Merge pull request #171 from ineszang/dev

Remontée dev vers main : livrables au thème EnerVision

.env.example

@@ -17,9 +17,103 @@ APP_LOG_LEVEL=INFO
 APP_SECRET_KEY=change_me
 APP_CORS_ORIGINS=http://localhost:4200
 BACKEND_PORT=8000
+FRONTEND_PORT=3000
+
+# Mailpit capture les courriels du backend, rien ne sort vers l'extérieur.
+MAILPIT_SMTP_PORT=1025
+MAILPIT_UI_PORT=8025
 
 # API Mock EnerVision
 APP_MOCK_API_BASE_URL=https://api-mock.charlieandre.fr
 APP_MOCK_API_USERNAME=change_me
 APP_MOCK_API_PASSWORD=change_me
 APP_MOCK_API_TIMEOUT_SECONDS=10
+
+# Airflow (api-server + scheduler + dag-processor, LocalExecutor). Base de métadonnées dédiée `airflow` dans le
+# même conteneur `db` (cf. db/init/120-airflow-database.sql), pas un conteneur de plus.
+AIRFLOW_PORT=8080
+# Chiffre les connexions/variables stockées par Airflow. Générer la vôtre :
+# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+AIRFLOW_FERNET_KEY=change_me
+# Clé de session de l'api-server Airflow, distincte de la précédente. Générer la
+# vôtre : python -c "import secrets; print(secrets.token_urlsafe(48))"
+AIRFLOW_API_SECRET_KEY=change_me
+# Secret des jetons JWT entre scheduler, tâches et api-server (conteneurs distincts, le secret
+# doit être partagé). Même générateur que ci-dessus.
+AIRFLOW_JWT_SECRET=change_me
+AIRFLOW_ADMIN_USERNAME=admin
+# Compte Airflow créé au premier démarrage (service `airflow-init`), sans rapport avec les
+# comptes `app_user` d'EnerVision.
+AIRFLOW_ADMIN_PASSWORD=change_me
+AIRFLOW_ADMIN_EMAIL=admin@enervision.fr
+# `APP_SECRET_KEY` du backend, que le DAG `alertes` lance en sous-processus. Distincte de
+# celle de l'API : la détection ne signe aucun jeton, et Airflow exécute du code depuis son
+# interface (cf. ADR 0008). Générer la vôtre :
+# python -c "import secrets; print(secrets.token_urlsafe(48))"
+AIRFLOW_APP_SECRET_KEY=change_me
+
+# Garage, stockage objet S3 par environnement (ADR 0019) : un conteneur par projet Compose, publié
+# sur 127.0.0.1 seulement. Les six secrets ci-dessous sont exigés par `make services-up` et
+# `make stack-up` ; scripts/provision-host.sh les génère sur la VM.
+# 32 octets en hexadécimal, rien d'autre n'est accepté : openssl rand -hex 32
+GARAGE_RPC_SECRET=change_me
+# Jetons de l'API d'administration et de /metrics (port 3903). Même générateur qu'APP_SECRET_KEY.
+GARAGE_ADMIN_TOKEN=change_me
+GARAGE_METRICS_TOKEN=change_me
+# Clé S3 créée au premier démarrage (`--default-bucket`). Identifiant : echo "GK$(openssl rand -hex 12)"
+# Secret : openssl rand -hex 32. Ne plus le changer ensuite, Garage refuserait de démarrer.
+GARAGE_ACCESS_KEY=change_me
+GARAGE_SECRET_KEY=change_me
+GARAGE_BUCKET=enervision-archives
+# Ports S3 et admin sur 127.0.0.1. Recette : 3910 et 3913, dev : 3920 et 3923.
+GARAGE_S3_PORT=3900
+GARAGE_ADMIN_PORT=3903
+
+# Rétention des mesures (ADR 0019, 0020) : le DAG `retention` exporte chaque nuit vers Garage les
+# chunks de `reading` plus vieux que cette borne, puis les supprime. L'historique de démonstration
+# s'arrête fin 2024 : sous 21 mois, la démo disparaîtrait.
+READING_RETENTION_DAYS=1095
+# Clé SSE-C des archives, 32 octets en base64 : openssl rand -base64 32. La perdre rend les
+# archives illisibles ; la sauvegarder hors de la VM.
+GARAGE_SSE_KEY=change_me
+
+# Stack complète derrière le reverse proxy (docker-compose.prod.yml).
+# PUBLIC_HOST alimente l'origine CORS, le lien de réinitialisation et le certificat.
+PUBLIC_HOST=enervision.local
+ACME_EMAIL=
+
+# Trois environnements sur la même machine (ADR 0009, 0017) : un dossier, un `.env` et un projet
+# Compose chacun. Le nom de projet préfixe volumes, réseau et conteneurs et l'emporte sur `name:`.
+# Vide sur un poste de développement : le projet reste `enervision`.
+COMPOSE_PROJECT_NAME=
+# Origine publique, avec le port si le proxy HTTPS n'écoute pas 443. Vide : https://PUBLIC_HOST.
+# Sur la VM, provision-host.sh pose https://<nom de l'environnement>, sans port (frontal SNI).
+PUBLIC_ORIGIN=
+# Ports publiés par le proxy. Vides : 80 et 443. Sur la VM, provision-host.sh les pose sur 127.0.0.1,
+# derrière le frontal SNI, et décale aussi base, Mailpit et Airflow par environnement.
+PROXY_HTTP_PORT=
+PROXY_HTTPS_PORT=
+# Écouteur PROXY protocol du proxy, que seul le frontal de la VM joint (infra/front, ADR 0018).
+# Vide : port aléatoire sur 127.0.0.1. VM : 127.0.0.1:10444 en prod, 8444 en recette, 9444 en dev.
+PROXY_FRONT_PORT=
+# Réglages mémoire de la stack déployée. Sans eux, timescaledb-tune réserve 25 % de la RAM de la
+# machine à chaque base au premier démarrage. L'api-server Airflow 3 n'a rien à régler ici : son
+# nombre de workers vaut 1 par défaut, contre 4 pour le webserver d'Airflow 2.
+TS_TUNE_MEMORY=2GB
+TS_TUNE_NUM_CPUS=2
+
+# Supervision (ADR 0016) : `monitoring` la démarre avec `make stack-up`, réglage de la prod.
+# Vide ailleurs, où `make monitoring-up` la lance à la demande.
+COMPOSE_PROFILES=
+# Jeton présenté par Prometheus sur `/metrics`, exigé par l'API dès qu'il est posé. Requis dès
+# que la supervision tourne ; même générateur que APP_SECRET_KEY.
+APP_METRICS_TOKEN=change_me
+# Compte `admin` de Grafana. Sans lui, le conteneur refuse de démarrer.
+GRAFANA_ADMIN_PASSWORD=change_me
+# Rôle PostgreSQL `supervision`, en lecture seule, de Grafana et de postgres-exporter
+# (db/roles/supervision.sql, posé par `make db-ensure-supervision`).
+SUPERVISION_DB_PASSWORD=change_me
+# Interfaces publiées sur 127.0.0.1 seulement, par tunnel SSH. 3000 est pris par le frontend.
+GRAFANA_PORT=3001
+PROMETHEUS_PORT=9090
+ALERTMANAGER_PORT=9093

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - eni-g3

.github/dependabot.yml

@@ -10,6 +10,26 @@ updates:
       frontend-dependencies:
         patterns:
           - "*"
+    ignore:
+      # Pourquoi : @angular/build épingle typescript (>=6.0 <6.1) et vitest (^4). Une majeure
+      # de l'un ou l'autre casse `npm ci` tant qu'Angular ne suit pas.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "vitest"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@vitest/coverage-v8"
+        update-types: ["version-update:semver-major"]
+
+  # Tests de bout en bout, paquet npm distinct du frontend
+  - package-ecosystem: "npm"
+    directory: "/tests/e2e"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    groups:
+      e2e-dependencies:
+        patterns:
+          - "*"
 
   # Backend — uv (lit pyproject.toml / uv.lock)
   - package-ecosystem: "uv"
@@ -38,3 +58,9 @@ updates:
     directory: "/apps/frontend"
     schedule:
       interval: "weekly"
+
+  # Images du reverse proxy et du compagnon ACME, épinglées dans les fichiers Compose
+  - package-ecosystem: "docker-compose"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/airflow.yml

@@ -0,0 +1,85 @@
+name: Airflow
+
+# Piège : la version de Python vient de etl/airflow/.python-version. C'est 3.12 et non 3.14
+# (contrairement à backend.yml et ml.yml) : celui de l'image apache/airflow retenue, et les tests
+# doivent tourner sur le même interpréteur qu'elle. Le 3.14 de ml/ ne vit que dans l'image
+# Docker, dans son propre environnement (cf. etl/airflow/Dockerfile).
+#
+# Piège : l'image COPY les fichiers de dépendances et le code de ml/ et de apps/backend/. Une
+# modification de l'un ou de l'autre peut donc casser sa construction : le filtre `airflow` de
+# ci.yml, qui appelle ce workflow, inclut ces chemins alors qu'il ne teste ni le modèle ni l'API.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  verification:
+    name: Lint et intégrité des DAGs
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: etl/airflow
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
+      - name: Installe uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: etl/airflow/uv.lock
+          prune-cache: false
+
+      - name: Installe l'interpréteur déclaré par .python-version
+        run: uv python install
+
+      - name: Synchronise les dépendances sur le verrou
+        run: uv sync --all-groups --locked
+
+      - name: Vérifie le formatage
+        run: uv run ruff format --check .
+
+      - name: Analyse statique
+        run: uv run ruff check --output-format=github .
+
+      # Aucun test ne lance de tâche ni de scheduler : DagBag charge les fichiers de dags/ et
+      # vérifie import, planification, plafonds d'exécution et commande de chaque tâche.
+      - name: Tests d'intégrité des DAGs
+        run: uv run pytest
+
+  image:
+    name: Construction de l'image
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Construit l'image (contexte à la racine, elle COPY ml/ et apps/backend/)
+        run: docker build -f etl/airflow/Dockerfile -t enervision-airflow:ci .
+
+      # Vérifie ce qui ne casse qu'à l'exécution, pas à la construction : libgomp1 absent
+      # (`OSError: libgomp.so.1` au premier import) ou environnement ml/ non figé.
+      - name: Vérifie que le pipeline ML s'importe sans réseau
+        run: >
+          docker run --rm --network none enervision-airflow:ci
+          bash -c "cd /opt/ml && env -u VIRTUAL_ENV uv run --no-sync python -m enervision_ml.train --help"
+
+      # `--help` sort par argparse avant `get_settings()` : ni base ni secret requis, et
+      # l'import des modules prouve que l'environnement /opt/backend est complet.
+      - name: Vérifie que les cinq commandes backend s'importent sans réseau
+        run: >
+          docker run --rm --network none enervision-airflow:ci
+          bash -c "cd /opt/backend
+          && env -u VIRTUAL_ENV uv run --no-sync python -m app.detection.internal_alerts --help
+          && env -u VIRTUAL_ENV uv run --no-sync python -m app.cli generate-recommendations --help
+          && env -u VIRTUAL_ENV uv run --no-sync python -m app.etl.historical_import --help
+          && env -u VIRTUAL_ENV uv run --no-sync python -m app.etl.mock_api_import --help
+          && env -u VIRTUAL_ENV uv run --no-sync python -m app.etl.reading_retention --help"

.github/workflows/backend.yml

@@ -2,47 +2,42 @@ name: Backend
 
 # Piège : la version de Python vient de apps/backend/.python-version, et elle doit rester
 # en 3.14. Le code utilise le PEP 758, qu'un interpréteur 3.13 refuse de compiler.
+# Pourquoi : aucun déclencheur propre. ci.yml appelle ce workflow quand le backend change, et
+# Sonar y reprend la couverture versée par le job `verification` (ADR 0014).
 
 on:
-  push:
-    paths:
-      - "apps/backend/**"
-      - ".github/workflows/backend.yml"
-  pull_request:
-    paths:
-      - "apps/backend/**"
-      - ".github/workflows/backend.yml"
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: backend-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   verification:
     name: Lint, typage et tests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: apps/backend
 
     steps:
       - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
       - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           cache-dependency-glob: apps/backend/uv.lock
+          prune-cache: false
 
       - name: Installe l'interpréteur déclaré par .python-version
         run: uv python install
 
-      - name: Synchronise les dépendances sans dévier du verrou
-        run: uv sync --all-groups --frozen
+      # `--locked` et non `--frozen` : un verrou qui ne suit plus pyproject.toml doit casser ici.
+      - name: Synchronise les dépendances sur le verrou
+        run: uv sync --all-groups --locked
 
       - name: Vérifie le formatage
         run: uv run ruff format --check .
@@ -55,14 +50,21 @@ jobs:
 
       # Le marqueur `integration` est exclu par défaut, donc aucune base n'est nécessaire ici.
       - name: Tests et couverture
-        run: uv run pytest --cov-fail-under=85
+        run: uv run pytest --cov-fail-under=85 --cov-report=xml
 
-  # Piège : l'image est celle de docker-compose.yml, pas une image `postgres` nue. La première
-  # migration (`5353c0e4f094`) échoue volontairement si l'extension TimescaleDB manque, et un
-  # écart d'image entre la CI et le poste rendrait ce job vert sur une base qui n'est pas la nôtre.
+      - name: Verse la couverture pour Sonar
+        uses: actions/upload-artifact@v7
+        with:
+          name: backend-coverage
+          path: apps/backend/coverage.xml
+          if-no-files-found: error
+
+  # Piège : même image que docker-compose.yml, pas un `postgres` nu. La première migration refuse
+  # de s'appliquer sans TimescaleDB, et une autre image testerait une base qui n'est pas la nôtre.
   integration:
     name: Tests exigeant une base
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: apps/backend
@@ -90,19 +92,20 @@ jobs:
 
     steps:
       - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           cache-dependency-glob: apps/backend/uv.lock
+          prune-cache: false
 
       - name: Installe l'interpréteur déclaré par .python-version
         run: uv python install
 
-      - name: Synchronise les dépendances sans dévier du verrou
-        run: uv sync --all-groups --frozen
+      - name: Synchronise les dépendances sur le verrou
+        run: uv sync --all-groups --locked
 
       # Sur le poste, c'est db/init/110-test-database.sql qui pose l'extension. Ce fichier n'est
       # pas monté ici, et sans lui `alembic upgrade head` s'arrête sur la garde de la révision 1.
@@ -112,31 +115,62 @@ jobs:
       - name: Applique les migrations
         run: uv run alembic upgrade head
 
-      # `-m` en ligne de commande écrase celui d'`addopts`. La couverture est désactivée : ce job
-      # ne joue qu'une partie de la suite, son taux n'aurait aucun sens face au seuil de 85 %.
+      # Couverture désactivée : ce job ne joue qu'une partie de la suite, son taux n'aurait
+      # aucun sens face au seuil de 85 %.
       - name: Tests d'intégration
         run: uv run pytest -m integration --no-cov
 
   security-audit:
     name: Audit des dépendances
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     defaults:
       run:
         working-directory: apps/backend
 
     steps:
       - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           cache-dependency-glob: apps/backend/uv.lock
+          prune-cache: false
 
       # L'audit porte sur le verrou, pas sur l'environnement : sinon pip-audit auditerait
       # aussi les paquets que son propre `--with` injecte, hors dépendances du projet.
       - name: Audite les dépendances livrées
         # Piège : sans `shell: bash`, un échec de `uv export` serait masqué par le pipe.
         shell: bash
-        run: uv export --frozen --no-dev --no-emit-project --no-hashes | uvx pip-audit --requirement /dev/stdin --no-deps
+        run: uv export --locked --no-dev --no-emit-project --no-hashes | uvx pip-audit --requirement /dev/stdin --no-deps
+
+  sast:
+    name: Analyse statique de sécurité
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: apps/backend
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
+      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
+      - name: Installe uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: false
+
+      # Pourquoi : le périmètre est `app`, le code livré. Les tests emploient légitimement des
+      # secrets factices et des `assert` que Bandit signalerait sans qu'aucun n'atteigne la prod.
+      - name: Analyse le code livré (bloquant à partir de MEDIUM)
+        run: uvx bandit==1.9.4 --recursive app --severity-level medium --confidence-level medium
+
+      # Piège : sans cette seconde passe, un constat LOW disparaîtrait du journal sans trace.
+      - name: Rapport complet, tous niveaux
+        continue-on-error: true
+        run: uvx bandit==1.9.4 --recursive app

.github/workflows/ci.yml

@@ -0,0 +1,227 @@
+# Pourquoi : un seul point d'entrée pour toute la CI (ADR 0014) - workflow CI. Chaque composant
+# ne tourne que si ses fichiers changent, Sonar reprend les couvertures déjà produites au lieu de
+# tout rejouer, et le déploiement ne part que d'un commit dont la CI est verte.
+# Piège : le seul check à exiger dans les règles de branche est « CI ok ». Un job sauté par son
+# filtre ne publie pas les checks de son workflow, qui resteraient en attente s'ils étaient exigés.
+# Piège : sur un push vers dev ou main, tous les filtres valent vrai. paths-filter comparerait
+# sinon à la base de fusion avec main, et Sonar n'analyserait qu'une partie de la branche.
+# Piège : pas d'annulation des runs de push. Un run coupé en plein `make stack-up` laisserait la
+# stack à moitié redémarrée ; le groupe par SHA évite aussi de mettre `dev` en file derrière lui.
+
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [dev, main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  changes:
+    name: Périmètre modifié
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      backend: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.backend == 'true' }}
+      frontend: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.frontend == 'true' }}
+      ml: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.ml == 'true' }}
+      airflow: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.airflow == 'true' }}
+      terraform: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.terraform == 'true' }}
+      compose: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.compose == 'true' }}
+      workflows: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.workflows == 'true' }}
+      e2e: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.e2e == 'true' }}
+      sonar: ${{ github.event_name != 'pull_request' || steps.filtre.outputs.ci == 'true' || steps.filtre.outputs.sonar == 'true' }}
+
+    steps:
+      # Sur une PR, la liste des fichiers vient de l'API : ni checkout ni historique requis.
+      - name: Calcule le périmètre de la PR
+        id: filtre
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          filters: |
+            ci:
+              - ".github/workflows/ci.yml"
+            backend:
+              - "apps/backend/**"
+              - ".github/workflows/backend.yml"
+            frontend:
+              - "apps/frontend/**"
+              - ".github/workflows/frontend.yml"
+            ml:
+              - "ml/**"
+              - "apps/backend/alembic/**"
+              - "apps/backend/app/models/**"
+              - "apps/backend/tests/test_chaine_ml_api.py"
+              - "apps/backend/pyproject.toml"
+              - "apps/backend/uv.lock"
+              - ".github/workflows/ml.yml"
+            airflow:
+              - "etl/airflow/**"
+              - "ml/pyproject.toml"
+              - "ml/uv.lock"
+              - "ml/enervision_ml/**"
+              - "apps/backend/pyproject.toml"
+              - "apps/backend/uv.lock"
+              - "apps/backend/app/**"
+              - ".github/workflows/airflow.yml"
+            terraform:
+              - "infra/terraform/**"
+              - ".github/workflows/infra.yml"
+            compose:
+              - "docker-compose*.yml"
+              - ".env.example"
+              - "infra/front/**"
+              - "infra/garage/**"
+              - "tests/garage/**"
+              - "monitoring/**"
+              - ".github/workflows/infra.yml"
+            workflows:
+              - ".github/**"
+            e2e:
+              - "apps/frontend/**"
+              - "apps/backend/app/**"
+              - "apps/backend/alembic/**"
+              - "apps/backend/Dockerfile"
+              - "apps/backend/pyproject.toml"
+              - "apps/backend/uv.lock"
+              - "infra/proxy/**"
+              - "docker-compose*.yml"
+              - "db/**"
+              - "tests/**"
+              - "scripts/comptes-test.sh"
+              - "scripts/tls-selfsigned.sh"
+              - "Makefile"
+              - ".env.example"
+              - ".github/workflows/e2e.yml"
+            sonar:
+              - "apps/backend/**"
+              - "apps/frontend/**"
+              - "ml/**"
+              - "etl/airflow/**"
+              - "sonar-project.properties"
+
+  backend:
+    name: Backend
+    needs: changes
+    if: needs.changes.outputs.backend == 'true'
+    uses: ./.github/workflows/backend.yml
+
+  frontend:
+    name: Frontend
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
+    uses: ./.github/workflows/frontend.yml
+
+  ml:
+    name: ML
+    needs: changes
+    if: needs.changes.outputs.ml == 'true'
+    uses: ./.github/workflows/ml.yml
+
+  airflow:
+    name: Airflow
+    needs: changes
+    if: needs.changes.outputs.airflow == 'true'
+    uses: ./.github/workflows/airflow.yml
+
+  infra:
+    name: Infra
+    needs: changes
+    if: >-
+      needs.changes.outputs.terraform == 'true'
+      || needs.changes.outputs.compose == 'true'
+      || needs.changes.outputs.workflows == 'true'
+    uses: ./.github/workflows/infra.yml
+    with:
+      terraform: ${{ needs.changes.outputs.terraform == 'true' }}
+      compose: ${{ needs.changes.outputs.compose == 'true' }}
+      workflows: ${{ needs.changes.outputs.workflows == 'true' }}
+
+  e2e:
+    name: E2E
+    needs: changes
+    if: needs.changes.outputs.e2e == 'true'
+    uses: ./.github/workflows/e2e.yml
+
+  # Ni dependabot[bot] ni une PR de fork ne reçoivent SONAR_TOKEN : le scan échouerait sans rien
+  # analyser. Tests et couverture restent joués par leurs jobs.
+  sonar:
+    name: SonarQube
+    needs: [changes, backend, frontend, ml]
+    if: >-
+      always() && !cancelled()
+      && !contains(needs.*.result, 'failure')
+      && needs.changes.outputs.sonar == 'true'
+      && github.actor != 'dependabot[bot]'
+      && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      # Un téléchargement par rapport : backend et ML nomment tous deux le leur `coverage.xml`.
+      - name: Couverture du backend
+        if: needs.backend.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: backend-coverage
+          path: apps/backend
+
+      - name: Couverture du pipeline ML
+        if: needs.ml.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: ml-coverage
+          path: ml
+
+      - name: Couverture du frontend
+        if: needs.frontend.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: frontend-coverage
+          path: apps/frontend/coverage/frontend
+
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
+      - name: Analyse SonarQube
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+  ci-ok:
+    name: CI ok
+    needs: [changes, backend, frontend, ml, airflow, infra, e2e, sonar]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Refuse si un job a échoué ou a été annulé
+        env:
+          RESULTATS: ${{ toJSON(needs.*.result) }}
+        run: |
+          echo "$RESULTATS"
+          if grep -qE '"(failure|cancelled)"' <<<"$RESULTATS"; then
+            echo "::error::Au moins un job de la CI a échoué ou a été annulé."
+            exit 1
+          fi
+
+  deploy:
+    name: Déploiement
+    needs: ci-ok
+    if: ${{ !cancelled() && needs.ci-ok.result == 'success' && github.event_name == 'push' }}
+    uses: ./.github/workflows/deploy.yml

.github/workflows/dast.yml

@@ -0,0 +1,316 @@
+name: DAST
+
+# Scan dynamique OWASP ZAP de l'API (issue #41). Il attaque une API qui tourne : le job démarre
+# la base et le backend sur le runner, sème le jeu de démonstration (sans ça le scan ne frappe que
+# des gestionnaires d'erreur), crée des comptes jetables (scripts/dast-token.sh), puis lance ZAP
+# sur le contrat OpenAPI avec le jeton du `lecteur`.
+#
+# Non bloquant pour l'instant sur les alertes (`continue-on-error` sur la seule étape du scan) :
+# le volume d'un premier passage trié est inconnu. Deux étapes suivantes, elles, bloquent si le
+# scan n'a rien testé (import du contrat, absence de toute réponse de succès) : un job vert doit
+# vouloir dire qu'un scan a eu lieu.
+#
+# Piège : ce scan tape la configuration par défaut du backend (`APP_ENV=local`, pas de TLS, pas
+# de reverse proxy). Il ne dit rien des en-têtes ni du TLS posés par le proxy en production, et
+# remontera des alertes (HSTS absent...) qui n'existent pas derrière lui.
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Un scan actif est long : hebdomadaire plutôt qu'à chaque PR.
+    - cron: "0 3 * * 1"
+  pull_request:
+    # Ne se lance sur une PR que si le scan lui-même change.
+    paths:
+      - ".github/workflows/dast.yml"
+      - "scripts/dast-token.sh"
+      - "scripts/comptes-test.sh"
+      - "db/seeds/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dast-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zap:
+    name: Scan OWASP ZAP de l'API
+    runs-on: ubuntu-latest
+    # Généreux face aux ~2 minutes observées de bout en bout : le vrai plafond est
+    # `scanner.maxScanDurationInMins` (étape Scan ZAP), sous le TTL du jeton. Une annulation par
+    # ce timeout-ci n'exécute pas les étapes `always()` : mieux vaut ne jamais l'atteindre.
+    timeout-minutes: 30
+
+    # Même image que docker-compose.yml : la première migration refuse de s'appliquer sans
+    # l'extension TimescaleDB (cf. backend.yml).
+    services:
+      db:
+        image: timescale/timescaledb-ha:pg17
+        env:
+          POSTGRES_USER: enervision
+          POSTGRES_PASSWORD: change_me
+          POSTGRES_DB: enervision_dast
+        ports:
+          - "5433:5432"
+        options: >-
+          --health-cmd "pg_isready -U enervision -d enervision_dast"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 12
+          --health-start-period 40s
+
+    env:
+      # Base jetable : ZAP y écrira et le script y crée deux comptes.
+      DATABASE_URL: postgresql+asyncpg://enervision:change_me@localhost:5433/enervision_dast
+      APP_SECRET_KEY: secret-de-scan-assez-long-pour-le-validateur
+      APP_ENV: local
+      # Le jeton du lecteur doit survivre à toute la durée du scan (15 minutes par défaut).
+      # 3600 est le plafond accepté par la configuration ; `scanner.maxScanDurationInMins`
+      # (étape Scan ZAP) reste très en dessous, marge comprise pour les étapes qui l'entourent.
+      APP_ACCESS_TOKEN_TTL_SECONDS: "3600"
+      PGPASSWORD: change_me
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Installe uv
+        # Épinglé sur le commit du tag v7 (règle Sonar githubactions:S7637 : dépendance tierce,
+        # contrairement à actions/checkout ou actions/upload-artifact, premières parties).
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: apps/backend/uv.lock
+          # `prune-cache` vaut `true` par défaut (encore sur ce commit) : l'étape de post-job
+          # « Pruning cache » est restée bloquée 5 minutes avant d'échouer (exit code 2) sur un
+          # run où les 16 étapes précédentes passaient, sans lien avec le scan. Le prune n'est
+          # qu'une optimisation de taille de cache entre deux runs, pas une garantie : le
+          # désactiver retire le blocage sans rien changer au comportement du job.
+          prune-cache: false
+
+      - name: Installe l'interpréteur déclaré par .python-version
+        run: uv python install
+        working-directory: apps/backend
+
+      # `--no-build` : aucune dépendance n'est construite depuis ses sources, donc aucun script de
+      # build exécuté (règle Sonar S8541). Le projet lui-même n'est pas installé : il tourne depuis
+      # `apps/backend`, comme dans son Dockerfile. Les `uv run` suivants portent `--frozen
+      # --no-sync` pour ne rien résoudre ni reconstruire (règle S8544).
+      - name: Synchronise les dépendances sans dévier du verrou
+        run: uv sync --locked --no-dev --no-install-project --no-build
+        working-directory: apps/backend
+
+      - name: Active TimescaleDB sur la base du scan
+        run: psql -h localhost -p 5433 -U enervision -d enervision_dast -c "CREATE EXTENSION IF NOT EXISTS timescaledb"
+
+      - name: Applique les migrations
+        run: uv run --frozen --no-sync --no-build alembic upgrade head
+        working-directory: apps/backend
+
+      # Sans données, `GET /sites` rend `[]`, chaque `/{site_id}` rend 404 et le scan actif ne
+      # frappe que des gestionnaires d'erreur plutôt que la logique métier.
+      - name: Sème le jeu de démonstration
+        run: psql -h localhost -p 5433 -U enervision -d enervision_dast -v ON_ERROR_STOP=1 -f db/seeds/demo.sql
+
+      - name: Démarre l'API
+        run: |
+          nohup uv run --frozen --no-sync --no-build uvicorn app.main:create_app --factory \
+            --host 0.0.0.0 --port 8000 > "$RUNNER_TEMP/api.log" 2>&1 &
+          for _ in $(seq 1 30); do
+            curl -fsS http://localhost:8000/api/v1/health/ready >/dev/null 2>&1 && exit 0
+            sleep 2
+          done
+          echo "L'API ne répond pas sur /health/ready" >&2
+          cat "$RUNNER_TEMP/api.log" >&2
+          exit 1
+        working-directory: apps/backend
+
+      - name: Crée le compte lecteur du scan
+        id: jeton
+        run: |
+          jeton="$(../../scripts/dast-token.sh)"
+          echo "::add-mask::$jeton"
+          echo "jeton=$jeton" >> "$GITHUB_OUTPUT"
+        working-directory: apps/backend
+
+      # Étape distincte du scan lui-même, et sans `continue-on-error` : un `curl` qui échoue ici
+      # (API tombée juste après la sonde de readiness, par exemple) doit rester un échec visible,
+      # pas se travestir en « ZAP n'a importé aucune URL » à l'étape de garde suivante.
+      - name: Prépare le contrat pour ZAP
+        run: |
+          mkdir -p zap-out zap-logs
+          curl -fsS http://localhost:8000/openapi.json -o zap-out/openapi.json
+          # Le dossier passe à l'uid 1000 (utilisateur du conteneur ZAP) : le runner n'y écrit
+          # plus après ce chown, d'où `zap-logs/` (uid du runner) pour les journaux ci-dessous.
+          # Pas de `chmod 777` (règle Sonar S2612).
+          sudo chown -R 1000:1000 zap-out
+
+      # `--network host` : ZAP atteint l'API sur le localhost du runner.
+      #
+      # Piège vécu : la clé du nom d'en-tête est `matchstr`, pas `matchstring`. ZAP accepte
+      # n'importe quelle clé `-config` sans erreur ; avec la mauvaise, il ajoutait à TOUTES les
+      # requêtes un en-tête au nom vide (`: Bearer <jeton>`), qu'uvicorn refuse par un 400
+      # (« Invalid HTTP request received »), y compris sur les routes publiques.
+      #
+      # Le jeton ne passe ni par `${{ }}` dans ce script (il finirait en clair dans le fichier de
+      # commande que GitHub écrit sur le disque du runner pour toute la durée de l'étape), ni par
+      # l'argv de `docker run` (visible par `ps aux` et par `docker inspect zap` tant que le
+      # conteneur existe) : il est écrit dans un fichier de configuration ZAP séparé, monté en
+      # lecture seule hors de `/zap/wrk` pour ne jamais atterrir dans l'artefact publié.
+      #
+      # Les routes d'authentification qui changent l'état du compte du scan sont exclues : un
+      # scan actif y déclencherait la limitation de débit du login, la réinitialisation de mots de
+      # passe et la fermeture des sessions, sans rien apprendre de plus.
+      #
+      # `scanner.maxScanDurationInMins`/`maxRuleDurationInMins` bornent le scan actif, que `-T` ne
+      # couvre pas (il ne borne que le démarrage et le scan passif) : sans ça, une règle qui
+      # traîne peut dépasser le TTL du jeton (401 muets en fin de scan) ou le timeout du job (qui
+      # annule sans exécuter les étapes `always()`, rapport et journaux perdus).
+      - name: Scan ZAP
+        id: zap
+        continue-on-error: true
+        env:
+          JETON: ${{ steps.jeton.outputs.jeton }}
+        run: |
+          set -o pipefail
+          printf 'replacer.full_list(0).description=auth\nreplacer.full_list(0).enabled=true\nreplacer.full_list(0).matchtype=REQ_HEADER\nreplacer.full_list(0).matchstr=Authorization\nreplacer.full_list(0).regex=false\nreplacer.full_list(0).replacement=Bearer %s\n' "$JETON" > "$RUNNER_TEMP/zap-auth.conf"
+          # Piège vécu : `chmod 600` seul rend le fichier illisible pour le conteneur, qui lit un
+          # montage bind avec son propre uid (1000), distinct de celui du runner qui l'a écrit.
+          # ZAP échoue alors dès le lancement (« File not readable: /zap/auth.conf »), et
+          # `zap-api-scan.py` attend `-T` minutes complètes avant d'abandonner : dix minutes qui
+          # ressemblent à un scan actif, pour un daemon mort depuis le début.
+          #
+          # Piège vécu (numéro deux) : une fois le fichier passé à l'uid 1000 par `sudo chown`,
+          # l'utilisateur du runner n'en est plus propriétaire et un `chmod` sans `sudo` échoue
+          # (« Operation not permitted »). Avec le `-e` implicite de bash sur les étapes GitHub
+          # Actions, cette erreur arrêtait toute l'étape avant même `docker run` : scan « réussi »
+          # en une fraction de seconde, sans le moindre journal ni rapport produit.
+          sudo chown 1000:1000 "$RUNNER_TEMP/zap-auth.conf"
+          sudo chmod 644 "$RUNNER_TEMP/zap-auth.conf"
+          docker run --name zap --network host \
+            -v "$PWD/zap-out:/zap/wrk:rw" \
+            -v "$RUNNER_TEMP/zap-auth.conf:/zap/auth.conf:ro" \
+            ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
+            -t /zap/wrk/openapi.json -f openapi -O http://localhost:8000 \
+            -T 10 \
+            -r zap-report.html -J zap-report.json -w zap-report.md \
+            -z "-configfile /zap/auth.conf \
+                -config globalexcludeurl.url_list.url(0).description=auth-etat \
+                -config globalexcludeurl.url_list.url(0).enabled=true \
+                -config globalexcludeurl.url_list.url(0).regex='.*/api/v1/auth/(login|password|logout-all|forgot-password|reset-password).*' \
+                -config scanner.maxScanDurationInMins=15 \
+                -config scanner.maxRuleDurationInMins=5" \
+            2>&1 | tee "$RUNNER_TEMP/zap-stdout.log"
+
+      - name: Récupère les journaux de ZAP
+        if: always()
+        run: |
+          mkdir -p zap-logs
+          # ZAP journalise la valeur de chaque `-config`/`-configfile` chargé, y compris le jeton,
+          # à un niveau visible sans `-d` : les copies publiées en artefact sont donc caviardées,
+          # même si `::add-mask::` (posé à la création du jeton) protège déjà le journal du job.
+          masque() { sed -E 's/(Bearer )[A-Za-z0-9._-]+/\1[MASQUE]/Ig'; }
+          [ -f "$RUNNER_TEMP/zap-stdout.log" ] && masque < "$RUNNER_TEMP/zap-stdout.log" > zap-logs/zap-stdout.log
+          docker cp zap:/home/zap/.ZAP/zap.log "$RUNNER_TEMP/zap-internal.log" 2>/dev/null || true
+          [ -f "$RUNNER_TEMP/zap-internal.log" ] && masque < "$RUNNER_TEMP/zap-internal.log" > zap-logs/zap.log
+          [ -f "$RUNNER_TEMP/api.log" ] && masque < "$RUNNER_TEMP/api.log" > zap-logs/api.log
+          rm -f "$RUNNER_TEMP/zap-auth.conf"
+          docker rm -f zap >/dev/null 2>&1 || true
+
+      # `continue-on-error` sur le scan ne doit pas faire passer pour vert un scan qui n'a rien
+      # testé. Constaté une première fois : 2 URL importées sur 26 opérations, ZAP n'avait envoyé
+      # que des requêtes vouées au 404. Le seuil est dérivé du contrat plutôt que d'un nombre fixe
+      # : un contrat qui grossit ne doit pas rendre la garde plus permissive qu'elle ne l'était.
+      - name: Vérifie que le contrat a bien été importé
+        run: |
+          attendu="$(python3 -c "
+          import json
+          d = json.load(open('zap-out/openapi.json'))
+          methodes = ('get', 'post', 'put', 'patch', 'delete', 'head', 'options')
+          print(sum(1 for chemin in d['paths'].values() for m in chemin if m in methodes))
+          ")"
+          minimum=$((attendu * 80 / 100))
+          importees="$(sed -n 's/.*Number of Imported URLs: \([0-9]*\).*/\1/p' "$RUNNER_TEMP/zap-stdout.log" | tail -1)"
+          echo "URL importées depuis le contrat OpenAPI : ${importees:-aucune} (contrat : $attendu opérations, minimum accepté : $minimum)"
+          if [ "${importees:-0}" -lt "$minimum" ]; then
+            echo "::error::ZAP n'a importé que ${importees:-0} URL sur $attendu opérations du contrat OpenAPI (minimum attendu : $minimum, soit 80%). Le scan n'a pas testé l'API, voir zap-logs/zap.log dans l'artefact zap-report."
+            exit 1
+          fi
+
+      # Deuxième garde-fou : le contrat peut être importé et ZAP n'obtenir que des erreurs
+      # (constaté : base sans données, toutes les routes de site répondaient 404).
+      #
+      # Piège de conception, trouvé en répétant ce job en local avant de l'écrire ici : borner le
+      # pourcentage de 4xx ne marche pas. Un scan actif fuzze délibérément un grand nombre
+      # d'entrées invalides (identifiants inventés, méthodes non supportées...), donc même un scan
+      # sain, contre l'API seedée juste au-dessus, reste à 98% de 4xx avec seulement 1% de 2xx :
+      # c'est la forme normale d'un scan actif, pas un signe d'échec. Le signal qui distingue
+      # vraiment un scan cassé (0% de 2xx, `insight.code.2xx` absent du rapport dans le premier
+      # incident) d'un scan sain (2xx non nul, aussi faible soit-il) est donc l'absence de succès,
+      # pas la part d'échecs. Dérivé de `zap-report.json` (champ structuré `insights[]`) plutôt
+      # que du texte libre du rapport Markdown, qui aurait le même défaut de conception en plus
+      # d'être fragile au format.
+      - name: Vérifie que le scan a obtenu au moins une réponse de succès
+        run: |
+          python3 - <<'PY'
+          import json
+          import sys
+
+          try:
+              rapport = json.load(open("zap-out/zap-report.json"))
+          except FileNotFoundError:
+              print("::error::Aucun rapport ZAP produit : le scan n'a rien testé.")
+              sys.exit(1)
+
+          pourcentage_2xx = 0.0
+          for insight in rapport.get("insights", []):
+              if insight.get("key") == "insight.code.2xx":
+                  pourcentage_2xx = float(insight.get("statistic", 0))
+                  break
+
+          print(f"Pourcentage de réponses 2xx : {pourcentage_2xx}%")
+          if pourcentage_2xx <= 0:
+              print(
+                  "::error::Aucune réponse 2xx (succès) reçue : le scan n'a atteint aucune route "
+                  "réelle de l'API. Voir zap-logs/api.log et zap-logs/zap.log dans l'artefact "
+                  "zap-report."
+              )
+              sys.exit(1)
+          PY
+
+      # Uniquement la synthèse (jusqu'à « Alert Detail » exclu) : `$GITHUB_STEP_SUMMARY` est
+      # limité à 1 Mio, et cette étape tourne sous `always()` - son échec ferait échouer le job
+      # après le passage des deux garde-fous, pour une simple raison de mise en forme. Le rapport
+      # complet reste dans l'artefact `zap-report`.
+      - name: Publie le résumé
+        if: always()
+        run: |
+          if [ -f zap-out/zap-report.md ]; then
+            {
+              awk '/^## Alert Detail/{exit} {print}' zap-out/zap-report.md
+              echo ""
+              echo "Rapport complet (HTML/JSON/Markdown) dans l'artefact \`zap-report\`."
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "Aucun rapport ZAP produit, voir le journal du job." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Publie les rapports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: zap-report
+          path: |
+            zap-out/
+            zap-logs/
+          if-no-files-found: warn
+
+      # Diagnostic de dernier recours : les journaux de l'API sont déjà dans l'artefact
+      # (zap-logs/api.log) via l'étape « Récupère les journaux de ZAP » (always()), mais les
+      # afficher directement dans le journal du job évite d'avoir à le télécharger pour un échec
+      # évident (l'API n'a jamais démarré, par exemple).
+      - name: Journal de l'API en cas d'échec
+        if: failure() || steps.zap.outcome == 'failure'
+        run: cat "$RUNNER_TEMP/api.log" || true

.github/workflows/deploy.yml

@@ -0,0 +1,75 @@
+# Pourquoi : le runner tourne sur la VM ENI, adresse privée que les runners hébergés par GitHub
+# ne joignent pas, et travaille dans un dossier stable par environnement plutôt que dans son
+# espace de travail : `.env`, certificats et volumes y survivent d'un déploiement à l'autre.
+# Pourquoi : appelé par ci.yml une fois « CI ok » vert, jamais directement par un push, et il
+# déploie `GITHUB_SHA`, le commit testé, pas la pointe de branche du moment (ADR 0014).
+# Pourquoi : `main` va en prod, `dev` en recette, et toute autre branche lancée à la main
+# (workflow_dispatch) va dans `dev`, la vitrine d'une branche de travail (ADR 0017).
+# Piège : jamais de déclencheur `pull_request` ici. Sur un dépôt public, une PR de fork
+# exécuterait son code sur la machine de production (ADR 0009) - job deploy.
+# Piège : les CI de deux push finissent parfois dans le désordre. Un commit qui précède celui déjà
+# déployé depuis la même branche est ignoré, et le verrou est un `flock` sur le dossier de
+# l'environnement plutôt qu'un groupe `concurrency` : GitHub n'y garde qu'un job en attente, et
+# le suivant l'évince sans bruit.
+
+name: Déploiement
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: Déploie sur la VM
+    runs-on: [self-hosted, linux, eni-g3]
+    timeout-minutes: 30
+    environment:
+      name: ${{ github.ref_name == 'main' && 'prod' || github.ref_name == 'dev' && 'rec' || 'dev' }}
+      url: ${{ github.ref_name == 'main' && 'https://prod.enervision-g3.dynv6.net' || github.ref_name == 'dev' && 'https://rec.enervision-g3.dynv6.net' || 'https://dev.enervision-g3.dynv6.net' }}
+    env:
+      ENVIRONNEMENT: ${{ github.ref_name == 'main' && 'prod' || github.ref_name == 'dev' && 'rec' || 'dev' }}
+      PORT_HTTPS: ${{ github.ref_name == 'main' && '10443' || github.ref_name == 'dev' && '8443' || '9443' }}
+    steps:
+      # Un seul step : le verrou tombe avec le shell qui l'a posé.
+      - name: Déploie le commit testé, sans jamais reculer
+        run: |
+          cd "/srv/enervision/${ENVIRONNEMENT}"
+          exec 9>"$(git rev-parse --git-dir)/verrou-deploiement"
+          flock 9
+
+          echo "::group::Aligne le dossier de l'environnement sur le commit testé"
+          git fetch --quiet origin "${GITHUB_REF_NAME}"
+          deploye="$(git rev-parse HEAD)"
+          if [ "$(git branch --show-current)" = "$GITHUB_REF_NAME" ] && [ "$deploye" != "$GITHUB_SHA" ] \
+            && git merge-base --is-ancestor "$GITHUB_SHA" "$deploye"; then
+            echo "::notice::${GITHUB_SHA:0:7} précède le commit déjà déployé (${deploye:0:7}) : rien à déployer."
+            exit 0
+          fi
+          git checkout --quiet "${GITHUB_REF_NAME}"
+          git reset --quiet --hard "${GITHUB_SHA}"
+          git log -1 --format='%h %s'
+          echo "::endgroup::"
+
+          echo "::group::Reconstruit et redémarre la stack"
+          # Un `.env` pas encore réaligné par provision-host.sh porte encore un nom en `.local`.
+          if [ -r ../dns.token ] && ! grep -q '^PUBLIC_HOST=.*\.local$' .env; then make tls-dns01; fi
+          make stack-up
+          if [ "${ENVIRONNEMENT}" = prod ]; then make front-up; fi
+          echo "::endgroup::"
+
+          echo "::group::Attend que l'API réponde derrière le proxy"
+          for _ in $(seq 1 36); do
+            if curl --fail --silent --insecure "https://localhost:${PORT_HTTPS}/api/v1/health/ready"; then
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "::endgroup::"
+          echo "L'API ne répond pas après 3 minutes" >&2
+          compose="docker compose -f docker-compose.yml -f docker-compose.prod.yml"
+          $compose ps
+          $compose logs --tail=50 backend proxy
+          exit 1

