `admin/index.php` inconsistency**
+- [x] **Fix `admin/index.php` inconsistency**
   `admin/index.php` uses `src/AdminAuth.php` (correct) but then
   `../../lib/Database.php` (broken). It should load from `src/` consistently.
 
diff --git a/public/admin/actions/formulaire.php b/public/admin/actions/formulaire.php
index 0efd75f..a8c1260 100644
--- a/public/admin/actions/formulaire.php
+++ b/public/admin/actions/formulaire.php
@@ -1,7 +1,7 @@
 <?php // formulaire.php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // Configure error reporting
 ini_set('display_errors', 0);
@@ -21,7 +21,7 @@ if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) ||
 // Log the content of the $_FILES array
 error_log("FILES array: " . print_r($_FILES, true));
 
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 // Helper function to sanitize string input
 function sanitize_string($input) {
diff --git a/public/admin/actions/publish.php b/public/admin/actions/publish.php
index ab0b699..b1ec939 100644
--- a/public/admin/actions/publish.php
+++ b/public/admin/actions/publish.php
@@ -1,7 +1,7 @@
 <?php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 /**
  * Handle publish/unpublish actions for theses
@@ -9,7 +9,7 @@ require_once __DIR__ . '/../../lib/AdminAuth.php';
 // PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
 AdminAuth::requireLogin();
 
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 // Verify CSRF token
 if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
diff --git a/public/admin/add.php b/public/admin/add.php
index 790e6ca..58c1bfe 100644
--- a/public/admin/add.php
+++ b/public/admin/add.php
@@ -1,7 +1,7 @@
 <?php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
 AdminAuth::requireLogin();
@@ -13,7 +13,7 @@ if (empty($_SESSION["csrf_token"])) {
 $pageTitle = "Ajout de TFE";
 
 // Load database helper
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 try {
     $db = new Database();
diff --git a/public/admin/edit.php b/public/admin/edit.php
index 3f502f2..51a9b8b 100644
--- a/public/admin/edit.php
+++ b/public/admin/edit.php
@@ -1,7 +1,7 @@
 <?php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
 AdminAuth::requireLogin();
@@ -11,7 +11,7 @@ if (empty($_SESSION['csrf_token'])) {
     $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
 }
 
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 $thesisId = isset($_GET['id']) ? intval($_GET['id']) : 0;
 $error = null;
diff --git a/public/admin/import.php b/public/admin/import.php
index 3fbd4ea..2a12358 100644
--- a/public/admin/import.php
+++ b/public/admin/import.php
@@ -1,7 +1,7 @@
 <?php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // CSV Import page for Post-ERG thesis database
 // This page allows importing thesis data from CSV files
@@ -14,7 +14,7 @@ if (empty($_SESSION['csrf_token'])) {
     $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
 }
 
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 $pageTitle = "Import";
 
diff --git a/public/admin/index.php b/public/admin/index.php
index 63969bc..4feaf86 100644
--- a/public/admin/index.php
+++ b/public/admin/index.php
@@ -13,7 +13,7 @@ if (empty($_SESSION['csrf_token'])) {
 
 $pageTitle = "Liste des TFE";
 
-require_once __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 try {
     $db = new Database();
diff --git a/public/admin/login.php b/public/admin/login.php
index 64cf523..fc54227 100644
--- a/public/admin/login.php
+++ b/public/admin/login.php
@@ -1,6 +1,6 @@
 <?php
 require_once __DIR__ . '/../../config/bootstrap.php';
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // If no password is configured, nothing to log into — go straight to admin.
 if (!defined('ADMIN_PASSWORD_HASH')) {
diff --git a/public/admin/logout.php b/public/admin/logout.php
index 6796156..001e0ab 100644
--- a/public/admin/logout.php
+++ b/public/admin/logout.php
@@ -1,6 +1,6 @@
 <?php
 require_once __DIR__ . '/../../config/bootstrap.php';
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 AdminAuth::logout();
 
diff --git a/public/admin/thanks.php b/public/admin/thanks.php
index fa44d1a..81c0c8f 100644
--- a/public/admin/thanks.php
+++ b/public/admin/thanks.php
@@ -1,7 +1,7 @@
 <?php
 // Bootstrap application
 require_once __DIR__ . "/../../config/bootstrap.php";
-require_once __DIR__ . '/../../lib/AdminAuth.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
 
 // PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
 AdminAuth::requireLogin();
@@ -11,7 +11,7 @@ ini_set('display_errors', 0);
 ini_set('log_errors', 1);
 ini_set('error_log', 'error.log');
 
-require __DIR__ . '/../../lib/Database.php';
+require_once __DIR__ . '/../../src/Database.php';
 
 // Security: Validate thesis ID parameter
 $thesisId = null;
diff --git a/public/search.php b/public/search.php
index c32c5ab..f0e3ea4 100644
--- a/public/search.php
+++ b/public/search.php
@@ -116,7 +116,7 @@ try {
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Recherche - Posterg</title>
-    <link rel="stylesheet" href="assets/modern-normalize.css">
+    <link rel="stylesheet" href="assets/modern-normalize.min.css">
     <link rel="stylesheet" href="assets/common.css">
     <link rel="stylesheet" href="assets/search.css">
 </head>
diff --git a/templates/head.php b/templates/head.php
index a0121c4..e2439dc 100644
--- a/templates/head.php
+++ b/templates/head.php
@@ -7,7 +7,7 @@
     <meta name="author" content="">
     <meta name="description" content="">
     <title><?= isset($pageTitle) ? htmlspecialchars($pageTitle) . ' - Posterg' : 'Posterg' ?></title>
-    <link rel="stylesheet" href="assets/modern-normalize.css">
+    <link rel="stylesheet" href="assets/modern-normalize.min.css">
     <link rel="stylesheet" href="assets/common.css">
     <?php if (isset($additionalCSS)): ?>
         <?php foreach ((array)$additionalCSS as $css): ?>
diff --git a/templates/header.php b/templates/header.php
index 1099efe..9f46bbe 100644
--- a/templates/header.php
+++ b/templates/header.php
@@ -8,7 +8,7 @@
     <meta name="description" content="">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>Posterg</title>
-    <link rel="stylesheet" href="assets/modern-normalize.css">
+    <link rel="stylesheet" href="assets/modern-normalize.min.css">
     <link rel="stylesheet" href="assets/common.css">
     <link rel="stylesheet" href="assets/main.css">
     <?php if (php_sapi_name() === 'cli-server'): ?>