Refactor + feat: unify format/fichiers HTMX fragment, reorder format types, add file constraints, fix admin auth

* **Unified Format + Fichiers into a single HTMX fragment**

  * Introduced `app/public/partage/fichiers-fragment.php` as shared dynamic block returning both format checkboxes and adaptive “Fichiers” fieldset
  * Logic adapts inputs based on selected formats:

    * no selection / upload formats → standard file inputs
    * “Site web” → URL fields only
    * “Site web + upload” → file inputs + URL sub-fieldset
  * Added admin wrapper: `app/public/admin/fichiers-fragment.php` (gated via `admin_mode=1`)
  * Added `app/public/admin/format-website-fragment.php` for edit-mode website URL toggling
  * Wired route `/partage/fichiers-fragment` in `app/public/partage/index.php`
  * Refactored `form.php` (add/edit partage) to use single `#format-fichiers-block` instead of separate fragments
  * Edit mode format checkboxes now target `format-website-fragment.php` → `#edit-website-url-fieldset`
  * Added `$hxInclude` support in `checkbox-list.php` for configurable HTMX includes

* **Format system migration + ordering**

  * Migration `020_format_types_sort_and_rename.sql`:

    * added `sort_order` column to `format_types`
    * inserted new format **Image**
    * defined ordering: Écriture · Image · Audio · Vidéo · Site web · Performance · Objet éditorial · Installation · Autre
  * `Database.php`: format queries now use `ORDER BY sort_order, id`
  * `fichiers-fragment.php`:

    * uses ordered format list
    * resolves Image/Vidéo/Audio by name
    * introduces `$hasImage` flag
    * preserves `admin_mode` across HTMX requests

* **File constraints and UX updates**

  * Enforced **100 MB PDF limit**

    * `ThesisCreateController`: `MAX_PDF_SIZE = 100MB` for PDFs only
    * `ThesisEditController`: same PDF-specific constraint applied
    * Other file types remain capped at 500 MB
  * Updated UI hints in `fichiers-fragment.php` and edit form:

    * explicitly mention 100 MB PDF limit
    * added reference to `bentopdf.com` for compression guidance
  * `file-field.php`: added `$hintRaw` to allow HTML rendering in hints

* **Admin authentication fix**

  * Fixed missing auth in admin fragments
  * Added `require_once AdminAuth.php`
  * Replaced direct usage with `AdminAuth::requireLogin()`
  * Applied consistent pattern with existing fragment authentication approach

* **Migrations included**

  * `019_add_ecriture_format.sql`
  * `020_format_types_sort_and_rename.sql`

* **Files affected**

  * Controllers: `ThesisCreateController`, `ThesisEditController`
  * DB layer: `Database.php`
  * Public fragments: `partage/fichiers-fragment.php`, `admin/fichiers-fragment.php`, `admin/format-website-fragment.php`
  * Templates: `form.php`, `checkbox-list.php`, `file-field.php`
  * Routing: `partage/index.php`
  * Misc: `TODO.md`

This consolidates format normalization, HTMX UI simplification, file validation rules, and admin stability fixes into a single coherent system update.

app/templates/partials/form/checkbox-list.php

@@ -16,13 +16,15 @@
  *   string  $hxPost    — optional hx-post URL for HTMX live update
  *   string  $hxTarget  — optional hx-target CSS selector for HTMX swap
  *   string  $hxSwap    — optional hx-swap value; default 'outerHTML'
+ *   string  $hxInclude — optional hx-include selector; default 'this, #website-url-fieldset'
  */
 
-$checked   = $checked   ?? [];
-$required  = $required  ?? false;
-$hxPost    = $hxPost    ?? '';
-$hxTarget  = $hxTarget  ?? '';
-$hxSwap    = $hxSwap    ?? 'outerHTML';
+$checked    = $checked    ?? [];
+$required   = $required   ?? false;
+$hxPost     = $hxPost     ?? '';
+$hxTarget   = $hxTarget   ?? '';
+$hxSwap     = $hxSwap     ?? 'outerHTML';
+$hxInclude  = $hxInclude  ?? 'this, #website-url-fieldset';
 ?>
 <div>
     <span class="admin-row-label"><?= htmlspecialchars($label) ?><?= $required ? ' <span class="asterisk">*</span>' : '' ?></span>
@@ -32,7 +34,7 @@ $hxSwap    = $hxSwap    ?? 'outerHTML';
               hx-post="<?= htmlspecialchars($hxPost) ?>"
               hx-target="<?= htmlspecialchars($hxTarget) ?>"
               hx-trigger="change"
-              hx-include="this, #website-url-fieldset"
+              hx-include="<?= htmlspecialchars($hxInclude) ?>"
               hx-swap="<?= htmlspecialchars($hxSwap) ?>"
               <?php endif; ?>>
         <legend class="sr-only"><?= htmlspecialchars($label) ?></legend>
@@ -52,4 +54,4 @@ $hxSwap    = $hxSwap    ?? 'outerHTML';
     </fieldset>
 </div>
 <?php
-unset($checked, $hxPost, $hxTarget, $hxSwap);
+unset($checked, $hxPost, $hxTarget, $hxSwap, $hxInclude);