.github/workflows/e2e.yml

@@ -0,0 +1,135 @@
+name: E2E
+
+# Pourquoi : les parcours tournent contre la stack telle qu'elle est déployée, derrière le proxy
+# TLS (cookie `__Secure-`, CSP, limitation de débit), pas contre `ng serve` - job parcours. Il
+# construit aussi les images backend et frontend, que rien d'autre ne construit avant le
+# déploiement (ADR 0015).
+# Piège : pas d'Airflow ici. `up` nomme ses services : sans eux, la construction de l'image
+# Airflow doublerait la durée du job sans rien tester de plus.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  parcours:
+    name: Parcours Playwright et tirs k6
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      COMPOSE_FILE: docker-compose.yml:docker-compose.prod.yml
+      PUBLIC_HOST: localhost
+      E2E_BASE_URL: https://localhost
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Prépare le .env de la stack
+        run: |
+          secret() { openssl rand -hex 32; }
+          sed -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=$(secret)|" \
+              -e "s|^APP_SECRET_KEY=.*|APP_SECRET_KEY=$(secret)|" \
+              -e "s|^PUBLIC_HOST=.*|PUBLIC_HOST=localhost|" \
+              .env.example > .env
+
+      - name: Génère le certificat de démonstration
+        run: ./scripts/tls-selfsigned.sh
+
+      - name: Construit et démarre la stack derrière le proxy
+        run: docker compose up --detach --build --wait --wait-timeout 300 db mailpit backend frontend proxy
+
+      - name: Applique les migrations
+        run: docker compose exec -T backend alembic upgrade head
+
+      # Même cible que `make stack-up` en prod : les droits du rôle portent sur le schéma réel.
+      - name: Pose le rôle de supervision en lecture seule
+        run: make db-ensure-supervision
+
+      - name: Sème le jeu de démonstration
+        run: docker compose exec -T db psql -U enervision -d enervision -v ON_ERROR_STOP=1 < db/seeds/demo.sql
+
+      - name: Crée les comptes de test
+        env:
+          BASE_URL: https://localhost
+          APP_CLI: docker compose exec -T backend python -m app.cli
+          COMPTES_FICHIER: ${{ runner.temp }}/comptes.json
+        run: ./scripts/comptes-test.sh
+
+      - name: Installe Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 26
+          cache: npm
+          cache-dependency-path: tests/e2e/package-lock.json
+
+      - name: Installe Playwright
+        working-directory: tests/e2e
+        run: npm ci
+
+      - name: Restaure les navigateurs de Playwright
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('tests/e2e/package-lock.json') }}
+
+      # `--with-deps` tourne même quand le cache a servi : il pose aussi les bibliothèques système.
+      - name: Installe Chromium
+        working-directory: tests/e2e
+        run: npx playwright install --with-deps chromium
+
+      - name: Joue les parcours
+        working-directory: tests/e2e
+        env:
+          E2E_COMPTES: ${{ runner.temp }}/comptes.json
+        run: npx playwright test
+
+      # Direct sur `backend:8000` : ce tir mesure l'API, pas la limitation de nginx.
+      - name: Tir k6 de fumée sur l'API
+        env:
+          K6_RESUME: /results/resume-smoke.md
+        run: |
+          K6_EMAIL="$(jq -r .lecteur.email "$RUNNER_TEMP/comptes.json")"
+          K6_PASSWORD="$(jq -r .lecteur.password "$RUNNER_TEMP/comptes.json")"
+          echo "::add-mask::$K6_PASSWORD"
+          export K6_EMAIL K6_PASSWORD
+          make load-smoke
+
+      - name: Vérifie par k6 que le proxy limite le débit
+        env:
+          K6_RESUME: /results/resume-limitation.md
+        run: make load-limits
+
+      - name: Publie la synthèse k6
+        if: ${{ !cancelled() }}
+        run: cat tests/load/results/resume-*.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
+
+      - name: Publie les rapports k6
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: k6-rapports
+          path: tests/load/results/
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Publie le rapport Playwright
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: |
+            tests/e2e/playwright-report/
+            tests/e2e/test-results/
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Journaux de la stack en cas d'échec
+        if: failure()
+        run: docker compose logs --tail=200 backend proxy frontend
+
+      - name: Arrête la stack
+        if: always()
+        run: docker compose down --volumes

.github/workflows/frontend.yml

@@ -1,64 +1,70 @@
 name: Frontend
 
+# Pourquoi : aucun déclencheur propre. ci.yml appelle ce workflow quand le frontend change, et
+# Sonar y reprend la couverture versée par le job `verification` (ADR 0014).
+
 on:
-  push:
-    paths:
-      - "apps/frontend/**"
-      - ".github/workflows/frontend.yml"
-  pull_request:
-    paths:
-      - "apps/frontend/**"
-      - ".github/workflows/frontend.yml"
+  workflow_call:
 
 permissions:
   contents: read
 
 jobs:
-  build:
+  # Un seul `npm ci` pour la construction et les tests : un job de plus ne ferait que le rejouer.
+  verification:
+    name: Construction et tests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: apps/frontend
+
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Installe Node
+        uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 26
           cache: npm
           cache-dependency-path: apps/frontend/package-lock.json
 
-      - run: npm ci
-        working-directory: apps/frontend
-      - run: npm run build
-        working-directory: apps/frontend
+      - name: Installe les dépendances
+        run: npm ci
+
+      - name: Construit l'application
+        run: npm run build
+
+      # Piège : `npm test --watch=false` garde l'option pour npm, `ng test` ne la reçoit jamais.
+      # La couverture lcov vient d'angular.json (`coverage: true`).
+      - name: Tests et couverture
+        run: npm run test:ci
+
+      - name: Verse la couverture pour Sonar
+        uses: actions/upload-artifact@v7
+        with:
+          name: frontend-coverage
+          path: apps/frontend/coverage/frontend/lcov.info
+          if-no-files-found: error
 
   security-audit:
     name: Audit des dépendances
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-      # Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
-      - run: npm audit --audit-level=high --package-lock-only
+    timeout-minutes: 10
+    defaults:
+      run:
         working-directory: apps/frontend
 
-  test:
-    needs: build
-    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Installe Node
+        uses: actions/setup-node@v7
         with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: apps/frontend/package-lock.json
-      - name : Installation des dépendances (Front)
-        run: npm ci 
-        working-directory: apps/frontend
-      - name : Lancement des tests et génénration du rapport de couverture (Front)
-        run: npm test --watch=false --code-coverage --coverageReporters=lcov
-        working-directory: apps/frontend
-      - name: Upload coverage
-        uses: actions/upload-artifact@v4
-        with:
-          name: frontend-coverage
-          path: apps/frontend/coverage/frontend/lcov.info
+          node-version: 26
+
+      # Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
+      - name: Audite le verrou
+        run: npm audit --audit-level=high --package-lock-only

.github/workflows/infra.yml

@@ -0,0 +1,140 @@
+name: Infra
+
+# Pourquoi : rien de ce qui décrit l'infrastructure ne s'exécute avant le déploiement. Terraform est
+# resté cassé sans que rien ne le dise, faute de job qui le joue : ce workflow n'applique rien, il
+# vérifie le Terraform, les fichiers Compose et les workflows eux-mêmes - jobs terraform, compose,
+# workflows. ci.yml choisit par ses entrées ceux qui tournent (ADR 0014).
+# Piège : la boucle Terraform parcourt `environments/*`, pour qu'une racine ajoutée soit couverte
+# sans toucher à ce fichier.
+
+on:
+  workflow_call:
+    inputs:
+      terraform:
+        type: boolean
+        default: false
+      compose:
+        type: boolean
+        default: false
+      workflows:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  terraform:
+    name: Formatage et validation Terraform
+    if: inputs.terraform
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
+      - name: Installe Terraform
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: 1.16.3
+          terraform_wrapper: false
+
+      - name: Vérifie le formatage
+        run: terraform fmt -check -recursive infra/terraform
+
+      - name: Valide chaque racine
+        run: |
+          for racine in infra/terraform/environments/*/; do
+            echo "::group::${racine}"
+            terraform -chdir="${racine}" init -backend=false -input=false
+            terraform -chdir="${racine}" validate
+            echo "::endgroup::"
+          done
+
+  compose:
+    name: Validation des fichiers Compose et de la supervision
+    if: inputs.compose
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Compose interpole tout le fichier : les `:?` exigent une valeur, pas un vrai secret.
+      - name: Prépare un .env d'exemple
+        run: cp .env.example .env
+
+      # Garage refuse un rpc_secret qui n'est pas 32 octets hexadécimaux : `change_me` ne suffit pas.
+      - name: Génère les secrets Garage du .env
+        run: |
+          sed -i -e "s|^GARAGE_RPC_SECRET=.*|GARAGE_RPC_SECRET=$(openssl rand -hex 32)|" \
+              -e "s|^GARAGE_ADMIN_TOKEN=.*|GARAGE_ADMIN_TOKEN=$(openssl rand -hex 32)|" \
+              -e "s|^GARAGE_METRICS_TOKEN=.*|GARAGE_METRICS_TOKEN=$(openssl rand -hex 32)|" \
+              -e "s|^GARAGE_ACCESS_KEY=.*|GARAGE_ACCESS_KEY=GK$(openssl rand -hex 12)|" \
+              -e "s|^GARAGE_SECRET_KEY=.*|GARAGE_SECRET_KEY=$(openssl rand -hex 32)|" \
+              -e "s|^GARAGE_SSE_KEY=.*|GARAGE_SSE_KEY=$(openssl rand -base64 32)|" .env
+
+      - name: Valide la stack de développement
+        run: docker compose config --quiet
+
+      - name: Valide la stack déployée, profils compris
+        run: docker compose -f docker-compose.yml -f docker-compose.prod.yml --profile acme --profile monitoring --profile load config --quiet
+
+      - name: Valide le frontal SNI de la VM
+        run: |
+          docker compose -f infra/front/compose.yml config --quiet
+          docker run --rm -v "$PWD/infra/front/nginx.conf:/etc/nginx/nginx.conf:ro" nginx:1.31-alpine nginx -t
+
+      # Mêmes commandes que `make monitoring-check` : images et montages viennent du fichier Compose.
+      - name: Valide la configuration de Prometheus et ses règles
+        run: docker compose --profile monitoring run --rm --no-deps --entrypoint promtool prometheus check config /etc/prometheus/prometheus.yml
+
+      - name: Joue les tests unitaires des règles d'alerte
+        run: docker compose --profile monitoring run --rm --no-deps --entrypoint promtool prometheus test rules /etc/prometheus/tests/enervision.test.yml
+
+      - name: Valide la configuration d'Alertmanager
+        run: docker compose --profile monitoring run --rm --no-deps --entrypoint amtool alertmanager check-config /etc/alertmanager/alertmanager.yml
+
+      - name: Valide les tableaux de bord Grafana
+        run: for tableau in monitoring/grafana/dashboards/*.json; do jq empty "$tableau"; done
+
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
+      - name: Installe uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: false
+
+      # Même image et même healthcheck qu'en prod : `--wait` ne rend la main qu'une fois le S3 prêt.
+      - name: Démarre Garage
+        run: docker compose up -d --wait --wait-timeout 120 garage
+
+      - name: Fumée S3 sur Garage, SSE-C compris
+        run: |
+          set -a; . ./.env; set +a
+          uvx --no-build --with boto3==1.43.101 pytest==9.1.1 tests/garage -q
+
+      - name: Journaux de Garage en cas d'échec
+        if: failure()
+        run: docker compose logs --tail=100 garage
+
+      - name: Arrête Garage
+        if: always()
+        run: docker compose down --volumes
+
+  workflows:
+    name: Analyse des workflows
+    if: inputs.workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Image épinglée par tag, comme les images des fichiers Compose. Elle embarque shellcheck,
+      # qui analyse aussi les blocs `run:`.
+      - name: actionlint
+        run: docker run --rm -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.12 -color

.github/workflows/ml.yml

@@ -2,47 +2,41 @@ name: ML
 
 # Piège : la version de Python vient de ml/.python-version, et doit rester en 3.14 (cf.
 # .github/workflows/backend.yml, même contrainte).
+# Pourquoi : aucun déclencheur propre. ci.yml l'appelle aussi quand les migrations ou les modèles
+# du backend changent, dont dépend le job `integration` (ADR 0014).
 
 on:
-  push:
-    paths:
-      - "ml/**"
-      - ".github/workflows/ml.yml"
-  pull_request:
-    paths:
-      - "ml/**"
-      - ".github/workflows/ml.yml"
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ml-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   verification:
     name: Lint, typage et tests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: ml
 
     steps:
       - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
+      # Action tierce, épinglée sur le commit du tag (règle Sonar githubactions:S7637).
       - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           cache-dependency-glob: ml/uv.lock
+          prune-cache: false
 
       - name: Installe l'interpréteur déclaré par .python-version
         run: uv python install
 
-      - name: Synchronise les dépendances sans dévier du verrou
-        run: uv sync --all-groups --frozen
+      - name: Synchronise les dépendances sur le verrou
+        run: uv sync --all-groups --locked
 
       - name: Vérifie le formatage
         run: uv run ruff format --check .
@@ -53,7 +47,121 @@ jobs:
       - name: Typage
         run: uv run mypy enervision_ml tests
 
-      # Aucun test ne touche PostgreSQL ni MLflow distant : tout tourne sur donnees
-      # synthetiques ou un magasin SQLite local jetable (cf. ml/tests/test_train.py).
-      - name: Tests
-        run: uv run pytest
+      # Les tests exigeant une base portent le marqueur `integration`, écarté par défaut et
+      # joué par le job `integration` ci-dessous.
+      - name: Tests et couverture
+        run: uv run pytest --cov-report=xml
+
+      - name: Verse la couverture pour Sonar
+        uses: actions/upload-artifact@v7
+        with:
+          name: ml-coverage
+          path: ml/coverage.xml
+          if-no-files-found: error
+
+  # Piège : le schéma de la base ML est celui du backend (apps/backend/alembic, propriétaire du
+  # schéma). Le reconstruire ici à la main rendrait ce job vert sur une base qui n'est pas la nôtre.
+  integration:
+    name: ML - DB et chaîne ML - DB - API
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    services:
+      db:
+        image: timescale/timescaledb-ha:pg17
+        env:
+          POSTGRES_USER: enervision
+          POSTGRES_PASSWORD: change_me
+          POSTGRES_DB: enervision_test
+        ports:
+          - "5433:5432"
+        options: >-
+          --health-cmd "pg_isready -U enervision -d enervision_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 12
+          --health-start-period 40s
+
+    env:
+      # Deux variables, deux dialectes : Alembic et l'API parlent asyncpg, le pipeline ML parle
+      # psycopg en synchrone. Cf. docs/ML-START.md, section 1.
+      DATABASE_URL: postgresql+asyncpg://enervision:change_me@localhost:5433/enervision_test
+      ML_DATABASE_URL: postgresql+psycopg://enervision:change_me@localhost:5433/enervision_test
+      APP_SECRET_KEY: secret-de-test-assez-long-pour-le-validateur
+      PGPASSWORD: change_me
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      - name: Installe uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            ml/uv.lock
+            apps/backend/uv.lock
+          prune-cache: false
+
+      - name: Installe l'interpréteur déclaré par .python-version
+        working-directory: ml
+        run: uv python install
+
+      - name: Synchronise le pipeline ML sur le verrou
+        working-directory: ml
+        run: uv sync --all-groups --locked
+
+      # Le backend est installé ici parce qu'il porte les migrations, seule source du schéma, et
+      # le test de chaîne, qui interroge l'API.
+      - name: Synchronise le backend sur le verrou
+        working-directory: apps/backend
+        run: uv sync --all-groups --locked
+
+      # db/init/110-test-database.sql n'est pas monté ici, et sans l'extension la première
+      # révision Alembic refuse de s'appliquer.
+      - name: Active TimescaleDB sur la base de test
+        run: psql -h localhost -p 5433 -U enervision -d enervision_test -c "CREATE EXTENSION IF NOT EXISTS timescaledb"
+
+      - name: Applique les migrations du backend, propriétaire du schéma
+        working-directory: apps/backend
+        run: uv run alembic upgrade head
+
+      # Couverture désactivée : ce job ne joue qu'une partie de la suite, son taux n'aurait pas
+      # de sens (même raison que backend.yml).
+      - name: Tests ML exigeant une base
+        working-directory: ml
+        run: uv run pytest -m integration --no-cov
+
+      # Lance les vrais binaires enervision_ml.train et .score en sous-processus, comme les DAGs
+      # ml_train et ml_score, puis relit le résultat par GET /api/v1/predictions.
+      - name: Chaîne complète ML vers DB vers API
+        working-directory: apps/backend
+        env:
+          ML_PYTHON: ${{ github.workspace }}/ml/.venv/bin/python
+        run: uv run pytest -m chaine --no-cov
+
+  sast:
+    name: Analyse statique de sécurité
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: ml
+
+    steps:
+      - name: Récupère le dépôt
+        uses: actions/checkout@v7
+
+      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
+      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
+      - name: Installe uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          enable-cache: false
+
+      - name: Analyse le code livré (bloquant à partir de MEDIUM)
+        run: uvx bandit==1.9.4 --recursive enervision_ml --severity-level medium --confidence-level medium
+
+      - name: Rapport complet, tous niveaux
+        continue-on-error: true
+        run: uvx bandit==1.9.4 --recursive enervision_ml

.github/workflows/sonarqube.yml

@@ -1,132 +0,0 @@
-name: SonarQube
-
-on:
-  push:
-    paths:
-      - "apps/frontend/**"
-      - "apps/backend/**"
-      - ".github/workflows/sonarqube.yml"
-  pull_request:
-    paths:
-      - "apps/frontend/**"
-      - "apps/backend/**"
-      - ".github/workflows/sonarqube.yml"
-
-
-# Build l'ensemble du projet, puis lance les tests
-# Génère les rapports de couverture, puis lance l'analyse SonarQube
-
-jobs:
-  build-front:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: apps/frontend/package-lock.json
-      
-      - run: npm ci 
-        working-directory: apps/frontend
-      - run: npm run build
-        working-directory: apps/frontend
-
-  test-front:  
-    needs: build-front
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: apps/frontend/package-lock.json
-
-      - name : Installation des dépendances (Front)
-        run: npm ci 
-        working-directory: apps/frontend
-
-      - name : Lancement des tests et génénration du rapport de couverture (Front)
-        run: npm test --watch=false --code-coverage --coverageReporters=lcov
-        working-directory: apps/frontend
-
-      - name: Upload coverage
-        uses: actions/upload-artifact@v4
-        with:
-          name: frontend-coverage
-          path: apps/frontend/coverage/frontend/lcov.info
-
-  build-back:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-          cache-dependency-glob: apps/backend/uv.lock
-      - name: Installe l'interpréteur déclaré par .python-version
-        run: uv python install
-        working-directory: apps/backend
-
-      - name: Synchronise les dépendances sans dévier du verrou
-        run: uv sync --all-groups --frozen
-        working-directory: apps/backend
-
-      - name: Vérifie le formatage
-        run: uv run ruff format --check .
-        working-directory: apps/backend
-
-      - name: Analyse statique
-        run: uv run ruff check --output-format=github .
-        working-directory: apps/backend
-
-      - name: Typage
-        run: uv run mypy app
-        working-directory: apps/backend
-
-
-  test-back:
-    needs: build-back
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-          cache-dependency-glob: apps/backend/uv.lock
-
-      - name : Lancement des tests et génénration du rapport de couverture (Back)
-        run: uv run pytest --cov-fail-under=85 --cov-report=xml
-        working-directory: apps/backend
-
-      - name: Upload coverage
-        uses: actions/upload-artifact@v4
-        with:
-          name: backend-coverage
-          path: apps/backend/coverage.xml
-
-  sonarqube:
-    needs: [build-front, build-back, test-front, test-back]
-    name: SonarQube
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Téléchargement du rapport de couverture (Front)
-        uses: actions/download-artifact@v4
-        with:
-          name: frontend-coverage
-          path: apps/frontend/coverage/frontend
-      - name: Téléchargement du rapport de couverture (Back)
-        uses: actions/download-artifact@v4
-        with:
-          name: backend-coverage
-          path: apps/backend
-      - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v8
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -22,6 +22,12 @@ apps/frontend/.angular/
 npm-debug.log*
 yarn-error.log*
 
+# Tests de bout en bout et de charge : rapports générés et identifiants des comptes de test
+playwright-report/
+blob-report/
+tests/e2e/.comptes.json
+tests/load/results/
+
 # Terraform
 .terraform/
 # .terraform.lock.hcl est versionne (pas ignore) pour figer les versions de provider entre contributeurs/CI
@@ -40,7 +46,6 @@ kubeconfig
 # Airflow
 etl/airflow/logs/
 airflow.db
-airflow-webserver.pid
 standalone_admin_password.txt
 
 # Environnement et secrets
@@ -55,8 +60,6 @@ secrets/
 data/raw/*
 !data/raw/.gitkeep
 *.sqlite3
-monitoring/grafana/data/
-monitoring/prometheus/data/
 
 # ML : jeu de donnees, modeles entraines et suivi MLflow local, tous generes/volumineux
 ml/data/
@@ -64,7 +67,15 @@ ml/models/*
 !ml/models/.gitkeep
 ml/mlruns/
 ml/mlartifacts/
-ml/mlflow.db
+ml/mlflow.db*
+ml/.env
+
+# Airflow : base sqlite locale generee par les tests d'integrite des DAGs (etl/airflow/tests)
+etl/airflow/tests/.airflow_home/
+
+# TLS : certificats du reverse proxy, générés par script ou par certbot
+infra/proxy/tls/*.pem
+infra/proxy/acme/
 
 # IDE et OS
 .idea/

Makefile

@@ -1,17 +1,94 @@
 BACKEND := apps/backend
 FRONTEND := apps/frontend
 ML := ml
+AIRFLOW := etl/airflow
+E2E := tests/e2e
+COMPOSE_PROD := docker compose -f docker-compose.yml -f docker-compose.prod.yml
+
+# Piège : sans `export`, une valeur passée en ligne de commande n'atteindrait pas docker compose.
+# PUBLIC_HOST retombe sur le `.env`, que make ne lit pas, puis sur la valeur de `.env.example`.
+PUBLIC_HOST ?= $(shell sed -n 's/^PUBLIC_HOST=//p' .env 2>/dev/null | tail -1)
+PUBLIC_HOST := $(or $(strip $(PUBLIC_HOST)),enervision.local)
+export PUBLIC_HOST
+ifdef ACME_EMAIL
+export ACME_EMAIL
+endif
+
+# Piege : make ne lit pas `.env`, que seul docker compose interpole. Les cibles hors conteneur
+# (ml-*, demo-data, db-wait) joignent la base par le port publie et ont besoin de ces valeurs.
+env-val = $(shell sed -n 's/^$(1)=//p' .env 2>/dev/null | tail -1)
+PG_USER := $(or $(strip $(call env-val,POSTGRES_USER)),enervision)
+PG_PASSWORD := $(or $(strip $(call env-val,POSTGRES_PASSWORD)),change_me)
+PG_DB := $(or $(strip $(call env-val,POSTGRES_DB)),enervision)
+PG_PORT := $(or $(strip $(call env-val,POSTGRES_PORT)),5433)
+ml-env-val = $(shell sed -n 's/^$(1)=//p' ml/.env 2>/dev/null | tail -1)
+ML_ENV_DB_PASSWORD := $(call ml-env-val,MLFLOW_DB_PASSWORD)
+AIRFLOW_PORT := $(or $(strip $(call env-val,AIRFLOW_PORT)),8080)
+MAILPIT_UI_PORT := $(or $(strip $(call env-val,MAILPIT_UI_PORT)),8025)
+ML_DATABASE_URL ?= postgresql+psycopg://$(PG_USER):$(PG_PASSWORD)@localhost:$(PG_PORT)/$(PG_DB)
+export ML_DATABASE_URL
+
+# Piege : la base des tests d'integration n'est pas la base de developpement. Ces tests ecrivent
+# et suppriment des lignes, et leurs fixtures refusent de demarrer ailleurs que sur
+# `enervision_test` (garde sur le nom, cf. ml/tests/conftest.py).
+PG_TEST_DB ?= enervision_test
+TEST_DATABASE_URL ?= postgresql+asyncpg://$(PG_USER):$(PG_PASSWORD)@localhost:$(PG_PORT)/$(PG_TEST_DB)
+ML_TEST_DATABASE_URL ?= postgresql+psycopg://$(PG_USER):$(PG_PASSWORD)@localhost:$(PG_PORT)/$(PG_TEST_DB)
+
+# Piege : ni make ni ces cibles ne lisent `.env` pour COMPOSE_PROFILES, que docker compose y lit
+# seul. `stack-up` le relit ici pour savoir s'il doit poser le role `supervision` apres migration.
+SUPERVISION := $(findstring monitoring,$(COMPOSE_PROFILES) $(call env-val,COMPOSE_PROFILES))
+SERVICES_SUPERVISION := prometheus alertmanager grafana postgres-exporter node-exporter cadvisor
+GRAFANA_PORT := $(or $(strip $(call env-val,GRAFANA_PORT)),3001)
+PROMETHEUS_PORT := $(or $(strip $(call env-val,PROMETHEUS_PORT)),9090)
+supervision-garde = for cle in APP_METRICS_TOKEN GRAFANA_ADMIN_PASSWORD SUPERVISION_DB_PASSWORD GARAGE_METRICS_TOKEN; do \
+		sed -n "s/^$$cle=//p" .env 2>/dev/null | tail -1 | grep -q . \
+			|| { echo "$$cle manquant dans .env, requis par la supervision (cf. .env.example)"; exit 1; }; \
+	done
+MONITORING := docker compose --profile monitoring
+
+# Piege : l'image Garage n'a pas de shell, elle ne peut pas porter sa garde comme grafana ou
+# airflow-init. Un secret vide ou laisse a change_me la ferait redemarrer en boucle (ADR 0019).
+CLES_GARAGE := GARAGE_RPC_SECRET GARAGE_ADMIN_TOKEN GARAGE_METRICS_TOKEN GARAGE_ACCESS_KEY GARAGE_SECRET_KEY GARAGE_SSE_KEY
+garage-garde = for cle in $(CLES_GARAGE); do \
+		sed -n "s/^$$cle=//p" .env 2>/dev/null | tail -1 | grep -qv '^change_me$$' \
+			|| { echo "$$cle manquant ou laisse a change_me dans .env, requis par Garage (cf. .env.example)"; exit 1; }; \
+	done
+PROMTOOL := $(MONITORING) run --rm --no-deps --entrypoint promtool prometheus
+
+# Piege : `e2e-prepare` ajoute trois sites `demo-*` et des comptes `test-*` a la base visee. Elle
+# vise la base de `make dev` ; ne jamais la lancer contre la recette ou la prod.
+E2E_COMPTES ?= $(CURDIR)/$(E2E)/.comptes.json
+E2E_API ?= http://localhost:$(or $(strip $(call env-val,BACKEND_PORT)),8000)
+
+# Piege : `run` ne demarre que k6, la stack doit deja tourner. `--user` fait ecrire les rapports
+# de tests/load/results avec l'uid du poste, pas celui de l'image (12345), qui n'y a pas acces.
+k6-run = mkdir -p tests/load/results && $(COMPOSE_PROD) --profile load run --rm \
+	--user "$$(id -u):$$(id -g)" -e K6_WEB_DASHBOARD=true \
+	-e K6_WEB_DASHBOARD_EXPORT=/results/$(1)-$$(date +%Y%m%dT%H%M%S).html \
+	k6 run /scripts/$(1).js
+
+# Le jeu historique s'arrete au 31/12/2024 : score et detection ancres a l'horloge reelle ne
+# verraient qu'un parc muet depuis des mois. Cf. `--now` de enervision_ml.score.
+DEMO_NOW ?= 2024-12-31T00:00:00Z
 
 .DEFAULT_GOAL := help
-.PHONY: help install install-backend install-frontend install-ml dev dev-backend dev-frontend \
-        lint format typecheck test test-cov test-integration check \
-        openapi docker-build db-up db-down db-reset db-logs db-psql migrate bootstrap-admin \
-        ml-lint ml-typecheck ml-test ml-check ml-train ml-score
+.PHONY: help install install-backend install-frontend install-ml install-airflow \
+        dev dev-backend dev-frontend \
+        lint format typecheck test test-cov test-integration ml-test-integration \
+        test-chaine check \
+        openapi docker-build db-up db-down db-reset db-logs db-psql db-wait db-ensure-airflow \
+        migrate migrate-test bootstrap-admin services-up demo-data demo-data-force \
+        ml-lint ml-typecheck ml-test ml-check ml-train ml-score mlflow-up detect-alerts recommendations \
+        airflow-lint airflow-test airflow-check airflow-up airflow-down airflow-logs \
+        tls-selfsigned tls-acme tls-renew tls-dns01 front-up stack-up stack-down stack-logs \
+        e2e-install e2e-prepare e2e load-smoke load-test load-stress load-limits \
+        db-ensure-supervision monitoring-up monitoring-down monitoring-logs monitoring-check
 
 help: ## Liste les cibles disponibles
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}'
+	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}'
 
-install: install-backend install-frontend install-ml ## Installe les dépendances backend, frontend et ML
+install: install-backend install-frontend install-ml install-airflow ## Installe les dépendances backend, frontend, ML et Airflow
 
 install-backend: ## Installe les dépendances du backend
 	cd $(BACKEND) && uv sync --all-groups
@@ -22,12 +99,23 @@ install-frontend: ## Installe les dépendances du frontend
 install-ml: ## Installe les dépendances du pipeline ML
 	cd $(ML) && uv sync --all-groups
 
-dev: ## Lance toute la stack (backend + frontend) en rechargement à chaud
+install-airflow: ## Installe les dépendances de lint/test des DAGs Airflow
+	cd $(AIRFLOW) && uv sync --all-groups
+
+dev: services-up migrate demo-data ## Lance toute la stack : base, Mailpit, Airflow, puis backend et frontend
+	@echo "airflow  -> http://localhost:$(AIRFLOW_PORT)  mailpit -> http://localhost:$(MAILPIT_UI_PORT)"
 	@trap 'kill 0' EXIT INT TERM; \
 	$(MAKE) --no-print-directory dev-backend & \
 	$(MAKE) --no-print-directory dev-frontend & \
 	wait
 
+services-up: ## Démarre les services conteneurisés dont `make dev` dépend (base, Mailpit, Garage, Airflow)
+	@$(garage-garde)
+	docker compose up -d db mailpit garage
+	@$(MAKE) --no-print-directory db-wait
+	@$(MAKE) --no-print-directory db-ensure-airflow
+	docker compose up -d airflow-init airflow-apiserver airflow-scheduler airflow-dag-processor
+
 dev-backend: ## Lance l'API seule en rechargement à chaud
 	@echo "backend  -> http://localhost:8000 (docs sur /docs)"
 	cd $(BACKEND) && uv run uvicorn app.main:create_app --factory --reload --host 0.0.0.0 --port 8000
@@ -71,15 +159,168 @@ ml-test: ## Exécute les tests du pipeline ML (donnees synthetiques, sans base n
 
 ml-check: ml-lint ml-typecheck ml-test ## Chaîne de vérification complète du pipeline ML
 
+# La cible surcharge ML_DATABASE_URL, que ce Makefile exporte vers la base de développement : la
+# garde du conftest ferait échouer la cible sans cette surcharge.
+ml-test-integration: ML_DATABASE_URL := $(ML_TEST_DATABASE_URL)
+ml-test-integration: ## Tests ML exigeant une base migrée. Faire `make db-up migrate-test` avant
+	cd $(ML) && uv run pytest -m integration --no-cov
+
+test-chaine: ## Chaîne ML -> DB -> API, vrais binaires. Exige les deux environnements uv
+	cd $(BACKEND) && DATABASE_URL=$(TEST_DATABASE_URL) ML_PYTHON=$(CURDIR)/$(ML)/.venv/bin/python \
+		uv run pytest -m chaine --no-cov
+
 ml-train: ## Entraine le modele LightGBM. CSV=chemin optionnel, sinon lit ML_DATABASE_URL
 	cd $(ML) && uv run python -m enervision_ml.train $(if $(CSV),--csv $(CSV),)
 
-ml-score: ## Score le prochain pas horaire et l'ecrit dans `prediction`. CSV=chemin optionnel
-	cd $(ML) && uv run python -m enervision_ml.score $(if $(CSV),--csv $(CSV),)
+ml-score: ## Score le prochain pas horaire et l'ecrit dans `prediction`. CSV= et NOW= optionnels
+	cd $(ML) && uv run python -m enervision_ml.score $(if $(CSV),--csv $(CSV),) $(if $(NOW),--now $(NOW),)
+
+mlflow-up: ## Démarre le serveur MLflow (tracking + registry) en conteneur. ml/.env requis
+	@test -n "$(strip $(ML_ENV_DB_PASSWORD))" \
+		|| { echo "MLFLOW_DB_PASSWORD absente de ml/.env (copier ml/.env.example)"; exit 1; }
+	@echo "$(ML_ENV_DB_PASSWORD)" | grep -qE '^[A-Za-z0-9]+$$' \
+		|| { echo "MLFLOW_DB_PASSWORD doit contenir uniquement lettres et chiffres (interpolee dans l'URI postgresql://)"; exit 1; }
+	cd $(ML) && docker compose -f docker-compose.mlflow.yml up -d --build
+	@echo "mlflow   -> http://localhost:5000"
+
+detect-alerts: ## Détecte les alertes internes depuis les lectures en base. SITE= et NOW= optionnels
+	cd $(BACKEND) && uv run python -m app.detection.internal_alerts $(if $(SITE),--site-id $(SITE),) $(if $(NOW),--now $(NOW),)
+
+recommendations: ## Genere les recommandations depuis les alertes en base. SITE=identifiant optionnel
+	cd $(BACKEND) && uv run python -m app.cli generate-recommendations $(if $(SITE),--site-id $(SITE),)
+
+airflow-lint: ## Analyse statique des DAGs Airflow
+	cd $(AIRFLOW) && uv run ruff check .
+
+airflow-test: ## Verifie que les DAGs s'importent sans erreur et ont la structure attendue
+	cd $(AIRFLOW) && uv run pytest
+
+airflow-check: airflow-lint airflow-test ## Chaîne de vérification complète des DAGs Airflow
+
+airflow-up: db-ensure-airflow ## Démarre Airflow (api-server + scheduler + dag-processor, LocalExecutor). db-up requis avant.
+	docker compose up -d airflow-init airflow-apiserver airflow-scheduler airflow-dag-processor
+	@echo "airflow  -> http://localhost:$${AIRFLOW_PORT:-8080}"
+
+airflow-down: ## Arrête l'api-server, le scheduler et le dag-processor Airflow
+	docker compose stop airflow-apiserver airflow-scheduler airflow-dag-processor
+
+airflow-logs: ## Suit les journaux du scheduler Airflow (où tournent les tâches, LocalExecutor)
+	docker compose logs -f airflow-scheduler
 
 docker-build: ## Construit l'image du backend
 	docker build -t enervision-backend:local $(BACKEND)
 
+tls-selfsigned: ## Génère le certificat de démonstration. PUBLIC_HOST=..., FORCE=1 pour écraser
+	./scripts/tls-selfsigned.sh $(if $(FORCE),--force,)
+
+# Piège : l'image backend ne migre pas au démarrage, et `/health/ready` ne teste que la connexion
+# et l'extension. Sans `alembic upgrade head`, la stack démarre verte sur une base sans schéma.
+stack-up: ## Démarre la stack derrière le reverse proxy, puis migre la base. PUBLIC_HOST=... au besoin
+	@test -f infra/proxy/tls/fullchain.pem \
+		|| { echo "Aucun certificat dans infra/proxy/tls. Lancer d'abord make tls-selfsigned"; exit 1; }
+	@openssl x509 -in infra/proxy/tls/fullchain.pem -noout -checkhost "$(PUBLIC_HOST)" >/dev/null \
+		|| { echo "Le certificat ne couvre pas $(PUBLIC_HOST). Relancer make tls-selfsigned PUBLIC_HOST=$(PUBLIC_HOST) FORCE=1"; exit 1; }
+	@$(if $(SUPERVISION),$(supervision-garde),true)
+	@$(garage-garde)
+	$(COMPOSE_PROD) up -d --build
+	$(COMPOSE_PROD) exec -T backend alembic upgrade head
+	@$(if $(SUPERVISION),$(MAKE) --no-print-directory db-ensure-supervision,true)
+
+stack-down: ## Arrête la stack complète en conservant les données
+	$(COMPOSE_PROD) stop
+
+stack-logs: ## Suit les journaux du reverse proxy
+	$(COMPOSE_PROD) logs -f proxy
+
+tls-acme: ## Demande un certificat Let's Encrypt. PUBLIC_HOST public et ACME_EMAIL requis
+	@test "$(PUBLIC_HOST)" != enervision.local \
+		|| { echo "PUBLIC_HOST doit être un domaine public résolvable, pas le nom de démonstration"; exit 1; }
+	$(COMPOSE_PROD) --profile acme run --rm certbot certonly --webroot -w /var/www/certbot \
+		-d $(PUBLIC_HOST) \
+		--email $${ACME_EMAIL:?ACME_EMAIL=... requis} \
+		--agree-tos --no-eff-email --deploy-hook /deploy-hook.sh
+	$(COMPOSE_PROD) exec proxy nginx -s reload
+
+tls-renew: ## Renouvelle les certificats Let's Encrypt et recharge le proxy
+	$(COMPOSE_PROD) --profile acme run --rm certbot renew --deploy-hook /deploy-hook.sh
+	$(COMPOSE_PROD) exec proxy nginx -s reload
+
+# Pourquoi : la VM n'a qu'une IP privée, que Let's Encrypt ne joint pas ; le défi DNS-01 passe
+# par l'API du fournisseur DNS, dynv6 par défaut (ADR 0018). Le jeton ne passe jamais par `argv`.
+ACME_SH := neilpang/acme.sh:3.1.6
+DNS01_API ?= dns_dynv6
+DNS01_JETON_VAR ?= DYNV6_TOKEN
+DNS01_JETON_FICHIER ?= $(abspath $(CURDIR)/../dns.token)
+acme-sh = docker run --rm --user "$$(id -u):$$(id -g)" -e $(DNS01_JETON_VAR) -e AUTO_UPGRADE=0 \
+	-v "$(CURDIR)/infra/proxy/acme:/acme.sh" -v "$(CURDIR)/infra/proxy/tls:/tls" $(ACME_SH)
+
+# acme.sh sort en 2 quand le certificat n'est pas à renouveler, et recopie le jeton dans
+# acme/account.conf, d'où le chmod. `--dnssleep` : Let's Encrypt valide depuis plusieurs réseaux.
+tls-dns01: ## Certificat Let's Encrypt par DNS-01, renouvelé seulement à échéance. Jeton : ../dns.token
+	@case "$(PUBLIC_HOST)" in *.local | localhost) echo "PUBLIC_HOST=$(PUBLIC_HOST) n'est pas un nom public"; exit 1 ;; esac
+	@test -r "$(DNS01_JETON_FICHIER)" || { echo "Jeton DNS illisible : $(DNS01_JETON_FICHIER)"; exit 1; }
+	@mkdir -p infra/proxy/acme && chmod 700 infra/proxy/acme
+	@$(DNS01_JETON_VAR)="$$(tr -d '[:space:]' < "$(DNS01_JETON_FICHIER)")"; export $(DNS01_JETON_VAR); \
+		$(acme-sh) --issue --server letsencrypt --dns $(DNS01_API) --dnssleep 90 -d "$(PUBLIC_HOST)"; \
+		code=$$?; chmod -R go-rwx infra/proxy/acme; [ $$code -eq 0 ] || [ $$code -eq 2 ] || exit $$code
+	@$(acme-sh) --install-cert --ecc -d "$(PUBLIC_HOST)" \
+		--fullchain-file /tls/fullchain.pem --key-file /tls/privkey.pem
+	@$(COMPOSE_PROD) exec -T proxy nginx -s reload 2>/dev/null \
+		|| echo "Proxy arrêté : il lira le certificat à son démarrage"
+
+front-up: ## Démarre ou recharge le frontal SNI de la VM, sur les ports 80 et 443 de l'hôte
+	docker compose -f infra/front/compose.yml up -d
+	docker compose -f infra/front/compose.yml exec -T front nginx -s reload
+
+e2e-install: ## Installe Playwright et Chromium pour les tests de bout en bout
+	cd $(E2E) && npm ci && npx playwright install chromium
+
+e2e-prepare: ## Sème le jeu de démonstration et crée les comptes de test sur la base de `make dev`
+	docker compose exec -T db psql -U $(PG_USER) -d $(PG_DB) -v ON_ERROR_STOP=1 < db/seeds/demo.sql
+	cd $(BACKEND) && BASE_URL=$(E2E_API) COMPTES_FICHIER=$(E2E_COMPTES) ADMIN_SUPPLEMENTAIRE=1 \
+		../../scripts/comptes-test.sh
+
+e2e: ## Joue les parcours Playwright. E2E_BASE_URL= optionnel (défaut http://localhost:4200)
+	cd $(E2E) && E2E_COMPTES=$(E2E_COMPTES) npx playwright test
+
+load-smoke: ## Tir k6 d'une minute. K6_EMAIL= et K6_PASSWORD= d'un lecteur, K6_BASE_URL= optionnel
+	$(call k6-run,smoke)
+
+load-test: ## Charge nominale k6, 50 utilisateurs pendant 8 minutes. Rapport HTML dans tests/load/results
+	$(call k6-run,charge)
+
+load-stress: ## Monte le débit jusqu'à la rupture de l'API. Sur la VM, la prod partage la machine
+	$(call k6-run,stress)
+
+load-limits: ## Vérifie par le proxy que nginx limite le débit d'une même adresse (429)
+	$(call k6-run,limitation-debit)
+
+# Piege : le mot de passe est lu dans `.env` par le shell et passe a psql sur son entree
+# standard. Developpe par make, il apparaitrait en clair dans la ligne de commande (`ps`).
+db-ensure-supervision: ## Crée ou réaligne le rôle `supervision`, en lecture seule, de Grafana et de l'exportateur
+	@mdp="$$(sed -n 's/^SUPERVISION_DB_PASSWORD=//p' .env 2>/dev/null | tail -1)"; \
+	[ -n "$$mdp" ] || { echo "SUPERVISION_DB_PASSWORD manquant dans .env"; exit 1; }; \
+	{ printf '\\set mot_de_passe %s\n' "$$mdp"; cat db/roles/supervision.sql; } \
+		| docker compose exec -T db psql -U $(PG_USER) -d $(PG_DB) -v ON_ERROR_STOP=1 -v base=$(PG_DB) -q
+
+monitoring-up: ## Démarre la supervision sur la stack en cours : Prometheus, Alertmanager, Grafana, exporteurs
+	@$(supervision-garde)
+	$(MONITORING) up -d --no-deps $(SERVICES_SUPERVISION)
+	@$(MAKE) --no-print-directory db-ensure-supervision
+	@echo "grafana -> http://localhost:$(GRAFANA_PORT)  prometheus -> http://localhost:$(PROMETHEUS_PORT)"
+
+monitoring-down: ## Arrête la supervision en conservant ses données
+	$(MONITORING) stop $(SERVICES_SUPERVISION)
+
+monitoring-logs: ## Suit les journaux de Prometheus, Alertmanager et Grafana
+	$(MONITORING) logs -f prometheus alertmanager grafana
+
+monitoring-check: ## Valide la configuration de supervision et joue les tests des règles d'alerte, comme la CI
+	$(PROMTOOL) check config /etc/prometheus/prometheus.yml
+	$(PROMTOOL) test rules /etc/prometheus/tests/enervision.test.yml
+	$(MONITORING) run --rm --no-deps --entrypoint amtool alertmanager check-config /etc/alertmanager/alertmanager.yml
+	@for tableau in monitoring/grafana/dashboards/*.json; do jq empty "$$tableau" || exit 1; done
+
 db-up: ## Démarre la base PostgreSQL TimescaleDB
 	docker compose up -d db
 
@@ -95,8 +336,39 @@ db-logs: ## Suit les journaux de la base
 db-psql: ## Ouvre une session psql sur la base applicative
 	docker compose exec db psql -U $${POSTGRES_USER:-enervision} -d $${POSTGRES_DB:-enervision}
 
+db-wait: ## Attend que la base accepte les connexions
+	@for _ in $$(seq 1 60); do \
+		docker compose exec -T db pg_isready -U $(PG_USER) -d $(PG_DB) >/dev/null 2>&1 && exit 0; \
+		sleep 1; \
+	done; \
+	echo "La base n'accepte toujours pas de connexion apres 60s"; exit 1
+
+# Piege : db/init ne rejoue qu'a la premiere initialisation du volume. Un `pgdata` cree avant
+# db/init/120-airflow-database.sql n'a pas de base `airflow`, et airflow-init boucle dessus.
+db-ensure-airflow: ## Crée la base de métadonnées Airflow si le volume pgdata est antérieur à db/init/120
+	@docker compose exec -T db psql -U $(PG_USER) -d postgres -tAc \
+		"SELECT 1 FROM pg_database WHERE datname = 'airflow'" | grep -q 1 \
+		|| docker compose exec -T db psql -U $(PG_USER) -d postgres -c "CREATE DATABASE airflow"
+
 migrate: ## Applique les migrations Alembic
 	cd $(BACKEND) && uv run alembic upgrade head
 
+migrate-test: ## Applique les migrations sur enervision_test, la base des tests d'intégration
+	cd $(BACKEND) && DATABASE_URL=$(TEST_DATABASE_URL) uv run alembic upgrade head
+
 bootstrap-admin: ## Crée le premier administrateur, mot de passe saisi au clavier
 	cd $(BACKEND) && uv run python -m app.cli create-admin --email $${EMAIL:?EMAIL=... requis}
+
+demo-data: ## Renseigne prédictions, alertes et recommandations si elles manquent. NOW= optionnel
+	@nombre=$$(docker compose exec -T db psql -U $(PG_USER) -d $(PG_DB) -tAc 'SELECT count(*) FROM alert') \
+		|| { echo "demo-data : base injoignable ou migrations non appliquees"; exit 1; }; \
+	if [ "$$nombre" = 0 ]; then \
+		$(MAKE) --no-print-directory demo-data-force; \
+	else \
+		echo "demo-data : $$nombre alerte(s) deja en base (make demo-data-force pour rejouer)"; \
+	fi
+
+demo-data-force: ## Rejoue le peuplement sans regarder l'existant. Les trois etapes sont idempotentes
+	$(MAKE) --no-print-directory ml-score NOW=$(DEMO_NOW)
+	$(MAKE) --no-print-directory detect-alerts NOW=$(DEMO_NOW)
+	$(MAKE) --no-print-directory recommendations

README.md

@@ -9,28 +9,34 @@ series temporelles energetiques, deployee sur une machine on-premise.
 |-------|----------------------------------------------------------|
 | J1    | Valider la préparation de l'environnement et du repo     |
 | J2    | Valider le périmètre retenu et les choix technologiques  |
-| J3    | Valider l'architecture et la gestion de la sécurité      |
-| J4    | Valider la robustesse et assurer les livrables           |
+| J3    | Ingestion & backend                                      |
+| J4    | Architecture, sécurité & frontend                        |
+| J5    | Valider la robustesse et assurer les livrables           |
+| J6    | Amélioration possible                                    |
 
 Ce que la documentation apporte à chacun : [docs/architecture/00-vue-ensemble.md](docs/architecture/00-vue-ensemble.md).
 
