migrate file-access tokens onto shared OneTimeToken model (hash-at-rest)

app/public/request-access.php

@@ -171,9 +171,7 @@ try {
             if ($e->isRecipientRejected()) {
                 // SMTP server does not know this address — roll back the approval
                 // so the user can retry with a valid address.
-                $db->getPDO()->exec(
-                    "DELETE FROM file_access_tokens WHERE request_id = {$requestId}"
-                );
+                $db->deleteAccessTokensForRequest($requestId);
                 $db->getPDO()->exec(
                     "UPDATE file_access_requests
                      SET status = 'rejected', admin_notes = 'Adresse e-mail inconnue du serveur de messagerie (550)'

app/public/validate-access.php

@@ -72,20 +72,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     // Minimal pre-check: does the token exist and look valid?
     // (Full redemption + one-time mark only happens on POST)
     $db = Database::getInstance();
-    $check = $db->getPDO()->prepare(
-        "SELECT fat.expires_at, fr.thesis_id
-         FROM file_access_tokens fat
-         JOIN file_access_requests fr ON fat.request_id = fr.id
-         WHERE fat.token = ?
-           AND fat.is_valid = 1
-           AND fat.used_at IS NULL
-           AND fat.expires_at > CURRENT_TIMESTAMP
-           AND fr.status = 'approved'
-           AND fr.thesis_id = ?
-         LIMIT 1"
-    );
-    $check->execute([$token, $thesisId]);
-    $valid = $check->fetch();
+    $valid = $db->isAccessTokenValid($token, $thesisId);
 
     if (!$valid) {
         renderError(403, 'Lien d\'accès invalide ou expiré',