refactor: extract buildSearchConditions, add getThesesList, remove dead code, fix SearchTest

- Database: extract private buildSearchConditions(array $params): array shared by
  searchTheses() and countSearchResults(), eliminating ~80 lines of duplication;
  add array type hints to both public methods
- Database: add getThesesList(array $filters) and getAllYears() so admin/index.php
  no longer builds raw SQL inline
- admin/index.php: replace inline PDO query block with $db->getThesesList() /
  $db->getAllYears(); drop the now-unused $pdo local
- config/bootstrap.php: remove dead include_template() helper and the
  vendor/autoload.php Composer stub (no vendor/ directory exists)
- apps/: delete entire directory (leftover artefact, no code references it)
- tests/Integration/SearchTest.php: fix three searchTheses() calls from bare
  strings to proper array params to match the method signature (prevented TypeError)

TODO.md

@@ -39,7 +39,7 @@ third-party dependencies. The tasks below are ordered from critical to nice-to-h
   `src/Database.php` and `src/AdminAuth.php` via `APP_ROOT` (the constant already
   defined in `bootstrap.php`), removing the fragile relative-path `../../` chains.
 
-- [ ] **Eliminate the duplicate `searchTheses` / `countSearchResults` condition block**
+- [x] **Eliminate the duplicate `searchTheses` / `countSearchResults` condition block**
   `Database::searchTheses()` and `Database::countSearchResults()` share identical
   WHERE-clause construction logic (~80 lines each). Extract a private
   `buildSearchConditions(array $params): array` helper that returns `[$conditions,
@@ -52,7 +52,7 @@ third-party dependencies. The tasks below are ordered from critical to nice-to-h
   instead promoting the most-used raw queries into `Database` methods, reducing
   direct PDO exposure.
 
-- [ ] **Move inline SQL in `admin/index.php` into `Database`**
+- [x] **Move inline SQL in `admin/index.php` into `Database`**
   `admin/index.php` builds a raw SQL query with dynamic filter conditions directly in
   the page. This is the only admin page doing so. Add a `getThesesList(array
   $filters): array` method to `Database` to match the pattern used everywhere else.
@@ -67,20 +67,20 @@ third-party dependencies. The tasks below are ordered from critical to nice-to-h
 
 ## What Can Be Removed / Simplified
 
-- [ ] **Remove `include_template()` helper from `bootstrap.php` — it is never called**
+- [x] **Remove `include_template()` helper from `bootstrap.php` — it is never called**
   The function `include_template($name)` in `config/bootstrap.php` is dead code;
   pages use direct `include APP_ROOT . '/templates/...'` instead.
 
-- [ ] **Remove the Composer autoload stub from `bootstrap.php`**
+- [x] **Remove the Composer autoload stub from `bootstrap.php`**
   `bootstrap.php` has `if (file_exists(APP_ROOT . '/vendor/autoload.php'))` — there
   is no Composer vendor directory and no plan for one. Remove this dead branch.
 
-- [ ] **Delete `apps/admin/` directory**
+- [x] **Delete `apps/admin/` directory**
   `apps/admin/` contains only `data/` (empty with test data) and `error.log` and
   `test.db`. It appears to be a leftover from an earlier structure. If confirmed
   unused, delete it.
 
-- [ ] **Remove `apps/` directory entirely if it contains only residual artefacts**
+- [x] **Remove `apps/` directory entirely if it contains only residual artefacts**
   Related to the above — verify no active code references `apps/`.
 
 ---
@@ -102,7 +102,7 @@ third-party dependencies. The tasks below are ordered from critical to nice-to-h
 
 ## Testing Infrastructure
 
-- [ ] **Fix `SearchTest.php` — it calls `searchTheses()` with a string, not an array**
+- [x] **Fix `SearchTest.php` — it calls `searchTheses()` with a string, not an array**
   `$db->searchTheses('art')` passes a string, but `searchTheses()` expects
   `array $params`. This test would throw a TypeError at runtime. Fix the call to
   `$db->searchTheses(['query' => 'art'])`.