-## Stack cible
+## Stack
 
 | Domaine    | Technologie                         | Emplacement         | Etat          |
 |------------|-------------------------------------|---------------------|---------------|
-| Backend    | FastAPI, Python 3.14                | `apps/backend`      | Initialise    |
-| Frontend   | Angular 22, Node 24 LTS             | `apps/frontend`     | Tableau de bord |
-| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | Initialise    |
-| ETL        | Apache Airflow                      | `etl/airflow`       | A initialiser |
-| Infra      | Terraform (k3s single-node)         | `infra/terraform`   | Initialise    |
-| CI/CD      | GitHub Actions                      | `.github/workflows` | Backend en place |
-| Monitoring | Prometheus, Grafana, Alertmanager   | `monitoring`        | A initialiser |
-| ML         | LightGBM, MLflow                    | `ml`                | Entrainement initialise |
+| Backend    | FastAPI, Python 3.14                | `apps/backend`      | En place    |
+| Frontend   | Angular 22, Node 26                 | `apps/frontend`     | En place |
+| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | En place    |
+| ETL        | Apache Airflow                      | `etl/airflow`       | Sept DAGs     |
+| Infra      | Terraform (VM ENI ; module k3s)     | `infra/terraform`   | VM appliquée, k3s écrit non appliqué |
+| Reverse proxy | Nginx, TLS, frontal SNI          | `infra/proxy`, `infra/front` | En place, certificats Let's Encrypt |
+| CI/CD      | GitHub Actions                      | `.github/workflows` | En place |
+| Monitoring | Prometheus, Grafana, Alertmanager   | `monitoring`        | En place, profil Compose |
+| Stockage objet | Garage (S3), un par environnement | `infra/garage`      | En place, archives de `reading` |
+| Tests e2e et de charge | Playwright, k6              | `tests`             | En place |
+| ML         | LightGBM, MLflow                    | `ml`                | En place |
 
-Le backend, la base et l'infrastructure (Terraform/k3s) sont initialises a ce stade. Le frontend
-sert un tableau de bord sur `/dashboard`, dont les données proviennent de fixtures : les endpoints
-correspondants restent à écrire côté API. Les autres dossiers portent l'arborescence et un README
-de cadrage, leur contenu fait l'objet d'un ticket dedie.
+Toutes ces briques tournent sur la machine du groupe, en trois environnements (production,
+recette, dev). Le frontend sert le tableau de bord, les vues sites, recommandations et
+supervision des capteurs, toutes branchées sur l'API réelle : les fixtures sont coupées
+(`useMockFixtures: false`). Le module Terraform k3s reste une cible, écrite et validée, jamais
+appliquée.
 
 L'etat detaille de chaque brique et les vues d'architecture sont dans
 [docs/architecture](docs/architecture/README.md).
@@ -45,52 +51,91 @@ L'etat detaille de chaque brique et les vues d'architecture sont dans
 ├── db/
 │   ├── init/           Bootstrap PostgreSQL + TimescaleDB
 │   ├── migrations/     Migrations SQL versionnees
-│   └── seeds/          Jeux de donnees de reference
+│   ├── roles/          Roles PostgreSQL hors schema (supervision)
+│   └── seeds/          Jeu de demonstration des tests
 ├── etl/airflow/
-│   ├── dags/           DAGs d'ingestion et d'agregation
+│   ├── dags/           DAGs d'orchestration (pipeline ML, alertes, imports, dérive, rétention)
 │   ├── plugins/        Operateurs et hooks maison
 │   ├── include/        Requetes SQL et ressources des DAGs
 │   └── tests/          Tests d'integrite des DAGs
-├── infra/terraform/
-│   ├── modules/        Modules reutilisables
-│   └── environments/   Racines Terraform, une par environnement
+├── infra/
+│   ├── front/          Frontal SNI de la machine : ports 80 et 443, aiguillage par nom
+│   ├── garage/         Stockage objet S3 : configuration sans secret
+│   ├── proxy/          Reverse proxy Nginx : terminaison TLS et routage
+│   └── terraform/
+│       ├── modules/        Modules reutilisables
+│       └── environments/   Racines Terraform, une par environnement
 ├── ml/                 Pipeline d'entrainement LightGBM, suivi MLflow
 ├── monitoring/
 │   ├── prometheus/     Collecte et regles d'alerte
 │   ├── grafana/        Provisioning et dashboards
 │   └── alertmanager/   Routage des alertes
-├── docs/               ADR et vues d'architecture
+├── tests/
+│   ├── e2e/            Parcours Playwright contre la stack
+│   ├── garage/         Tests de fumée S3 joués par la CI contre Garage
+│   └── load/           Scenarios de charge k6
+├── docs/               ADR, vues d'architecture, runbook de pilotage, livrables de rendu
 └── scripts/            Outillage local
 ```
 
 ## Demarrage
 
-Prerequis : uv, Docker, Node 24 LTS (npm fourni). Le poste doit disposer de Python 3.14, que
+Prerequis : uv, Docker, Node 26 (version de la CI et de l'image frontend, npm fourni). Le poste doit disposer de Python 3.14, que
 `uv` installe seul.
 
 ```bash
 cp .env.example .env                               # variables de docker-compose
 cp apps/backend/.env.example apps/backend/.env     # variables du backend hors conteneur
 
-make db-up     # PostgreSQL + TimescaleDB, publie sur le port 5433
-make install   # dependances du backend et du frontend
-make migrate   # applique les migrations Alembic
-make dev       # backend sur http://localhost:8000 (docs sur /docs), frontend sur http://localhost:4200
+make install   # dependances du backend, du frontend, du ML et des DAGs
+make dev       # toute la stack, voir ci-dessous
 make check     # lint + typage + tests
 ```
 
+`make dev` enchaine tout : demarrage des services conteneurises (base sur le port 5433, Mailpit,
+Airflow), migrations Alembic, peuplement de demonstration si les alertes manquent, puis backend
+et frontend en rechargement a chaud sur le poste.
+
+| Service | Adresse |
+|---|---|
+| Backend | <http://localhost:8000> (documentation sur `/docs`) |
+| Frontend | <http://localhost:4200> |
+| Airflow | <http://localhost:8080> (`AIRFLOW_ADMIN_USERNAME` / `AIRFLOW_ADMIN_PASSWORD` du `.env`) |
+| Mailpit | <http://localhost:8025> |
+
+Le `.env` doit porter les cles Airflow avant le premier `make dev` : `AIRFLOW_FERNET_KEY`,
+`AIRFLOW_API_SECRET_KEY`, `AIRFLOW_JWT_SECRET`, `AIRFLOW_APP_SECRET_KEY` et
+`AIRFLOW_ADMIN_PASSWORD`. Sans elles `airflow-init` refuse de demarrer, et `airflow-apiserver`,
+`airflow-scheduler` et `airflow-dag-processor` avec lui. Il doit aussi porter les six clés
+`GARAGE_*` (rpc, jetons, clé S3, clé SSE-C) : `make services-up` refuse sinon de démarrer Garage,
+où le DAG `retention` archive les mesures anciennes ([ADR 0019](docs/adr/0019-stockage-objet-garage-et-cycle-de-vie-des-mesures.md)).
+
+Les cibles d'origine restent disponibles pour ne demarrer qu'une partie : `make db-up`,
+`make airflow-up`, `make dev-backend`, `make dev-frontend`.
+
 `make help` liste les cibles disponibles.
 
 Deux fichiers d'environnement, deux usages : `.env` a la racine alimente `docker-compose.yml`,
 `apps/backend/.env` alimente le backend lance sur le poste. Le port 5433 est publie plutot que
 5432, souvent deja pris par une autre base.
 
-La boucle de developpement est `make db-up` puis `make dev` : seule la base tourne en
-conteneur, le backend et le frontend tournent tous les deux sur le poste, lances ensemble par
-`make dev` (logs entrelaces dans le meme terminal, Ctrl+C arrete les deux). `make dev-backend`
-et `make dev-frontend` restent disponibles pour lancer un seul des deux. Le service `backend`
-du `docker-compose.yml` sert la stack complete et la recette, et n'embarque pas le source, donc
-toute modification y demande un `docker compose up -d --build backend`.
+Le backend et le frontend tournent sur le poste, lances ensemble par `make dev` (logs
+entrelaces dans le meme terminal, Ctrl+C arrete les deux) ; la base, Mailpit et Airflow tournent
+en conteneur. Le service `backend` du `docker-compose.yml` sert la stack complete et la recette,
+et n'embarque pas le source, donc toute modification y demande un
+`docker compose up -d --build backend`.
+
+### Donnees de demonstration
+
+Le jeu historique s'arrete au 31/12/2024. `make demo-data` renseigne les tables que les vues
+alertes, recommandations et previsions lisent, en ancrant le scoring et la detection a cette
+date (`DEMO_NOW`) plutot qu'a l'horloge reelle, qui ne verrait qu'un parc muet depuis des mois.
+La cible ne fait rien si des alertes existent deja ; `make demo-data-force` rejoue les trois
+etapes, toutes idempotentes en base.
+
+Un volume `pgdata` cree avant `db/init/120-airflow-database.sql` n'a pas de base `airflow` :
+`db/init` ne rejoue qu'a la premiere initialisation. `make db-ensure-airflow`, appelee par
+`make dev` et `make airflow-up`, la cree au besoin, sans detruire les donnees applicatives.
 
 Verifier que la base repond et que l'extension est chargee :
 
@@ -98,6 +143,45 @@ Verifier que la base repond et que l'extension est chargee :
 curl -s localhost:8000/api/v1/health/ready
 ```
 
+## Stack complète derrière le reverse proxy
+
+Pour servir l'application comme sur la machine cible, en HTTPS et sous une seule origine.
+L'overlay emploie `!override` et `!reset`, donc **Docker Compose 2.24.4 ou plus récent** :
+
+```bash
+make tls-selfsigned PUBLIC_HOST=enervision.local   # certificat de démonstration
+make stack-up PUBLIC_HOST=enervision.local         # nginx en 80/443, le reste sur 127.0.0.1
+```
+
+Le navigateur avertit d'un émetteur inconnu : sur le poste, le certificat est auto-signé. Sur la
+machine, les certificats viennent de Let's Encrypt par défi DNS-01
+([ADR 0018](docs/adr/0018-noms-publics-certificats-dns01-et-frontal-sni.md)). Routage, mode ACME et renouvellement dans
+[`infra/proxy/README.md`](infra/proxy/README.md) ; la décision et ses motifs dans
+[l'ADR 0007](docs/adr/0007-terminaison-tls-et-reverse-proxy-nginx.md).
+
+Sur la VM ENI, trois environnements cohabitent, production sur `main`, recette sur `dev`, et
+`dev` pour toute autre branche lancée à la main
+([ADR 0017](docs/adr/0017-environnement-dev-a-la-demande.md)), chacun dans son dossier et son
+projet Compose, derrière un frontal SNI commun : `scripts/provision-host.sh` les prépare, le
+workflow `deploy.yml` les redéploie par un runner auto-hébergé, une fois la CI du commit poussé
+verte ([ADR 0014](docs/adr/0014-pipeline-ci-unique-et-deploiement-conditionne.md)). Ports, noms
+d'hôte et garde-fous dans [`docs/architecture/10-infra.md`](docs/architecture/10-infra.md) et
+[l'ADR 0009](docs/adr/0009-deux-environnements-compose-sur-la-vm-eni.md).
+
+## Tests de bout en bout, charge et supervision
+
+| Besoin | Commandes | Détail |
+|---|---|---|
+| Parcours utilisateur (Playwright) | `make e2e-install`, puis `make e2e-prepare e2e` contre `make dev` | [`tests/e2e/README.md`](tests/e2e/README.md) |
+| Tir de charge (k6) | `make load-smoke`, `load-test`, `load-stress`, `load-limits` | [`tests/load/README.md`](tests/load/README.md) |
+| Supervision | `make monitoring-up`, Grafana sur <http://localhost:3001> | [`monitoring/README.md`](monitoring/README.md) |
+
+La CI joue les parcours, un tir de fumée et le contrôle de la limitation de débit à chaque PR
+qui touche l'application, contre la stack de prod derrière le proxy
+([ADR 0015](docs/adr/0015-tests-e2e-et-de-charge-contre-la-stack-compose.md)). La supervision
+est active en prod, à la demande ailleurs
+([ADR 0016](docs/adr/0016-supervision-en-profil-compose.md)).
+
 ## Conventions
 
 - Branches : `feat/`, `fix/`, `chore/`, `docs/`, `test/` suivi d'un libelle court.

apps/backend/Dockerfile

@@ -11,13 +11,14 @@ WORKDIR /app
 RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=type=bind,source=uv.lock,target=uv.lock \
     --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
-    uv sync --locked --no-install-project --no-dev
+    uv sync --locked --no-install-project --no-dev --no-build
 
+# Le projet lui-meme n'est pas installe (pas de second `uv sync`) : il tourne depuis /app, le
+# repertoire de travail, et rien ne lit ses metadonnees. L'installer imposerait de le construire
+# (backend hatchling), donc de retirer `--no-build` de l'etape ci-dessus, qui garantit que
+# l'installation des dependances n'execute aucun script de build (regle Sonar docker:S8541).
 COPY . /app
 
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
-
 
 FROM python:3.14-slim AS runtime
 

apps/backend/README.md

@@ -113,6 +113,7 @@ Le sens de dependance est unique : `endpoints` vers `services` vers `repositorie
 | `/api/v1/sites/{site_id}` | Décrit un site | `lecteur` |
 | `/api/v1/recommendations` | Liste les recommandations | `lecteur` |
 | `/api/v1/recommendations/{recommendation_id}` | Décrit une recommandation | `lecteur` |
+| `/api/v1/recommendations/generate` | Génère les recommandations depuis les alertes (POST) | `admin` |
 | `/metrics` | Métriques au format Prometheus | jeton si `APP_METRICS_TOKEN` |
 | `/docs`, `/openapi.json` | Documentation, fermée en `staging` et `prod` | public sinon |
 

apps/backend/alembic/versions/d3f1a2b7c904_rapports_de_derive.py

@@ -0,0 +1,81 @@
+"""rapports de derive du modele de prevision
+
+Revision ID: d3f1a2b7c904
+Revises: c0adab96238c
+Create Date: 2026-09-22 14:40:00.000000
+
+`site_id` est nullable, et c'est le coeur du schema : une ligne par site, plus une ligne
+globale tous sites confondus, que `NULL` designe. Un seul site qui derive est invisible dans
+une moyenne d'ensemble, et une derive d'ensemble sans rupture par site signale un changement
+de modele ou de saison, pas une panne.
+
+L'unicite passe par un index a `coalesce` et non par une `UniqueConstraint` : deux lignes
+globales successives ont toutes deux `site_id` a NULL, et NULL n'est egal a aucune valeur, pas
+meme a lui-meme. Meme forme que `uq_reading_source`.
+
+Les trois `CHECK` sont portees par la base, comme `ck_prediction_status` : un verdict sans
+motif, ou un statut inconnu, ne doit pas dependre de la vigilance de l'appelant.
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "d3f1a2b7c904"
+down_revision: str | Sequence[str] | None = "c0adab96238c"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "drift_report",
+        sa.Column("drift_report_id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column(
+            "computed_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column("site_id", sa.Text(), nullable=True),
+        sa.Column("window_start", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("window_end", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("reference_start", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("reference_end", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("n_observations", sa.Integer(), nullable=False),
+        sa.Column("mae", sa.Double(), nullable=True),
+        sa.Column("mape", sa.Double(), nullable=True),
+        sa.Column("bias", sa.Double(), nullable=True),
+        sa.Column("reference_mae", sa.Double(), nullable=True),
+        sa.Column("coverage_ratio", sa.Double(), nullable=True),
+        sa.Column("insufficient_data_ratio", sa.Double(), nullable=True),
+        sa.Column("model_references", postgresql.ARRAY(sa.Text()), nullable=False),
+        sa.Column("status", sa.Text(), nullable=False),
+        sa.Column("reason", sa.Text(), nullable=True),
+        sa.CheckConstraint(
+            "status IN ('stable', 'derive', 'indetermine')", name="ck_drift_report_status"
+        ),
+        sa.CheckConstraint(
+            "status = 'stable' OR reason IS NOT NULL", name="ck_drift_report_reason"
+        ),
+        sa.CheckConstraint("n_observations >= 0", name="ck_drift_report_observations"),
+        sa.ForeignKeyConstraint(
+            ["site_id"], ["site.site_id"], name="fk_drift_report_site", ondelete="RESTRICT"
+        ),
+        sa.PrimaryKeyConstraint("drift_report_id"),
+    )
+    op.create_index(
+        "ix_drift_report_site_computed", "drift_report", ["site_id", "computed_at"], unique=False
+    )
+    op.create_index(
+        "uq_drift_report_window",
+        "drift_report",
+        ["window_end", sa.literal_column("coalesce(site_id, '')")],
+        unique=True,
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("drift_report")

apps/backend/app/api/deps.py

@@ -24,6 +24,7 @@ from app.core.security import decode_access_token as decode_token
 from app.db.session import get_session
 from app.repositories.alert import AlertRepository
 from app.repositories.audit_log import AuditLogRepository
+from app.repositories.drift import DriftRepository
 from app.repositories.login_attempt import LoginAttemptRepository
 from app.repositories.password_reset_attempt import PasswordResetAttemptRepository
 from app.repositories.password_reset_token import PasswordResetTokenRepository
@@ -35,6 +36,7 @@ from app.repositories.site import SiteRepository
 from app.repositories.user import UserRepository
 from app.services.alert import AlertService
 from app.services.auth import AuthService, LoginPolicy, PasswordResetPolicy
+from app.services.drift import DriftService
 from app.services.prediction import PredictionService
 from app.services.reading import ReadingService
 from app.services.recommendation import RecommendationService
@@ -48,7 +50,9 @@ SettingsDep = Annotated[Settings, Depends(get_settings)]
 
 CODE_CHANGEMENT_REQUIS = "password_change_required"
 
-_porteur = HTTPBearer(auto_error=False, scheme_name="Jeton d'accès")
+# Nom ASCII : un outillage tiers (ZAP, cf. .github/workflows/dast.yml) peut mal analyser un nom
+# de schéma accentué dans le contrat OpenAPI. Piège vécu, pas anticipé.
+_porteur = HTTPBearer(auto_error=False, scheme_name="JetonAcces")
 CredentialsDep = Annotated[HTTPAuthorizationCredentials | None, Depends(_porteur)]
 
 
@@ -192,7 +196,11 @@ AlertServiceDep = Annotated[AlertService, Depends(get_alert_service)]
 
 
 def get_recommendation_service(session: SessionDep) -> RecommendationService:
-    return RecommendationService(recommendations=RecommendationRepository(session))
+    return RecommendationService(
+        recommendations=RecommendationRepository(session),
+        alerts=AlertRepository(session),
+        transaction=session,
+    )
 
 
 RecommendationServiceDep = Annotated[RecommendationService, Depends(get_recommendation_service)]
@@ -228,6 +236,13 @@ def get_prediction_service(session: SessionDep) -> PredictionService:
 PredictionServiceDep = Annotated[PredictionService, Depends(get_prediction_service)]
 
 
+def get_drift_service(session: SessionDep) -> DriftService:
+    return DriftService(DriftRepository(session))
+
+
+DriftServiceDep = Annotated[DriftService, Depends(get_drift_service)]
+
+
 async def get_current_principal(
     credentials: CredentialsDep,
     session: SessionDep,

apps/backend/app/api/middleware.py

@@ -16,6 +16,9 @@ EN_TETES: Final[dict[str, str]] = {
     "X-Content-Type-Options": "nosniff",
     "X-Frame-Options": "DENY",
     "Referrer-Policy": "no-referrer",
+    # same-origin : aucun client ne charge l'API en no-cors depuis une autre origine
+    # (proxy.conf.json en dev, reverse proxy nginx ensuite, cf. docs/architecture/20-backend.md).
+    "Cross-Origin-Resource-Policy": "same-origin",
 }
 
 PREFIXE_AUTHENTIFICATION: Final = "/auth"

apps/backend/app/api/openapi.py

@@ -63,7 +63,7 @@ TAGS: Final[list[dict[str, Any]]] = [
         "name": "recommendations",
         "description": (
             "Consultation des recommandations issues des alertes. Accessible à partir du rôle "
-            "`lecteur`."
+            "`lecteur`. Leur génération par le moteur de règles est réservée au rôle `admin`."
         ),
     },
     {
@@ -90,11 +90,21 @@ TAGS: Final[list[dict[str, Any]]] = [
             "de scoring (`ml/`) et simplement lue ici. Accessible à partir du rôle `lecteur`."
         ),
     },
+    {
+        "name": "monitoring",
+        "description": (
+            "Surveillance de la dérive du modèle : écart entre les prévisions déjà écrites et "
+            "les lectures réellement arrivées, par site et tous sites confondus. Réservé à "
+            "partir du rôle `operateur`, qui agit sur un pipeline dégradé."
+        ),
+    },
 ]
 
 cookie_de_rafraichissement = APIKeyCookie(
     name=REFRESH_COOKIE_DEFAUT,
-    scheme_name="Cookie de rafraîchissement",
+    # Nom ASCII : un outillage tiers (ZAP, cf. .github/workflows/dast.yml) peut mal analyser un
+    # nom de schéma accentué dans le contrat OpenAPI. Piège vécu, pas anticipé.
+    scheme_name="CookieRafraichissement",
     description=(
         "Cookie `HttpOnly` posé par `/auth/login` et tourné par `/auth/refresh`. Il prend le "
         "préfixe `__Secure-` dès que l'API tourne derrière TLS, et n'est émis que vers "
@@ -153,6 +163,17 @@ REPONSES_ADMIN: Final[Reponses] = {
     },
 }
 
+REPONSES_OPERATEUR: Final[Reponses] = {
+    **REPONSES_AUTHENTIFIEES,
+    403: {
+        "model": ErrorResponse,
+        "description": (
+            "Droits insuffisants, ou mot de passe provisoire à changer quand `detail` vaut "
+            "`password_change_required`."
+        ),
+    },
+}
+
 # `lecteur` est le rôle minimum : `require_role` n'y refuse jamais un 403 pour droits
 # insuffisants, seulement pour le mot de passe provisoire.
 REPONSES_LECTEUR: Final[Reponses] = {

apps/backend/app/api/v1/endpoints/monitoring.py

@@ -0,0 +1,20 @@
+from fastapi import APIRouter
+
+from app.api.deps import DriftServiceDep, OperateurDep
+from app.api.openapi import REPONSE_VALIDATION
+from app.schemas.drift import DriftReportResponse
+
+router = APIRouter()
+
+
+@router.get(
+    "/drift",
+    response_model=list[DriftReportResponse],
+    summary="Dernier rapport de dérive par site, plus la ligne globale",
+    responses=REPONSE_VALIDATION,
+)
+async def get_drift(
+    _: OperateurDep, service: DriftServiceDep, site_id: str | None = None
+) -> list[DriftReportResponse]:
+    rapports = await service.derniers(site_id=site_id)
+    return [DriftReportResponse.model_validate(rapport) for rapport in rapports]

apps/backend/app/api/v1/endpoints/recommendations.py

@@ -1,13 +1,18 @@
 from fastapi import APIRouter, HTTPException, status
 
-from app.api.deps import LecteurDep, RecommendationServiceDep
-from app.api.openapi import REPONSE_VALIDATION, Reponses
+from app.api.deps import AdminDep, LecteurDep, RecommendationServiceDep
+from app.api.openapi import REPONSE_VALIDATION, REPONSES_ADMIN, Reponses
 from app.schemas.errors import ErrorResponse
-from app.schemas.recommendation import RecommendationResponse
+from app.schemas.recommendation import (
+    RecommendationGenerationResponse,
+    RecommendationResponse,
+)
 from app.services.recommendation import RecommendationNotFoundError
 
 router = APIRouter()
 
+REPONSES_GENERATION: Reponses = {**REPONSES_ADMIN, **REPONSE_VALIDATION}
+
 REPONSES_INTROUVABLE: Reponses = {
     **REPONSE_VALIDATION,
     404: {"model": ErrorResponse, "description": "Aucune recommandation ne porte cet identifiant."},
@@ -38,3 +43,22 @@ async def get_recommendation(
             status_code=status.HTTP_404_NOT_FOUND, detail="Recommandation introuvable"
         ) from erreur
     return RecommendationResponse.model_validate(recommendation)
+
+
+@router.post(
+    "/generate",
+    response_model=RecommendationGenerationResponse,
+    summary="Génère les recommandations à partir des alertes",
+    responses=REPONSES_GENERATION,
+)
+async def generate_recommendations(
+    _: AdminDep,
+    service: RecommendationServiceDep,
+    site_id: str | None = None,
+) -> RecommendationGenerationResponse:
+    rapport = await service.generate(site_id=site_id)
+    return RecommendationGenerationResponse(
+        alerts_examined=rapport.alertes_examinees,
+        recommendations_created=rapport.recommandations_creees,
+        already_present=rapport.deja_presentes,
+    )

apps/backend/app/api/v1/router.py

@@ -1,10 +1,16 @@
 from fastapi import APIRouter
 
-from app.api.openapi import REPONSE_SERVEUR, REPONSES_ADMIN, REPONSES_LECTEUR
+from app.api.openapi import (
+    REPONSE_SERVEUR,
+    REPONSES_ADMIN,
+    REPONSES_LECTEUR,
+    REPONSES_OPERATEUR,
+)
 from app.api.v1.endpoints import (
     alerts,
     auth,
     health,
+    monitoring,
     predictions,
     readings,
     recommendations,
@@ -38,3 +44,6 @@ api_router.include_router(
 api_router.include_router(
     predictions.router, prefix="/predictions", tags=["predictions"], responses=REPONSES_LECTEUR
 )
+api_router.include_router(
+    monitoring.router, prefix="/monitoring", tags=["monitoring"], responses=REPONSES_OPERATEUR
+)

apps/backend/app/cli.py

@@ -22,8 +22,11 @@ from app.core.hashing import build_hasher
 from app.core.roles import Role
 from app.db.session import get_session_factory
 from app.main import create_app
+from app.repositories.alert import AlertRepository
+from app.repositories.recommendation import RecommendationRepository
 from app.repositories.user import UserRepository
 from app.schemas.auth import PASSWORD_MIN_LENGTH, SPECIAL_CHARACTERS, valide_complexite
+from app.services.recommendation import RecommendationService
 
 LONGUEUR_MOT_DE_PASSE_GENERE = 24
 CHEMIN_CONTRAT = Path(__file__).resolve().parent.parent / "openapi.json"
@@ -63,6 +66,22 @@ async def create_admin(
     )
 
 
+async def generate_recommendations(*, site_id: str | None) -> str:
+    async with get_session_factory()() as session:
+        service = RecommendationService(
+            recommendations=RecommendationRepository(session),
+            alerts=AlertRepository(session),
+            transaction=session,
+        )
+        rapport = await service.generate(site_id=site_id)
+
+    return (
+        f"{rapport.alertes_examinees} alerte(s) examinée(s), "
+        f"{rapport.recommandations_creees} recommandation(s) créée(s), "
+        f"{rapport.deja_presentes} déjà présente(s)"
+    )
+
+
 # Piège : le schéma ne doit dépendre ni du `.env` du poste ni des variables `APP_*`, sinon le
 # fichier versionné changerait de machine en machine et le test de dérive deviendrait un oracle
 # de configuration locale. Tout ce qui atteint le schéma est donc posé ici, `_env_file` compris.
@@ -109,6 +128,14 @@ def build_parser() -> argparse.ArgumentParser:
         "export-openapi", help="Écrit le contrat OpenAPI sur disque"
     )
     contrat.add_argument("--output", default=str(CHEMIN_CONTRAT))
+
+    recommandations = sous_commandes.add_parser(
+        "generate-recommendations",
+        help="Applique le moteur de règles aux alertes en base",
+    )
+    recommandations.add_argument(
+        "--site-id", default=None, help="Limite le traitement aux alertes d'un site"
+    )
     return parser
 
 
@@ -152,6 +179,10 @@ def main(argv: list[str] | None = None) -> int:
         print(export_openapi(Path(arguments.output)))
         return 0
 
+    if arguments.commande == "generate-recommendations":
+        print(asyncio.run(generate_recommendations(site_id=arguments.site_id)))
+        return 0
+
     mot_de_passe = read_password(generate=arguments.generate)
 
     succes, message = asyncio.run(

apps/backend/app/core/config.py

@@ -1,7 +1,7 @@
 from functools import lru_cache
 from typing import Literal, Self
 
-from pydantic import Field, SecretStr, model_validator
+from pydantic import Field, SecretStr, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 Environment = Literal["local", "dev", "staging", "prod"]
@@ -76,6 +76,29 @@ class Settings(BaseSettings):
     expose_api_docs: bool | None = None
     metrics_token: SecretStr | None = None
 
+    s3_endpoint_url: str | None = None
+    s3_region: str = "garage"
+    s3_access_key: str | None = None
+    s3_secret_key: SecretStr | None = None
+    s3_bucket: str | None = None
+    s3_sse_key: SecretStr | None = None
+    reading_retention_days: int = Field(default=1095, ge=30)
+
+    # Compose passe `APP_METRICS_TOKEN` et les réglages S3 vides quand rien n'est posé : vide vaut
+    # absent, sinon `/metrics` exigerait un `Bearer` sans valeur et l'archivage un endpoint vide.
+    @field_validator(
+        "metrics_token",
+        "s3_endpoint_url",
+        "s3_access_key",
+        "s3_secret_key",
+        "s3_bucket",
+        "s3_sse_key",
+        mode="before",
+    )
+    @classmethod
+    def _jeton_vide_vaut_absent(cls, valeur: object) -> object:
+        return None if valeur == "" else valeur
+
     @property
     def allowed_origins(self) -> list[str]:
         return [origin.strip() for origin in self.cors_origins.split(",") if origin.strip()]

