migrate file-access tokens onto shared OneTimeToken model (hash-at-rest)

app/public/validate-access.php

@@ -72,20 +72,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     // Minimal pre-check: does the token exist and look valid?
     // (Full redemption + one-time mark only happens on POST)
     $db = Database::getInstance();
-    $check = $db->getPDO()->prepare(
-        "SELECT fat.expires_at, fr.thesis_id
-         FROM file_access_tokens fat
-         JOIN file_access_requests fr ON fat.request_id = fr.id
-         WHERE fat.token = ?
-           AND fat.is_valid = 1
-           AND fat.used_at IS NULL
-           AND fat.expires_at > CURRENT_TIMESTAMP
-           AND fr.status = 'approved'
-           AND fr.thesis_id = ?
-         LIMIT 1"
-    );
-    $check->execute([$token, $thesisId]);
-    $valid = $check->fetch();
+    $valid = $db->isAccessTokenValid($token, $thesisId);
 
     if (!$valid) {
         renderError(403, 'Lien d\'accès invalide ou expiré',