apps/backend/app/etl/mock_api_import.py

@@ -1,315 +1,527 @@
-from __future__ import annotations
-
-import argparse
-import asyncio
-import json
-from datetime import datetime
-from typing import Any
-
-import httpx
-from sqlalchemy import text
-from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
-
-from app.core.config import get_settings
-
-SOURCE_HISTORY = "api_history"
-
-
-def create_mock_api_client() -> httpx.AsyncClient:
-    settings = get_settings()
-
-    if settings.mock_api_username is None or settings.mock_api_password is None:
-        raise ValueError("Les identifiants de l'API Mock ne sont pas configurés.")
-
-    return httpx.AsyncClient(
-        base_url=settings.mock_api_base_url.rstrip("/"),
-        auth=(
-            settings.mock_api_username,
-            settings.mock_api_password.get_secret_value(),
-        ),
-        timeout=settings.mock_api_timeout_seconds,
-    )
-
-
-async def fetch_sites(
-    client: httpx.AsyncClient,
-) -> list[dict[str, Any]]:
-    response = await client.get("/api/v1/sites")
-
-    response.raise_for_status()
-
-    payload = response.json()
-
-    if not isinstance(payload, list):
-        raise ValueError("La réponse /api/v1/sites doit être une liste.")
-
-    return payload
-
-
-async def upsert_sites(
-    connection: AsyncConnection,
-    sites: list[dict[str, Any]],
-) -> None:
-    if not sites:
-        return
-
-    await connection.execute(
-        text(
-            """
-            INSERT INTO site (
-                site_id,
-                site_type,
-                site_name,
-                location,
-                capacity_kw,
-                status
-            )
-            VALUES (
-                :site_id,
-                :site_type,
-                :site_name,
-                :location,
-                :capacity_kw,
-                :status
-            )
-            ON CONFLICT (site_id)
-            DO UPDATE SET
-                site_type = EXCLUDED.site_type,
-                site_name = EXCLUDED.site_name,
-                location = EXCLUDED.location,
-                capacity_kw = EXCLUDED.capacity_kw,
-                status = EXCLUDED.status
-            """
-        ),
-        sites,
-    )
-
-
-async def fetch_readings(
-    client: httpx.AsyncClient,
-    site_id: str,
-    start_time: datetime,
-    end_time: datetime,
-    limit: int = 1000,
-) -> list[dict[str, Any]]:
-    response = await client.get(
-        "/api/v1/readings",
-        params={
-            "site_id": site_id,
-            "start_time": start_time.isoformat(),
-            "end_time": end_time.isoformat(),
-            "limit": limit,
-        },
-    )
-
-    response.raise_for_status()
-
-    payload = response.json()
-
-    if not isinstance(payload, list):
-        raise ValueError("La réponse /api/v1/readings doit être une liste.")
-
-    return payload
-
-
-def build_reading_row(
-    reading: dict[str, Any],
-) -> dict[str, Any]:
-    timestamp = datetime.fromisoformat(reading["timestamp"].replace("Z", "+00:00"))
-    return {
-        "site_id": reading["site_id"],
-        "timestamp": timestamp,
-        "source": SOURCE_HISTORY,
-        "dataset_id": None,
-        "consumption_kw": reading.get("consumption_kw"),
-        "consumption_kwh": reading.get("consumption_kwh"),
-        "consumption_euros": None,
-        "voltage_v": reading.get("voltage_v"),
-        "current_a": reading.get("current_a"),
-        "power_factor": reading.get("power_factor"),
-        "temperature_celsius": reading.get("temperature_celsius"),
-        "humidity_percent": reading.get("humidity_percent"),
-        "solar_irradiance_wm2": None,
-        "is_working_hours": None,
-        "data_quality": reading.get("data_quality"),
-        "null_reasons": reading.get("null_reasons"),
-        "imputed_values": None,
-        "imputation_method": None,
-        "raw_data": json.dumps(
-            reading,
-            ensure_ascii=False,
-        ),
-    }
-
-
-READING_INSERT = text(
-    """
-    INSERT INTO reading (
-        site_id,
-        timestamp,
-        source,
-        dataset_id,
-        consumption_kw,
-        consumption_kwh,
-        consumption_euros,
-        voltage_v,
-        current_a,
-        power_factor,
-        temperature_celsius,
-        humidity_percent,
-        solar_irradiance_wm2,
-        is_working_hours,
-        data_quality,
-        null_reasons,
-        imputed_values,
-        imputation_method,
-        raw_data
-    )
-    VALUES (
-        :site_id,
-        :timestamp,
-        :source,
-        :dataset_id,
-        :consumption_kw,
-        :consumption_kwh,
-        :consumption_euros,
-        :voltage_v,
-        :current_a,
-        :power_factor,
-        :temperature_celsius,
-        :humidity_percent,
-        :solar_irradiance_wm2,
-        :is_working_hours,
-        :data_quality,
-        :null_reasons,
-        CAST(:imputed_values AS jsonb),
-        :imputation_method,
-        CAST(:raw_data AS jsonb)
-    )
-    ON CONFLICT DO NOTHING
-    """
-)
-
-
-def build_reading_batch(
-    readings: list[dict[str, Any]],
-) -> list[dict[str, Any]]:
-    return [build_reading_row(reading) for reading in readings]
-
-
-async def import_mock_api_history(
-    start_time: datetime,
-    end_time: datetime,
-    limit: int,
-    dry_run: bool,
-) -> None:
-    settings = get_settings()
-
-    async with create_mock_api_client() as client:
-        sites = await fetch_sites(client)
-
-        print(f"Sites récupérés : {len(sites)}")
-
-        all_readings: list[dict[str, Any]] = []
-
-        for site in sites:
-            site_id = site["site_id"]
-
-            readings = await fetch_readings(
-                client=client,
-                site_id=site_id,
-                start_time=start_time,
-                end_time=end_time,
-                limit=limit,
-            )
-
-            print(f"{site_id}: {len(readings)} lectures")
-
-            all_readings.extend(readings)
-
-    print(f"Lectures récupérées : {len(all_readings)}")
-
-    if dry_run:
-        print("Dry-run terminé : aucune donnée écrite.")
-        return
-
-    engine = create_async_engine(
-        str(settings.database_url),
-        pool_pre_ping=True,
-    )
-
-    try:
-        async with engine.begin() as connection:
-            await upsert_sites(
-                connection,
-                sites,
-            )
-
-            rows = build_reading_batch(all_readings)
-
-            if rows:
-                await connection.execute(
-                    READING_INSERT,
-                    rows,
-                )
-
-    finally:
-        await engine.dispose()
-
-    print("Import API Mock terminé.")
-
-
-def parse_datetime(value: str) -> datetime:
-    return datetime.fromisoformat(value.replace("Z", "+00:00"))
-
-
-def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description=("Import historique depuis l'API Mock EnerVision"))
-
-    parser.add_argument(
-        "--start-time",
-        required=True,
-        type=parse_datetime,
-    )
-
-    parser.add_argument(
-        "--end-time",
-        required=True,
-        type=parse_datetime,
-    )
-
-    parser.add_argument(
-        "--limit",
-        type=int,
-        default=1000,
-    )
-
-    parser.add_argument(
-        "--dry-run",
-        action="store_true",
-    )
-
-    return parser.parse_args()
-
-
-def main() -> None:
-    args = parse_args()
-
-    if args.limit < 1 or args.limit > 1000:
-        raise ValueError("--limit doit être compris entre 1 et 1000.")
-
-    if args.start_time >= args.end_time:
-        raise ValueError("--start-time doit être antérieur à --end-time.")
-
-    asyncio.run(
-        import_mock_api_history(
-            start_time=args.start_time,
-            end_time=args.end_time,
-            limit=args.limit,
-            dry_run=args.dry_run,
-        )
-    )
-
-
-if __name__ == "__main__":
-    main()
+# Contrainte : la réponse de l'API Mock est une entrée hostile, pas une source de confiance.
+# Voir OWASP API10 dans docs/architecture/owasp-traceabilite.md. Rien de ce qu'elle renvoie
+# n'atteint la base sans passer par build_site_row() ou build_reading_row() : seuls les champs
+# attendus sont recopiés, les grandeurs physiques sont bornées par PHYSICAL_BOUNDS, la taille des
+# tableaux est plafonnée par MAX_SITES et par limit_for_window() (dérivé de la fenêtre, jamais
+# fourni par l'appelant), et les lectures dont le timestamp déborde de la fenêtre demandée sont
+# écartées (fetch_readings). Une valeur hors bornes devient NULL et laisse sa trace dans
+# null_reasons plutôt que de lever : le mock émet des anomalies par construction, et raw_data
+# conserve de toute façon la réponse d'origine intacte.
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+from datetime import UTC, datetime
+from typing import Any
+
+import httpx
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
+
+from app.core.config import get_settings
+from app.etl.historical_import import SOURCE_NAME as SOURCE_CSV
+
+SOURCE_HISTORY = "api_history"
+
+MAX_SITES = 100
+
+MAX_LIMIT = 1000
+
+# Les quatre seules valeurs que la contrainte ck_reading_quality accepte.
+ACCEPTED_QUALITIES = frozenset({"good", "partial", "degraded", "critical"})
+
+PHYSICAL_BOUNDS: dict[str, tuple[float, float]] = {
+    "consumption_kw": (0.0, 100_000.0),
+    "consumption_kwh": (0.0, 100_000.0),
+    "voltage_v": (0.0, 1_000.0),
+    "current_a": (0.0, 10_000.0),
+    "power_factor": (0.0, 1.0),
+    "temperature_celsius": (-90.0, 60.0),
+    "humidity_percent": (0.0, 100.0),
+}
+
+CAPACITY_BOUNDS = (0.0, 100_000.0)
+
+
+def create_mock_api_client() -> httpx.AsyncClient:
+    settings = get_settings()
+
+    username = settings.mock_api_username
+    password = (
+        settings.mock_api_password.get_secret_value()
+        if settings.mock_api_password is not None
+        else None
+    )
+
+    if not username or not username.strip() or not password or not password.strip():
+        raise ValueError("Les identifiants de l'API Mock ne sont pas configurés.")
+
+    return httpx.AsyncClient(
+        base_url=settings.mock_api_base_url.rstrip("/"),
+        auth=(username, password),
+        timeout=settings.mock_api_timeout_seconds,
+    )
+
+
+def read_text(payload: dict[str, Any], key: str) -> str:
+    value = payload.get(key)
+
+    if not isinstance(value, str) or not value:
+        raise ValueError(f"Champ {key} absent ou invalide dans la réponse de l'API Mock.")
+
+    return value
+
+
+def optional_text(value: Any) -> str | None:
+    return value if isinstance(value, str) else None
+
+
+def coerce_measure(
+    value: Any,
+    bounds: tuple[float, float],
+) -> float | None:
+    if isinstance(value, bool) or not isinstance(value, int | float):
+        return None
+
+    lower, upper = bounds
+
+    # Écarte aussi NaN et les infinis, qu'aucune comparaison de bornes ne retient.
+    return float(value) if lower <= value <= upper else None
+
+
+def resolve_quality(
+    value: Any,
+    rejected: list[str],
+) -> str | None:
+    quality = value if isinstance(value, str) and value in ACCEPTED_QUALITIES else None
+
+    if rejected:
+        return "critical" if quality == "critical" else "degraded"
+
+    return quality
+
+
+def resolve_null_reasons(
+    value: Any,
+    rejected: list[str],
+) -> list[str]:
+    reported = [str(reason) for reason in value] if isinstance(value, list) else []
+
+    return reported + rejected
+
+
+async def fetch_sites(
+    client: httpx.AsyncClient,
+) -> list[dict[str, Any]]:
+    response = await client.get("/api/v1/sites")
+
+    response.raise_for_status()
+
+    payload = response.json()
+
+    if not isinstance(payload, list):
+        raise ValueError("La réponse /api/v1/sites doit être une liste.")
+
+    if len(payload) > MAX_SITES:
+        raise ValueError(f"La réponse /api/v1/sites dépasse le plafond de {MAX_SITES} sites.")
+
+    return payload
+
+
+def build_site_row(
+    site: dict[str, Any],
+) -> dict[str, Any]:
+    return {
+        "site_id": read_text(site, "site_id"),
+        "site_type": read_text(site, "site_type"),
+        "site_name": read_text(site, "site_name"),
+        "location": optional_text(site.get("location")),
+        "capacity_kw": coerce_measure(site.get("capacity_kw"), CAPACITY_BOUNDS),
+        "status": optional_text(site.get("status")),
+    }
+
+
+async def upsert_sites(
+    connection: AsyncConnection,
+    sites: list[dict[str, Any]],
+) -> None:
+    rows = [build_site_row(site) for site in sites]
+
+    if not rows:
+        return
+
+    await connection.execute(
+        text(
+            """
+            INSERT INTO site (
+                site_id,
+                site_type,
+                site_name,
+                location,
+                capacity_kw,
+                status
+            )
+            VALUES (
+                :site_id,
+                :site_type,
+                :site_name,
+                :location,
+                :capacity_kw,
+                :status
+            )
+            ON CONFLICT (site_id)
+            DO UPDATE SET
+                site_type = EXCLUDED.site_type,
+                site_name = EXCLUDED.site_name,
+                location = EXCLUDED.location,
+                capacity_kw = EXCLUDED.capacity_kw,
+                status = EXCLUDED.status
+            """
+        ),
+        rows,
+    )
+
+
+def _timestamp_in_window(reading: dict[str, Any], start_time: datetime, end_time: datetime) -> bool:
+    valeur = reading.get("timestamp")
+    if not isinstance(valeur, str):
+        return False
+
+    try:
+        instant = parse_datetime(valeur)
+    except ValueError:
+        return False
+
+    return start_time <= instant < end_time
+
+
+async def fetch_readings(
+    client: httpx.AsyncClient,
+    site_id: str,
+    start_time: datetime,
+    end_time: datetime,
+    limit: int = MAX_LIMIT,
+) -> list[dict[str, Any]]:
+    response = await client.get(
+        "/api/v1/readings",
+        params={
+            "site_id": site_id,
+            "start_time": start_time.isoformat(),
+            "end_time": end_time.isoformat(),
+            "limit": limit,
+        },
+    )
+
+    response.raise_for_status()
+
+    payload = response.json()
+
+    if not isinstance(payload, list):
+        raise ValueError("La réponse /api/v1/readings doit être une liste.")
+
+    if len(payload) > limit:
+        raise ValueError(f"La réponse /api/v1/readings dépasse la limite demandée de {limit}.")
+
+    # Le garde-fou `refuse_if_overlaps_historical_dataset` ne vérifie que la fenêtre demandée :
+    # une réponse (bug du mock, ou hostile) dont les `timestamp` débordent de
+    # `[start_time, end_time)` contournerait ce contrôle et écrirait exactement le doublon
+    # inter-source qu'il doit empêcher. Écarter ces lectures ici rend le contrôle par fenêtre
+    # suffisant.
+    dans_la_fenetre = [
+        lecture
+        for lecture in payload
+        if isinstance(lecture, dict) and _timestamp_in_window(lecture, start_time, end_time)
+    ]
+
+    if len(dans_la_fenetre) != len(payload):
+        ecartees = len(payload) - len(dans_la_fenetre)
+        print(f"{site_id}: {ecartees} lecture(s) hors fenêtre écartée(s).")
+
+    return dans_la_fenetre
+
+
+def build_reading_row(
+    reading: dict[str, Any],
+) -> dict[str, Any]:
+    measures: dict[str, float | None] = {}
+    rejected: list[str] = []
+
+    for name, bounds in PHYSICAL_BOUNDS.items():
+        received = reading.get(name)
+        measures[name] = coerce_measure(received, bounds)
+
+        if received is not None and measures[name] is None:
+            rejected.append(f"out_of_physical_bounds:{name}")
+
+    return {
+        "site_id": read_text(reading, "site_id"),
+        "timestamp": parse_datetime(read_text(reading, "timestamp")),
+        "source": SOURCE_HISTORY,
+        "dataset_id": None,
+        **measures,
+        "consumption_euros": None,
+        "solar_irradiance_wm2": None,
+        "is_working_hours": None,
+        "data_quality": resolve_quality(reading.get("data_quality"), rejected),
+        "null_reasons": resolve_null_reasons(reading.get("null_reasons"), rejected),
+        "imputed_values": None,
+        "imputation_method": None,
+        "raw_data": json.dumps(
+            reading,
+            ensure_ascii=False,
+        ),
+    }
+
+
+# `uq_reading_source` autorise deux lignes au même (site_id, timestamp) dès que `source` diffère :
+# sans ce garde-fou, importer une fenêtre déjà couverte par le dataset historique (source='csv')
+# dupliquerait silencieusement chaque point plutôt que de lever une erreur. Ce garde-fou protège
+# l'ingestion ; il ne dit rien de la lecture (`GET /readings` renvoie les deux lignes en cas de
+# doublon malgré tout, cf. la section réconciliation de 40-data.md).
+OVERLAP_CHECK = text(
+    "SELECT count(*) FROM reading WHERE source = :source_csv "
+    "AND timestamp >= :start_time AND timestamp < :end_time"
+)
+
+
+async def refuse_if_overlaps_historical_dataset(
+    connection: AsyncConnection,
+    start_time: datetime,
+    end_time: datetime,
+) -> None:
+    resultat = await connection.execute(
+        OVERLAP_CHECK,
+        {"source_csv": SOURCE_CSV, "start_time": start_time, "end_time": end_time},
+    )
+    nombre = resultat.scalar_one()
+
+    if nombre > 0:
+        raise ValueError(
+            f"La fenêtre [{start_time.isoformat()}, {end_time.isoformat()}) recouvre "
+            f"{nombre} lecture(s) déjà importée(s) du dataset historique (source='{SOURCE_CSV}') : "
+            "import refusé pour éviter un doublon inter-source."
+        )
+
+
+# Le conflit vise l'index unique uq_reading_source plutôt que la table entière : sans cible
+# nommée, DO NOTHING avalerait aussi une violation de clé primaire.
+READING_INSERT = text(
+    """
+    INSERT INTO reading (
+        site_id,
+        timestamp,
+        source,
+        dataset_id,
+        consumption_kw,
+        consumption_kwh,
+        consumption_euros,
+        voltage_v,
+        current_a,
+        power_factor,
+        temperature_celsius,
+        humidity_percent,
+        solar_irradiance_wm2,
+        is_working_hours,
+        data_quality,
+        null_reasons,
+        imputed_values,
+        imputation_method,
+        raw_data
+    )
+    VALUES (
+        :site_id,
+        :timestamp,
+        :source,
+        :dataset_id,
+        :consumption_kw,
+        :consumption_kwh,
+        :consumption_euros,
+        :voltage_v,
+        :current_a,
+        :power_factor,
+        :temperature_celsius,
+        :humidity_percent,
+        :solar_irradiance_wm2,
+        :is_working_hours,
+        :data_quality,
+        :null_reasons,
+        CAST(:imputed_values AS jsonb),
+        :imputation_method,
+        CAST(:raw_data AS jsonb)
+    )
+    ON CONFLICT (site_id, timestamp, source, (coalesce(dataset_id, 0)))
+    DO NOTHING
+    """
+)
+
+
+def build_reading_batch(
+    readings: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    return [build_reading_row(reading) for reading in readings]
+
+
+def limit_for_window(start_time: datetime, end_time: datetime) -> int:
+    """Nombre de lectures à demander pour que l'API Mock en rende une par heure, alignée.
+
+    L'API ne renvoie pas un flux à un rythme naturel : elle répartit exactement `limit` lectures,
+    espacées uniformément, sur toute la fenêtre `[start_time, end_time)` demandée, la première
+    au tout début de la fenêtre (vérifié empiriquement). Deux façons d'obtenir une lecture
+    alignée sur l'heure :
+
+    - une fenêtre d'exactement N heures (`start_time` sur l'heure) donne, avec `limit=N`, N
+      lectures espacées d'1h pile, la première à `start_time` : c'est le chemin du backfill
+      manuel (plusieurs jours d'historique en un seul appel).
+    - une fenêtre plus courte qu'une heure, ou qui n'est pas un multiple entier d'heure, ne peut
+      espacer plusieurs lectures d'1h pile (l'espacement de l'API vaut toujours
+      `durée / limit`) : seule `limit=1` reste alignée, la lecture unique atterrissant à
+      `start_time`. C'est le chemin du DAG horaire, dont la fenêtre part de l'heure pile qui
+      précède son déclenchement jusqu'à l'instant du déclenchement lui-même (`:45`), donc plus
+      courte qu'une heure.
+
+    Dans les deux cas, `start_time` doit tomber pile sur l'heure : c'est elle qui ancre
+    l'alignement, jamais `end_time`. Un `limit` plus grand que celui rendu ici fabriquerait des
+    lectures infra-horaires, incompatibles avec les lags positionnels de `build_features`.
+    """
+    if start_time.minute or start_time.second or start_time.microsecond:
+        raise ValueError(
+            f"La fenêtre doit démarrer pile sur l'heure : {start_time.isoformat()} ne l'est pas."
+        )
+
+    duree = end_time - start_time
+    heures, reste = divmod(duree.total_seconds(), 3600)
+
+    # Fenêtre plus courte qu'une heure, ou pas un multiple entier : aucun `limit` supérieur à 1
+    # n'espacerait ses lectures d'1h pile (l'espacement vaut toujours durée / limit). Seule la
+    # lecture unique, ancrée sur `start_time`, reste alignée.
+    limit = int(heures) if reste == 0 and heures >= 1 else 1
+
+    if limit > MAX_LIMIT:
+        raise ValueError(
+            f"La fenêtre demandée couvre {limit}h, au-delà du plafond de {MAX_LIMIT} "
+            "lectures accepté par l'API Mock."
+        )
+
+    return limit
+
+
+async def import_mock_api_history(
+    start_time: datetime,
+    end_time: datetime,
+    dry_run: bool,
+) -> None:
+    settings = get_settings()
+    limit = limit_for_window(start_time, end_time)
+
+    engine = create_async_engine(
+        str(settings.database_url),
+        pool_pre_ping=True,
+    )
+
+    try:
+        # Garde-fou d'abord, y compris en dry-run : il est en lecture seule, et annoncer un
+        # succès pour une fenêtre que l'import réel refusera serait trompeur.
+        async with engine.connect() as connection:
+            await refuse_if_overlaps_historical_dataset(connection, start_time, end_time)
+
+        async with create_mock_api_client() as client:
+            sites = await fetch_sites(client)
+
+            print(f"Sites récupérés : {len(sites)}")
+
+            all_readings: list[dict[str, Any]] = []
+
+            for site in sites:
+                site_id = read_text(site, "site_id")
+
+                readings = await fetch_readings(
+                    client=client,
+                    site_id=site_id,
+                    start_time=start_time,
+                    end_time=end_time,
+                    limit=limit,
+                )
+
+                print(f"{site_id}: {len(readings)} lectures")
+
+                all_readings.extend(readings)
+
+        print(f"Lectures récupérées : {len(all_readings)}")
+
+        if dry_run:
+            print("Dry-run terminé : aucune donnée écrite.")
+            return
+
+        async with engine.begin() as connection:
+            await upsert_sites(
+                connection,
+                sites,
+            )
+
+            rows = build_reading_batch(all_readings)
+
+            if rows:
+                await connection.execute(
+                    READING_INSERT,
+                    rows,
+                )
+
+    finally:
+        await engine.dispose()
+
+    print("Import API Mock terminé.")
+
+
+def parse_datetime(value: str) -> datetime:
+    # Sans fuseau, l'API le traite comme reçu, telle quelle, mais l'encodeur `timestamptz`
+    # d'asyncpg lirait un datetime naif dans le fuseau *local du processus* (correct dans le
+    # conteneur Airflow en UTC, décalé de 1-2h pour un import manuel lancé depuis un poste en
+    # Europe/Paris). Poser `tzinfo=UTC` explicitement, même pattern que `_vers_utc()` dans
+    # `app/services/reading.py`, garantit que la borne envoyée à l'API et celle comparée en SQL
+    # (refuse_if_overlaps_historical_dataset) désignent le même instant.
+    instant = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    return instant if instant.tzinfo is not None else instant.replace(tzinfo=UTC)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=("Import historique depuis l'API Mock EnerVision"))
+
+    parser.add_argument(
+        "--start-time",
+        required=True,
+        type=parse_datetime,
+    )
+
+    parser.add_argument(
+        "--end-time",
+        required=True,
+        type=parse_datetime,
+    )
+
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+    )
+
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+
+    if args.start_time >= args.end_time:
+        raise ValueError("--start-time doit être antérieur à --end-time.")
+
+    asyncio.run(
+        import_mock_api_history(
+            start_time=args.start_time,
+            end_time=args.end_time,
+            dry_run=args.dry_run,
+        )
+    )
+
+
+if __name__ == "__main__":
+    main()

apps/backend/app/etl/reading_retention.py

@@ -0,0 +1,349 @@
+# Pourquoi : la suppression n'est pas confiée à add_retention_policy, qui ignorerait l'export.
+# archive_reading_chunks() exporte chaque chunk vers Garage, le relit, puis le supprime seul.
+# Piège : drop_chunks pose un verrou exclusif sur reading, site et dataset jusqu'au COMMIT. La
+# suppression tient donc dans une transaction dédiée et courte, séparée de la lecture du chunk.
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import base64
+import hashlib
+import io
+import json
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+from typing import TYPE_CHECKING, Any
+
+import anyio.to_thread
+import boto3
+import pandas as pd
+from botocore.exceptions import ClientError
+from pydantic import SecretStr
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncConnection, AsyncEngine, create_async_engine
+
+from app.core.config import Settings, get_settings
+
+if TYPE_CHECKING:
+    from types_boto3_s3.client import S3Client
+
+SSE_KEY_LENGTH = 32
+FORMAT_BORNE = "%Y%m%dT%H%M%SZ"
+
+ELIGIBLE_CHUNKS = text(
+    "SELECT chunk_schema, chunk_name, range_start, range_end "
+    "FROM timescaledb_information.chunks "
+    "WHERE hypertable_name = 'reading' AND range_end <= :older_than "
+    "ORDER BY range_start"
+)
+
+# Lecture via l'hypertable, jamais la table interne : l'exclusion de partition vise le seul chunk.
+CHUNK_ROWS = text(
+    "SELECT * FROM reading WHERE timestamp >= :start AND timestamp < :end "
+    "ORDER BY timestamp, reading_id"
+)
+
+# Les deux bornes sont inclusives pour drop_chunks : celles du chunk le désignent, et lui seul.
+DROP_CHUNK = text(
+    "SELECT drop_chunks('reading', "
+    "older_than => CAST(:end AS timestamptz), newer_than => CAST(:start AS timestamptz))"
+)
+
+
+@dataclass(frozen=True)
+class Chunk:
+    schema: str
+    name: str
+    range_start: datetime
+    range_end: datetime
+
+    @property
+    def qualified_name(self) -> str:
+        return f"{self.schema}.{self.name}"
+
+
+@dataclass
+class Rapport:
+    chunks_vus: int = 0
+    exportes: int = 0
+    deja_presents: int = 0
+    supprimes: int = 0
+    lignes: int = 0
+
+
+def object_key(chunk: Chunk) -> str:
+    start = chunk.range_start.astimezone(UTC)
+    end = chunk.range_end.astimezone(UTC)
+    return (
+        f"reading/{start.year}/reading_{start.strftime(FORMAT_BORNE)}_"
+        f"{end.strftime(FORMAT_BORNE)}.csv.gz"
+    )
+
+
+async def eligible_chunks(conn: AsyncConnection, older_than: datetime) -> list[Chunk]:
+    result = await conn.execute(ELIGIBLE_CHUNKS, {"older_than": older_than})
+    return [
+        Chunk(
+            schema=row["chunk_schema"],
+            name=row["chunk_name"],
+            range_start=row["range_start"],
+            range_end=row["range_end"],
+        )
+        for row in result.mappings().all()
+    ]
+
+
+async def read_chunk_rows(conn: AsyncConnection, chunk: Chunk) -> list[dict[str, Any]]:
+    result = await conn.execute(CHUNK_ROWS, {"start": chunk.range_start, "end": chunk.range_end})
+    return [dict(row) for row in result.mappings().all()]
+
+
+def _csv_cell(value: object) -> object:
+    if isinstance(value, dict | list):
+        return json.dumps(value, ensure_ascii=False, sort_keys=True)
+    return value
+
+
+def serialize_csv_gzip(rows: list[dict[str, Any]]) -> bytes:
+    if not rows:
+        raise ValueError("Aucune ligne à sérialiser : un CSV sans colonne ne se relit pas.")
+
+    frame = pd.DataFrame([{name: _csv_cell(value) for name, value in row.items()} for row in rows])
+    buffer = io.BytesIO()
+    frame.to_csv(buffer, mode="wb", index=False, compression={"method": "gzip", "mtime": 0})
+    return buffer.getvalue()
+
+
+def sha256_of(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def _is_missing_object(erreur: ClientError) -> bool:
+    error = erreur.response.get("Error")
+    metadata = erreur.response.get("ResponseMetadata")
+    code = error.get("Code") if error is not None else None
+    status = metadata.get("HTTPStatusCode") if metadata is not None else None
+    return code == "NoSuchKey" or status == 404
+
+
+class ArchiveStore:
+    def __init__(self, client: S3Client, bucket: str, sse_key: bytes | None) -> None:
+        self._client = client
+        self._bucket = bucket
+        self._sse_key = sse_key
+
+    # boto3 encode lui-même la clé en base64 et calcule son MD5 : la fournir brute, sans MD5.
+    def _sse_headers(self) -> dict[str, Any]:
+        if self._sse_key is None:
+            return {}
+        return {"SSECustomerAlgorithm": "AES256", "SSECustomerKey": self._sse_key}
+
+    def put(self, key: str, body: bytes, metadata: dict[str, str]) -> None:
+        self._client.put_object(
+            Bucket=self._bucket,
+            Key=key,
+            Body=body,
+            ContentType="text/csv",
+            ContentEncoding="gzip",
+            Metadata=metadata,
+            **self._sse_headers(),
+        )
+
+    def fetch_sha256(self, key: str) -> str | None:
+        try:
+            response = self._client.get_object(Bucket=self._bucket, Key=key, **self._sse_headers())
+        except ClientError as erreur:
+            if _is_missing_object(erreur):
+                return None
+            raise
+        return sha256_of(response["Body"].read())
+
+
+def decode_sse_key(encoded: SecretStr | None) -> bytes | None:
+    if encoded is None:
+        return None
+
+    key = base64.b64decode(encoded.get_secret_value(), validate=True)
+    if len(key) != SSE_KEY_LENGTH:
+        raise ValueError(
+            f"APP_S3_SSE_KEY doit encoder exactement {SSE_KEY_LENGTH} octets en base64, "
+            f"pas {len(key)}."
+        )
+    return key
+
+
+def build_archive_store(settings: Settings) -> ArchiveStore:
+    endpoint = settings.s3_endpoint_url
+    access_key = settings.s3_access_key
+    secret_key = settings.s3_secret_key
+    bucket = settings.s3_bucket
+
+    if endpoint is None or access_key is None or secret_key is None or bucket is None:
+        raise ValueError(
+            "L'archivage vers Garage exige APP_S3_ENDPOINT_URL, APP_S3_ACCESS_KEY, "
+            "APP_S3_SECRET_KEY et APP_S3_BUCKET."
+        )
+
+    client = boto3.client(
+        "s3",
+        endpoint_url=endpoint,
+        aws_access_key_id=access_key,
+        aws_secret_access_key=secret_key.get_secret_value(),
+        region_name=settings.s3_region,
+    )
+    return ArchiveStore(client, bucket=bucket, sse_key=decode_sse_key(settings.s3_sse_key))
+
+
+async def drop_chunk(conn: AsyncConnection, chunk: Chunk) -> None:
+    result = await conn.execute(DROP_CHUNK, {"start": chunk.range_start, "end": chunk.range_end})
+    supprimes = list(result.scalars().all())
+
+    if supprimes != [chunk.qualified_name]:
+        raise RuntimeError(
+            f"drop_chunks devait supprimer exactement {chunk.qualified_name}, "
+            f"il a rendu {supprimes}."
+        )
+
+
+async def _export(
+    store: ArchiveStore,
+    key: str,
+    rows: list[dict[str, Any]],
+    *,
+    dry_run: bool,
+    rapport: Rapport,
+) -> str:
+    body = serialize_csv_gzip(rows)
+    sha = sha256_of(body)
+
+    if await anyio.to_thread.run_sync(store.fetch_sha256, key) == sha:
+        rapport.deja_presents += 1
+        return f"{len(body)} octets déjà présents"
+
+    if dry_run:
+        return f"{len(body)} octets à exporter"
+
+    metadata = {"sha256": sha, "rows": str(len(rows))}
+    await anyio.to_thread.run_sync(store.put, key, body, metadata)
+    relu = await anyio.to_thread.run_sync(store.fetch_sha256, key)
+
+    if relu != sha:
+        raise RuntimeError(
+            f"Relecture de {key} : sha256 {relu} au lieu de {sha}, le chunk est conservé."
+        )
+
+    rapport.exportes += 1
+    return f"{len(body)} octets exportés et relus"
+
+
+async def _archive_chunk(
+    engine: AsyncEngine,
+    store: ArchiveStore,
+    chunk: Chunk,
+    *,
+    dry_run: bool,
+    rapport: Rapport,
+) -> None:
+    async with engine.connect() as conn:
+        rows = await read_chunk_rows(conn, chunk)
+
+    key = object_key(chunk)
+    rapport.lignes += len(rows)
+
+    if rows:
+        action = await _export(store, key, rows, dry_run=dry_run, rapport=rapport)
+    else:
+        action = "vide, rien à exporter"
+
+    if dry_run:
+        print(f"{key} : {len(rows)} ligne(s), {action}, suppression simulée.")
+        return
+
+    async with engine.begin() as conn:
+        await drop_chunk(conn, chunk)
+
+    rapport.supprimes += 1
+    print(f"{key} : {len(rows)} ligne(s), {action}, chunk {chunk.qualified_name} supprimé.")
+
+
+async def archive_reading_chunks(
+    engine: AsyncEngine,
+    store: ArchiveStore,
+    *,
+    older_than: datetime,
+    dry_run: bool,
+) -> Rapport:
+    rapport = Rapport()
+
+    async with engine.connect() as conn:
+        chunks = await eligible_chunks(conn, older_than)
+
+    rapport.chunks_vus = len(chunks)
+    print(
+        f"{len(chunks)} chunk(s) de reading entièrement antérieur(s) au {older_than.isoformat()}."
+    )
+
+    for chunk in chunks:
+        await _archive_chunk(engine, store, chunk, dry_run=dry_run, rapport=rapport)
+
+    bilan = "Dry-run terminé : rien n'a été écrit ni supprimé." if dry_run else "Archivage terminé."
+    print(
+        f"{bilan} Chunks vus : {rapport.chunks_vus}, exportés : {rapport.exportes}, "
+        f"déjà présents : {rapport.deja_presents}, supprimés : {rapport.supprimes}, "
+        f"lignes : {rapport.lignes}."
+    )
+    return rapport
+
+
+async def _run(
+    settings: Settings,
+    store: ArchiveStore,
+    *,
+    older_than: datetime,
+    dry_run: bool,
+) -> Rapport:
+    engine = create_async_engine(str(settings.database_url), pool_pre_ping=True)
+    try:
+        return await archive_reading_chunks(engine, store, older_than=older_than, dry_run=dry_run)
+    finally:
+        await engine.dispose()
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="python -m app.etl.reading_retention",
+        description=(
+            "Exporte vers Garage puis supprime les chunks de reading entièrement plus vieux "
+            "que la borne de rétention."
+        ),
+    )
+    parser.add_argument(
+        "--older-than-days",
+        type=int,
+        default=None,
+        help="Borne en jours, par défaut APP_READING_RETENTION_DAYS.",
+    )
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Liste et mesure les chunks éligibles sans rien écrire ni supprimer.",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> None:
+    args = build_parser().parse_args(argv)
+    settings = get_settings()
+
+    jours = (
+        settings.reading_retention_days if args.older_than_days is None else args.older_than_days
+    )
+    older_than = datetime.now(UTC) - timedelta(days=jours)
+    store = build_archive_store(settings)
+
+    asyncio.run(_run(settings, store, older_than=older_than, dry_run=args.dry_run))
+
+
+if __name__ == "__main__":
+    main()

apps/backend/app/main.py

@@ -6,7 +6,8 @@ from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.openapi.docs import get_redoc_html, get_swagger_ui_html
 from fastapi.staticfiles import StaticFiles
-from prometheus_fastapi_instrumentator import Instrumentator
+from prometheus_client import CollectorRegistry, GCCollector, PlatformCollector, ProcessCollector
+from prometheus_fastapi_instrumentator import Instrumentator, metrics
 from starlette.requests import Request
 from starlette.responses import HTMLResponse
 
@@ -37,6 +38,16 @@ async def lifespan(_: FastAPI) -> AsyncIterator[None]:
     await get_engine().dispose()
 
 
+# Pourquoi : le registre global n'accepte chaque métrique qu'une fois. Toute application créée
+# après la première, dans les tests notamment, n'aurait rien mesuré.
+def _registre_de_metriques() -> CollectorRegistry:
+    registre = CollectorRegistry()
+    ProcessCollector(registry=registre)
+    PlatformCollector(registry=registre)
+    GCCollector(registry=registre)
+    return registre
+
+
 def create_app(settings: Settings | None = None) -> FastAPI:
     resolved = settings or get_settings()
     configure_logging(resolved)
@@ -102,7 +113,14 @@ def create_app(settings: Settings | None = None) -> FastAPI:
 
     register_error_handlers(application)
 
-    Instrumentator().instrument(application).expose(
+    # Les sondes de santé tombent toutes les 30 s : comptées, elles fausseraient latences et débit.
+    # Seaux fins autour du seuil de charge (p95 < 500 ms, ADR 0015), route par route.
+    registre = _registre_de_metriques()
+    Instrumentator(
+        excluded_handlers=["/metrics", f"{resolved.api_prefix}/health/.*"], registry=registre
+    ).add(
+        metrics.default(latency_lowr_buckets=(0.05, 0.1, 0.25, 0.5, 1, 2.5), registry=registre)
+    ).instrument(application).expose(
         application,
         endpoint="/metrics",
         include_in_schema=False,

apps/backend/app/models/__init__.py

@@ -2,7 +2,15 @@
 # --autogenerate`, qui générerait alors un drop de sa table.
 
 from app.models.audit_log import AuditLog
-from app.models.energy import Alert, Dataset, Prediction, Reading, Recommendation, Site
+from app.models.energy import (
+    Alert,
+    Dataset,
+    DriftReport,
+    Prediction,
+    Reading,
+    Recommendation,
+    Site,
+)
 from app.models.login_attempt import LoginAttempt
 from app.models.password_reset_attempt import PasswordResetAttempt
 from app.models.password_reset_token import PasswordResetToken
@@ -14,6 +22,7 @@ __all__ = [
     "AppUser",
     "AuditLog",
     "Dataset",
+    "DriftReport",
     "LoginAttempt",
     "PasswordResetAttempt",
     "PasswordResetToken",

apps/backend/app/models/energy.py

@@ -208,3 +208,49 @@ class Recommendation(Base):
     explanation: Mapped[str] = mapped_column(Text)
     rule_reference: Mapped[str] = mapped_column(Text)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+
+
+class DriftReport(Base):
+    __tablename__ = "drift_report"
+    __table_args__ = (
+        CheckConstraint(
+            "status IN ('stable', 'derive', 'indetermine')", name="ck_drift_report_status"
+        ),
+        CheckConstraint("status = 'stable' OR reason IS NOT NULL", name="ck_drift_report_reason"),
+        CheckConstraint("n_observations >= 0", name="ck_drift_report_observations"),
+        Index("ix_drift_report_site_computed", "site_id", "computed_at"),
+    )
+
+    drift_report_id: Mapped[int] = mapped_column(BigInteger, primary_key=True, autoincrement=True)
+    computed_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )
+    # `NULL` porte la ligne globale, tous sites confondus : une derive d'ensemble et la derive
+    # d'un seul site ne se lisent pas dans le meme chiffre.
+    site_id: Mapped[str | None] = mapped_column(
+        Text, ForeignKey("site.site_id", name="fk_drift_report_site", ondelete="RESTRICT")
+    )
+    window_start: Mapped[datetime] = mapped_column(DateTime(timezone=True))
+    window_end: Mapped[datetime] = mapped_column(DateTime(timezone=True))
+    reference_start: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    reference_end: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    n_observations: Mapped[int] = mapped_column(Integer)
+    mae: Mapped[float | None] = mapped_column(Double)
+    mape: Mapped[float | None] = mapped_column(Double)
+    bias: Mapped[float | None] = mapped_column(Double)
+    reference_mae: Mapped[float | None] = mapped_column(Double)
+    coverage_ratio: Mapped[float | None] = mapped_column(Double)
+    insufficient_data_ratio: Mapped[float | None] = mapped_column(Double)
+    model_references: Mapped[list[str]] = mapped_column(ARRAY(Text))
+    status: Mapped[str] = mapped_column(Text)
+    reason: Mapped[str | None] = mapped_column(Text)
+
+
+# Piège : une `UniqueConstraint` ne dédoublonnerait pas les lignes globales, dont `site_id` est
+# NULL et qu'aucune n'est égale à une autre. Même forme que `uq_reading_source`.
+Index(
+    "uq_drift_report_window",
+    DriftReport.window_end,
+    func.coalesce(DriftReport.site_id, text("''")),
+    unique=True,
+)

apps/backend/app/monitoring/drift.py

@@ -0,0 +1,115 @@
+# Surveillance de dérive du modèle de prévision (EC06, issue #45) : même gabarit que
+# `app.detection.internal_alerts`, ordonnancé par le DAG `derive`.
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import sys
+from datetime import UTC, datetime, timedelta
+
+from app.core.config import get_settings
+from app.db.session import get_session_factory
+from app.repositories.drift import DriftRepository, NouveauRapportDerive
+from app.services.drift import STATUT_DERIVE, DriftService, Seuils
+
+
+async def run_drift(
+    *, now: datetime | None = None, site_id: str | None = None, seuils: Seuils | None = None
+) -> list[NouveauRapportDerive]:
+    """Calcule les rapports de la fenêtre et les enregistre. Rend ce qui a été calculé, que la
+    ligne ait été écrite ou ignorée par l'index d'idempotence."""
+    async with get_session_factory()() as session:
+        depot = DriftRepository(session)
+        rapports = await DriftService(depot, seuils=seuils).evaluate(now=now, site_id=site_id)
+        await depot.enregistre(rapports)
+        await session.commit()
+    return rapports
+
+
+def _parse_instant(valeur: str) -> datetime:
+    instant = datetime.fromisoformat(valeur)
+    return instant if instant.tzinfo is not None else instant.replace(tzinfo=UTC)
+
+
+def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
+    defauts = Seuils()
+    parser = argparse.ArgumentParser(
+        prog="python -m app.monitoring.drift",
+        description="Surveillance de dérive du modèle de prévision EnerVision",
+    )
+    parser.add_argument("--site-id", default=None, help="Limite le calcul à un seul site.")
+    parser.add_argument(
+        "--now",
+        type=_parse_instant,
+        default=None,
+        help=(
+            "Instant de référence (ISO 8601, UTC si le fuseau est omis). Défaut : l'heure courante."
+        ),
+    )
+    parser.add_argument(
+        "--window-hours",
+        type=int,
+        default=int(defauts.fenetre.total_seconds() // 3600),
+        help="Durée de la fenêtre récente, et de la fenêtre de référence qui la précède.",
+    )
+    parser.add_argument(
+        "--grace-hours",
+        type=int,
+        default=int(defauts.grace.total_seconds() // 3600),
+        help="Délai laissé à l'ingestion avant qu'une prévision soit jugée vérifiable.",
+    )
+    parser.add_argument(
+        "--min-observations",
+        type=int,
+        default=defauts.min_observations,
+        help="En deçà, le verdict est `indetermine` plutôt qu'un chiffre trompeur.",
+    )
+    parser.add_argument(
+        "--bias-threshold",
+        type=float,
+        default=defauts.seuil_biais,
+        help=(
+            "Biais absolu en kWh au-delà duquel le verdict bascule en dérive. "
+            "Zéro, le défaut, laisse le biais informatif : voir l'ADR 0013."
+        ),
+    )
+    parser.add_argument(
+        "--fail-on-drift",
+        action="store_true",
+        help="Sort en code non nul si une dérive est constatée, pour que la tâche rougisse.",
+    )
+    return parser.parse_args(argv)
+
+
+def seuils_depuis(args: argparse.Namespace) -> Seuils:
+    return Seuils(
+        fenetre=timedelta(hours=args.window_hours),
+        grace=timedelta(hours=args.grace_hours),
+        min_observations=args.min_observations,
+        seuil_biais=args.bias_threshold,
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse_args(argv)
+    # Échoue tôt si `APP_SECRET_KEY`/`DATABASE_URL` manquent, avant toute requête à la base.
+    get_settings()
+    rapports = asyncio.run(
+        run_drift(now=args.now, site_id=args.site_id, seuils=seuils_depuis(args))
+    )
+
+    for rapport in rapports:
+        cible = rapport.site_id or "TOUS SITES"
+        mae = f"{rapport.mae:.2f}" if rapport.mae is not None else "-"
+        print(
+            f"{cible} : {rapport.status}, MAE {mae} kWh sur {rapport.n_observations} prévision(s)"
+            f"{' : ' + rapport.reason if rapport.reason else ''}"
+        )
+
+    derive = any(rapport.status == STATUT_DERIVE for rapport in rapports)
+    return 1 if derive and args.fail_on_drift else 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

apps/backend/app/repositories/alert.py

@@ -6,6 +6,10 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.energy import Alert
 
+# Douze colonnes par alerte, contre quatre pour une recommandation : le plafond asyncpg de
+# 32 767 parametres tombe a 2 730 lignes, d'ou un lot plus petit que `recommendation.py`.
+TAILLE_DE_LOT = 1000
+
 
 class AlertRepository:
     def __init__(self, session: AsyncSession) -> None:
@@ -44,12 +48,17 @@ class AlertRepository:
             }
             for alerte in alerts
         ]
-        requete = (
-            insert(Alert)
-            .values(valeurs)
-            .on_conflict_do_nothing(constraint="uq_alert_source_reference")
-            .returning(Alert)
-        )
-        resultat = await self._session.execute(requete)
+        creees: list[Alert] = []
+        # Piège : asyncpg plafonne une requête à 32 767 paramètres. Une détection sur une fenêtre
+        # chargée dépasse ce seuil, et l'`INSERT` d'un seul tenant échouerait.
+        for debut in range(0, len(valeurs), TAILLE_DE_LOT):
+            requete = (
+                insert(Alert)
+                .values(valeurs[debut : debut + TAILLE_DE_LOT])
+                .on_conflict_do_nothing(constraint="uq_alert_source_reference")
+                .returning(Alert)
+            )
+            resultat = await self._session.execute(requete)
+            creees.extend(resultat.scalars().all())
         await self._session.flush()
-        return resultat.scalars().all()
+        return creees

apps/backend/app/repositories/drift.py

@@ -0,0 +1,184 @@
+"""Piège : deux dédoublonnages, pas un - DriftRepository.paires()
+
+`prediction` n'a pas d'unicité sur `(site_id, target_at)` : chaque run de scoring empile une
+ligne de plus. `uq_reading_source` autorise de son côté deux lectures au même instant quand la
+`source` diffère. Joindre les deux tables sans `DISTINCT ON` des deux côtés compterait donc la
+même heure plusieurs fois, et la moyenne d'erreur pèserait ces sites en double.
+
+On retient la prédiction du run le plus récent, celle que sert `GET /api/v1/predictions`, avec
+`prediction_id` en départage : `created_at` vaut l'heure de début de transaction et ne
+distingue pas deux lignes du même run.
+"""
+
+from collections.abc import Sequence
+from dataclasses import asdict, dataclass
+from datetime import datetime
+
+from sqlalchemy import Subquery, func, select
+from sqlalchemy.dialects.postgresql import insert
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.energy import DriftReport, Prediction, Reading
+
+TARGET_METRIC = "consumption_kwh"
+STATUT_DISPONIBLE = "available"
+
+
+@dataclass(frozen=True, slots=True)
+class PaireDerive:
+    site_id: str
+    target_at: datetime
+    predicted_value: float
+    actual_value: float
+    model_reference: str
+
+
+@dataclass(frozen=True, slots=True)
+class NouveauRapportDerive:
+    site_id: str | None
+    window_start: datetime
+    window_end: datetime
+    reference_start: datetime | None
+    reference_end: datetime | None
+    n_observations: int
+    mae: float | None
+    mape: float | None
+    bias: float | None
+    reference_mae: float | None
+    coverage_ratio: float | None
+    insufficient_data_ratio: float | None
+    model_references: list[str]
+    status: str
+    reason: str | None
+
+
+@dataclass(frozen=True, slots=True)
+class ComptageStatut:
+    site_id: str
+    status: str
+    nombre: int
+
+
+def _predictions_retenues(*, debut: datetime, fin: datetime, site_id: str | None) -> Subquery:
+    requete = (
+        select(
+            Prediction.site_id,
+            Prediction.target_at,
+            Prediction.predicted_value,
+            Prediction.model_reference,
+            Prediction.status,
+        )
+        .distinct(Prediction.site_id, Prediction.target_at)
+        .where(
+            Prediction.target_metric == TARGET_METRIC,
+            Prediction.target_at >= debut,
+            Prediction.target_at < fin,
+        )
+        .order_by(Prediction.site_id, Prediction.target_at, Prediction.prediction_id.desc())
+    )
+    if site_id is not None:
+        requete = requete.where(Prediction.site_id == site_id)
+    return requete.subquery()
+
+
+def _lectures_retenues(*, debut: datetime, fin: datetime, site_id: str | None) -> Subquery:
+    requete = (
+        select(Reading.site_id, Reading.timestamp, Reading.consumption_kwh)
+        .distinct(Reading.site_id, Reading.timestamp)
+        .where(
+            Reading.timestamp >= debut,
+            Reading.timestamp < fin,
+            Reading.consumption_kwh.is_not(None),
+        )
+        .order_by(Reading.site_id, Reading.timestamp, Reading.reading_id.desc())
+    )
+    if site_id is not None:
+        requete = requete.where(Reading.site_id == site_id)
+    return requete.subquery()
+
+
+class DriftRepository:
+    def __init__(self, session: AsyncSession) -> None:
+        self._session = session
+
+    async def paires(
+        self, *, debut: datetime, fin: datetime, site_id: str | None = None
+    ) -> Sequence[PaireDerive]:
+        predictions = _predictions_retenues(debut=debut, fin=fin, site_id=site_id)
+        lectures = _lectures_retenues(debut=debut, fin=fin, site_id=site_id)
+        requete = (
+            select(
+                predictions.c.site_id,
+                predictions.c.target_at,
+                predictions.c.predicted_value,
+                lectures.c.consumption_kwh,
+                predictions.c.model_reference,
+            )
+            .select_from(predictions)
+            .join(
+                lectures,
+                (lectures.c.site_id == predictions.c.site_id)
+                & (lectures.c.timestamp == predictions.c.target_at),
+            )
+            .where(predictions.c.status == STATUT_DISPONIBLE)
+            .order_by(predictions.c.site_id, predictions.c.target_at)
+        )
+
+        lignes = await self._session.execute(requete)
+        return [
+            PaireDerive(
+                site_id=ligne[0],
+                target_at=ligne[1],
+                predicted_value=ligne[2],
+                actual_value=ligne[3],
+                model_reference=ligne[4],
+            )
+            for ligne in lignes
+        ]
+
+    async def comptages(
+        self, *, debut: datetime, fin: datetime, site_id: str | None = None
+    ) -> Sequence[ComptageStatut]:
+        predictions = _predictions_retenues(debut=debut, fin=fin, site_id=site_id)
+        requete = (
+            select(predictions.c.site_id, predictions.c.status, func.count())
+            .select_from(predictions)
+            .group_by(predictions.c.site_id, predictions.c.status)
+        )
+
+        lignes = await self._session.execute(requete)
+        return [
+            ComptageStatut(site_id=ligne[0], status=ligne[1], nombre=ligne[2]) for ligne in lignes
+        ]
+
+    # Pourquoi : l'idempotence est déléguée à `uq_drift_report_window` plutôt qu'à une lecture
+    # préalable, comme pour les recommandations. Rejouer la commande sur la même fenêtre ne
+    # duplique donc rien.
+    async def enregistre(self, rapports: Sequence[NouveauRapportDerive]) -> int:
+        if not rapports:
+            return 0
+
+        valeurs = [asdict(rapport) for rapport in rapports]
+        requete = (
+            insert(DriftReport)
+            .values(valeurs)
+            .on_conflict_do_nothing(
+                index_elements=[DriftReport.window_end, func.coalesce(DriftReport.site_id, "")]
+            )
+            .returning(DriftReport.drift_report_id)
+        )
+        return len((await self._session.scalars(requete)).all())
+
+    async def derniers(self, *, site_id: str | None = None) -> Sequence[DriftReport]:
+        requete = (
+            select(DriftReport)
+            .distinct(DriftReport.site_id)
+            .order_by(
+                DriftReport.site_id,
+                DriftReport.computed_at.desc(),
+                DriftReport.drift_report_id.desc(),
+            )
+        )
+        if site_id is not None:
+            requete = requete.where(DriftReport.site_id == site_id)
+        return (await self._session.scalars(requete)).all()

apps/backend/app/repositories/recommendation.py

@@ -1,11 +1,24 @@
 from collections.abc import Sequence
+from dataclasses import asdict, dataclass
 
 from sqlalchemy import select
+from sqlalchemy.dialects.postgresql import insert
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.energy import Recommendation
 
 
+@dataclass(frozen=True, slots=True)
+class NouvelleRecommandation:
+    alert_id: int
+    action: str
+    explanation: str
+    rule_reference: str
+
+
+TAILLE_DE_LOT = 1000
+
+
 class RecommendationRepository:
     def __init__(self, session: AsyncSession) -> None:
         self._session = session
@@ -20,3 +33,19 @@ class RecommendationRepository:
         )
         recommendation: Recommendation | None = await self._session.scalar(requete)
         return recommendation
+
+    # Pourquoi : l'idempotence est déléguée à `uq_recommendation_alert_rule` plutôt qu'à une
+    # lecture préalable, qui laisserait une fenêtre entre le contrôle et l'insertion.
+    async def create_missing(self, nouvelles: Sequence[NouvelleRecommandation]) -> int:
+        creees = 0
+        # Piège : asyncpg plafonne une requête à 32 767 paramètres, soit 8 191 lignes de quatre
+        # colonnes. Au-delà de ce seuil un `INSERT` d'un seul tenant échouerait.
+        for debut in range(0, len(nouvelles), TAILLE_DE_LOT):
+            requete = (
+                insert(Recommendation)
+                .values([asdict(nouvelle) for nouvelle in nouvelles[debut : debut + TAILLE_DE_LOT]])
+                .on_conflict_do_nothing(constraint="uq_recommendation_alert_rule")
+                .returning(Recommendation.recommendation_id)
+            )
+            creees += len((await self._session.scalars(requete)).all())
+        return creees

apps/backend/app/schemas/drift.py

@@ -0,0 +1,31 @@
+from datetime import datetime
+from enum import StrEnum
+
+from pydantic import BaseModel, ConfigDict
+
+
+class DriftStatus(StrEnum):
+    STABLE = "stable"
+    DERIVE = "derive"
+    INDETERMINE = "indetermine"
+
+
+class DriftReportResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    site_id: str | None
+    computed_at: datetime
+    window_start: datetime
+    window_end: datetime
+    reference_start: datetime | None
+    reference_end: datetime | None
+    n_observations: int
+    mae: float | None
+    mape: float | None
+    bias: float | None
+    reference_mae: float | None
+    coverage_ratio: float | None
+    insufficient_data_ratio: float | None
+    model_references: list[str]
+    status: DriftStatus
+    reason: str | None

apps/backend/app/schemas/recommendation.py

@@ -12,3 +12,9 @@ class RecommendationResponse(BaseModel):
     explanation: str
     rule_reference: str
     created_at: datetime
+
+
+class RecommendationGenerationResponse(BaseModel):
+    alerts_examined: int
+    recommendations_created: int
+    already_present: int

apps/backend/app/services/drift.py

@@ -0,0 +1,233 @@
+"""Contrainte : la dérive se mesure sur ce qui a déjà eu lieu - DriftService.evaluate()
+
+Une prévision ne devient vérifiable que quand la lecture de son instant cible est ingérée. La
+fenêtre est donc fermée à droite par un délai de grâce : sans lui, la dernière heure ferait
+chuter le taux de couverture à chaque exécution, et le verdict dirait « dérive » alors que
+seule l'ingestion n'avait pas fini son tour.
+
+La comparaison se fait entre deux fenêtres vives de même durée, pas contre la métrique de
+référence du modèle journalisée à l'entraînement. Ce ne sont pas les mêmes grandeurs :
+l'entraînement mesure un backtest où la météo de l'heure cible est connue, le scoring prévoit
+une heure future dont la météo ne l'est pas. Les comparer classerait le modèle « en dérive »
+dès le premier jour, ce qui ne prouverait rien.
+"""
+
+from collections.abc import Sequence
+from dataclasses import dataclass, replace
+from datetime import UTC, datetime, timedelta
+
+from app.models.energy import DriftReport
+from app.repositories.drift import (
+    ComptageStatut,
+    DriftRepository,
+    NouveauRapportDerive,
+    PaireDerive,
+)
+
+STATUT_STABLE = "stable"
+STATUT_DERIVE = "derive"
+STATUT_INDETERMINE = "indetermine"
+
+STATUT_INSUFFISANT = "insufficient_data"
+STATUT_DISPONIBLE = "available"
+
+
+@dataclass(frozen=True, slots=True)
+class Seuils:
+    # 168 h, la saisonnalité hebdomadaire que le modèle apprend par son lag principal : une
+    # fenêtre plus courte comparerait un week-end à une semaine ouvrée.
+    fenetre: timedelta = timedelta(hours=168)
+    grace: timedelta = timedelta(hours=2)
+    min_observations: int = 24
+    ratio_derive: float = 1.25
+    mae_plancher: float = 0.0
+    # Un biais se compte en kWh, donc ne se transpose pas d'un site à l'autre : zéro le désactive,
+    # sans cesser de le mesurer. Réglé par `--bias-threshold`, arbitrage dans l'ADR 0013.
+    seuil_biais: float = 0.0
+    seuil_couverture: float = 0.8
+
+
+@dataclass(frozen=True, slots=True)
+class Metriques:
+    n_observations: int
+    mae: float | None
+    mape: float | None
+    bias: float | None
+    model_references: list[str]
+
+
+def mesure(paires: Sequence[PaireDerive]) -> Metriques:
+    if not paires:
+        return Metriques(n_observations=0, mae=None, mape=None, bias=None, model_references=[])
+
+    ecarts = [paire.predicted_value - paire.actual_value for paire in paires]
+    # Le MAPE diverge sur une consommation nulle : les sites à l'arrêt sortent de ce seul
+    # rapport, jamais des autres métriques.
+    ratios = [
+        abs(ecart / paire.actual_value)
+        for ecart, paire in zip(ecarts, paires, strict=True)
+        if paire.actual_value != 0
+    ]
+
+    return Metriques(
+        n_observations=len(paires),
+        mae=sum(abs(ecart) for ecart in ecarts) / len(ecarts),
+        mape=(sum(ratios) / len(ratios) * 100) if ratios else None,
+        bias=sum(ecarts) / len(ecarts),
+        model_references=sorted({paire.model_reference for paire in paires}),
+    )
+
+
+@dataclass(frozen=True, slots=True)
+class Verdict:
+    status: str
+    reason: str | None
+
+
+class DriftService:
+    def __init__(self, depot: DriftRepository, *, seuils: Seuils | None = None) -> None:
+        self._depot = depot
+        self._seuils = seuils or Seuils()
+
+    async def derniers(self, *, site_id: str | None = None) -> Sequence[DriftReport]:
+        """Ce que sert l'API : le dernier rapport de chaque site, plus la ligne globale."""
+        return await self._depot.derniers(site_id=site_id)
+
+    async def evaluate(
+        self, *, now: datetime | None = None, site_id: str | None = None
+    ) -> list[NouveauRapportDerive]:
+        """Une ligne par site, plus une ligne globale dont le `site_id` est nul."""
+        fin = (now or datetime.now(UTC)) - self._seuils.grace
+        debut = fin - self._seuils.fenetre
+        reference_fin = debut
+        reference_debut = reference_fin - self._seuils.fenetre
+
+        recentes = await self._depot.paires(debut=debut, fin=fin, site_id=site_id)
+        anciennes = await self._depot.paires(
+            debut=reference_debut, fin=reference_fin, site_id=site_id
+        )
+        comptages = await self._depot.comptages(debut=debut, fin=fin, site_id=site_id)
+
+        gabarit = NouveauRapportDerive(
+            site_id=None,
+            window_start=debut,
+            window_end=fin,
+            reference_start=reference_debut,
+            reference_end=reference_fin,
+            n_observations=0,
+            mae=None,
+            mape=None,
+            bias=None,
+            reference_mae=None,
+            coverage_ratio=None,
+            insufficient_data_ratio=None,
+            model_references=[],
+            status=STATUT_INDETERMINE,
+            reason=None,
+        )
+
+        rapports = [
+            self._rapport(
+                gabarit,
+                site=site,
+                recentes=[p for p in recentes if p.site_id == site],
+                anciennes=[p for p in anciennes if p.site_id == site],
+                comptages=[c for c in comptages if c.site_id == site],
+            )
+            for site in sorted(
+                {paire.site_id for paire in recentes} | {c.site_id for c in comptages}
+            )
+        ]
+        rapports.append(
+            self._rapport(
+                gabarit, site=None, recentes=recentes, anciennes=anciennes, comptages=comptages
+            )
+        )
+        return rapports
+
+    def _rapport(
+        self,
+        gabarit: NouveauRapportDerive,
+        *,
+        site: str | None,
+        recentes: Sequence[PaireDerive],
+        anciennes: Sequence[PaireDerive],
+        comptages: Sequence[ComptageStatut],
+    ) -> NouveauRapportDerive:
+        metriques = mesure(recentes)
+        reference = mesure(anciennes)
+        couverture = _couverture(len(recentes), comptages)
+        verdict = self._verdict(metriques, reference_mae=reference.mae, couverture=couverture)
+
+        return replace(
+            gabarit,
+            site_id=site,
+            n_observations=metriques.n_observations,
+            mae=metriques.mae,
+            mape=metriques.mape,
+            bias=metriques.bias,
+            reference_mae=reference.mae,
+            coverage_ratio=couverture,
+            insufficient_data_ratio=_part_insuffisante(comptages),
+            model_references=metriques.model_references,
+            status=verdict.status,
+            reason=verdict.reason,
+        )
+
+    def _verdict(
+        self, metriques: Metriques, *, reference_mae: float | None, couverture: float | None
+    ) -> Verdict:
+        seuils = self._seuils
+        if metriques.n_observations < seuils.min_observations:
+            return Verdict(
+                STATUT_INDETERMINE,
+                f"{metriques.n_observations} prévision(s) vérifiée(s) sur la fenêtre, "
+                f"minimum {seuils.min_observations}.",
+            )
+
+        if couverture is not None and couverture < seuils.seuil_couverture:
+            return Verdict(
+                STATUT_DERIVE,
+                f"Couverture de {couverture:.0%}, sous le seuil de {seuils.seuil_couverture:.0%} : "
+                "le pipeline, pas le modèle.",
+            )
+
+        plafond = _plafond(reference_mae, ratio=seuils.ratio_derive, plancher=seuils.mae_plancher)
+        if metriques.mae is not None and plafond is not None and metriques.mae > plafond:
+            return Verdict(
+                STATUT_DERIVE,
+                f"MAE de {metriques.mae:.2f} kWh au-delà de {plafond:.2f} kWh, "
+                "seuil dérivé de la fenêtre de référence.",
+            )
+
+        if (
+            seuils.seuil_biais > 0
+            and metriques.bias is not None
+            and abs(metriques.bias) > seuils.seuil_biais
+        ):
+            return Verdict(
+                STATUT_DERIVE,
+                f"Biais de {metriques.bias:+.2f} kWh : le modèle se trompe toujours du même côté.",
+            )
+
+        return Verdict(STATUT_STABLE, None)
+
+
+def _plafond(reference_mae: float | None, *, ratio: float, plancher: float) -> float | None:
+    if reference_mae is None:
+        return plancher or None
+    return max(plancher, reference_mae * ratio)
+
+
+def _couverture(apparie: int, comptages: Sequence[ComptageStatut]) -> float | None:
+    """Part des prévisions disponibles qui ont trouvé leur réalisé. Mesure l'ingestion et
+    l'ordonnancement, pas la qualité du modèle."""
+    disponibles = sum(c.nombre for c in comptages if c.status == STATUT_DISPONIBLE)
+    return apparie / disponibles if disponibles else None
+
+
+def _part_insuffisante(comptages: Sequence[ComptageStatut]) -> float | None:
+    total = sum(c.nombre for c in comptages)
+    if not total:
+        return None
+    return sum(c.nombre for c in comptages if c.status == STATUT_INSUFFISANT) / total

apps/backend/app/services/recommendation.py

@@ -1,7 +1,15 @@
 from collections.abc import Sequence
+from dataclasses import dataclass
+from typing import Protocol
 
 from app.models.energy import Recommendation
+from app.repositories.alert import AlertRepository
 from app.repositories.recommendation import RecommendationRepository
+from app.services.recommendation_rules import applique_les_regles
+
+
+class Transaction(Protocol):
+    async def commit(self) -> None: ...
 
 
 class RecommendationError(Exception):
@@ -12,9 +20,24 @@ class RecommendationNotFoundError(RecommendationError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class RapportGeneration:
+    alertes_examinees: int
+    recommandations_creees: int
+    deja_presentes: int
+
+
 class RecommendationService:
-    def __init__(self, *, recommendations: RecommendationRepository) -> None:
+    def __init__(
+        self,
+        *,
+        recommendations: RecommendationRepository,
+        alerts: AlertRepository,
+        transaction: Transaction,
+    ) -> None:
         self._recommendations = recommendations
+        self._alerts = alerts
+        self._transaction = transaction
 
     async def list_all(self) -> Sequence[Recommendation]:
         return await self._recommendations.list_all()
@@ -24,3 +47,16 @@ class RecommendationService:
         if recommendation is None:
             raise RecommendationNotFoundError(recommendation_id)
         return recommendation
+
+    async def generate(self, *, site_id: str | None = None) -> RapportGeneration:
+        alertes = await self._alerts.list_all(site_id=site_id)
+        nouvelles = [nouvelle for alerte in alertes for nouvelle in applique_les_regles(alerte)]
+
+        creees = await self._recommendations.create_missing(nouvelles)
+        await self._transaction.commit()
+
+        return RapportGeneration(
+            alertes_examinees=len(alertes),
+            recommandations_creees=creees,
+            deja_presentes=len(nouvelles) - creees,
+        )

apps/backend/app/services/recommendation_rules.py

@@ -0,0 +1,117 @@
+# Piège : `rule_reference` est la clé d'idempotence en base, portée par la contrainte
+# `uq_recommendation_alert_rule`. Renommer une référence déjà livrée ne remplace pas les
+# recommandations existantes, il en crée de nouvelles à côté. Une règle qui change de sens
+# prend donc une référence suffixée `-v2` - REGLES.
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Final
+
+from app.models.energy import Alert
+from app.repositories.recommendation import NouvelleRecommandation
+from app.schemas.alert import AlertSeverity, AlertType
+
+FACTEUR_DEPASSEMENT_MAJEUR: Final = 1.2
+POURCENTAGE_DEPASSEMENT_MAJEUR: Final = round((FACTEUR_DEPASSEMENT_MAJEUR - 1) * 100)
+
+
+@dataclass(frozen=True, slots=True)
+class Regle:
+    reference: str
+    action: str
+    declencheur: Callable[[Alert], bool]
+    motif: Callable[[Alert], str]
+
+
+def _du_type(attendu: AlertType) -> Callable[[Alert], bool]:
+    return lambda alerte: alerte.type == attendu
+
+
+def _de_severite(attendue: AlertSeverity) -> Callable[[Alert], bool]:
+    return lambda alerte: alerte.severity == attendue
+
+
+# Un seuil nul ou négatif rendrait le rapport `value / threshold` arbitraire : l'alerte ne
+# renseigne alors aucun dépassement exploitable, et la règle ne se déclenche pas.
+def _depasse_largement_le_seuil(alerte: Alert) -> bool:
+    if alerte.value is None or alerte.threshold is None or alerte.threshold <= 0:
+        return False
+    return alerte.value >= alerte.threshold * FACTEUR_DEPASSEMENT_MAJEUR
+
+
+REGLES: Final[tuple[Regle, ...]] = (
+    Regle(
+        reference="spike-delestage-v1",
+        action="Délester les équipements non prioritaires sur le créneau du pic",
+        declencheur=_du_type(AlertType.SPIKE),
+        motif=lambda alerte: f"Pic de consommation signalé sur le site {alerte.site_id}",
+    ),
+    Regle(
+        reference="threshold-reduction-v1",
+        action="Ramener la puissance appelée sous le seuil contractuel",
+        declencheur=_du_type(AlertType.THRESHOLD),
+        motif=lambda alerte: f"Seuil de consommation dépassé sur le site {alerte.site_id}",
+    ),
+    Regle(
+        reference="outage-secours-v1",
+        action="Basculer sur l'alimentation de secours et prévenir l'exploitant",
+        declencheur=_du_type(AlertType.OUTAGE),
+        motif=lambda alerte: (
+            f"Risque de surcharge ou de coupure imminente sur le site {alerte.site_id}"
+        ),
+    ),
+    Regle(
+        reference="sensor-maintenance-v1",
+        action="Planifier une intervention de maintenance sur le capteur",
+        declencheur=_du_type(AlertType.SENSOR),
+        motif=lambda alerte: (
+            f"Capteur défaillant sur le site {alerte.site_id}, les mesures ne sont plus fiables"
+        ),
+    ),
+    Regle(
+        reference="anomaly-verification-v1",
+        action="Confronter la mesure à la prévision et vérifier le paramétrage du site",
+        declencheur=_du_type(AlertType.ANOMALY),
+        motif=lambda alerte: (
+            f"Écart anormal entre la mesure et le comportement attendu du site {alerte.site_id}"
+        ),
+    ),
+    Regle(
+        reference="escalade-astreinte-v1",
+        action="Escalader à l'astreinte sous une heure",
+        declencheur=_de_severite(AlertSeverity.CRITICAL),
+        motif=lambda alerte: f"Alerte de sévérité critique sur le site {alerte.site_id}",
+    ),
+    Regle(
+        reference="contrat-puissance-v1",
+        action="Réévaluer la puissance souscrite au contrat",
+        declencheur=_depasse_largement_le_seuil,
+        motif=lambda alerte: (
+            f"Dépassement d'au moins {POURCENTAGE_DEPASSEMENT_MAJEUR} % du seuil "
+            f"sur le site {alerte.site_id}"
+        ),
+    ),
+)
+
+
+def applique_les_regles(alerte: Alert) -> list[NouvelleRecommandation]:
+    contexte = _contexte_de_mesure(alerte)
+    return [
+        NouvelleRecommandation(
+            alert_id=alerte.alert_id,
+            action=regle.action,
+            explanation=f"{regle.motif(alerte)}{contexte}.",
+            rule_reference=regle.reference,
+        )
+        for regle in REGLES
+        if regle.declencheur(alerte)
+    ]
+
+
+def _contexte_de_mesure(alerte: Alert) -> str:
+    if alerte.value is None:
+        return ""
+    grandeur = alerte.metric or "valeur"
+    if alerte.threshold is None:
+        return f" ({grandeur} mesurée à {alerte.value})"
+    return f" ({grandeur} mesurée à {alerte.value}, seuil {alerte.threshold})"

apps/backend/openapi.json

@@ -213,7 +213,7 @@
         },
         "security": [
           {
-            "Cookie de rafraîchissement": []
+            "CookieRafraichissement": []
           }
         ]
       }
@@ -252,7 +252,7 @@
         },
         "security": [
           {
-            "Cookie de rafraîchissement": []
+            "CookieRafraichissement": []
           }
         ]
       }
@@ -301,7 +301,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -347,7 +347,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -423,7 +423,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -673,7 +673,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       },
@@ -757,7 +757,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -771,7 +771,7 @@
         "operationId": "update_user_api_v1_users__user_id__patch",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -889,7 +889,7 @@
         "operationId": "reset_password_api_v1_users__user_id__password_reset_post",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1023,7 +1023,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -1037,7 +1037,7 @@
         "operationId": "get_site_api_v1_sites__site_id__get",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1124,7 +1124,7 @@
         "operationId": "get_current_api_v1_sites__site_id__current_get",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1211,7 +1211,7 @@
         "operationId": "list_alerts_api_v1_alerts_get",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1361,7 +1361,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -1375,7 +1375,7 @@
         "operationId": "get_recommendation_api_v1_recommendations__recommendation_id__get",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1453,6 +1453,90 @@
         }
       }
     },
+    "/api/v1/recommendations/generate": {
+      "post": {
+        "tags": [
+          "recommendations"
+        ],
+        "summary": "Génère les recommandations à partir des alertes",
+        "operationId": "generate_recommendations_api_v1_recommendations_generate_post",
+        "security": [
+          {
+            "JetonAcces": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "site_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Site Id"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RecommendationGenerationResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Erreur interne. `correlation` identifie la trace côté serveur, qui n'est pas renvoyée au client.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InternalErrorResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Jeton absent, illisible, périmé, ou rendu caduc par un changement de rôle ou une désactivation. L'en-tête `WWW-Authenticate` porte la cause dans `error=`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Droits insuffisants, ou mot de passe provisoire à changer quand `detail` vaut `password_change_required`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Corps invalide. Le détail nomme le champ fautif et le type d'erreur, jamais la valeur envoyée.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ValidationErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/v1/stats/summary": {
       "get": {
         "tags": [
@@ -1504,7 +1588,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -1518,7 +1602,7 @@
         "operationId": "list_readings_api_v1_readings_get",
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ],
         "parameters": [
@@ -1715,7 +1799,7 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
@@ -1771,10 +1855,98 @@
         },
         "security": [
           {
-            "Jeton d'accès": []
+            "JetonAcces": []
           }
         ]
       }
+    },
+    "/api/v1/monitoring/drift": {
+      "get": {
+        "tags": [
+          "monitoring"
+        ],
+        "summary": "Dernier rapport de dérive par site, plus la ligne globale",
+        "operationId": "get_drift_api_v1_monitoring_drift_get",
+        "security": [
+          {
+            "JetonAcces": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "site_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Site Id"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/DriftReportResponse"
+                  },
+                  "title": "Response Get Drift Api V1 Monitoring Drift Get"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Erreur interne. `correlation` identifie la trace côté serveur, qui n'est pas renvoyée au client.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/InternalErrorResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Jeton absent, illisible, périmé, ou rendu caduc par un changement de rôle ou une désactivation. L'en-tête `WWW-Authenticate` porte la cause dans `error=`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Droits insuffisants, ou mot de passe provisoire à changer quand `detail` vaut `password_change_required`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Corps invalide. Le détail nomme le champ fautif et le type d'erreur, jamais la valeur envoyée.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ValidationErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   "components": {
@@ -1893,6 +2065,180 @@
         ],
         "title": "AlertType"
       },
+      "DriftReportResponse": {
+        "properties": {
+          "site_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Site Id"
+          },
+          "computed_at": {
+            "type": "string",
+            "format": "date-time",
+            "title": "Computed At"
+          },
+          "window_start": {
+            "type": "string",
+            "format": "date-time",
+            "title": "Window Start"
+          },
+          "window_end": {
+            "type": "string",
+            "format": "date-time",
+            "title": "Window End"
+          },
+          "reference_start": {
+            "anyOf": [
+              {
+                "type": "string",
+                "format": "date-time"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reference Start"
+          },
+          "reference_end": {
+            "anyOf": [
+              {
+                "type": "string",
+                "format": "date-time"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reference End"
+          },
+          "n_observations": {
+            "type": "integer",
+            "title": "N Observations"
+          },
+          "mae": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mae"
+          },
+          "mape": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Mape"
+          },
+          "bias": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Bias"
+          },
+          "reference_mae": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reference Mae"
+          },
+          "coverage_ratio": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Coverage Ratio"
+          },
+          "insufficient_data_ratio": {
+            "anyOf": [
+              {
+                "type": "number"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Insufficient Data Ratio"
+          },
+          "model_references": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "title": "Model References"
+          },
+          "status": {
+            "$ref": "#/components/schemas/DriftStatus"
+          },
+          "reason": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Reason"
+          }
+        },
+        "type": "object",
+        "required": [
+          "site_id",
+          "computed_at",
+          "window_start",
+          "window_end",
+          "reference_start",
+          "reference_end",
+          "n_observations",
+          "mae",
+          "mape",
+          "bias",
+          "reference_mae",
+          "coverage_ratio",
+          "insufficient_data_ratio",
+          "model_references",
+          "status",
+          "reason"
+        ],
+        "title": "DriftReportResponse"
+      },
+      "DriftStatus": {
+        "type": "string",
+        "enum": [
+          "stable",
+          "derive",
+          "indetermine"
+        ],
+        "title": "DriftStatus"
+      },
       "ErrorResponse": {
         "properties": {
           "detail": {
@@ -2344,6 +2690,29 @@
         ],
         "title": "ReadingSource"
       },
+      "RecommendationGenerationResponse": {
+        "properties": {
+          "alerts_examined": {
+            "type": "integer",
+            "title": "Alerts Examined"
+          },
+          "recommendations_created": {
+            "type": "integer",
+            "title": "Recommendations Created"
+          },
+          "already_present": {
+            "type": "integer",
+            "title": "Already Present"
+          }
+        },
+        "type": "object",
+        "required": [
+          "alerts_examined",
+          "recommendations_created",
+          "already_present"
+        ],
+        "title": "RecommendationGenerationResponse"
+      },
       "RecommendationResponse": {
         "properties": {
           "recommendation_id": {
@@ -3118,13 +3487,13 @@
       }
     },
     "securitySchemes": {
-      "Cookie de rafraîchissement": {
+      "CookieRafraichissement": {
         "type": "apiKey",
         "description": "Cookie `HttpOnly` posé par `/auth/login` et tourné par `/auth/refresh`. Il prend le préfixe `__Secure-` dès que l'API tourne derrière TLS, et n'est émis que vers `/api/v1/auth`.",
         "in": "cookie",
         "name": "ev_refresh"
       },
-      "Jeton d'accès": {
+      "JetonAcces": {
         "type": "http",
         "scheme": "bearer"
       }
@@ -3153,7 +3522,7 @@
     },
     {
       "name": "recommendations",
-      "description": "Consultation des recommandations issues des alertes. Accessible à partir du rôle `lecteur`."
+      "description": "Consultation des recommandations issues des alertes. Accessible à partir du rôle `lecteur`. Leur génération par le moteur de règles est réservée au rôle `admin`."
     },
     {
       "name": "stats",
@@ -3170,6 +3539,10 @@
     {
       "name": "predictions",
       "description": "Dernière prévision de consommation par site, calculée hors ligne par le pipeline de scoring (`ml/`) et simplement lue ici. Accessible à partir du rôle `lecteur`."
+    },
+    {
+      "name": "monitoring",
+      "description": "Surveillance de la dérive du modèle : écart entre les prévisions déjà écrites et les lectures réellement arrivées, par site et tous sites confondus. Réservé à partir du rôle `operateur`, qui agit sur un pipeline dégradé."
     }
   ]
 }

apps/backend/pyproject.toml

@@ -19,6 +19,7 @@ dependencies = [
     "aiosmtplib>=5.1.3",
     "httpx>=0.28.1",
     "pandas>=3.0.5",
+    "boto3>=1.43.101",
 ]
 
 [dependency-groups]
@@ -29,6 +30,7 @@ dev = [
     "pytest-asyncio>=1.4.0",
     "pytest-cov>=7.1.0",
     "pandas-stubs>=3.0.5.260914",
+    "types-boto3[s3]>=1.43.101",
 ]
 
 [build-system]
@@ -87,8 +89,11 @@ disallow_untyped_defs = false
 testpaths = ["tests"]
 asyncio_mode = "auto"
 asyncio_default_fixture_loop_scope = "function"
-addopts = "-q --strict-markers -m 'not integration' --cov=app --cov-report=term-missing"
-markers = ["integration: requiert une base PostgreSQL joignable, hors `make test`"]
+addopts = "-q --strict-markers -m 'not integration and not chaine' --cov=app --cov-report=term-missing"
+markers = [
+    "integration: requiert une base PostgreSQL joignable, hors `make test`",
+    "chaine: requiert en plus l'environnement uv de ml/, hors `make test` et hors `-m integration`",
+]
 
 [tool.coverage.run]
 source = ["app"]

apps/backend/tests/api/acces.py

@@ -51,10 +51,12 @@ ROLE_MINIMUM: Final[dict[Route, Role]] = {
     ("GET", "/api/v1/alerts"): Role.LECTEUR,
     ("GET", "/api/v1/recommendations"): Role.LECTEUR,
     ("GET", "/api/v1/recommendations/{recommendation_id}"): Role.LECTEUR,
+    ("POST", "/api/v1/recommendations/generate"): Role.ADMIN,
     ("GET", "/api/v1/stats/summary"): Role.LECTEUR,
     ("GET", "/api/v1/readings"): Role.LECTEUR,
     ("GET", "/api/v1/predictions"): Role.LECTEUR,
     ("GET", "/api/v1/sensors/status"): Role.ADMIN,
+    ("GET", "/api/v1/monitoring/drift"): Role.OPERATEUR,
     ("GET", "/api/v1/users"): Role.ADMIN,
     ("POST", "/api/v1/users"): Role.ADMIN,
     ("PATCH", "/api/v1/users/{user_id}"): Role.ADMIN,

apps/backend/tests/api/conftest.py

@@ -0,0 +1,131 @@
+"""Piège : ces fixtures valident leurs écritures, contrairement à celles de tests/repositories.
+
+Un endpoint ouvre sa propre session par `get_session` : il ne verrait pas une ligne semée dans
+une transaction en cours. Lui passer la session de la fixture par `dependency_overrides`
+supprimerait justement ce que ces tests prouvent, et `RecommendationService.generate` valide de
+toute façon lui-même. L'isolation vient donc de la marque portée par chaque `site_id`, et le
+nettoyage est explicite, dans l'ordre imposé par les clés étrangères `RESTRICT`.
+
+Contrainte : toutes ces fixtures sont à portée fonction. `engine_per_test` vide le cache du
+moteur après chaque test ; une fixture de module verrait un moteur déjà fermé à son démontage,
+et ses lignes resteraient en base.
+"""
+
+from collections.abc import AsyncIterator, Callable, Iterator
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+import pytest
+from fastapi import FastAPI
+from sqlalchemy import delete, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.deps import get_current_principal
+from app.core.principal import Principal
+from app.core.roles import AccountKind, Role
+from app.db.session import get_session_factory
+from app.models.energy import Alert, Prediction, Reading, Recommendation, Site
+from tests.repositories.test_alert import creer_alerte
+from tests.repositories.test_prediction import creer_prediction
+from tests.repositories.test_reading import creer_lecture
+from tests.repositories.test_site import creer as creer_site
+
+INSTANT = datetime(2026, 9, 16, 12, 0, tzinfo=UTC)
+
+
+@dataclass(frozen=True)
+class JeuMetier:
+    """Identifiants seuls, jamais d'instance ORM : un attribut relu sur une session fermée
+    déclenche un `MissingGreenlet`."""
+
+    site_id: str
+    site_voisin: str
+    alert_id: int
+    prediction_id: int
+    instant: datetime
+
+
+async def _supprime(session: AsyncSession, sites: list[str]) -> None:
+    # La suppression des recommandations est inconditionnelle : `POST /generate` en cree hors du
+    # controle de la fixture, et `alert` les retient par une cle etrangere `RESTRICT`.
+    alertes = select(Alert.alert_id).where(Alert.site_id.in_(sites))
+    await session.execute(delete(Recommendation).where(Recommendation.alert_id.in_(alertes)))
+    await session.execute(delete(Alert).where(Alert.site_id.in_(sites)))
+    await session.execute(delete(Prediction).where(Prediction.site_id.in_(sites)))
+    await session.execute(delete(Reading).where(Reading.site_id.in_(sites)))
+    await session.execute(delete(Site).where(Site.site_id.in_(sites)))
+    await session.commit()
+
+
+@pytest.fixture
+def marque() -> str:
+    return uuid4().hex[:12]
+
+
+@pytest.fixture
+async def jeu_metier(marque: str) -> AsyncIterator[JeuMetier]:
+    """Un site instrumenté, un site voisin, trois lectures horaires, une prédiction, une alerte.
+
+    Le voisin existe pour que les tests de filtre prouvent qu'ils écartent quelque chose.
+    """
+    site_id = f"SITE-{marque}"
+    voisin = f"SITE-{marque}-VOISIN"
+
+    async with get_session_factory()() as session:
+        await creer_site(session, site_id=site_id, capacity_kw=100.0)
+        await creer_site(session, site_id=voisin, capacity_kw=100.0)
+        for decalage in range(3):
+            await creer_lecture(
+                session,
+                site_id=site_id,
+                timestamp=INSTANT - timedelta(hours=decalage),
+                consumption_kw=10.0 + decalage,
+            )
+        prediction = await creer_prediction(session, site_id=site_id, target_at=INSTANT)
+        alerte = await creer_alerte(session, site_id=site_id, timestamp=INSTANT)
+        jeu = JeuMetier(
+            site_id=site_id,
+            site_voisin=voisin,
+            alert_id=alerte.alert_id,
+            prediction_id=prediction.prediction_id,
+            instant=INSTANT,
+        )
+        await session.commit()
+
+    try:
+        yield jeu
+    finally:
+        async with get_session_factory()() as session:
+            await _supprime(session, [site_id, voisin])
+
+
+@pytest.fixture
+async def site_nu(marque: str) -> AsyncIterator[str]:
+    """Un site sans lecture ni prédiction : le cas que seul un vrai `LEFT JOIN` distingue."""
+    site_id = f"SITE-{marque}-NU"
+
+    async with get_session_factory()() as session:
+        await creer_site(session, site_id=site_id, capacity_kw=100.0)
+        await session.commit()
+
+    try:
+        yield site_id
+    finally:
+        async with get_session_factory()() as session:
+            await _supprime(session, [site_id])
+
+
+@pytest.fixture
+def principal_injecte(app: FastAPI) -> Iterator[Callable[[Role], None]]:
+    def installe(role: Role = Role.LECTEUR) -> None:
+        app.dependency_overrides[get_current_principal] = lambda: Principal(
+            id=uuid4(),
+            email="parcours@enervision.fr",
+            role=role,
+            kind=AccountKind.HUMAIN,
+            must_change_password=False,
+        )
+
+    yield installe
+    app.dependency_overrides.pop(get_current_principal, None)

apps/backend/tests/api/test_hardening.py

@@ -23,8 +23,9 @@ async def interroge(
         ("x-content-type-options", "nosniff"),
         ("x-frame-options", "DENY"),
         ("referrer-policy", "no-referrer"),
+        ("cross-origin-resource-policy", "same-origin"),
     ],
-    ids=["nosniff", "anti_iframe", "referrer"],
+    ids=["nosniff", "anti_iframe", "referrer", "corp"],
 )
 async def test_every_response_carries_the_security_headers(
     client: AsyncClient, entete: str, valeur: str
@@ -71,6 +72,20 @@ async def test_metrics_stay_open_when_no_token_is_configured(client: AsyncClient
     assert response.status_code == 200
 
 
+async def test_an_empty_metrics_token_means_no_token() -> None:
+    assert (await interroge({"metrics_token": ""}, "/metrics")).status_code == 200
+
+
+async def test_metrics_ignore_health_probes_but_count_business_routes(client: AsyncClient) -> None:
+    await client.get("/api/v1/health/live")
+    await client.get("/api/v1/sites")
+
+    exposition = (await client.get("/metrics")).text
+
+    assert 'handler="/api/v1/health/live"' not in exposition
+    assert 'handler="/api/v1/sites"' in exposition
+
+
 async def test_metrics_demand_the_token_once_one_is_configured() -> None:
     surcharges = {"metrics_token": "un-jeton-de-supervision-assez-long"}
 

apps/backend/tests/api/test_matrice_acces.py

@@ -227,24 +227,26 @@ async def test_a_real_token_reaches_exactly_the_routes_of_its_rank(
     assert ecarts == []
 
 
-# Contrainte : `operateur` n'ouvre aujourd'hui aucune route de plus que `lecteur`, faute d'écriture
-# métier dans l'API. Figer l'égalité rend la régression visible le jour où une route d'opérateur
-# arrive sans que `ROLE_MINIMUM` soit mis à jour.
+# Contrainte : les deux rangs ne se séparent que sur les routes que `ROLE_MINIMUM` réserve à
+# `operateur`. Une route d'opérateur ajoutée sans être classée fait diverger les statuts sans
+# qu'aucune entrée ne l'annonce, et une garde d'opérateur posée par erreur sur une route de
+# lecture fait diverger ce qui devait rester identique.
 @pytest.mark.integration
-async def test_the_operator_rank_opens_nothing_more_than_the_reader_rank(
+async def test_the_operator_rank_diverges_from_the_reader_rank_only_where_declared(
     comptes_par_role: dict[Role, str], client: AsyncClient
 ) -> None:
     lecteur = await authentifie(client, comptes_par_role[Role.LECTEUR])
     operateur = await authentifie(client, comptes_par_role[Role.OPERATEUR])
-    divergences: list[tuple[str, str]] = []
+    ecarts: list[tuple[str, str]] = []
 
-    for methode, chemin in ROLE_MINIMUM:
+    for (methode, chemin), minimum in ROLE_MINIMUM.items():
         cote_lecteur = await appelle(client, methode, chemin, headers=lecteur)
         cote_operateur = await appelle(client, methode, chemin, headers=operateur)
-        if cote_lecteur.status_code != cote_operateur.status_code:
-            divergences.append((methode, chemin))
+        diverge = cote_lecteur.status_code != cote_operateur.status_code
+        if diverge is not (minimum is Role.OPERATEUR):
+            ecarts.append((methode, chemin))
 
-    assert divergences == []
+    assert ecarts == []
 
 
 # Piège : `/auth/logout-all` prend un `CurrentPrincipalDep` nu, donc elle échappe au gate

apps/backend/tests/api/test_monitoring.py

@@ -0,0 +1,99 @@
+from collections.abc import Iterator, Sequence
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+import pytest
+from fastapi import FastAPI
+from httpx import AsyncClient
+
+from app.api.deps import get_current_principal, get_drift_service
+from app.core.principal import Principal
+from app.core.roles import AccountKind, Role
+from app.models.energy import DriftReport
+
+INSTANT = datetime(2026, 9, 22, 12, tzinfo=UTC)
+
+
+def operateur() -> Principal:
+    return Principal(
+        id=uuid4(),
+        email="operateur@enervision.fr",
+        role=Role.OPERATEUR,
+        kind=AccountKind.HUMAIN,
+        must_change_password=False,
+    )
+
+
+def rapport(*, site_id: str | None) -> DriftReport:
+    return DriftReport(
+        drift_report_id=1,
+        computed_at=INSTANT,
+        site_id=site_id,
+        window_start=INSTANT - timedelta(hours=168),
+        window_end=INSTANT,
+        reference_start=None,
+        reference_end=None,
+        n_observations=48,
+        mae=1.5,
+        mape=12.0,
+        bias=0.3,
+        reference_mae=1.2,
+        coverage_ratio=0.95,
+        insufficient_data_ratio=0.0,
+        model_references=["lightgbm-aaa"],
+        status="stable",
+        reason=None,
+    )
+
+
+class FauxService:
+    def __init__(self, rapports: Sequence[DriftReport]) -> None:
+        self.rapports = list(rapports)
+        self.site_demande: str | None = None
+
+    async def derniers(self, *, site_id: str | None = None) -> Sequence[DriftReport]:
+        self.site_demande = site_id
+        return self.rapports
+
+
+@pytest.fixture
+def servi(app: FastAPI) -> Iterator[list[DriftReport]]:
+    rapports = [rapport(site_id="SITE001"), rapport(site_id=None)]
+    service = FauxService(rapports)
+    app.dependency_overrides[get_current_principal] = operateur
+    app.dependency_overrides[get_drift_service] = lambda: service
+    yield rapports
+    app.dependency_overrides.clear()
+
+
+async def test_drift_returns_the_latest_report_of_every_site(
+    servi: list[DriftReport], client: AsyncClient
+) -> None:
+    reponse = await client.get("/api/v1/monitoring/drift")
+
+    assert reponse.status_code == 200
+    assert [ligne["site_id"] for ligne in reponse.json()] == ["SITE001", None]
+
+
+async def test_drift_exposes_the_metrics_of_the_stored_report(
+    servi: list[DriftReport], client: AsyncClient
+) -> None:
+    reponse = await client.get("/api/v1/monitoring/drift")
+
+    premier = reponse.json()[0]
+    assert premier["status"] == "stable"
+    assert premier["mae"] == 1.5
+    assert premier["model_references"] == ["lightgbm-aaa"]
+
+
+async def test_drift_returns_an_empty_list_when_no_report_exists(
+    app: FastAPI, client: AsyncClient
+) -> None:
+    app.dependency_overrides[get_current_principal] = operateur
+    app.dependency_overrides[get_drift_service] = lambda: FauxService([])
+
+    reponse = await client.get("/api/v1/monitoring/drift")
+
+    assert reponse.status_code == 200
+    assert reponse.json() == []
+    app.dependency_overrides.clear()

apps/backend/tests/api/test_openapi.py

@@ -104,8 +104,8 @@ def test_the_rate_limit_documents_the_delay_header(schema: dict[str, Any]) -> No
 def test_the_refresh_cookie_appears_in_the_security_schemes(schema: dict[str, Any]) -> None:
     schemes = schema["components"]["securitySchemes"]
 
-    assert schemes["Cookie de rafraîchissement"]["in"] == "cookie"
-    assert schemes["Cookie de rafraîchissement"]["name"] == "ev_refresh"
+    assert schemes["CookieRafraichissement"]["in"] == "cookie"
+    assert schemes["CookieRafraichissement"]["name"] == "ev_refresh"
 
 
 def test_each_tag_used_by_a_route_is_described(schema: dict[str, Any]) -> None:

apps/backend/tests/api/test_parcours_recommandations.py

@@ -0,0 +1,92 @@
+from collections.abc import Callable
+
+import pytest
+from httpx import AsyncClient
+
+from app.core.roles import Role
+from tests.api.conftest import JeuMetier
+
+pytestmark = pytest.mark.integration
+
+
+async def genere(client: AsyncClient, site_id: str) -> dict[str, int]:
+    # Toujours borne a un site : sans `site_id`, le service examine toutes les alertes de la
+    # base, y compris celles d'un autre test, et le rapport cesse d'etre deterministe.
+    reponse = await client.post(f"/api/v1/recommendations/generate?site_id={site_id}")
+
+    assert reponse.status_code == 200
+    return dict(reponse.json())
+
+
+async def test_generate_creates_a_recommendation_for_the_alert_of_the_requested_site(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.ADMIN)
+
+    rapport = await genere(client, jeu_metier.site_id)
+
+    assert rapport["alerts_examined"] == 1
+    assert rapport["recommendations_created"] >= 1
+    assert rapport["already_present"] == 0
+
+
+async def test_generate_creates_nothing_more_when_it_runs_twice_on_the_same_alerts(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.ADMIN)
+    premier = await genere(client, jeu_metier.site_id)
+
+    second = await genere(client, jeu_metier.site_id)
+
+    assert second["recommendations_created"] == 0
+    assert second["already_present"] == premier["recommendations_created"]
+
+
+async def test_generate_examines_no_alert_when_the_requested_site_has_none(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.ADMIN)
+
+    rapport = await genere(client, jeu_metier.site_voisin)
+
+    assert rapport["alerts_examined"] == 0
+    assert rapport["recommendations_created"] == 0
+
+
+async def test_list_recommendations_returns_what_generate_persisted_in_another_session(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.ADMIN)
+    await genere(client, jeu_metier.site_id)
+
+    reponse = await client.get("/api/v1/recommendations")
+
+    assert reponse.status_code == 200
+    miennes = [r for r in reponse.json() if r["alert_id"] == jeu_metier.alert_id]
+    assert miennes != []
+    assert all(r["rule_reference"] for r in miennes)
+
+
+async def test_get_recommendation_returns_the_row_created_by_generate(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.ADMIN)
+    await genere(client, jeu_metier.site_id)
+    liste = await client.get("/api/v1/recommendations")
+    creee = next(r for r in liste.json() if r["alert_id"] == jeu_metier.alert_id)
+
+    reponse = await client.get(f"/api/v1/recommendations/{creee['recommendation_id']}")
+
+    assert reponse.status_code == 200
+    assert reponse.json() == creee
+
+
+async def test_get_recommendation_returns_404_when_the_identifier_is_unknown(
+    principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+
+    reponse = await client.get("/api/v1/recommendations/9999999")
+
+    assert reponse.status_code == 404
+    assert reponse.json()["detail"] == "Recommandation introuvable"

apps/backend/tests/api/test_parcours_sites.py

@@ -0,0 +1,80 @@
+from collections.abc import Callable
+
+import pytest
+from httpx import AsyncClient
+
+from app.core.roles import Role
+from app.db.session import get_session_factory
+from tests.api.conftest import JeuMetier
+from tests.repositories.test_reading import creer_lecture
+
+pytestmark = pytest.mark.integration
+
+
+async def test_list_sites_returns_the_seeded_site_with_its_stored_attributes(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+
+    reponse = await client.get("/api/v1/sites")
+
+    assert reponse.status_code == 200
+    mien = next(site for site in reponse.json() if site["site_id"] == jeu_metier.site_id)
+    assert mien["capacity_kw"] == 100.0
+    assert mien["site_name"] == "Site de test"
+
+
+async def test_get_site_returns_404_when_the_identifier_is_absent_from_the_database(
+    principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+
+    reponse = await client.get("/api/v1/sites/SITE-JAMAIS-INSERE")
+
+    assert reponse.status_code == 404
+    assert reponse.json()["detail"] == "Site introuvable"
+
+
+async def test_get_current_returns_the_most_recent_reading_when_several_hours_are_stored(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+
+    reponse = await client.get(f"/api/v1/sites/{jeu_metier.site_id}/current")
+
+    assert reponse.status_code == 200
+    corps = reponse.json()
+    assert corps["consumption_kw"] == 10.0
+    assert corps["timestamp"].startswith("2026-09-16T12:00")
+
+
+async def test_get_current_keeps_the_highest_reading_id_when_two_sources_share_the_timestamp(
+    jeu_metier: JeuMetier, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+    async with get_session_factory()() as session:
+        await creer_lecture(
+            session,
+            site_id=jeu_metier.site_id,
+            timestamp=jeu_metier.instant,
+            source="api_history",
+            consumption_kw=999.0,
+        )
+        await session.commit()
+
+    reponse = await client.get(f"/api/v1/sites/{jeu_metier.site_id}/current")
+
+    assert reponse.json()["consumption_kw"] == 999.0
+
+
+async def test_get_current_reports_a_critical_quality_when_the_site_has_no_reading(
+    site_nu: str, principal_injecte: Callable[[Role], None], client: AsyncClient
+) -> None:
+    principal_injecte(Role.LECTEUR)
+
+    reponse = await client.get(f"/api/v1/sites/{site_nu}/current")
+
+    assert reponse.status_code == 200
+    corps = reponse.json()
+    assert corps["timestamp"] is None
+    assert corps["data_quality"] == "critical"

apps/backend/tests/api/test_recommendations.py

@@ -10,7 +10,7 @@ from app.api.deps import get_current_principal, get_recommendation_service
 from app.core.principal import Principal
 from app.core.roles import AccountKind, Role
 from app.models.energy import Recommendation
-from app.services.recommendation import RecommendationNotFoundError
+from app.services.recommendation import RapportGeneration, RecommendationNotFoundError
 
 MOMENT = datetime(2024, 1, 1, tzinfo=UTC)
 
@@ -40,6 +40,7 @@ class FauxService:
     def __init__(self, erreur: Exception | None = None) -> None:
         self._erreur = erreur
         self.recommendation = recommendation()
+        self.site_demande: str | None = None
 
     async def list_all(self) -> list[Recommendation]:
         return [self.recommendation]
@@ -49,6 +50,10 @@ class FauxService:
             raise self._erreur
         return self.recommendation
 
+    async def generate(self, *, site_id: str | None = None) -> RapportGeneration:
+        self.site_demande = site_id
+        return RapportGeneration(alertes_examinees=2, recommandations_creees=3, deja_presentes=1)
+
 
 @pytest.fixture
 def lecteur_connecte(app: FastAPI) -> Iterator[None]:
@@ -142,3 +147,56 @@ async def test_get_recommendation_returns_404_when_the_session_finds_nothing(
     response = await client.get("/api/v1/recommendations/404")
 
     assert response.status_code == 404
+
+
+@pytest.fixture
+def admin_connecte(app: FastAPI) -> Iterator[None]:
+    app.dependency_overrides[get_current_principal] = lambda: principal(Role.ADMIN)
+    yield
+    app.dependency_overrides.pop(get_current_principal, None)
+
+
+@pytest.fixture
+def servi_en_admin(app: FastAPI, admin_connecte: None) -> Iterator[Callable[[], FauxService]]:
+    def installe() -> FauxService:
+        service = FauxService()
+        app.dependency_overrides[get_recommendation_service] = lambda: service
+        return service
+
+    yield installe
+    app.dependency_overrides.pop(get_recommendation_service, None)
+
+
+async def test_generate_recommendations_returns_the_generation_report(
+    servi_en_admin: Callable[[], FauxService], client: AsyncClient
+) -> None:
+    servi_en_admin()
+
+    response = await client.post("/api/v1/recommendations/generate")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "alerts_examined": 2,
+        "recommendations_created": 3,
+        "already_present": 1,
+    }
+
+
+async def test_generate_recommendations_forwards_the_requested_site(
+    servi_en_admin: Callable[[], FauxService], client: AsyncClient
+) -> None:
+    service = servi_en_admin()
+
+    await client.post("/api/v1/recommendations/generate", params={"site_id": "SITE002"})
+
+    assert service.site_demande == "SITE002"
+
+
+async def test_generate_recommendations_refuses_a_reader(
+    servi: Callable[..., FauxService], client: AsyncClient
+) -> None:
+    servi()
+
+    response = await client.post("/api/v1/recommendations/generate")
+
+    assert response.status_code == 403

apps/backend/tests/db/test_data_schema.py

@@ -1,5 +1,5 @@
 from collections.abc import AsyncIterator
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta
 from uuid import uuid4
 
 import pytest
@@ -9,7 +9,15 @@ from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncConnection, create_async_engine
 
 from app.core.config import get_settings
-from app.models.energy import Alert, Dataset, Prediction, Reading, Recommendation, Site
+from app.models.energy import (
+    Alert,
+    Dataset,
+    DriftReport,
+    Prediction,
+    Reading,
+    Recommendation,
+    Site,
+)
 
 pytestmark = pytest.mark.integration
 MOMENT = datetime(2024, 1, 1, tzinfo=UTC)
@@ -112,8 +120,10 @@ async def test_duplicate_reading_is_rejected_when_key_matches(
     )
     await data_connection.execute(statement)
 
+    savepoint = data_connection.begin_nested()
+
     with pytest.raises(IntegrityError):
-        async with data_connection.begin_nested():
+        async with savepoint:
             await data_connection.execute(statement)
 
 
@@ -147,9 +157,12 @@ async def test_invalid_reading_is_rejected_when_constraints_fail(
     }
     values.update(changes)
 
+    statement = insert(Reading).values(**values)
+    savepoint = data_connection.begin_nested()
+
     with pytest.raises(IntegrityError):
-        async with data_connection.begin_nested():
-            await data_connection.execute(insert(Reading).values(**values))
+        async with savepoint:
+            await data_connection.execute(statement)
 
 
 async def test_prediction_requires_period_when_energy_is_predicted(
@@ -164,8 +177,10 @@ async def test_prediction_requires_period_when_energy_is_predicted(
         model_reference="test-model/1",
     )
 
+    savepoint = data_connection.begin_nested()
+
     with pytest.raises(IntegrityError):
-        async with data_connection.begin_nested():
+        async with savepoint:
             await data_connection.execute(statement)
 
 
@@ -212,21 +227,22 @@ async def test_alert_rejects_prediction_when_site_differs(
         )
     ).scalar_one()
 
+    statement = insert(Alert).values(
+        source_alert_id=str(uuid4()),
+        site_id=other_site,
+        source="enervision",
+        timestamp=MOMENT,
+        type="spike",
+        severity="high",
+        message="Test",
+        prediction_id=prediction_id,
+        raw_data={},
+    )
+    savepoint = data_connection.begin_nested()
+
     with pytest.raises(IntegrityError):
-        async with data_connection.begin_nested():
-            await data_connection.execute(
-                insert(Alert).values(
-                    source_alert_id=str(uuid4()),
-                    site_id=other_site,
-                    source="enervision",
-                    timestamp=MOMENT,
-                    type="spike",
-                    severity="high",
-                    message="Test",
-                    prediction_id=prediction_id,
-                    raw_data={},
-                )
-            )
+        async with savepoint:
+            await data_connection.execute(statement)
 
 
 async def test_recommendation_is_unique_when_alert_and_rule_match(
@@ -256,6 +272,67 @@ async def test_recommendation_is_unique_when_alert_and_rule_match(
     )
     await data_connection.execute(statement)
 
+    savepoint = data_connection.begin_nested()
+
     with pytest.raises(IntegrityError):
-        async with data_connection.begin_nested():
+        async with savepoint:
+            await data_connection.execute(statement)
+
+
+def _rapport(**remplacements: object) -> dict[str, object]:
+    defauts: dict[str, object] = {
+        "site_id": None,
+        "window_start": MOMENT,
+        "window_end": MOMENT,
+        "n_observations": 12,
+        "model_references": ["lightgbm-aaa"],
+        "status": "stable",
+        "reason": None,
+    }
+    return {**defauts, **remplacements}
+
+
+async def test_drift_report_rejects_an_unknown_status(data_connection: AsyncConnection) -> None:
+    statement = insert(DriftReport).values(**_rapport(status="douteux", reason="x"))
+    savepoint = data_connection.begin_nested()
+
+    with pytest.raises(IntegrityError):
+        async with savepoint:
+            await data_connection.execute(statement)
+
+
+async def test_drift_report_rejects_a_drift_without_a_reason(
+    data_connection: AsyncConnection,
+) -> None:
+    statement = insert(DriftReport).values(**_rapport(status="derive"))
+    savepoint = data_connection.begin_nested()
+
+    with pytest.raises(IntegrityError):
+        async with savepoint:
+            await data_connection.execute(statement)
+
+
+async def test_drift_report_accepts_one_global_row_without_a_site(
+    data_connection: AsyncConnection,
+) -> None:
+    identifiant = (
+        await data_connection.execute(
+            insert(DriftReport).values(**_rapport()).returning(DriftReport.drift_report_id)
+        )
+    ).scalar_one()
+
+    assert identifiant is not None
+
+
+async def test_drift_report_is_unique_when_window_and_site_match(
+    data_connection: AsyncConnection,
+) -> None:
+    fenetre = MOMENT + timedelta(days=1)
+    statement = insert(DriftReport).values(**_rapport(window_end=fenetre))
+    await data_connection.execute(statement)
+
+    savepoint = data_connection.begin_nested()
+
+    with pytest.raises(IntegrityError):
+        async with savepoint:
             await data_connection.execute(statement)

apps/backend/tests/etl/test_historical_import.py

@@ -1,239 +1,245 @@
-import hashlib
-import json
-
-import pandas as pd
-import pytest
-
-from app.etl.historical_import import (
-    SOURCE_NAME,
-    build_reading_batch,
-    classify_quality,
-    compute_sha256,
-    load_metadata,
-    normalize_timestamps,
-    validate_source,
-)
-
-
-def make_metadata() -> dict:
-    return {
-        "total_records": 2,
-        "sites": {
-            "SITE001": {},
-        },
-    }
-
-
-def make_dataframe() -> pd.DataFrame:
-    return pd.DataFrame(
-        [
-            {
-                "timestamp": "2023-01-01 00:00:00",
-                "site_id": "SITE001",
-                "site_type": "office",
-                "site_name": "Site 1",
-                "consumption_kwh": 10.5,
-                "consumption_euros": 2.5,
-                "temperature_celsius": 20.0,
-                "humidity_percent": 50.0,
-                "solar_irradiance_wm2": 0.0,
-                "hour": 0,
-                "day_of_week": 6,
-                "day_name": "Sunday",
-                "month": 1,
-                "is_weekend": True,
-                "is_working_hours": False,
-            },
-            {
-                "timestamp": "2023-01-01 01:00:00",
-                "site_id": "SITE001",
-                "site_type": "office",
-                "site_name": "Site 1",
-                "consumption_kwh": 11.0,
-                "consumption_euros": 2.7,
-                "temperature_celsius": 19.5,
-                "humidity_percent": 52.0,
-                "solar_irradiance_wm2": 0.0,
-                "hour": 1,
-                "day_of_week": 6,
-                "day_name": "Sunday",
-                "month": 1,
-                "is_weekend": True,
-                "is_working_hours": False,
-            },
-        ]
-    )
-
-
-def test_compute_sha256(tmp_path):
-    file_path = tmp_path / "dataset.csv"
-    content = b"hello-enervision"
-
-    file_path.write_bytes(content)
-
-    expected = hashlib.sha256(content).hexdigest()
-
-    assert compute_sha256(file_path) == expected
-
-
-def test_load_metadata(tmp_path):
-    metadata_path = tmp_path / "metadata.json"
-
-    metadata = {
-        "total_records": 2,
-        "sites": {
-            "SITE001": {},
-        },
-    }
-
-    metadata_path.write_text(
-        json.dumps(metadata),
-        encoding="utf-8",
-    )
-
-    assert load_metadata(metadata_path) == metadata
-
-
-def test_validate_source_accepts_valid_dataset():
-    frame = make_dataframe()
-
-    validate_source(
-        frame,
-        make_metadata(),
-    )
-
-
-def test_validate_source_rejects_missing_column():
-    frame = make_dataframe().drop(columns=["consumption_kwh"])
-
-    with pytest.raises(
-        ValueError,
-        match="Colonnes obligatoires absentes",
-    ):
-        validate_source(
-            frame,
-            make_metadata(),
-        )
-
-
-def test_validate_source_rejects_duplicates():
-    frame = make_dataframe()
-
-    frame.loc[1, "timestamp"] = frame.loc[
-        0,
-        "timestamp",
-    ]
-
-    with pytest.raises(
-        ValueError,
-        match="doublons",
-    ):
-        validate_source(
-            frame,
-            make_metadata(),
-        )
-
-
-def test_validate_source_rejects_unknown_site():
-    frame = make_dataframe()
-
-    frame.loc[1, "site_id"] = "SITE999"
-
-    with pytest.raises(
-        ValueError,
-        match="Sites incohérents",
-    ):
-        validate_source(
-            frame,
-            make_metadata(),
-        )
-
-
-def test_normalize_timestamps_adds_timezone():
-    frame = make_dataframe()
-
-    normalized = normalize_timestamps(
-        frame,
-        "UTC",
-    )
-
-    assert normalized["timestamp"].dt.tz is not None
-
-    assert "_source_timestamp" in normalized.columns
-
-
-def test_classify_quality_good():
-    row = make_dataframe().iloc[0].to_dict()
-
-    quality, reasons = classify_quality(row)
-
-    assert quality == "good"
-    assert reasons == []
-
-
-def test_classify_quality_degraded_when_consumption_missing():
-    row = make_dataframe().iloc[0].to_dict()
-    row["consumption_kwh"] = None
-
-    quality, reasons = classify_quality(row)
-
-    assert quality == "degraded"
-
-    assert "missing:consumption_kwh" in reasons
-
-
-def test_build_reading_batch_respects_database_contract():
-    frame = normalize_timestamps(
-        make_dataframe(),
-        "UTC",
-    )
-
-    rows = build_reading_batch(
-        frame.iloc[:1],
-        dataset_id=3,
-    )
-
-    assert len(rows) == 1
-
-    row = rows[0]
-
-    assert row["dataset_id"] == 3
-
-    # Important :
-    # contrainte ck_reading_dataset_source.
-    assert row["source"] == "csv"
-    assert SOURCE_NAME == "csv"
-
-    # Important :
-    # contrainte ck_reading_imputation.
-    assert row["imputed_values"] is None
-    assert row["imputation_method"] is None
-
-    assert row["data_quality"] == "good"
-    assert row["null_reasons"] == []
-
-
-def test_build_reading_batch_keeps_missing_values():
-    frame = make_dataframe()
-
-    frame.loc[0, "temperature_celsius"] = None
-
-    frame = normalize_timestamps(
-        frame,
-        "UTC",
-    )
-
-    rows = build_reading_batch(
-        frame.iloc[:1],
-        dataset_id=3,
-    )
-
-    row = rows[0]
-
-    assert row["temperature_celsius"] is None
-
-    assert "missing:temperature_celsius" in row["null_reasons"]
-
-    # RAW ingestion : aucune imputation.
-    assert row["imputed_values"] is None
-    assert row["imputation_method"] is None
+import hashlib
+import json
+
+import pandas as pd
+import pytest
+
+from app.etl.historical_import import (
+    SOURCE_NAME,
+    build_reading_batch,
+    classify_quality,
+    compute_sha256,
+    load_metadata,
+    normalize_timestamps,
+    validate_source,
+)
+
+
+def make_metadata() -> dict:
+    return {
+        "total_records": 2,
+        "sites": {
+            "SITE001": {},
+        },
+    }
+
+
+def make_dataframe() -> pd.DataFrame:
+    return pd.DataFrame(
+        [
+            {
+                "timestamp": "2023-01-01 00:00:00",
+                "site_id": "SITE001",
+                "site_type": "office",
+                "site_name": "Site 1",
+                "consumption_kwh": 10.5,
+                "consumption_euros": 2.5,
+                "temperature_celsius": 20.0,
+                "humidity_percent": 50.0,
+                "solar_irradiance_wm2": 0.0,
+                "hour": 0,
+                "day_of_week": 6,
+                "day_name": "Sunday",
+                "month": 1,
+                "is_weekend": True,
+                "is_working_hours": False,
+            },
+            {
+                "timestamp": "2023-01-01 01:00:00",
+                "site_id": "SITE001",
+                "site_type": "office",
+                "site_name": "Site 1",
+                "consumption_kwh": 11.0,
+                "consumption_euros": 2.7,
+                "temperature_celsius": 19.5,
+                "humidity_percent": 52.0,
+                "solar_irradiance_wm2": 0.0,
+                "hour": 1,
+                "day_of_week": 6,
+                "day_name": "Sunday",
+                "month": 1,
+                "is_weekend": True,
+                "is_working_hours": False,
+            },
+        ]
+    )
+
+
+def test_compute_sha256(tmp_path):
+    file_path = tmp_path / "dataset.csv"
+    content = b"hello-enervision"
+
+    file_path.write_bytes(content)
+
+    expected = hashlib.sha256(content).hexdigest()
+
+    assert compute_sha256(file_path) == expected
+
+
+def test_load_metadata(tmp_path):
+    metadata_path = tmp_path / "metadata.json"
+
+    metadata = {
+        "total_records": 2,
+        "sites": {
+            "SITE001": {},
+        },
+    }
+
+    metadata_path.write_text(
+        json.dumps(metadata),
+        encoding="utf-8",
+    )
+
+    assert load_metadata(metadata_path) == metadata
+
+
+def test_validate_source_accepts_valid_dataset():
+    frame = make_dataframe()
+
+    validate_source(
+        frame,
+        make_metadata(),
+    )
+
+
+def test_validate_source_rejects_missing_column():
+    frame = make_dataframe().drop(columns=["consumption_kwh"])
+
+    metadata = make_metadata()
+
+    with pytest.raises(
+        ValueError,
+        match="Colonnes obligatoires absentes",
+    ):
+        validate_source(
+            frame,
+            metadata,
+        )
+
+
+def test_validate_source_rejects_duplicates():
+    frame = make_dataframe()
+
+    frame.loc[1, "timestamp"] = frame.loc[
+        0,
+        "timestamp",
+    ]
+
+    metadata = make_metadata()
+
+    with pytest.raises(
+        ValueError,
+        match="doublons",
+    ):
+        validate_source(
+            frame,
+            metadata,
+        )
+
+
+def test_validate_source_rejects_unknown_site():
+    frame = make_dataframe()
+
+    frame.loc[1, "site_id"] = "SITE999"
+
+    metadata = make_metadata()
+
+    with pytest.raises(
+        ValueError,
+        match="Sites incohérents",
+    ):
+        validate_source(
+            frame,
+            metadata,
+        )
+
+
+def test_normalize_timestamps_adds_timezone():
+    frame = make_dataframe()
+
+    normalized = normalize_timestamps(
+        frame,
+        "UTC",
+    )
+
+    assert normalized["timestamp"].dt.tz is not None
+
+    assert "_source_timestamp" in normalized.columns
+
+
+def test_classify_quality_good():
+    row = make_dataframe().iloc[0].to_dict()
+
+    quality, reasons = classify_quality(row)
+
+    assert quality == "good"
+    assert reasons == []
+
+
+def test_classify_quality_degraded_when_consumption_missing():
+    row = make_dataframe().iloc[0].to_dict()
+    row["consumption_kwh"] = None
+
+    quality, reasons = classify_quality(row)
+
+    assert quality == "degraded"
+
+    assert "missing:consumption_kwh" in reasons
+
+
+def test_build_reading_batch_respects_database_contract():
+    frame = normalize_timestamps(
+        make_dataframe(),
+        "UTC",
+    )
+
+    rows = build_reading_batch(
+        frame.iloc[:1],
+        dataset_id=3,
+    )
+
+    assert len(rows) == 1
+
+    row = rows[0]
+
+    assert row["dataset_id"] == 3
+
+    # Important :
+    # contrainte ck_reading_dataset_source.
+    assert row["source"] == "csv"
+    assert SOURCE_NAME == "csv"
+
+    # Important :
+    # contrainte ck_reading_imputation.
+    assert row["imputed_values"] is None
+    assert row["imputation_method"] is None
+
+    assert row["data_quality"] == "good"
+    assert row["null_reasons"] == []
+
+
+def test_build_reading_batch_keeps_missing_values():
+    frame = make_dataframe()
+
+    frame.loc[0, "temperature_celsius"] = None
+
+    frame = normalize_timestamps(
+        frame,
+        "UTC",
+    )
+
+    rows = build_reading_batch(
+        frame.iloc[:1],
+        dataset_id=3,
+    )
+
+    row = rows[0]
+
+    assert row["temperature_celsius"] is None
+
+    assert "missing:temperature_celsius" in row["null_reasons"]
+
+    # RAW ingestion : aucune imputation.
+    assert row["imputed_values"] is None
+    assert row["imputation_method"] is None

apps/backend/tests/etl/test_reading_retention.py

@@ -0,0 +1,710 @@
+import base64
+import io
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from datetime import UTC, datetime, timedelta, timezone
+from decimal import Decimal
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock
+
+import boto3
+import pandas as pd
+import pytest
+from botocore.exceptions import ClientError
+from botocore.response import StreamingBody
+from botocore.stub import Stubber
+from pydantic import SecretStr
+from tests.factories import make_settings
+
+import app.etl.reading_retention as reading_retention
+from app.core.config import Settings
+from app.etl.reading_retention import (
+    CHUNK_ROWS,
+    DROP_CHUNK,
+    ELIGIBLE_CHUNKS,
+    ArchiveStore,
+    Chunk,
+    Rapport,
+    archive_reading_chunks,
+    build_archive_store,
+    build_parser,
+    decode_sse_key,
+    drop_chunk,
+    eligible_chunks,
+    object_key,
+    read_chunk_rows,
+    serialize_csv_gzip,
+    sha256_of,
+)
+
+CLE_SSE = b"0123456789abcdef0123456789abcdef"
+CLE_SSE_BASE64 = base64.b64encode(CLE_SSE).decode("ascii")
+
+CHUNK = Chunk(
+    schema="_timescaledb_internal",
+    name="_hyper_1_7_chunk",
+    range_start=datetime(2023, 1, 5, tzinfo=UTC),
+    range_end=datetime(2023, 1, 12, tzinfo=UTC),
+)
+CLE_ATTENDUE = "reading/2023/reading_20230105T000000Z_20230112T000000Z.csv.gz"
+
+
+def make_row(**overrides: Any) -> dict[str, Any]:
+    ligne: dict[str, Any] = {
+        "reading_id": 1,
+        "site_id": "SITE001",
+        "timestamp": datetime(2023, 1, 5, 12, tzinfo=UTC),
+        "source": "csv",
+        "dataset_id": 1,
+        "consumption_kw": Decimal("87.34"),
+        "data_quality": "good",
+        "null_reasons": ["sensor_offline"],
+        "imputed_values": None,
+        "raw_data": {"b": 1, "a": "é"},
+    }
+    return {**ligne, **overrides}
+
+
+def settings_s3(**overrides: Any) -> Settings:
+    reglages: dict[str, Any] = {
+        "_env_file": None,
+        "secret_key": SecretStr("secret-de-test-assez-long-pour-le-validateur"),
+        "database_url": "postgresql+asyncpg://retention:test@localhost:5432/enervision",
+        "s3_endpoint_url": "http://garage:3900",
+        "s3_access_key": "GK0123456789",
+        "s3_secret_key": SecretStr("un-secret-garage"),
+        "s3_bucket": "enervision-archives",
+        "s3_sse_key": SecretStr(CLE_SSE_BASE64),
+    }
+    return Settings(**{**reglages, **overrides})
+
+
+def s3_client() -> Any:
+    return boto3.client(
+        "s3",
+        endpoint_url="http://garage:3900",
+        aws_access_key_id="GK0123456789",
+        aws_secret_access_key="un-secret-garage",
+        region_name="garage",
+    )
+
+
+def streaming(data: bytes) -> StreamingBody:
+    return StreamingBody(io.BytesIO(data), len(data))
+
+
+def test_settings_treat_empty_s3_values_as_absent() -> None:
+    settings = make_settings(
+        s3_endpoint_url="", s3_access_key="", s3_secret_key="", s3_bucket="", s3_sse_key=""
+    )
+
+    assert settings.s3_endpoint_url is None
+    assert settings.s3_access_key is None
+    assert settings.s3_secret_key is None
+    assert settings.s3_bucket is None
+    assert settings.s3_sse_key is None
+    assert settings.reading_retention_days == 1095
+
+
+def test_object_key_places_the_chunk_under_the_year_of_its_start() -> None:
+    assert object_key(CHUNK) == CLE_ATTENDUE
+
+
+def test_object_key_expresses_the_bounds_in_utc() -> None:
+    paris = timezone(timedelta(hours=1))
+    chunk = Chunk(
+        schema=CHUNK.schema,
+        name=CHUNK.name,
+        range_start=datetime(2023, 1, 5, 1, tzinfo=paris),
+        range_end=datetime(2023, 1, 12, 1, tzinfo=paris),
+    )
+
+    assert object_key(chunk) == CLE_ATTENDUE
+
+
+def test_serialize_csv_gzip_is_read_back_by_pandas() -> None:
+    archive = serialize_csv_gzip([make_row(), make_row(reading_id=2, null_reasons=[])])
+
+    relu = pd.read_csv(io.BytesIO(archive), compression="gzip")
+
+    assert list(relu.columns) == list(make_row())
+    assert relu["reading_id"].tolist() == [1, 2]
+    assert relu["site_id"].tolist() == ["SITE001", "SITE001"]
+
+
+def test_serialize_csv_gzip_writes_jsonb_and_arrays_as_sorted_json() -> None:
+    archive = serialize_csv_gzip([make_row()])
+
+    relu = pd.read_csv(io.BytesIO(archive), compression="gzip")
+
+    assert relu.loc[0, "raw_data"] == '{"a": "é", "b": 1}'
+    assert relu.loc[0, "null_reasons"] == '["sensor_offline"]'
+
+
+def test_serialize_csv_gzip_is_byte_for_byte_reproducible() -> None:
+    lignes = [make_row(), make_row(reading_id=2)]
+
+    premier = serialize_csv_gzip(lignes)
+    second = serialize_csv_gzip(lignes)
+
+    assert premier == second
+
+
+def test_serialize_csv_gzip_refuses_an_empty_export() -> None:
+    with pytest.raises(ValueError, match="Aucune ligne"):
+        serialize_csv_gzip([])
+
+
+def test_sha256_of_hashes_the_bytes() -> None:
+    assert sha256_of(b"hello").startswith("2cf24dba")
+
+
+def test_store_put_sends_the_sse_c_headers_when_a_key_is_set() -> None:
+    client = s3_client()
+    store = ArchiveStore(client, bucket="enervision-archives", sse_key=CLE_SSE)
+
+    with Stubber(client) as stub:
+        stub.add_response(
+            "put_object",
+            {},
+            expected_params={
+                "Bucket": "enervision-archives",
+                "Key": CLE_ATTENDUE,
+                "Body": b"corps",
+                "ContentType": "text/csv",
+                "ContentEncoding": "gzip",
+                "Metadata": {"sha256": "abc"},
+                "SSECustomerAlgorithm": "AES256",
+                "SSECustomerKey": CLE_SSE,
+            },
+        )
+        store.put(CLE_ATTENDUE, b"corps", {"sha256": "abc"})
+        stub.assert_no_pending_responses()
+
+
+def test_store_put_omits_the_sse_c_headers_without_a_key() -> None:
+    client = s3_client()
+    store = ArchiveStore(client, bucket="enervision-archives", sse_key=None)
+
+    with Stubber(client) as stub:
+        stub.add_response(
+            "put_object",
+            {},
+            expected_params={
+                "Bucket": "enervision-archives",
+                "Key": CLE_ATTENDUE,
+                "Body": b"corps",
+                "ContentType": "text/csv",
+                "ContentEncoding": "gzip",
+                "Metadata": {},
+            },
+        )
+        store.put(CLE_ATTENDUE, b"corps", {})
+        stub.assert_no_pending_responses()
+
+
+def test_store_fetch_sha256_hashes_the_object_read_with_the_key() -> None:
+    client = s3_client()
+    store = ArchiveStore(client, bucket="enervision-archives", sse_key=CLE_SSE)
+
+    with Stubber(client) as stub:
+        stub.add_response(
+            "get_object",
+            {"Body": streaming(b"hello")},
+            expected_params={
+                "Bucket": "enervision-archives",
+                "Key": CLE_ATTENDUE,
+                "SSECustomerAlgorithm": "AES256",
+                "SSECustomerKey": CLE_SSE,
+            },
+        )
+
+        assert store.fetch_sha256(CLE_ATTENDUE) == sha256_of(b"hello")
+
+
+@pytest.mark.parametrize(
+    ("code", "statut"),
+    [("NoSuchKey", 404), ("NotFound", 404), ("NoSuchKey", 400)],
+    ids=["no_such_key", "404_sans_code_connu", "no_such_key_sans_404"],
+)
+def test_store_fetch_sha256_returns_none_for_a_missing_object(code: str, statut: int) -> None:
+    client = s3_client()
+    store = ArchiveStore(client, bucket="enervision-archives", sse_key=None)
+
+    with Stubber(client) as stub:
+        stub.add_client_error("get_object", service_error_code=code, http_status_code=statut)
+
+        assert store.fetch_sha256(CLE_ATTENDUE) is None
+
+
+def test_store_fetch_sha256_raises_any_other_error() -> None:
+    client = s3_client()
+    store = ArchiveStore(client, bucket="enervision-archives", sse_key=None)
+
+    with Stubber(client) as stub:
+        stub.add_client_error("get_object", service_error_code="AccessDenied", http_status_code=403)
+
+        with pytest.raises(ClientError):
+            store.fetch_sha256(CLE_ATTENDUE)
+
+
+def test_decode_sse_key_returns_none_without_a_key() -> None:
+    assert decode_sse_key(None) is None
+
+
+def test_decode_sse_key_decodes_the_base64_key() -> None:
+    assert decode_sse_key(SecretStr(CLE_SSE_BASE64)) == CLE_SSE
+
+
+def test_decode_sse_key_refuses_a_key_of_the_wrong_length() -> None:
+    courte = SecretStr(base64.b64encode(b"trop-courte").decode("ascii"))
+
+    with pytest.raises(ValueError, match="exactement 32 octets"):
+        decode_sse_key(courte)
+
+
+@pytest.mark.parametrize(
+    "manquant",
+    ["s3_endpoint_url", "s3_access_key", "s3_secret_key", "s3_bucket"],
+)
+def test_build_archive_store_refuses_a_missing_setting(manquant: str) -> None:
+    reglages = settings_s3(**{manquant: None})
+
+    with pytest.raises(ValueError, match="APP_S3_ENDPOINT_URL"):
+        build_archive_store(reglages)
+
+
+def test_build_archive_store_refuses_a_sse_key_of_the_wrong_length() -> None:
+    courte = base64.b64encode(b"trop-courte").decode("ascii")
+    reglages = settings_s3(s3_sse_key=SecretStr(courte))
+
+    with pytest.raises(ValueError, match="exactement 32 octets"):
+        build_archive_store(reglages)
+
+
+def test_build_archive_store_configures_the_client_from_the_settings(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    recu: dict[str, Any] = {}
+
+    def faux_client(service: str, **kwargs: Any) -> MagicMock:
+        recu["service"] = service
+        recu.update(kwargs)
+        return MagicMock()
+
+    monkeypatch.setattr(reading_retention.boto3, "client", faux_client)
+
+    build_archive_store(settings_s3())
+
+    assert recu == {
+        "service": "s3",
+        "endpoint_url": "http://garage:3900",
+        "aws_access_key_id": "GK0123456789",
+        "aws_secret_access_key": "un-secret-garage",
+        "region_name": "garage",
+    }
+
+
+def test_build_archive_store_uses_the_bucket_and_the_decoded_key() -> None:
+    store = build_archive_store(settings_s3())
+
+    with Stubber(store._client) as stub:
+        stub.add_response(
+            "get_object",
+            {"Body": streaming(b"hello")},
+            expected_params={
+                "Bucket": "enervision-archives",
+                "Key": CLE_ATTENDUE,
+                "SSECustomerAlgorithm": "AES256",
+                "SSECustomerKey": CLE_SSE,
+            },
+        )
+
+        assert store.fetch_sha256(CLE_ATTENDUE) == sha256_of(b"hello")
+
+
+def test_build_archive_store_accepts_an_absent_sse_key() -> None:
+    store = build_archive_store(settings_s3(s3_sse_key=None))
+
+    with Stubber(store._client) as stub:
+        stub.add_response(
+            "get_object",
+            {"Body": streaming(b"hello")},
+            expected_params={"Bucket": "enervision-archives", "Key": CLE_ATTENDUE},
+        )
+
+        assert store.fetch_sha256(CLE_ATTENDUE) == sha256_of(b"hello")
+
+
+class FakeResult:
+    def __init__(self, rows: list[Any]) -> None:
+        self._rows = rows
+
+    def mappings(self) -> FakeResult:
+        return self
+
+    def scalars(self) -> FakeResult:
+        return self
+
+    def all(self) -> list[Any]:
+        return self._rows
+
+
+def chunk_mapping(chunk: Chunk) -> dict[str, Any]:
+    return {
+        "chunk_schema": chunk.schema,
+        "chunk_name": chunk.name,
+        "range_start": chunk.range_start,
+        "range_end": chunk.range_end,
+    }
+
+
+async def test_eligible_chunks_queries_the_timescaledb_catalog() -> None:
+    conn = AsyncMock()
+    conn.execute.return_value = FakeResult([chunk_mapping(CHUNK)])
+    borne = datetime(2023, 10, 1, tzinfo=UTC)
+
+    chunks = await eligible_chunks(conn, borne)
+
+    assert chunks == [CHUNK]
+    statement, params = conn.execute.await_args.args
+    assert statement is ELIGIBLE_CHUNKS
+    assert params == {"older_than": borne}
+
+
+async def test_read_chunk_rows_reads_through_the_hypertable_within_the_chunk_bounds() -> None:
+    conn = AsyncMock()
+    conn.execute.return_value = FakeResult([make_row(), make_row(reading_id=2)])
+
+    lignes = await read_chunk_rows(conn, CHUNK)
+
+    assert lignes == [make_row(), make_row(reading_id=2)]
+    statement, params = conn.execute.await_args.args
+    assert statement is CHUNK_ROWS
+    assert params == {"start": CHUNK.range_start, "end": CHUNK.range_end}
+
+
+async def test_drop_chunk_targets_the_chunk_by_its_own_bounds() -> None:
+    conn = AsyncMock()
+    conn.execute.return_value = FakeResult([CHUNK.qualified_name])
+
+    await drop_chunk(conn, CHUNK)
+
+    statement, params = conn.execute.await_args.args
+    assert statement is DROP_CHUNK
+    assert params == {"start": CHUNK.range_start, "end": CHUNK.range_end}
+
+
+@pytest.mark.parametrize(
+    "rendu",
+    [[], ["_timescaledb_internal._hyper_1_7_chunk", "_timescaledb_internal._hyper_1_8_chunk"]],
+    ids=["aucun_chunk", "deux_chunks"],
+)
+async def test_drop_chunk_raises_unless_exactly_the_chunk_was_dropped(rendu: list[str]) -> None:
+    conn = AsyncMock()
+    conn.execute.return_value = FakeResult(rendu)
+
+    with pytest.raises(RuntimeError, match=r"exactement _timescaledb_internal\._hyper_1_7_chunk"):
+        await drop_chunk(conn, CHUNK)
+
+
+class FakeConn:
+    def __init__(self, journal: list[str], chunks: list[Chunk], rows: list[dict[str, Any]]) -> None:
+        self._journal = journal
+        self._chunks = chunks
+        self._rows = rows
+
+    async def execute(self, statement: Any, params: dict[str, Any]) -> FakeResult:
+        if statement is ELIGIBLE_CHUNKS:
+            self._journal.append("lister")
+            return FakeResult([chunk_mapping(chunk) for chunk in self._chunks])
+        if statement is CHUNK_ROWS:
+            self._journal.append("lire")
+            return FakeResult(self._rows)
+        self._journal.append("drop")
+        chunk = next(c for c in self._chunks if c.range_start == params["start"])
+        return FakeResult([chunk.qualified_name])
+
+
+class FakeEngine:
+    def __init__(self, conn: FakeConn, journal: list[str]) -> None:
+        self._conn = conn
+        self._journal = journal
+
+    @asynccontextmanager
+    async def connect(self) -> AsyncIterator[FakeConn]:
+        self._journal.append("connect")
+        yield self._conn
+
+    @asynccontextmanager
+    async def begin(self) -> AsyncIterator[FakeConn]:
+        self._journal.append("begin")
+        yield self._conn
+
+    async def dispose(self) -> None:
+        self._journal.append("dispose")
+
+
+class FakeStore(ArchiveStore):
+    def __init__(self, journal: list[str], *, corrompt: bool = False) -> None:
+        super().__init__(MagicMock(), bucket="enervision-archives", sse_key=None)
+        self._journal = journal
+        self._corrompt = corrompt
+        self.objets: dict[str, str] = {}
+        self.metadata: dict[str, dict[str, str]] = {}
+
+    def put(self, key: str, body: bytes, metadata: dict[str, str]) -> None:
+        self._journal.append("put")
+        self.objets[key] = "sha-corrompu" if self._corrompt else sha256_of(body)
+        self.metadata[key] = metadata
+
+    def fetch_sha256(self, key: str) -> str | None:
+        self._journal.append("relire")
+        return self.objets.get(key)
+
+
+def make_archive(
+    chunks: list[Chunk] | None = None,
+    rows: list[dict[str, Any]] | None = None,
+    *,
+    corrompt: bool = False,
+) -> tuple[FakeEngine, FakeStore, list[str]]:
+    journal: list[str] = []
+    lignes = [make_row(), make_row(reading_id=2)] if rows is None else rows
+    eligibles = [CHUNK] if chunks is None else chunks
+    engine = FakeEngine(FakeConn(journal, eligibles, lignes), journal)
+    return engine, FakeStore(journal, corrompt=corrompt), journal
+
+
+async def test_archive_reading_chunks_reads_exports_verifies_then_drops(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    engine, store, journal = make_archive()
+    borne = datetime(2023, 10, 1, tzinfo=UTC)
+
+    rapport = await archive_reading_chunks(engine, store, older_than=borne, dry_run=False)
+
+    assert journal == [
+        "connect",
+        "lister",
+        "connect",
+        "lire",
+        "relire",
+        "put",
+        "relire",
+        "begin",
+        "drop",
+    ]
+    assert rapport == Rapport(chunks_vus=1, exportes=1, deja_presents=0, supprimes=1, lignes=2)
+    assert store.objets[CLE_ATTENDUE] == sha256_of(
+        serialize_csv_gzip([make_row(), make_row(reading_id=2)])
+    )
+    assert store.metadata[CLE_ATTENDUE] == {"sha256": store.objets[CLE_ATTENDUE], "rows": "2"}
+
+    sortie = capsys.readouterr().out
+    assert f"{CLE_ATTENDUE} : 2 ligne(s)" in sortie
+    assert "exportés et relus" in sortie
+    assert f"chunk {CHUNK.qualified_name} supprimé" in sortie
+    assert "Archivage terminé." in sortie
+
+
+async def test_archive_reading_chunks_skips_the_upload_when_the_object_already_matches() -> None:
+    engine, store, journal = make_archive()
+    store.objets[CLE_ATTENDUE] = sha256_of(serialize_csv_gzip([make_row(), make_row(reading_id=2)]))
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=False
+    )
+
+    assert "put" not in journal
+    assert journal[-2:] == ["begin", "drop"]
+    assert rapport == Rapport(chunks_vus=1, exportes=0, deja_presents=1, supprimes=1, lignes=2)
+
+
+async def test_archive_reading_chunks_re_uploads_when_the_stored_object_differs() -> None:
+    engine, store, journal = make_archive()
+    store.objets[CLE_ATTENDUE] = "un-autre-sha"
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=False
+    )
+
+    assert journal.count("put") == 1
+    assert rapport.exportes == 1
+    assert rapport.deja_presents == 0
+
+
+async def test_archive_reading_chunks_in_dry_run_neither_writes_nor_drops(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    engine, store, journal = make_archive()
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=True
+    )
+
+    assert "put" not in journal
+    assert "begin" not in journal
+    assert "drop" not in journal
+    assert rapport == Rapport(chunks_vus=1, exportes=0, deja_presents=0, supprimes=0, lignes=2)
+
+    sortie = capsys.readouterr().out
+    assert "octets à exporter, suppression simulée." in sortie
+    assert "Dry-run terminé : rien n'a été écrit ni supprimé." in sortie
+
+
+async def test_archive_reading_chunks_keeps_the_chunk_when_the_read_back_differs() -> None:
+    engine, store, journal = make_archive(corrompt=True)
+    borne = datetime(2023, 10, 1, tzinfo=UTC)
+
+    with pytest.raises(RuntimeError, match="sha256 sha-corrompu au lieu de"):
+        await archive_reading_chunks(engine, store, older_than=borne, dry_run=False)
+
+    assert "put" in journal
+    assert "drop" not in journal
+
+
+async def test_archive_reading_chunks_drops_an_empty_chunk_without_exporting(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    engine, store, journal = make_archive(rows=[])
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=False
+    )
+
+    assert "put" not in journal
+    assert "relire" not in journal
+    assert journal[-2:] == ["begin", "drop"]
+    assert rapport == Rapport(chunks_vus=1, exportes=0, deja_presents=0, supprimes=1, lignes=0)
+    assert "vide, rien à exporter" in capsys.readouterr().out
+
+
+async def test_archive_reading_chunks_handles_each_chunk_in_turn() -> None:
+    suivant = Chunk(
+        schema=CHUNK.schema,
+        name="_hyper_1_8_chunk",
+        range_start=CHUNK.range_end,
+        range_end=CHUNK.range_end + timedelta(days=7),
+    )
+    engine, store, journal = make_archive(chunks=[CHUNK, suivant])
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=False
+    )
+
+    assert rapport == Rapport(chunks_vus=2, exportes=2, deja_presents=0, supprimes=2, lignes=4)
+    assert set(store.objets) == {CLE_ATTENDUE, object_key(suivant)}
+    assert journal.count("drop") == 2
+
+
+async def test_archive_reading_chunks_reports_nothing_to_do_without_eligible_chunks(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    engine, store, journal = make_archive(chunks=[])
+
+    rapport = await archive_reading_chunks(
+        engine, store, older_than=datetime(2023, 10, 1, tzinfo=UTC), dry_run=False
+    )
+
+    assert rapport == Rapport()
+    assert journal == ["connect", "lister"]
+    assert "0 chunk(s) de reading" in capsys.readouterr().out
+
+
+def test_build_parser_defaults_to_the_settings_and_a_real_run() -> None:
+    arguments = build_parser().parse_args([])
+
+    assert arguments.older_than_days is None
+    assert arguments.dry_run is False
+
+
+def test_build_parser_reads_the_bound_and_the_dry_run() -> None:
+    arguments = build_parser().parse_args(["--older-than-days", "400", "--dry-run"])
+
+    assert arguments.older_than_days == 400
+    assert arguments.dry_run is True
+
+
+def test_build_parser_refuses_a_non_integer_bound() -> None:
+    parser = build_parser()
+
+    with pytest.raises(SystemExit):
+        parser.parse_args(["--older-than-days", "un-an"])
+
+
+def test_build_parser_answers_help_without_settings(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("APP_SECRET_KEY", raising=False)
+    parser = build_parser()
+
+    with pytest.raises(SystemExit) as sortie:
+        parser.parse_args(["--help"])
+
+    assert sortie.value.code == 0
+
+
+@pytest.fixture
+def main_branche(monkeypatch: pytest.MonkeyPatch) -> dict[str, Any]:
+    capture: dict[str, Any] = {}
+    journal: list[str] = []
+    engine = FakeEngine(FakeConn(journal, [], []), journal)
+    store = FakeStore(journal)
+
+    async def faux_archive(
+        engine_recu: Any, store_recu: Any, *, older_than: datetime, dry_run: bool
+    ) -> Rapport:
+        capture.update(engine=engine_recu, store=store_recu, older_than=older_than, dry_run=dry_run)
+        return Rapport()
+
+    def faux_engine(url: str, **kwargs: Any) -> FakeEngine:
+        capture["url"] = url
+        capture["engine_kwargs"] = kwargs
+        return engine
+
+    monkeypatch.setattr(reading_retention, "get_settings", settings_s3)
+    monkeypatch.setattr(reading_retention, "build_archive_store", lambda settings: store)
+    monkeypatch.setattr(reading_retention, "create_async_engine", faux_engine)
+    monkeypatch.setattr(reading_retention, "archive_reading_chunks", faux_archive)
+    capture["journal"] = journal
+    capture["store_attendu"] = store
+    capture["engine_attendu"] = engine
+    return capture
+
+
+def test_main_uses_the_retention_setting_by_default(main_branche: dict[str, Any]) -> None:
+    avant = datetime.now(UTC)
+
+    reading_retention.main([])
+
+    attendu = avant - timedelta(days=1095)
+    assert timedelta(0) <= main_branche["older_than"] - attendu < timedelta(seconds=5)
+    assert main_branche["dry_run"] is False
+    assert main_branche["store"] is main_branche["store_attendu"]
+    assert main_branche["engine"] is main_branche["engine_attendu"]
+    assert main_branche["url"] == "postgresql+asyncpg://retention:test@localhost:5432/enervision"
+    assert main_branche["engine_kwargs"] == {"pool_pre_ping": True}
+    assert main_branche["journal"] == ["dispose"]
+
+
+def test_main_honours_an_explicit_bound_and_the_dry_run(main_branche: dict[str, Any]) -> None:
+    avant = datetime.now(UTC)
+
+    reading_retention.main(["--older-than-days", "10", "--dry-run"])
+
+    attendu = avant - timedelta(days=10)
+    assert timedelta(0) <= main_branche["older_than"] - attendu < timedelta(seconds=5)
+    assert main_branche["dry_run"] is True
+
+
+def test_main_fails_before_touching_the_database_without_s3_settings(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(reading_retention, "get_settings", lambda: settings_s3(s3_bucket=None))
+    monkeypatch.setattr(
+        reading_retention,
+        "create_async_engine",
+        lambda *_, **__: pytest.fail("l'engine ne doit pas être créé"),
+    )
+
+    with pytest.raises(ValueError, match="APP_S3_BUCKET"):
+        reading_retention.main([])

apps/backend/tests/repositories/test_alert.py

@@ -5,6 +5,7 @@ import pytest
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.energy import Alert
+from app.repositories import alert as module_alert
 from app.repositories.alert import AlertRepository
 from app.schemas.alert import AlertSeverity
 from tests.repositories.test_site import creer as creer_site
@@ -146,3 +147,20 @@ async def test_create_many_does_nothing_for_an_empty_list(session: AsyncSession)
     creees = await depot.create_many([])
 
     assert creees == []
+
+
+async def test_create_many_inserts_every_alert_across_several_batches(
+    session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(module_alert, "TAILLE_DE_LOT", 2)
+    site = await creer_site(session)
+    depot = AlertRepository(session)
+    a_inserer = [
+        _alerte_a_inserer(site_id=site.site_id, source_alert_id=f"threshold:lot-{index}")
+        for index in range(5)
+    ]
+
+    creees = await depot.create_many(a_inserer)
+    await session.rollback()
+
+    assert len(creees) == 5

apps/backend/tests/repositories/test_audit_log.py

@@ -49,8 +49,10 @@ async def test_the_database_refuses_to_mutate_the_audit_log(
 ) -> None:
     await une_ligne(session)
 
+    requete = text(instruction)
+
     with pytest.raises(DBAPIError, match="ajout seul"):
-        await session.execute(text(instruction))
+        await session.execute(requete)
     await session.rollback()
 
 

apps/backend/tests/repositories/test_drift.py

@@ -0,0 +1,187 @@
+from datetime import UTC, datetime, timedelta
+
+import pytest
+from sqlalchemy.dialects import postgresql
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.sql import ClauseElement
+
+from app.repositories.drift import (
+    DriftRepository,
+    NouveauRapportDerive,
+    _lectures_retenues,
+    _predictions_retenues,
+)
+from tests.repositories.test_prediction import creer_prediction
+from tests.repositories.test_reading import creer_lecture
+from tests.repositories.test_site import creer as creer_site
+
+DEBUT = datetime(2026, 9, 15, tzinfo=UTC)
+FIN = datetime(2026, 9, 22, tzinfo=UTC)
+CIBLE = datetime(2026, 9, 16, 12, tzinfo=UTC)
+
+
+def sql(requete: ClauseElement) -> str:
+    return str(requete.compile(dialect=postgresql.dialect()))  # type: ignore[no-untyped-call]
+
+
+def rapport(**remplacements: object) -> NouveauRapportDerive:
+    defauts: dict[str, object] = {
+        "site_id": None,
+        "window_start": DEBUT,
+        "window_end": FIN,
+        "reference_start": None,
+        "reference_end": None,
+        "n_observations": 10,
+        "mae": 1.0,
+        "mape": 5.0,
+        "bias": 0.1,
+        "reference_mae": None,
+        "coverage_ratio": 1.0,
+        "insufficient_data_ratio": 0.0,
+        "model_references": ["lightgbm-aaa"],
+        "status": "stable",
+        "reason": None,
+    }
+    return NouveauRapportDerive(**{**defauts, **remplacements})  # type: ignore[arg-type]
+
+
+def test_predictions_keep_one_row_per_site_and_target_in_sql() -> None:
+    requete = sql(_predictions_retenues(debut=DEBUT, fin=FIN, site_id=None).element)
+
+    assert "DISTINCT ON (prediction.site_id, prediction.target_at)" in requete
+    assert "prediction.prediction_id DESC" in requete
+
+
+def test_readings_keep_one_row_per_site_and_instant_in_sql() -> None:
+    requete = sql(_lectures_retenues(debut=DEBUT, fin=FIN, site_id=None).element)
+
+    assert "DISTINCT ON (reading.site_id, reading.timestamp)" in requete
+    assert "reading.reading_id DESC" in requete
+
+
+def test_predictions_restrict_themselves_to_the_requested_site_in_sql() -> None:
+    requete = sql(_predictions_retenues(debut=DEBUT, fin=FIN, site_id="SITE001").element)
+
+    assert requete.count("prediction.site_id = ") == 1
+
+
+def test_readings_ignore_a_missing_consumption_in_sql() -> None:
+    requete = sql(_lectures_retenues(debut=DEBUT, fin=FIN, site_id=None).element)
+
+    assert "reading.consumption_kwh IS NOT NULL" in requete
+
+
+@pytest.mark.integration
+async def test_repository_pairs_a_prediction_with_the_reading_of_the_same_instant(
+    session: AsyncSession,
+) -> None:
+    site = await creer_site(session)
+    await creer_prediction(session, site_id=site.site_id, target_at=CIBLE, predicted_value=12.0)
+    await creer_lecture(session, site_id=site.site_id, timestamp=CIBLE, consumption_kwh=10.0)
+
+    paires = await DriftRepository(session).paires(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    await session.rollback()
+
+    assert [(p.predicted_value, p.actual_value) for p in paires] == [(12.0, 10.0)]
+
+
+@pytest.mark.integration
+async def test_repository_keeps_the_latest_run_when_several_predictions_share_a_target(
+    session: AsyncSession,
+) -> None:
+    site = await creer_site(session)
+    await creer_prediction(session, site_id=site.site_id, target_at=CIBLE, predicted_value=12.0)
+    await creer_prediction(session, site_id=site.site_id, target_at=CIBLE, predicted_value=99.0)
+    await creer_lecture(session, site_id=site.site_id, timestamp=CIBLE, consumption_kwh=10.0)
+
+    paires = await DriftRepository(session).paires(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    await session.rollback()
+
+    assert [p.predicted_value for p in paires] == [99.0]
+
+
+@pytest.mark.integration
+async def test_repository_keeps_one_reading_per_instant_when_two_sources_wrote_the_same_hour(
+    session: AsyncSession,
+) -> None:
+    site = await creer_site(session)
+    await creer_prediction(session, site_id=site.site_id, target_at=CIBLE, predicted_value=12.0)
+    await creer_lecture(
+        session, site_id=site.site_id, timestamp=CIBLE, source="api_current", consumption_kwh=10.0
+    )
+    await creer_lecture(
+        session, site_id=site.site_id, timestamp=CIBLE, source="api_history", consumption_kwh=20.0
+    )
+
+    paires = await DriftRepository(session).paires(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    await session.rollback()
+
+    assert [p.actual_value for p in paires] == [20.0]
+
+
+@pytest.mark.integration
+async def test_repository_excludes_an_insufficient_data_prediction_from_the_pairs(
+    session: AsyncSession,
+) -> None:
+    site = await creer_site(session)
+    await creer_prediction(
+        session,
+        site_id=site.site_id,
+        target_at=CIBLE,
+        predicted_value=None,
+        status="insufficient_data",
+        failure_reason="historique trop court",
+    )
+    await creer_lecture(session, site_id=site.site_id, timestamp=CIBLE, consumption_kwh=10.0)
+
+    depot = DriftRepository(session)
+    paires = await depot.paires(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    comptages = await depot.comptages(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    await session.rollback()
+
+    assert paires == []
+    assert [(c.status, c.nombre) for c in comptages] == [("insufficient_data", 1)]
+
+
+@pytest.mark.integration
+async def test_repository_excludes_a_target_outside_the_window(session: AsyncSession) -> None:
+    site = await creer_site(session)
+    hors_fenetre = FIN + timedelta(hours=1)
+    await creer_prediction(
+        session, site_id=site.site_id, target_at=hors_fenetre, predicted_value=12.0
+    )
+    await creer_lecture(session, site_id=site.site_id, timestamp=hors_fenetre, consumption_kwh=10.0)
+
+    paires = await DriftRepository(session).paires(debut=DEBUT, fin=FIN, site_id=site.site_id)
+    await session.rollback()
+
+    assert paires == []
+
+
+@pytest.mark.integration
+async def test_repository_reads_back_the_global_report_it_wrote(session: AsyncSession) -> None:
+    depot = DriftRepository(session)
+    fenetre = datetime(2035, 3, 1, tzinfo=UTC)
+
+    ecrites = await depot.enregistre([rapport(window_end=fenetre)])
+    derniers = await depot.derniers()
+    globaux = [r for r in derniers if r.site_id is None and r.window_end == fenetre]
+    await session.rollback()
+
+    assert ecrites == 1
+    assert len(globaux) == 1
+
+
+@pytest.mark.integration
+async def test_repository_ignores_a_second_report_for_the_same_window_and_site(
+    session: AsyncSession,
+) -> None:
+    depot = DriftRepository(session)
+    fenetre = datetime(2035, 4, 1, tzinfo=UTC)
+
+    premiere = await depot.enregistre([rapport(window_end=fenetre)])
+    seconde = await depot.enregistre([rapport(window_end=fenetre, status="derive", reason="x")])
+    await session.rollback()
+
+    assert premiere == 1
+    assert seconde == 0

apps/backend/tests/repositories/test_password_reset_token.py

@@ -131,11 +131,14 @@ async def test_the_database_refuses_two_tokens_sharing_a_fingerprint(
         user_agent=None,
     )
 
+    empreinte = fingerprint_refresh(secret)
+    expiration = datetime.now(UTC) + DUREE
+
     with pytest.raises(IntegrityError):
         await depot.create(
             user_id=compte,
-            token_hash=fingerprint_refresh(secret),
-            expires_at=datetime.now(UTC) + DUREE,
+            token_hash=empreinte,
+            expires_at=expiration,
             client_ip=None,
             user_agent=None,
         )

apps/backend/tests/repositories/test_reading.py

@@ -33,6 +33,9 @@ async def creer_lecture(session: AsyncSession, *, site_id: str, **overrides: obj
         timestamp=overrides.get("timestamp", datetime(2026, 9, 16, tzinfo=UTC)),
         source=overrides.get("source", "api_current"),
         consumption_kw=overrides.get("consumption_kw", 10.0),
+        # Nul par defaut : seules les mesures en kWh alimentent la comparaison prevu/realise, et
+        # un override silencieusement ignore laissait la colonne vide sans que rien ne le dise.
+        consumption_kwh=overrides.get("consumption_kwh"),
         data_quality=overrides.get("data_quality", "good"),
         raw_data=overrides.get("raw_data", {}),
     )

apps/backend/tests/repositories/test_recommendation.py

@@ -5,7 +5,8 @@ import pytest
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.energy import Alert, Recommendation, Site
-from app.repositories.recommendation import RecommendationRepository
+from app.repositories import recommendation as module_recommendation
+from app.repositories.recommendation import NouvelleRecommandation, RecommendationRepository
 
 pytestmark = pytest.mark.integration
 
@@ -83,3 +84,59 @@ async def test_list_all_returns_the_recommendations_sorted_by_identifier(
     await session.rollback()
 
     assert identifiants == sorted(identifiants)
+
+
+def nouvelle(alert_id: int, reference: str = "spike-delestage-v1") -> NouvelleRecommandation:
+    return NouvelleRecommandation(
+        alert_id=alert_id,
+        action="Délester les équipements non prioritaires",
+        explanation="Pic de consommation signalé.",
+        rule_reference=reference,
+    )
+
+
+async def test_create_missing_inserts_the_proposals(session: AsyncSession) -> None:
+    depot = RecommendationRepository(session)
+    alert_id = await creer_alerte(session)
+
+    creees = await depot.create_missing(
+        [nouvelle(alert_id), nouvelle(alert_id, "escalade-astreinte-v1")]
+    )
+    await session.rollback()
+
+    assert creees == 2
+
+
+async def test_create_missing_ignores_a_rule_already_held_for_the_alert(
+    session: AsyncSession,
+) -> None:
+    depot = RecommendationRepository(session)
+    alert_id = await creer_alerte(session)
+    await depot.create_missing([nouvelle(alert_id)])
+
+    creees = await depot.create_missing([nouvelle(alert_id)])
+    await session.rollback()
+
+    assert creees == 0
+
+
+async def test_create_missing_returns_zero_without_any_proposal(session: AsyncSession) -> None:
+    creees = await RecommendationRepository(session).create_missing([])
+
+    assert creees == 0
+
+
+async def test_create_missing_inserts_every_proposal_across_several_batches(
+    session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(module_recommendation, "TAILLE_DE_LOT", 2)
+    depot = RecommendationRepository(session)
+    alert_id = await creer_alerte(session)
+    propositions = [nouvelle(alert_id, f"regle-{index}-v1") for index in range(5)]
+
+    creees = await depot.create_missing(propositions)
+    enregistrees = [r for r in await depot.list_all() if r.alert_id == alert_id]
+    await session.rollback()
+
+    assert creees == 5
+    assert len(enregistrees) == 5

apps/backend/tests/repositories/test_refresh_token.py

@@ -178,12 +178,16 @@ async def test_the_database_refuses_two_tokens_sharing_a_fingerprint(
         user_agent=None,
     )
 
+    famille = uuid.uuid4()
+    empreinte = fingerprint_refresh(secret)
+    expiration = datetime.now(UTC) + DUREE
+
     with pytest.raises(IntegrityError):
         await depot.create(
             user_id=compte,
-            family_id=uuid.uuid4(),
-            token_hash=fingerprint_refresh(secret),
-            expires_at=datetime.now(UTC) + DUREE,
+            family_id=famille,
+            token_hash=empreinte,
+            expires_at=expiration,
             client_ip=None,
             user_agent=None,
         )

apps/backend/tests/repositories/test_user.py

@@ -31,14 +31,12 @@ async def test_the_database_refuses_an_email_written_in_upper_case(
 ) -> None:
     saisie = adresse().upper()
 
+    requete = text(
+        "insert into app_user (email, password_hash, role) values (:e, '$argon2id$x', 'lecteur')"
+    )
+
     with pytest.raises(IntegrityError):
-        await session.execute(
-            text(
-                "insert into app_user (email, password_hash, role) "
-                "values (:e, '$argon2id$x', 'lecteur')"
-            ),
-            {"e": saisie},
-        )
+        await session.execute(requete, {"e": saisie})
     await session.rollback()
 
 

apps/backend/tests/services/test_drift.py

@@ -0,0 +1,271 @@
+from collections.abc import Sequence
+from datetime import UTC, datetime, timedelta
+
+import pytest
+
+from app.repositories.drift import ComptageStatut, PaireDerive
+from app.services.drift import (
+    STATUT_DERIVE,
+    STATUT_INDETERMINE,
+    STATUT_STABLE,
+    DriftService,
+    Seuils,
+    mesure,
+)
+
+INSTANT = datetime(2026, 9, 22, 12, 0, tzinfo=UTC)
+
+
+def paire(
+    *, site_id: str = "SITE001", prevu: float, reel: float, reference: str = "lightgbm-aaa"
+) -> PaireDerive:
+    return PaireDerive(
+        site_id=site_id,
+        target_at=INSTANT,
+        predicted_value=prevu,
+        actual_value=reel,
+        model_reference=reference,
+    )
+
+
+def paires(
+    *, site_id: str = "SITE001", nombre: int, prevu: float, reel: float
+) -> list[PaireDerive]:
+    return [paire(site_id=site_id, prevu=prevu, reel=reel) for _ in range(nombre)]
+
+
+class FauxDepot:
+    def __init__(
+        self,
+        *,
+        recentes: Sequence[PaireDerive] = (),
+        anciennes: Sequence[PaireDerive] = (),
+        comptages: Sequence[ComptageStatut] = (),
+    ) -> None:
+        self.recentes = list(recentes)
+        self.anciennes = list(anciennes)
+        self._comptages = list(comptages)
+        self.fenetres: list[tuple[datetime, datetime]] = []
+
+    async def paires(
+        self, *, debut: datetime, fin: datetime, site_id: str | None = None
+    ) -> Sequence[PaireDerive]:
+        self.fenetres.append((debut, fin))
+        return self.recentes if len(self.fenetres) == 1 else self.anciennes
+
+    async def comptages(
+        self, *, debut: datetime, fin: datetime, site_id: str | None = None
+    ) -> Sequence[ComptageStatut]:
+        return self._comptages
+
+
+def service(depot: FauxDepot, **surcharges: object) -> DriftService:
+    return DriftService(depot, seuils=Seuils(**surcharges))  # type: ignore[arg-type]
+
+
+def test_drift_averages_the_absolute_gap_between_forecast_and_actual() -> None:
+    metriques = mesure([paire(prevu=12.0, reel=10.0), paire(prevu=8.0, reel=10.0)])
+
+    assert metriques.mae == 2.0
+    assert metriques.n_observations == 2
+
+
+def test_drift_computes_a_signed_bias_when_the_model_overforecasts() -> None:
+    metriques = mesure([paire(prevu=12.0, reel=10.0), paire(prevu=14.0, reel=10.0)])
+
+    assert metriques.bias == 3.0
+
+
+def test_drift_computes_a_negative_bias_when_the_model_underforecasts() -> None:
+    metriques = mesure([paire(prevu=8.0, reel=10.0), paire(prevu=6.0, reel=10.0)])
+
+    assert metriques.bias == -3.0
+
+
+def test_drift_excludes_a_zero_actual_from_the_mape_only() -> None:
+    metriques = mesure([paire(prevu=11.0, reel=10.0), paire(prevu=5.0, reel=0.0)])
+
+    assert metriques.mape == 10.0
+    assert metriques.n_observations == 2
+    assert metriques.mae == 3.0
+
+
+def test_drift_reports_no_mape_when_every_actual_is_zero() -> None:
+    metriques = mesure([paire(prevu=1.0, reel=0.0)])
+
+    assert metriques.mape is None
+
+
+def test_drift_lists_every_model_reference_seen_in_the_window() -> None:
+    metriques = mesure(
+        [paire(prevu=10.0, reel=10.0, reference="lightgbm-bbb"), paire(prevu=10.0, reel=10.0)]
+    )
+
+    assert metriques.model_references == ["lightgbm-aaa", "lightgbm-bbb"]
+
+
+async def test_drift_reports_indetermine_when_the_window_holds_too_few_observations() -> None:
+    depot = FauxDepot(recentes=paires(nombre=3, prevu=10.0, reel=10.0))
+
+    rapports = await service(depot, min_observations=24).evaluate(now=INSTANT)
+
+    assert {rapport.status for rapport in rapports} == {STATUT_INDETERMINE}
+    assert all(rapport.reason for rapport in rapports)
+
+
+async def test_drift_reports_derive_when_the_recent_mae_exceeds_the_reference_ratio() -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=14.0, reel=10.0),
+        anciennes=paires(nombre=30, prevu=11.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == STATUT_DERIVE
+    assert global_.mae == 4.0
+    assert global_.reference_mae == 1.0
+
+
+async def test_drift_reports_stable_when_the_recent_mae_stays_close_to_the_reference() -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=11.0, reel=10.0),
+        anciennes=paires(nombre=30, prevu=11.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == STATUT_STABLE
+    assert global_.reason is None
+
+
+async def test_drift_reports_derive_when_the_coverage_ratio_falls_under_the_threshold() -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=10.0, reel=10.0),
+        anciennes=paires(nombre=30, prevu=10.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=100)],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == STATUT_DERIVE
+    assert global_.coverage_ratio == 0.3
+
+
+async def test_drift_reports_one_line_per_site_and_one_global_line() -> None:
+    depot = FauxDepot(
+        recentes=[
+            *paires(site_id="SITE001", nombre=12, prevu=10.0, reel=10.0),
+            *paires(site_id="SITE002", nombre=12, prevu=10.0, reel=10.0),
+        ],
+        comptages=[
+            ComptageStatut(site_id="SITE001", status="available", nombre=12),
+            ComptageStatut(site_id="SITE002", status="available", nombre=12),
+        ],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    assert [rapport.site_id for rapport in rapports] == ["SITE001", "SITE002", None]
+    assert next(r for r in rapports if r.site_id is None).n_observations == 24
+
+
+async def test_drift_measures_the_share_of_sites_left_without_enough_history() -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=10.0, reel=10.0),
+        comptages=[
+            ComptageStatut(site_id="SITE001", status="available", nombre=30),
+            ComptageStatut(site_id="SITE001", status="insufficient_data", nombre=10),
+        ],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    assert next(r for r in rapports if r.site_id is None).insufficient_data_ratio == 0.25
+
+
+async def test_drift_closes_the_window_before_the_grace_delay() -> None:
+    depot = FauxDepot()
+
+    await service(depot, grace=timedelta(hours=2), fenetre=timedelta(hours=168)).evaluate(
+        now=INSTANT
+    )
+
+    recente, reference = depot.fenetres
+    assert recente[1] == INSTANT - timedelta(hours=2)
+    assert recente[0] == INSTANT - timedelta(hours=170)
+    assert reference[1] == recente[0]
+
+
+@pytest.mark.parametrize(
+    ("prevu", "attendu"),
+    [(10.0, STATUT_STABLE), (30.0, STATUT_DERIVE)],
+    ids=["mae_stable", "mae_triplee"],
+)
+async def test_drift_compares_the_recent_window_to_the_reference_one(
+    prevu: float, attendu: str
+) -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=prevu, reel=10.0),
+        anciennes=paires(nombre=30, prevu=10.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10, mae_plancher=1.0).evaluate(now=INSTANT)
+
+    assert next(r for r in rapports if r.site_id is None).status == attendu
+
+
+async def test_drift_leaves_the_bias_out_of_the_verdict_by_default() -> None:
+    # Le modèle surestime de 3 kWh à chaque heure, et le verdict reste `stable` : le biais est
+    # mesuré et servi, il ne juge pas tant que `--bias-threshold` n'a pas été réglé (ADR 0013).
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=13.0, reel=10.0),
+        anciennes=paires(nombre=30, prevu=13.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == STATUT_STABLE
+    assert global_.bias == 3.0
+
+
+@pytest.mark.parametrize(
+    ("prevu", "attendu"),
+    [(13.0, STATUT_DERIVE), (11.0, STATUT_STABLE)],
+    ids=["biais_au_dela", "biais_sous_le_seuil"],
+)
+async def test_drift_reports_derive_on_the_bias_once_a_threshold_is_set(
+    prevu: float, attendu: str
+) -> None:
+    # MAE récente et MAE de référence sont égales : seul le biais peut faire basculer le verdict.
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=prevu, reel=10.0),
+        anciennes=paires(nombre=30, prevu=prevu, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10, seuil_biais=2.0).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == attendu
+
+
+async def test_drift_prefers_the_mae_reason_when_both_the_mae_and_the_bias_exceed() -> None:
+    depot = FauxDepot(
+        recentes=paires(nombre=30, prevu=20.0, reel=10.0),
+        anciennes=paires(nombre=30, prevu=11.0, reel=10.0),
+        comptages=[ComptageStatut(site_id="SITE001", status="available", nombre=30)],
+    )
+
+    rapports = await service(depot, min_observations=10, seuil_biais=2.0).evaluate(now=INSTANT)
+
+    global_ = next(rapport for rapport in rapports if rapport.site_id is None)
+    assert global_.status == STATUT_DERIVE
+    assert "MAE" in (global_.reason or "")

apps/backend/tests/services/test_reading.py

@@ -116,13 +116,11 @@ async def test_list_history_normalizes_naive_datetimes_to_utc() -> None:
 async def test_list_history_raises_when_start_is_after_end() -> None:
     service = ReadingService(readings=FakeRepository([]))
 
+    debut = datetime(2026, 9, 2, tzinfo=UTC)
+    fin = datetime(2026, 9, 1, tzinfo=UTC)
+
     with pytest.raises(FenetreInverseeError):
-        await service.list_history(
-            start=datetime(2026, 9, 2, tzinfo=UTC),
-            end=datetime(2026, 9, 1, tzinfo=UTC),
-            limit=500,
-            offset=0,
-        )
+        await service.list_history(start=debut, end=fin, limit=500, offset=0)
 
 
 async def test_list_history_raises_when_start_equals_end() -> None:

apps/backend/tests/services/test_recommendation.py

@@ -1,10 +1,14 @@
+from collections.abc import Sequence
 from datetime import UTC, datetime
 
 import pytest
 
-from app.models.energy import Recommendation
+from app.models.energy import Alert, Recommendation
+from app.repositories.recommendation import NouvelleRecommandation
 from app.services.recommendation import RecommendationNotFoundError, RecommendationService
 
+MOMENT = datetime(2024, 1, 1, tzinfo=UTC)
+
 
 def recommendation(recommendation_id: int = 1) -> Recommendation:
     return Recommendation(
@@ -13,13 +17,33 @@ def recommendation(recommendation_id: int = 1) -> Recommendation:
         action="Vérifier la consommation",
         explanation="Pic détecté",
         rule_reference="spike-v1",
-        created_at=datetime(2024, 1, 1, tzinfo=UTC),
+        created_at=MOMENT,
+    )
+
+
+def alerte(alert_id: int = 1, site_id: str = "SITE001", severity: str = "high") -> Alert:
+    return Alert(
+        alert_id=alert_id,
+        source_alert_id=f"ALR-{alert_id}",
+        site_id=site_id,
+        source="api_mock",
+        timestamp=MOMENT,
+        type="spike",
+        severity=severity,
+        message="Pic de consommation",
+        value=None,
+        threshold=None,
+        metric=None,
+        prediction_id=None,
+        raw_data={},
     )
 
 
 class FakeRepository:
-    def __init__(self, recommendations: list[Recommendation]) -> None:
+    def __init__(self, recommendations: list[Recommendation], creees: int | None = None) -> None:
         self._recommendations = recommendations
+        self._creees = creees
+        self.recues: list[NouvelleRecommandation] = []
 
     async def list_all(self) -> list[Recommendation]:
         return self._recommendations
@@ -29,27 +53,111 @@ class FakeRepository:
             (r for r in self._recommendations if r.recommendation_id == recommendation_id), None
         )
 
+    async def create_missing(self, nouvelles: Sequence[NouvelleRecommandation]) -> int:
+        self.recues = list(nouvelles)
+        return len(self.recues) if self._creees is None else self._creees
 
-async def test_list_all_returns_the_repository_recommendations() -> None:
-    service = RecommendationService(
-        recommendations=FakeRepository([recommendation(1), recommendation(2)])
+
+class FakeAlertRepository:
+    def __init__(self, alertes: list[Alert]) -> None:
+        self._alertes = alertes
+        self.site_demande: str | None = None
+
+    async def list_all(
+        self, *, site_id: str | None = None, severity: str | None = None
+    ) -> list[Alert]:
+        self.site_demande = site_id
+        if site_id is None:
+            return self._alertes
+        return [a for a in self._alertes if a.site_id == site_id]
+
+
+class FakeTransaction:
+    def __init__(self) -> None:
+        self.commits = 0
+
+    async def commit(self) -> None:
+        self.commits += 1
+
+
+def service(
+    recommendations: FakeRepository | None = None,
+    alerts: FakeAlertRepository | None = None,
+    transaction: FakeTransaction | None = None,
+) -> RecommendationService:
+    return RecommendationService(
+        recommendations=recommendations or FakeRepository([]),
+        alerts=alerts or FakeAlertRepository([]),
+        transaction=transaction or FakeTransaction(),
     )
 
-    recommendations = await service.list_all()
+
+async def test_list_all_returns_the_repository_recommendations() -> None:
+    depot = FakeRepository([recommendation(1), recommendation(2)])
+
+    recommendations = await service(recommendations=depot).list_all()
 
     assert [r.recommendation_id for r in recommendations] == [1, 2]
 
 
 async def test_get_by_id_returns_the_matching_recommendation() -> None:
-    service = RecommendationService(recommendations=FakeRepository([recommendation(1)]))
-
-    trouve = await service.get_by_id(1)
+    trouve = await service(recommendations=FakeRepository([recommendation(1)])).get_by_id(1)
 
     assert trouve.recommendation_id == 1
 
 
 async def test_get_by_id_raises_when_the_recommendation_is_unknown() -> None:
-    service = RecommendationService(recommendations=FakeRepository([]))
-
     with pytest.raises(RecommendationNotFoundError):
-        await service.get_by_id(404)
+        await service().get_by_id(404)
+
+
+async def test_generate_persists_one_proposal_per_triggered_rule() -> None:
+    depot = FakeRepository([])
+
+    rapport = await service(
+        recommendations=depot, alerts=FakeAlertRepository([alerte(severity="critical")])
+    ).generate()
+
+    assert {n.rule_reference for n in depot.recues} == {
+        "spike-delestage-v1",
+        "escalade-astreinte-v1",
+    }
+    assert rapport.recommandations_creees == 2
+
+
+async def test_generate_commits_once() -> None:
+    transaction = FakeTransaction()
+
+    await service(alerts=FakeAlertRepository([alerte()]), transaction=transaction).generate()
+
+    assert transaction.commits == 1
+
+
+async def test_generate_restricts_the_alerts_to_the_requested_site() -> None:
+    alertes = FakeAlertRepository([alerte(1, site_id="SITE001"), alerte(2, site_id="SITE002")])
+    depot = FakeRepository([])
+
+    rapport = await service(recommendations=depot, alerts=alertes).generate(site_id="SITE002")
+
+    assert alertes.site_demande == "SITE002"
+    assert rapport.alertes_examinees == 1
+    assert {n.alert_id for n in depot.recues} == {2}
+
+
+async def test_generate_reports_nothing_when_no_alert_matches() -> None:
+    rapport = await service().generate()
+
+    assert rapport.alertes_examinees == 0
+    assert rapport.recommandations_creees == 0
+    assert rapport.deja_presentes == 0
+
+
+async def test_generate_counts_the_proposals_the_database_already_held() -> None:
+    depot = FakeRepository([], creees=0)
+
+    rapport = await service(
+        recommendations=depot, alerts=FakeAlertRepository([alerte()])
+    ).generate()
+
+    assert rapport.recommandations_creees == 0
+    assert rapport.deja_presentes == 1

apps/backend/tests/services/test_recommendation_rules.py

@@ -0,0 +1,142 @@
+from datetime import UTC, datetime
+
+import pytest
+
+from app.models.energy import Alert
+from app.services.recommendation_rules import FACTEUR_DEPASSEMENT_MAJEUR, applique_les_regles
+
+MOMENT = datetime(2024, 1, 1, tzinfo=UTC)
+
+
+def alerte(
+    *,
+    alert_id: int = 1,
+    type_alerte: str = "spike",
+    severity: str = "high",
+    value: float | None = None,
+    threshold: float | None = None,
+    metric: str | None = None,
+    site_id: str = "SITE001",
+) -> Alert:
+    return Alert(
+        alert_id=alert_id,
+        source_alert_id=f"ALR-{alert_id}",
+        site_id=site_id,
+        source="api_mock",
+        timestamp=MOMENT,
+        type=type_alerte,
+        severity=severity,
+        message="Alerte de test",
+        value=value,
+        threshold=threshold,
+        metric=metric,
+        prediction_id=None,
+        raw_data={},
+    )
+
+
+@pytest.mark.parametrize(
+    ("type_alerte", "attendue"),
+    [
+        ("spike", "spike-delestage-v1"),
+        ("threshold", "threshold-reduction-v1"),
+        ("outage", "outage-secours-v1"),
+        ("sensor", "sensor-maintenance-v1"),
+        ("anomaly", "anomaly-verification-v1"),
+    ],
+    ids=["pic", "seuil", "coupure", "capteur", "anomalie"],
+)
+def test_each_alert_type_yields_its_own_rule(type_alerte: str, attendue: str) -> None:
+    proposees = applique_les_regles(alerte(type_alerte=type_alerte))
+
+    assert [p.rule_reference for p in proposees] == [attendue]
+
+
+def test_a_critical_alert_adds_the_escalation_rule() -> None:
+    proposees = applique_les_regles(alerte(severity="critical"))
+
+    assert "escalade-astreinte-v1" in {p.rule_reference for p in proposees}
+
+
+@pytest.mark.parametrize("severity", ["low", "medium", "high"], ids=["faible", "moyenne", "haute"])
+def test_a_non_critical_alert_does_not_escalate(severity: str) -> None:
+    proposees = applique_les_regles(alerte(severity=severity))
+
+    assert "escalade-astreinte-v1" not in {p.rule_reference for p in proposees}
+
+
+def test_a_large_overshoot_adds_the_contract_rule() -> None:
+    proposees = applique_les_regles(
+        alerte(value=720.0 * FACTEUR_DEPASSEMENT_MAJEUR, threshold=720.0)
+    )
+
+    assert "contrat-puissance-v1" in {p.rule_reference for p in proposees}
+
+
+def test_an_overshoot_below_the_factor_does_not_add_the_contract_rule() -> None:
+    proposees = applique_les_regles(alerte(value=800.0, threshold=720.0))
+
+    assert "contrat-puissance-v1" not in {p.rule_reference for p in proposees}
+
+
+@pytest.mark.parametrize(
+    ("value", "threshold"),
+    [(None, 720.0), (900.0, None), (900.0, 0.0), (900.0, -10.0)],
+    ids=["sans mesure", "sans seuil", "seuil nul", "seuil negatif"],
+)
+def test_the_contract_rule_stays_silent_without_an_exploitable_threshold(
+    value: float | None, threshold: float | None
+) -> None:
+    proposees = applique_les_regles(alerte(value=value, threshold=threshold))
+
+    assert "contrat-puissance-v1" not in {p.rule_reference for p in proposees}
+
+
+def test_the_explanation_quotes_the_measure_and_the_threshold() -> None:
+    proposees = applique_les_regles(alerte(value=812.5, threshold=720.0, metric="consumption_kw"))
+
+    assert "(consumption_kw mesurée à 812.5, seuil 720.0)" in proposees[0].explanation
+
+
+def test_the_explanation_quotes_the_measure_alone_when_no_threshold_is_known() -> None:
+    proposees = applique_les_regles(alerte(value=812.5, metric="consumption_kw"))
+
+    assert "(consumption_kw mesurée à 812.5)" in proposees[0].explanation
+
+
+def test_the_explanation_omits_the_measure_when_the_alert_carries_none() -> None:
+    proposees = applique_les_regles(alerte())
+
+    assert "(" not in proposees[0].explanation
+
+
+def test_the_explanation_names_the_site() -> None:
+    proposees = applique_les_regles(alerte(site_id="SITE042"))
+
+    assert "SITE042" in proposees[0].explanation
+
+
+def test_every_proposal_carries_the_alert_identifier() -> None:
+    proposees = applique_les_regles(alerte(alert_id=77, severity="critical"))
+
+    assert {p.alert_id for p in proposees} == {77}
+
+
+def test_an_alert_never_yields_the_same_rule_twice() -> None:
+    proposees = applique_les_regles(
+        alerte(severity="critical", value=900.0, threshold=720.0, metric="consumption_kw")
+    )
+
+    assert len(proposees) == len({p.rule_reference for p in proposees})
+
+
+def test_a_critical_alert_over_the_threshold_yields_the_three_rules() -> None:
+    proposees = applique_les_regles(
+        alerte(severity="critical", value=900.0, threshold=720.0, metric="consumption_kw")
+    )
+
+    assert {p.rule_reference for p in proposees} == {
+        "spike-delestage-v1",
+        "escalade-astreinte-v1",
+        "contrat-puissance-v1",
+    }

apps/backend/tests/services/test_user.py

@@ -235,5 +235,7 @@ async def test_every_operation_refuses_an_unknown_account(action: str) -> None:
     if action == "set_active":
         arguments["is_active"] = False
 
+    methode = getattr(attirail.service, action)
+
     with pytest.raises(UserNotFoundError):
-        await getattr(attirail.service, action)(**arguments)
+        await methode(**arguments)

apps/backend/tests/test_chaine_ml_api.py

@@ -0,0 +1,223 @@
+"""Piege : ce fichier porte le marqueur `chaine`, pas `integration` - test_the_ml_binaries...()
+
+Il lance les vrais binaires `enervision_ml.train` et `enervision_ml.score` dans l'environnement
+uv de `ml/`, que le job `integration` de `backend.yml` n'installe pas. Un marqueur distinct evite
+que ce job, et `make test`, ne le selectionnent et n'echouent faute de `ml/.venv`.
+"""
+
+import math
+import os
+import subprocess
+from collections.abc import AsyncIterator, Iterator
+from dataclasses import dataclass, field
+from datetime import UTC, datetime, timedelta
+from functools import partial
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+import anyio
+import pytest
+from fastapi import FastAPI
+from httpx import AsyncClient
+from sqlalchemy import delete, insert, make_url
+
+from app.api.deps import get_current_principal
+from app.core.config import get_settings
+from app.core.principal import Principal
+from app.core.roles import AccountKind, Role
+from app.db.session import get_session_factory
+from app.models.energy import Prediction, Reading, Site
+
+pytestmark = pytest.mark.chaine
+
+RACINE = Path(__file__).resolve().parents[3]
+ML = RACINE / "ml"
+PYTHON_ML = Path(os.environ.get("ML_PYTHON", ML / ".venv" / "bin" / "python"))
+
+HEURES_COMPLETES = 400
+HEURES_INSUFFISANTES = 100
+
+
+def lecteur() -> Principal:
+    return Principal(
+        id=uuid4(),
+        email="lecteur@enervision.fr",
+        role=Role.LECTEUR,
+        kind=AccountKind.HUMAIN,
+        must_change_password=False,
+    )
+
+
+def url_ml() -> str:
+    """Derive la chaine du pipeline de celle du backend plutot que de la recopier : les deux
+    cotes visent ainsi la meme base, dans leur dialecte respectif."""
+    return (
+        make_url(get_settings().database_url)
+        .set(drivername="postgresql+psycopg")
+        .render_as_string(hide_password=False)
+    )
+
+
+def lance_ml(module: str, *arguments: str, journal: Path) -> subprocess.CompletedProcess[str]:
+    if not PYTHON_ML.exists():
+        pytest.fail(
+            f"Environnement ml/ absent ({PYTHON_ML}). Lancer `cd ml && uv sync --all-groups`."
+        )
+
+    return subprocess.run(  # noqa: S603 -- argv en liste, sans shell, binaire resolu dans le depot
+        [str(PYTHON_ML), "-m", module, *arguments],
+        cwd=ML,
+        text=True,
+        capture_output=True,
+        timeout=600,
+        check=False,
+        env={
+            **os.environ,
+            "ML_DATABASE_URL": url_ml(),
+            "MLFLOW_TRACKING_URI": f"sqlite:///{journal}/mlflow.db",
+        },
+    )
+
+
+async def executer(module: str, *arguments: str, journal: Path) -> subprocess.CompletedProcess[str]:
+    resultat = await anyio.to_thread.run_sync(
+        partial(lance_ml, module, *arguments, journal=journal)
+    )
+    assert resultat.returncode == 0, resultat.stderr
+    return resultat
+
+
+@dataclass
+class Parc:
+    sites: list[str] = field(default_factory=list)
+
+
+def lignes_horaires(site_id: str, *, heures: int, fin: datetime) -> list[dict[str, Any]]:
+    return [
+        {
+            "site_id": site_id,
+            "timestamp": fin - timedelta(hours=decalage),
+            "source": "api_history",
+            "consumption_kwh": 50.0 + math.sin(decalage / 12.0) * 10.0,
+            "temperature_celsius": 15.0,
+            "humidity_percent": 50.0,
+            "solar_irradiance_wm2": 0.0,
+            "is_working_hours": True,
+            "raw_data": {},
+        }
+        for decalage in reversed(range(heures))
+    ]
+
+
+@pytest.fixture
+async def parc() -> AsyncIterator[Parc]:
+    """Deux sites dotes d'un historique complet, un troisieme qui n'atteint pas le lag de 168 h.
+
+    Les ecritures sont validees : les binaires ML ouvrent leur propre connexion et ne verraient
+    pas une transaction en cours.
+    """
+    fin = datetime.now(UTC).replace(minute=0, second=0, microsecond=0) - timedelta(hours=1)
+    marque = uuid4().hex[:12]
+    complets = [f"TEST-{marque}-A", f"TEST-{marque}-B"]
+    partiel = f"TEST-{marque}-C"
+    parc = Parc(sites=[*complets, partiel])
+
+    async with get_session_factory()() as session:
+        await session.execute(
+            insert(Site),
+            [
+                {
+                    "site_id": site_id,
+                    "site_name": f"Site {site_id}",
+                    "site_type": "office",
+                    "capacity_kw": 100.0,
+                }
+                for site_id in parc.sites
+            ],
+        )
+        for site_id in complets:
+            await session.execute(
+                insert(Reading), lignes_horaires(site_id, heures=HEURES_COMPLETES, fin=fin)
+            )
+        await session.execute(
+            insert(Reading), lignes_horaires(partiel, heures=HEURES_INSUFFISANTES, fin=fin)
+        )
+        await session.commit()
+
+    try:
+        yield parc
+    finally:
+        async with get_session_factory()() as session:
+            await session.execute(delete(Prediction).where(Prediction.site_id.in_(parc.sites)))
+            await session.execute(delete(Reading).where(Reading.site_id.in_(parc.sites)))
+            await session.execute(delete(Site).where(Site.site_id.in_(parc.sites)))
+            await session.commit()
+
+
+@pytest.fixture
+def principal_lecteur(app: FastAPI) -> Iterator[None]:
+    app.dependency_overrides[get_current_principal] = lecteur
+    yield
+    app.dependency_overrides.pop(get_current_principal, None)
+
+
+async def resume_du_site(client: AsyncClient, site_id: str) -> dict[str, Any]:
+    reponse = await client.get("/api/v1/predictions")
+
+    assert reponse.status_code == 200
+    sites = reponse.json()["sites"]
+    return next(site for site in sites if site["site_id"] == site_id)
+
+
+async def entraine_et_score(parc: Parc, tmp_path: Path, *arguments: str) -> Path:
+    modele = tmp_path / "lightgbm-consumption.txt"
+
+    await executer(
+        "enervision_ml.train",
+        "--model-output",
+        str(modele),
+        "--mlflow-tracking-uri",
+        f"sqlite:///{tmp_path}/mlflow.db",
+        journal=tmp_path,
+    )
+    await executer("enervision_ml.score", "--model", str(modele), *arguments, journal=tmp_path)
+
+    return modele
+
+
+async def test_the_ml_binaries_produce_a_prediction_that_the_api_serves(
+    parc: Parc, tmp_path: Path, client: AsyncClient, principal_lecteur: None
+) -> None:
+    await entraine_et_score(parc, tmp_path)
+
+    servi = await resume_du_site(client, parc.sites[0])
+
+    assert servi["prediction"]["status"] == "available"
+    assert servi["prediction"]["predicted_value"] is not None
+    assert servi["prediction"]["target_metric"] == "consumption_kwh"
+
+
+async def test_the_api_exposes_the_failure_reason_of_a_site_without_enough_history(
+    parc: Parc, tmp_path: Path, client: AsyncClient, principal_lecteur: None
+) -> None:
+    await entraine_et_score(parc, tmp_path)
+
+    servi = await resume_du_site(client, parc.sites[-1])
+
+    assert servi["prediction"]["status"] == "insufficient_data"
+    assert servi["prediction"]["predicted_value"] is None
+    assert servi["prediction"]["failure_reason"] is not None
+
+
+async def test_the_api_serves_the_latest_run_when_the_score_cli_runs_twice(
+    parc: Parc, tmp_path: Path, client: AsyncClient, principal_lecteur: None
+) -> None:
+    modele = await entraine_et_score(parc, tmp_path)
+    premier = await resume_du_site(client, parc.sites[0])
+
+    await executer("enervision_ml.score", "--model", str(modele), journal=tmp_path)
+
+    second = await resume_du_site(client, parc.sites[0])
+    assert second["prediction"]["created_at"] >= premier["prediction"]["created_at"]
+    assert second["prediction"]["model_reference"] == premier["prediction"]["model_reference"]

apps/backend/tests/test_cli.py

@@ -19,13 +19,17 @@ def test_build_parser_reads_the_create_admin_arguments() -> None:
 
 
 def test_build_parser_requires_a_subcommand() -> None:
+    parser = cli.build_parser()
+
     with pytest.raises(SystemExit):
-        cli.build_parser().parse_args([])
+        parser.parse_args([])
 
 
 def test_build_parser_requires_an_email() -> None:
+    parser = cli.build_parser()
+
     with pytest.raises(SystemExit):
-        cli.build_parser().parse_args(["create-admin"])
+        parser.parse_args(["create-admin"])
 
 
 def test_read_password_generates_a_long_secret_when_asked(
@@ -118,3 +122,30 @@ def test_main_exports_the_contract_without_asking_for_a_password(
     assert code == 0
     assert destination.exists()
     assert str(destination) in capsys.readouterr().out
+
+
+def test_build_parser_reads_the_generate_recommendations_arguments() -> None:
+    arguments = cli.build_parser().parse_args(["generate-recommendations", "--site-id", "SITE002"])
+
+    assert arguments.commande == "generate-recommendations"
+    assert arguments.site_id == "SITE002"
+
+
+def test_build_parser_defaults_the_generation_to_every_site() -> None:
+    arguments = cli.build_parser().parse_args(["generate-recommendations"])
+
+    assert arguments.site_id is None
+
+
+def test_main_generates_the_recommendations_without_asking_for_a_password(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    async def fausse_generation(*, site_id: str | None) -> str:
+        return f"génération lancée pour {site_id}"
+
+    monkeypatch.setattr(cli, "generate_recommendations", fausse_generation)
+
+    code = cli.main(["generate-recommendations", "--site-id", "SITE002"])
+
+    assert code == 0
+    assert "SITE002" in capsys.readouterr().out

apps/backend/tests/test_drift_cli.py

@@ -0,0 +1,116 @@
+from datetime import UTC, datetime, timedelta
+
+import pytest
+
+from app.monitoring import drift as cli
+from app.repositories.drift import NouveauRapportDerive
+from app.services.drift import STATUT_DERIVE, STATUT_STABLE, Seuils
+
+INSTANT = datetime(2026, 9, 22, 12, tzinfo=UTC)
+
+
+def rapport(*, site_id: str | None, status: str, reason: str | None = None) -> NouveauRapportDerive:
+    return NouveauRapportDerive(
+        site_id=site_id,
+        window_start=INSTANT - timedelta(hours=168),
+        window_end=INSTANT,
+        reference_start=None,
+        reference_end=None,
+        n_observations=48,
+        mae=1.5,
+        mape=12.0,
+        bias=0.3,
+        reference_mae=1.2,
+        coverage_ratio=1.0,
+        insufficient_data_ratio=0.0,
+        model_references=["lightgbm-aaa"],
+        status=status,
+        reason=reason,
+    )
+
+
+def installe(monkeypatch: pytest.MonkeyPatch, rapports: list[NouveauRapportDerive]) -> None:
+    async def fausse_execution(
+        *, now: datetime | None, site_id: str | None, seuils: Seuils | None
+    ) -> list[NouveauRapportDerive]:
+        return rapports
+
+    monkeypatch.setattr(cli, "run_drift", fausse_execution)
+
+
+def test_parse_args_defaults_to_the_standard_window() -> None:
+    arguments = cli.parse_args([])
+
+    assert arguments.window_hours == 168
+    assert arguments.grace_hours == 2
+    assert arguments.fail_on_drift is False
+
+
+def test_parse_args_reads_the_site_id() -> None:
+    assert cli.parse_args(["--site-id", "SITE001"]).site_id == "SITE001"
+
+
+def test_parse_args_parses_the_instant_option() -> None:
+    arguments = cli.parse_args(["--now", "2026-09-22T12:00:00+00:00"])
+
+    assert arguments.now == INSTANT
+
+
+def test_parse_instant_treats_a_naive_datetime_as_utc() -> None:
+    assert cli._parse_instant("2026-09-22T12:00:00") == INSTANT
+
+
+def test_seuils_depuis_translates_the_hour_options_into_durations() -> None:
+    seuils = cli.seuils_depuis(cli.parse_args(["--window-hours", "24", "--grace-hours", "1"]))
+
+    assert seuils.fenetre == timedelta(hours=24)
+    assert seuils.grace == timedelta(hours=1)
+
+
+def test_main_prints_the_verdict_of_every_line(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    installe(
+        monkeypatch,
+        [
+            rapport(site_id="SITE001", status=STATUT_STABLE),
+            rapport(site_id=None, status=STATUT_STABLE),
+        ],
+    )
+
+    code = cli.main([])
+
+    sortie = capsys.readouterr().out
+    assert code == 0
+    assert "SITE001" in sortie
+    assert "TOUS SITES" in sortie
+
+
+def test_main_exits_non_zero_when_drift_is_detected_and_the_flag_is_set(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    installe(monkeypatch, [rapport(site_id=None, status=STATUT_DERIVE, reason="MAE doublée")])
+
+    code = cli.main(["--fail-on-drift"])
+
+    assert code == 1
+    assert "MAE doublée" in capsys.readouterr().out
+
+
+def test_main_exits_zero_when_drift_is_detected_without_the_flag(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    installe(monkeypatch, [rapport(site_id=None, status=STATUT_DERIVE, reason="MAE doublée")])
+
+    code = cli.main([])
+
+    assert code == 0
+    assert capsys.readouterr().out != ""
+
+
+def test_parse_args_leaves_the_bias_threshold_disabled_by_default() -> None:
+    assert cli.parse_args([]).bias_threshold == 0.0
+
+
+def test_seuils_depuis_carries_the_bias_threshold() -> None:
+    assert cli.seuils_depuis(cli.parse_args(["--bias-threshold", "2.5"])).seuil_biais == 2.5

apps/backend/uv.lock

@@ -192,6 +192,43 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/3c/d7/8fb3044eaef08a310acfe23dae9a8e2e07d305edc29a53497e52bc76eca7/asyncpg-0.31.0-cp314-cp314t-win_amd64.whl", hash = "sha256:bd4107bb7cdd0e9e65fae66a62afd3a249663b844fa34d479f6d5b3bef9c04c3", size = 706062, upload-time = "2025-11-24T23:26:44.086Z" },
 ]
 
+[[package]]
+name = "boto3"
+version = "1.43.101"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "botocore" },
+    { name = "jmespath" },
+    { name = "s3transfer" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ad/ef/096f1520a4b0cbc794348fcf77ada637e5f98145c3453f219d678c3a0798/boto3-1.43.101.tar.gz", hash = "sha256:49f3eb750f70e050df9929a7e9392e67896c97d7d0a448f13ed3354c634268bd", size = 112635, upload-time = "2026-09-23T19:23:29.553Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d7/73/8dd65374f88b1b2a33656d9c808dc36aef0cb4a22c74d618ba6fe0092cd2/boto3-1.43.101-py3-none-any.whl", hash = "sha256:8a899b0ea94df3f2fab6d0c69caf2791f2971449696834374d8e88ced01c7ef3", size = 140041, upload-time = "2026-09-23T19:23:27.61Z" },
+]
+
+[[package]]
+name = "botocore"
+version = "1.43.101"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "jmespath" },
+    { name = "python-dateutil" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/12/12/e90cc51bd65ecdcd0eedcd522d3c9f102b1d2c601f39f1f1c256695d63a3/botocore-1.43.101.tar.gz", hash = "sha256:3bc67fb55046e1e05ce5f2bd0171f37bef1cf54161786ef04ff338614d98169e", size = 16202504, upload-time = "2026-09-23T19:23:24.49Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dd/0d/6679253333d6ba74b8ad7077560687096629255ef526e106bb3accceffcc/botocore-1.43.101-py3-none-any.whl", hash = "sha256:f380237ffecc3f887265cd09c4d7e9c8e8dd9ba6162af83b1fc9e5d24622e461", size = 15897867, upload-time = "2026-09-23T19:23:21.643Z" },
+]
+
+[[package]]
+name = "botocore-stubs"
+version = "1.43.67"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/3f/45/53d662227dc4787b2c854445ee7eb4751cb5d74cfb5c686a6ecbe1f94c17/botocore_stubs-1.43.67.tar.gz", hash = "sha256:853e74014a1f557055c4ffae5fb38d7c65c7c0520e1aab366cac41d5428f419d", size = 42846, upload-time = "2026-08-08T14:57:53.412Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4e/5e/bdbf19967898a032292da65a47d6e25b2eee55865db4e687f861d80b5602/botocore_stubs-1.43.67-py3-none-any.whl", hash = "sha256:c51262bac3341c1cda71f05fa01141fffd3990d7a92c7960e3b755c1bc830373", size = 67244, upload-time = "2026-08-08T14:57:52.01Z" },
+]
+
 [[package]]
 name = "certifi"
 version = "2026.7.22"
@@ -325,6 +362,7 @@ dependencies = [
     { name = "anyio" },
     { name = "argon2-cffi" },
     { name = "asyncpg" },
+    { name = "boto3" },
     { name = "fastapi" },
     { name = "httpx" },
     { name = "pandas" },
@@ -345,6 +383,7 @@ dev = [
     { name = "pytest-asyncio" },
     { name = "pytest-cov" },
     { name = "ruff" },
+    { name = "types-boto3", extra = ["s3"] },
 ]
 
 [package.metadata]
@@ -354,6 +393,7 @@ requires-dist = [
     { name = "anyio", specifier = ">=4.0" },
     { name = "argon2-cffi", specifier = ">=23.1" },
     { name = "asyncpg", specifier = ">=0.31.0" },
+    { name = "boto3", specifier = ">=1.43.101" },
     { name = "fastapi", specifier = ">=0.141.1" },
     { name = "httpx", specifier = ">=0.28.1" },
     { name = "pandas", specifier = ">=3.0.5" },
@@ -374,6 +414,7 @@ dev = [
     { name = "pytest-asyncio", specifier = ">=1.4.0" },
     { name = "pytest-cov", specifier = ">=7.1.0" },
     { name = "ruff", specifier = ">=0.16.7" },
+    { name = "types-boto3", extras = ["s3"], specifier = ">=1.43.101" },
 ]
 
 [[package]]
@@ -496,6 +537,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
 ]
 
+[[package]]
+name = "jmespath"
+version = "1.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/59/322338183ecda247fb5d1763a6cbe46eff7222eaeebafd9fa65d4bf5cb11/jmespath-1.1.0.tar.gz", hash = "sha256:472c87d80f36026ae83c6ddd0f1d05d4e510134ed462851fd5f754c8c3cbb88d", size = 27377, upload-time = "2026-01-22T16:35:26.279Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/2f/967ba146e6d58cf6a652da73885f52fc68001525b4197effc174321d70b4/jmespath-1.1.0-py3-none-any.whl", hash = "sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64", size = 20419, upload-time = "2026-01-22T16:35:24.919Z" },
+]
+
 [[package]]
 name = "librt"
 version = "0.15.0"
@@ -655,31 +705,31 @@ wheels = [
 
 [[package]]
 name = "pandas"
-version = "3.0.5"
+version = "3.0.6"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "numpy" },
     { name = "python-dateutil" },
     { name = "tzdata", marker = "sys_platform == 'emscripten' or sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/be/4f/5f3422a2afec5ffc46308b79e53291365a93748b498ac2e58bead0197916/pandas-3.0.5.tar.gz", hash = "sha256:dca3734d6ab7c906e6730f0788b0a1dbb9f2467731f9711f77995c8e9d62d712", size = 4658219, upload-time = "2026-07-22T22:19:28.819Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e2/17/d7b106e05bfa642e8694451e7d3d759c6a241c5386a5d962e4f66c047e06/pandas-3.0.6.tar.gz", hash = "sha256:66b07ef7315a31bfe1089cd3d71a7de781c9dca986762d0b4fe7c0ef17465d10", size = 4667686, upload-time = "2026-09-17T23:23:18.345Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/51/2f/cf6aae281264f4463f0875bcbb15fd2bb6d291cc535187dad1732475e4a9/pandas-3.0.5-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2f264fc46911cc8131a7322a16199bbf8e353d27c10bb211f5bd0c814324dc36", size = 10390034, upload-time = "2026-07-22T22:18:49.818Z" },
-    { url = "https://files.pythonhosted.org/packages/06/ec/5189518c7a7659c4bdcc6b1eb32c46c6f3c86b0661ffd84143d1112c7732/pandas-3.0.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:53730687fcd161883b24e10411c06d6a4c0f2275d2faf3bb2bc25deb4ba8007c", size = 9980065, upload-time = "2026-07-22T22:18:52.249Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/f1/598503ce8d7e3c35601e0747ba288c7864baae66380725bc12f13f884dfe/pandas-3.0.5-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:960d3ebcf249f75206899fcd2c6de53f736b7265759ced0d3e559df0b8b709b0", size = 10545532, upload-time = "2026-07-22T22:18:54.813Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/de/ceae2adf7034e07e9910299fe412e1819c4f0dd520700a888bcb03625448/pandas-3.0.5-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9e94c2c5ca43bd3ca32bf64d32308887b65e5f9bfd8023ea52755107a999f93b", size = 10963120, upload-time = "2026-07-22T22:18:57.42Z" },
-    { url = "https://files.pythonhosted.org/packages/66/25/86e0f4451874eb79e688deeebe3c451fec4557f8952005818d800ee8ac7e/pandas-3.0.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e819dd5f62966b481a8cb649d3299ebd886a1ea91ed5a99bf7ce77c98d18ab94", size = 11563178, upload-time = "2026-07-22T22:18:59.729Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/45/8643daa3b4147e433adfcccefdd0380d3aad79d86b15d8999730fe1944d5/pandas-3.0.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3c5ed2e7c06e91d340dfd091d7934f9bc82e4a36b95f647f090b9d1c9ac649da", size = 12028708, upload-time = "2026-07-22T22:19:02.164Z" },
-    { url = "https://files.pythonhosted.org/packages/96/58/ad979ae617615576e8aafd569c9d4b62f1191d896e38f51d66ba06f3b89a/pandas-3.0.5-cp314-cp314-win_amd64.whl", hash = "sha256:cd8f7c6dc98527058ee6264219343f5392240a6f1bfa654fc5d79023020d0c92", size = 9951806, upload-time = "2026-07-22T22:19:04.596Z" },
-    { url = "https://files.pythonhosted.org/packages/69/32/7ac03886b304049a9d2625ee88f59af760d8a93bd30ed9239bce7b9869a8/pandas-3.0.5-cp314-cp314-win_arm64.whl", hash = "sha256:5183427f5a8156d480f30333777bc978be93650a49a7c01db26adffe95b31e85", size = 9238297, upload-time = "2026-07-22T22:19:06.836Z" },
-    { url = "https://files.pythonhosted.org/packages/be/ed/1d1f2ee5547d5167face2376d11c8b2a4c7bfff5a416ee7a9046891fab1e/pandas-3.0.5-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:303da736987d481074ca720ada325f8bd80c64ebc2d45ed79b29df3aaa4a26ca", size = 10849690, upload-time = "2026-07-22T22:19:09.391Z" },
-    { url = "https://files.pythonhosted.org/packages/57/55/17e17152e98fbb0c4b1e562bc65387a2f20a80db0f4a86bf8d3a0e4248d4/pandas-3.0.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:3b2801bbb049d0136f6c213eae02b5fca969384fc2064dd728d8620552aa49da", size = 10509945, upload-time = "2026-07-22T22:19:11.773Z" },
-    { url = "https://files.pythonhosted.org/packages/88/90/817d44dbf83facf9556f33576d9af0a241981e7bb5c00606c0bcb5df8dda/pandas-3.0.5-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cce3a9d11d2b1f82c69a27ec1f4948a170e2c403c4bbfa8cca62e3fdebe2ef3a", size = 10392197, upload-time = "2026-07-22T22:19:14.024Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/da/889f00c0a6f5aa1545add70abbf01502dff87ab577adb855bd631c54d2f2/pandas-3.0.5-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ef01af4d8dc6cd2c8d6c7736f149574ef93fe043811eeb5e445f2647154b5040", size = 10862726, upload-time = "2026-07-22T22:19:16.351Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/98/f1e934fb3c98fce859c6147c6785816c7b5b9ab7821115c5d8c4de9842b9/pandas-3.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e2759e890db96dfcffdbd9b86c3c2cb6afaf58def482820317e06163ec1066cd", size = 11414864, upload-time = "2026-07-22T22:19:18.981Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/be/d448af7d657d82e1888dd8551f79c6d6fb161080b5b9752d84d910ec2319/pandas-3.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:b58b1b39d46a5862e3fb18f50d1a201398619d16a0f9f73f57eea5583cf0e63c", size = 11925105, upload-time = "2026-07-22T22:19:21.515Z" },
-    { url = "https://files.pythonhosted.org/packages/29/c1/ccb4238212c8c4f496c584f3044d94e0c030ed8e1d68999db46c91c2242f/pandas-3.0.5-cp314-cp314t-win_amd64.whl", hash = "sha256:1c10461f6eeb35d8f05b6184c65c8b9991663b66c46b1d559b682cb34ae7c6ea", size = 10387612, upload-time = "2026-07-22T22:19:24.257Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/cf/6a51b2c38980e04c279fd2fa908a1b0982064e860444acfca4ec2e2c8359/pandas-3.0.5-cp314-cp314t-win_arm64.whl", hash = "sha256:3c5015fd1730fbf883647e88068176c839c102cea883ba1769a6f4593bfc1f8c", size = 9509776, upload-time = "2026-07-22T22:19:26.694Z" },
+    { url = "https://files.pythonhosted.org/packages/75/55/1a8875395b05ccd572cbca0b9255dcd2db6e6508e632a558c1a6884b39ad/pandas-3.0.6-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ee913a91669056c1de1a6b733fbfeab711de9e54e3bee2dfa5fe79d9457247d1", size = 10492213, upload-time = "2026-09-17T23:21:40.746Z" },
+    { url = "https://files.pythonhosted.org/packages/35/61/47ae13476995cc8a40cd609e93e7cf11f273d8692925c2903cb6d38aa0d1/pandas-3.0.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:ff51a4459ed036e93d1eb1bb5e6e7b28685d3cb6b7c12b91c05b31024e234729", size = 10156618, upload-time = "2026-09-17T23:21:44.142Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/f2/cc5f2adb8d6e86a85d9fb5128f8cf205a61189336f70d1f7faf0d1b53ec9/pandas-3.0.6-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:654aae059295dbba6ecd2328ca12712a2cf1676214c8699f1c29213f7ccf9c34", size = 10375479, upload-time = "2026-09-17T23:21:47.159Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ba/ffdcb19be4ff6bfe7d969e7cef2c567c633df5a3a1cc1053394ad053bca8/pandas-3.0.6-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:62f51d7f651c8054c5e82a69265c98082e795d1442df7ca6edc3a545d61214b1", size = 10783244, upload-time = "2026-09-17T23:21:50.367Z" },
+    { url = "https://files.pythonhosted.org/packages/77/5b/e150075b2c6eb69fae896f2d9239bc6ed07db97735971d53d66de6553460/pandas-3.0.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:22172a92e7ee678ec0140c7af4fc9366b55413834a1cd86af78b3caa0b0574de", size = 11382223, upload-time = "2026-09-17T23:21:53.355Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/8a/b441c587dc7355bf6e1f68a91b4f76a6c29740f0c23be3acc5d4ebbeea6d/pandas-3.0.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:583be68728a31d0d750d5b8d9e00f02b153df0d4655f858bde93cb84cfc4227c", size = 11854881, upload-time = "2026-09-17T23:21:56.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e9/f43410fada510b43fec09993c08f552086c3d247d3ee801a678f3cb10ea5/pandas-3.0.6-cp314-cp314-win_amd64.whl", hash = "sha256:77ccbe5057aece6fc172b9b77f19c04335af6882bc2e10c8f3ee4e6bfb3da553", size = 9791672, upload-time = "2026-09-17T23:21:59.332Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/9e/db14c059c21f9baa1907d436f8bf30e0c76c6288225c5e8b79a08ba8b2c5/pandas-3.0.6-cp314-cp314-win_arm64.whl", hash = "sha256:fb625f426b375bcc96e3a04c5d5d266cd7be6ae5d6866e0e703382ab5164068c", size = 9121246, upload-time = "2026-09-17T23:22:02.123Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ba/bad0f8dac020ab38a8637fddab01a57a82da7a496a6e6f19590aad53ab62/pandas-3.0.6-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:9e492cd4bdba6778de4fe0df7f4590c012161ebcf9902dce01b01dc683105514", size = 10920612, upload-time = "2026-09-17T23:22:05.404Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/a9/b500982e9aac6d52a58da4ad3f11e14168a315b06906b3f397c427878065/pandas-3.0.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d7dcd21238cbb4828ff148481ba01cac8946dc5121457b5aeba28636f8f99a60", size = 10570213, upload-time = "2026-09-17T23:22:08.44Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/fa/e6ecd0073c98be8f840ac3125b955272835d7d9fd69f5944383b164deb5e/pandas-3.0.6-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6ff482fa91fa2bafd92e8fe66ce3645c851824310f295c1f0a2f96e928fc4541", size = 10252356, upload-time = "2026-09-17T23:22:11.302Z" },
+    { url = "https://files.pythonhosted.org/packages/04/f5/001e230a7a7803590d9275a1a3f7e1bb605e3a495cfe5e8d3a532090621b/pandas-3.0.6-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:db7ec631f26223beee8e5c9e0b8f23c24d8197bbd1d982421d4e3188bea51965", size = 10655952, upload-time = "2026-09-17T23:22:14.283Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ab/bab587148a3852c96aae26c4b5f9e04ce2221801ad94e166b4fbf969ede0/pandas-3.0.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:bd75ed0c840f709fc2ae26ddd9534ac77ca1a48ac0cce521a74acaa85f3340a7", size = 11274177, upload-time = "2026-09-17T23:22:17.352Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/32/74b48d87df2b80892d713c149abfe36d5db4de41b4eccb042a2bc07dafc1/pandas-3.0.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ef738d71d1059245b6bb03e312be06d8b3821326a83486c1ad03b9aba3710e44", size = 11719041, upload-time = "2026-09-17T23:22:20.227Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/c6/d64b72d64d7eb0fad9fe424d34138e45dee70ddbea1360dcd0adf30e28f6/pandas-3.0.6-cp314-cp314t-win_amd64.whl", hash = "sha256:429d9df32731ab01383ed98f2baa7a60368090d1a94fc06019a12062510e8630", size = 10191388, upload-time = "2026-09-17T23:22:23.524Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/30/5e5b2ccabeca73ae2b03fc82bca3eabb7466cf43737f05ac08d591665d47/pandas-3.0.6-cp314-cp314t-win_arm64.whl", hash = "sha256:a4dbd4dc65cbe645b92b8785d0f96dd7311010dc6606cf620e51b07b8788a12a", size = 9387796, upload-time = "2026-09-17T23:22:26.64Z" },
 ]
 
 [[package]]
@@ -936,27 +986,39 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.16.7"
+version = "0.16.8"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/82/bb/5a449b9162e49b139d72f61672bd3ac1d790221f796d3304e2241fff4c58/ruff-0.16.7.tar.gz", hash = "sha256:5f71d004ac1263b22fa39462ac5ae618a4b77d58981af2cc79bf79a29c12b1a6", size = 4924184, upload-time = "2026-09-10T18:04:06.336Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/78/449cb84790bd5cc3823b2652ee405a4558856e5c4195aee3a16bf7b3eb5d/ruff-0.16.8.tar.gz", hash = "sha256:9247bf92b5f04d825c8639a4fe423ec2e4222acd9222e58412b0dab7e442798b", size = 4938814, upload-time = "2026-09-16T15:54:46.688Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/b2/c80aeeb7f9e469c0d63a85d2f1ab6e1ebfbe10ea7a8d2438b7e09e3ff09e/ruff-0.16.7-py3-none-linux_armv6l.whl", hash = "sha256:727307773e7c7f9181d3ed3a2484186e56c1fa1874255911c74585eb2c7c19f9", size = 10048917, upload-time = "2026-09-10T18:03:30.28Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/96/20bb7bcae008004df52afcb7ac83432d4a467f2c17b672fe46d26be231c5/ruff-0.16.7-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:9d61c258deabf58f34c67bd4bb4d939c7f2e6b5f0e59c1cdd1cf771b11cde929", size = 10242929, upload-time = "2026-09-10T18:03:32.706Z" },
-    { url = "https://files.pythonhosted.org/packages/90/b2/f184b0d5abec02db69cfd7e49b688ae0237554528ca777136c613bf36bee/ruff-0.16.7-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ab81118df8945e0193d0240712aa4496573595b75185c3636ed825592a0f728", size = 9847245, upload-time = "2026-09-10T18:03:34.509Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/2d/db1633a641866ed801e34cc6b60ef236c5e16f9b2124ab1d49cc24a5fe4f/ruff-0.16.7-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4c196c968874fc8019da8e7163de7a1a370f111e2309b4b7dfea0fce950198d0", size = 9961780, upload-time = "2026-09-10T18:03:36.618Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/98/edea21e1a3e38dbbc3bf6bb068b863b3b06184cf8533a4c7dbbe208a89d5/ruff-0.16.7-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:ac8c3bd0a7e10ad31e6ce51e7a99f3cb772e69aecdd6b9ea7e99b362f62a62c0", size = 9866337, upload-time = "2026-09-10T18:03:38.805Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/11/a15e60d4c87b214646f116ca9d204475bf993ee1047459bc9a360fd4d6d1/ruff-0.16.7-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:398d3988edde000b5c75dc1b3f584708da9bc990de069c18909142580fec1af9", size = 10562512, upload-time = "2026-09-10T18:03:40.71Z" },
-    { url = "https://files.pythonhosted.org/packages/29/42/eaff4c9b6d0c7cdf56df313a17e89ae854f5bbc0b0c8f9cce19be0ab7a8f/ruff-0.16.7-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ce05b62b770a8217c4646a9c4139fca00efe8fe5d71f87df2b243ff20d4584d1", size = 11302938, upload-time = "2026-09-10T18:03:42.607Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/43/c75aa59a4ec181fe2ec06cab30e198c1c6d107229a9f008ae3a7c16cabd8/ruff-0.16.7-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:af1b576fddb9d9ef2ececfb5fadcd6a624b25070ed85e3cfcfe449fc3ff6a7b9", size = 10840857, upload-time = "2026-09-10T18:03:44.604Z" },
-    { url = "https://files.pythonhosted.org/packages/21/33/81f3da371942ea031105ba679d8d6e28ec1660ccd690a45f42d381161356/ruff-0.16.7-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9ce7f8f22df67c93ed96c717f9128eadb797144ac2bad475cf536f31d6100c55", size = 10370001, upload-time = "2026-09-10T18:03:46.706Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/0b/6345fb4dbf6dd0ed1cfe5d18391dc9c3f59cc81622a7b0a65b84b3e730ba/ruff-0.16.7-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:06d0e93d04f392996435ebd600c153f65b47d73fbec2415aa99c5ee5756b3a5f", size = 10548735, upload-time = "2026-09-10T18:03:48.658Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/4d/c5576adf511f92a328e5569dda190ecdd430da51f1a649f3a4a2fd73e21e/ruff-0.16.7-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:142151a5e7b93c1b11111337142f89dd2fbfee92161225c99a97222f22e32656", size = 10108496, upload-time = "2026-09-10T18:03:50.563Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/8c/667d83c16199a17a56adc6b0bd4c3beb5b767a2babcd16a56f76f9be7fd6/ruff-0.16.7-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:e6651f97a342d8b35d54d8991544ca22169b86dc54111cb604666940c431b750", size = 9860136, upload-time = "2026-09-10T18:03:52.621Z" },
-    { url = "https://files.pythonhosted.org/packages/99/75/78d401106731999a1dd20cc5a6961e37e1eb9397a3b589f73f3a5ce146a3/ruff-0.16.7-py3-none-musllinux_1_2_i686.whl", hash = "sha256:ef140c6eb935fa9a84c9c607dfb2cb1b85843c192e79265b0c54f35f557ea8e5", size = 10286290, upload-time = "2026-09-10T18:03:55.207Z" },
-    { url = "https://files.pythonhosted.org/packages/68/49/56f9c3a8b755df93a0ad318b2147bf4ef5dae9a7e5ec61c460109c67957f/ruff-0.16.7-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:53e39506a730fadeee0d998ed5946f30671f0db240c6c7c73bdabbe33604bb6f", size = 10745048, upload-time = "2026-09-10T18:03:57.299Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/ea/7f9b938a63ece4bec677ad7f9f7fa02df3383db1949ed93a382441c09a87/ruff-0.16.7-py3-none-win32.whl", hash = "sha256:2ea3470fcebcbc5df2fb0c6f3b90333fa9084c534e0111c038fa4a6ab9f1c4b7", size = 10059082, upload-time = "2026-09-10T18:03:59.632Z" },
-    { url = "https://files.pythonhosted.org/packages/39/11/480a6973a927aa653e1cead6a6416008640e03a99d05b34c0434b8c6c366/ruff-0.16.7-py3-none-win_amd64.whl", hash = "sha256:7ac26aca826e9e21d0f1cb25b54ac660760a9fdd094d3e4df9848232be98cfc6", size = 10593368, upload-time = "2026-09-10T18:04:01.999Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/4b/51327018d056f0dad2c2238f26d1fb0f53707a9d91b75dea6d1b3039f136/ruff-0.16.7-py3-none-win_arm64.whl", hash = "sha256:aab7f39e2c9df6c596216070f98eef1207b94f8516cca20c808826974971855b", size = 10412401, upload-time = "2026-09-10T18:04:04.098Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/25/6071aabc530e9be7e2c195e8fe3f7aea2735405b6cf447212832d7811831/ruff-0.16.8-py3-none-linux_armv6l.whl", hash = "sha256:6ffbd6d87383c1edf5f6fa890f10200950240d7c1a16052a19a09d3a2307dd38", size = 10048966, upload-time = "2026-09-16T15:53:57.605Z" },
+    { url = "https://files.pythonhosted.org/packages/54/98/07f90ecbc74dd5fb5764f11f2bc774d6a7cffef92d2ff5f5b4e9e23c754e/ruff-0.16.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:42ed6b878ed61e3acca92f2730a17acff39286944ea82398544696366a6f925e", size = 10165498, upload-time = "2026-09-16T15:54:01.14Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/1f/e6a712e3b47cad4a40600134105ed193cb773f618a42eb7ba323cb812cc0/ruff-0.16.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:7ea781c7f2afba8c6a505ea0fb3f994020249e0c450635f5381286fea6b46170", size = 9830004, upload-time = "2026-09-16T15:54:03.998Z" },
+    { url = "https://files.pythonhosted.org/packages/23/f2/311a08776d75d81c7676e20b6b020ae63cbe881fcdc7a8dd64e6e18bdd93/ruff-0.16.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8efeae3bbe414a5efefda11a792dfb51ef90ac48d50c4830de2f644caf3e8659", size = 9986558, upload-time = "2026-09-16T15:54:06.804Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/ed/37b6cb3d3ba8c73e68ae3eb1d502383beb5aa05a582bb7bb3a922f929f54/ruff-0.16.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3a79b795469fef7fc6e908b218eed2eb17332afd85031db6480dc864560e69b2", size = 9877332, upload-time = "2026-09-16T15:54:09.552Z" },
+    { url = "https://files.pythonhosted.org/packages/22/cc/40873a8f36ad084cc540d55fcca7077264d5b13b24659e9180c176fb2b08/ruff-0.16.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3fdc5563cdc50555e6fba39322850860e9267c1b3d12c26a74729d8604c3c812", size = 10507125, upload-time = "2026-09-16T15:54:12.152Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/e4/fc91a642b78ccbab6b9477720f3644ae7a10a9bcce69a934679cd64f62bc/ruff-0.16.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:34508983c70665578dab88f5223d8e6228307e1135398ca8bfc8b7e9501e282b", size = 11336694, upload-time = "2026-09-16T15:54:15.489Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/3d/bbd2a9a600a4e73dc3e7548a249c8d1671273464b55822c6fae50f602dff/ruff-0.16.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:644bb578569e0ffc575741232bd385dacdd6fbe123f1a729e7a225f54aa3957f", size = 10774448, upload-time = "2026-09-16T15:54:18.16Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/41/d83af9879a7b6e8bf5fe16b1da0b134049d2f5d3afac12defb0897cb84bd/ruff-0.16.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15e7d226246961db9235098333caa13063906d3851136b84c2900b82f5daa1df", size = 10323796, upload-time = "2026-09-16T15:54:20.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/2c/cefd07bfe914b84943ea769ade8d607bd22750b965d3228eefd7cebd15d0/ruff-0.16.8-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:a2bf6bc3e9ebdd4449abc6f06cf64b98051a2c61cf94d2fe9596518c881f1a1e", size = 10514115, upload-time = "2026-09-16T15:54:23.497Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/9d/76a2e26c79a23be6e6e3664c57bec9e9fc8de155cfb9e4b67ea91b64f9d7/ruff-0.16.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:6ca111ba0849539165e9e59d2b442542f3c1e8060ebbdea82494f1ffbccb1e1f", size = 10072582, upload-time = "2026-09-16T15:54:26.185Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/d4/f42edddb39668af1a559ceafa3823aedd65633a48dc9768e775485faa2c1/ruff-0.16.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:359a1e5b495448ee1e91018064382ebc86f90e8aac2fed222c7d0e4e8df85fd2", size = 9879644, upload-time = "2026-09-16T15:54:29.278Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/d4/913e3195d95e0378786c6656945c865f534a3560e29139da4882aff630d1/ruff-0.16.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:59e8f5681349474110b24d62e93cfda6593f5fa3473446ca3705200cac1a08b9", size = 10231569, upload-time = "2026-09-16T15:54:32.036Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c4/8aa6ea0bdcedbd1bf87397e2fc4ed8406448ea5842f8660bc6e5f163039d/ruff-0.16.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:efa3e7a16d1baaa79957888dfdf8be9ef2e44db81cb032af06d76632ab59e773", size = 10663666, upload-time = "2026-09-16T15:54:34.838Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/02/7f10ef4700bc223c30a3fdd10631a29830c45524b810a3c7ed947af64591/ruff-0.16.8-py3-none-win32.whl", hash = "sha256:55793ba85c69921e89be061426d91a78652d6e50317c962240922747a4eb713f", size = 10093472, upload-time = "2026-09-16T15:54:37.47Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/5d/a509c07d714b6da88f2c518b4637cf6f1d46b074be8f0f1e5fb9ff5126fe/ruff-0.16.8-py3-none-win_amd64.whl", hash = "sha256:a6b85621fd3c81e31fc5f5add09c9c078b430db3595ca632efafdec9e64ebfaa", size = 10586899, upload-time = "2026-09-16T15:54:40.488Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a0/50787329e4f20bf9dc9f6230015d46ec69c51a97ace5bc202dae4755365d/ruff-0.16.8-py3-none-win_arm64.whl", hash = "sha256:d075e820af612102ce217f07cc93e69f9490b10ec13ea85fa87bd03d996cef8a", size = 10386316, upload-time = "2026-09-16T15:54:43.332Z" },
+]
+
+[[package]]
+name = "s3transfer"
+version = "0.19.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "botocore" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/76/43/35e4d8aa320bffe8287fe8f65f578fa2d2db0a64212f0e710dce58267854/s3transfer-0.19.2.tar.gz", hash = "sha256:ba0309fd86be3c27dbf78cdd813c13c5e1df16e5874b99d2535ebbdfb9892993", size = 165592, upload-time = "2026-07-22T19:30:44.432Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bc/e7/5c595c75e9f41a44f30e526eda465ea0b4eec93470e074e4a111b253f13a/s3transfer-0.19.2-py3-none-any.whl", hash = "sha256:d8168eccca828cbb2cd573675333f3bddd254313a9c42494b84c76b539e8ba25", size = 90216, upload-time = "2026-07-22T19:30:43.251Z" },
 ]
 
 [[package]]
@@ -1006,6 +1068,42 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c8/cb/6a6a47d5b464bd08695d254f3da6e7986cc70c9fa5d778eda57538edfe56/starlette-1.6.0-py3-none-any.whl", hash = "sha256:a86dd39d14bb45f85a3d18525215a9ef0cfd1f192ac793220e72598c90335f0c", size = 75969, upload-time = "2026-08-08T18:27:56.196Z" },
 ]
 
+[[package]]
+name = "types-boto3"
+version = "1.43.101"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "botocore-stubs" },
+    { name = "types-s3transfer" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/1d/32/e9cfa9a44874cc603220713084bd3d347ee8d3f539748673aa7a62cc7b9c/types_boto3-1.43.101.tar.gz", hash = "sha256:a892e195f6b46e73a3278b08f45dea6470306662647ccf212e8e4366e052e863", size = 105304, upload-time = "2026-09-23T20:24:43.981Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/9e/57626d063d66db4329a6ee96524cf768a20b60194120a0d71ee962758d2b/types_boto3-1.43.101-py3-none-any.whl", hash = "sha256:a5303a8024fa0588dad70fb7ba5845adaa4d86c0ea395063d7ae33badbc6396f", size = 71672, upload-time = "2026-09-23T20:24:39.849Z" },
+]
+
+[package.optional-dependencies]
+s3 = [
+    { name = "types-boto3-s3" },
+]
+
+[[package]]
+name = "types-boto3-s3"
+version = "1.43.93"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f7/1a/285aa2a27436e437aea1c6d6f964b692df3d8c349bf6a35fd476d0b2f7bb/types_boto3_s3-1.43.93.tar.gz", hash = "sha256:6a7f979872b81f6bf22eb4dc39ea9909d635ec756275eca69e9caabdc94d5a6a", size = 79218, upload-time = "2026-09-11T19:44:38.149Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1f/16/db644e738b967336fb0ca335d708c7d659a965b8ae703e9c50fe209c59be/types_boto3_s3-1.43.93-py3-none-any.whl", hash = "sha256:da9249f05ea081bb3b3f3b8cc49099a988ff5c89da8a7393532397c6174e04d3", size = 86538, upload-time = "2026-09-11T19:44:36.68Z" },
+]
+
+[[package]]
+name = "types-s3transfer"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/fe/64/42689150509eb3e6e82b33ee3d89045de1592488842ddf23c56957786d05/types_s3transfer-0.16.0.tar.gz", hash = "sha256:b4636472024c5e2b62278c5b759661efeb52a81851cde5f092f24100b1ecb443", size = 13557, upload-time = "2025-12-08T08:13:09.928Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/98/27/e88220fe6274eccd3bdf95d9382918716d312f6f6cef6a46332d1ee2feff/types_s3transfer-0.16.0-py3-none-any.whl", hash = "sha256:1c0cd111ecf6e21437cb410f5cddb631bfb2263b77ad973e79b9c6d0cb24e0ef", size = 19247, upload-time = "2025-12-08T08:13:08.426Z" },
+]
+
 [[package]]
 name = "typing-extensions"
 version = "4.16.0"
@@ -1036,6 +1134,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f9/bc/8737e8d54cf51106118039b83f485a4783112fab49ea9d044b234978a46e/tzdata-2026.4-py2.py3-none-any.whl", hash = "sha256:c2169a8b0a7a5e9674da5a135ccdfb2b3e671b333ed9fed17b41f73c34476e81", size = 347494, upload-time = "2026-09-12T12:56:01.67Z" },
 ]
 
+[[package]]
+name = "urllib3"
+version = "2.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
+]
+
 [[package]]
 name = "uvicorn"
 version = "0.53.0"

apps/frontend/Dockerfile

@@ -3,7 +3,7 @@
 # ==================
 
 # Image pour frontend
-FROM node:24-alpine3.22 AS builder
+FROM node:26-alpine3.22 AS builder
 
 WORKDIR /app
 
@@ -23,7 +23,7 @@ RUN npm run build
 # ==================
 
 
-FROM dhi.io/nginx:1.28.0-alpine3.21-dev AS runner
+FROM nginx:1.31-alpine AS runner
 
 # Copie de la configuration de nginx
 COPY --chown=root:root --chmod=755 nginx.conf /etc/nginx/nginx.conf

apps/frontend/TESTING.md

@@ -1,4 +1,4 @@
-# Conventions de tests unitaires — Frontend
+# Conventions de tests unitaires : Frontend
 
 ## Outil
 Vitest (intégré nativement à Angular CLI, pas d'installation à faire).
@@ -24,14 +24,14 @@ it('devrait faire X quand Y', () => {
 ## Ce qui doit être testé en priorité
 - Services (`core/services/`) : logique métier, gestion des erreurs
 - Guards et interceptors (`core/guards/`, `core/interceptors/`) : chaque branche de décision
-- Composants avec logique (formulaires, conditions d'affichage) — pas nécessaire pour
+- Composants avec logique (formulaires, conditions d'affichage), mais pas nécessaire pour
   un composant 100% template, sans logique
 
 `core/services/`, `core/guards/` et `core/interceptors/` n'existent pas encore : c'est
 l'arborescence cible, décrite dans
 [docs/architecture/30-frontend.md](../../docs/architecture/30-frontend.md).
 
-## Gabarit — tester un service avec appel HTTP
+## Gabarit · tester un service avec appel HTTP
 ```typescript
 import { TestBed } from '@angular/core/testing';
 import { provideHttpClient } from '@angular/common/http';
@@ -61,7 +61,7 @@ describe('MonService', () => {
 });
 ```
 
-## Gabarit — tester un composant standalone
+## Gabarit · tester un composant standalone
 ```typescript
 import { TestBed } from '@angular/core/testing';
 import { MonComposant } from './mon-composant';
@@ -83,3 +83,12 @@ describe('MonComposant', () => {
 ## Lancer les tests
 - Développement (mode watch) : `npm test`
 - Rapport de couverture (CI) : `npm run test:ci -- --coverage`, puis ouvrir `coverage/index.html`
+- Un fichier ou un dossier seulement :
+  `npx ng test --watch=false --coverage=false --include=src/app/core/services/alerts.service.spec.ts`
+  (répéter `--include` pour plusieurs cibles ; un dossier joue tous ses specs)
+
+## Au-delà des tests unitaires
+Les parcours utilisateur complets (connexion, rôles, sites, recommandations, alertes) sont
+testés de bout en bout par Playwright, contre l'API et le proxy réels : voir
+[tests/e2e/README.md](../../tests/e2e/README.md). Un élément sans rôle ni libellé stable que ces
+parcours doivent viser reçoit un `data-testid`.

apps/frontend/angular.json

@@ -34,6 +34,11 @@
           },
           "configurations": {
             "production": {
+              "optimization": {
+                "styles": {
+                  "inlineCritical": false
+                }
+              },
               "budgets": [
                 {
                   "type": "initial",

apps/frontend/package-lock.json

@@ -8,12 +8,12 @@
       "name": "frontend",
       "version": "0.0.0",
       "dependencies": {
-        "@angular/common": "^22.1.0",
-        "@angular/compiler": "^22.1.0",
-        "@angular/core": "^22.1.0",
-        "@angular/forms": "^22.1.0",
-        "@angular/platform-browser": "^22.1.0",
-        "@angular/router": "^22.1.0",
+        "@angular/common": "^22.1.7",
+        "@angular/compiler": "^22.1.7",
+        "@angular/core": "^22.1.7",
+        "@angular/forms": "^22.1.7",
+        "@angular/platform-browser": "^22.1.7",
+        "@angular/router": "^22.1.7",
         "chart.js": "^4.5.1",
         "rxjs": "~7.8.0",
         "tslib": "^2.3.0"
@@ -21,21 +21,14 @@
       "devDependencies": {
         "@angular/build": "^22.1.8",
         "@angular/cli": "^22.1.8",
-        "@angular/compiler-cli": "^22.1.0",
+        "@angular/compiler-cli": "^22.1.7",
         "@vitest/coverage-v8": "^4.1.11",
-        "jsdom": "^28.0.0",
-        "prettier": "^3.8.1",
+        "jsdom": "^30.1.0",
+        "prettier": "^3.9.8",
         "typescript": "~6.0.2",
-        "vitest": "^4.0.8"
+        "vitest": "^4.1.11"
       }
     },
-    "node_modules/@acemir/cssom": {
-      "version": "0.9.31",
-      "resolved": "https://registry.npmjs.org/@acemir/cssom/-/cssom-0.9.31.tgz",
-      "integrity": "sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@ampproject/remapping": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
@@ -255,9 +248,9 @@
       }
     },
     "node_modules/@angular/common": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/common/-/common-22.1.6.tgz",
-      "integrity": "sha512-giuH+jJvo6YbBxbKofJCXvq6k8g1Z/xCAvh4piNFSSS6/toXTLCeZ+snr6Stw5b2wRbArM5Q5nDeuto3NqVPnQ==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/common/-/common-22.1.7.tgz",
+      "integrity": "sha512-SLW4AdH2Y8G9SM/iFRNpCQtkmvq55RcIQWsADT9ypZ7FxxcnJRsr4Q/WnbUBbuCslsCkrgzU1i9WDiW0m7gcnw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -266,14 +259,14 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/core": "22.1.6",
+        "@angular/core": "22.1.7",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
     "node_modules/@angular/compiler": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-22.1.6.tgz",
-      "integrity": "sha512-JjOUm/qD338+fGfZvxSNn/vTUiVqNwOiPzacInVUq1eVp7Jev+cnvEwXA2cFJkYZoy3Imz6wHoMvTUZNN8cbKQ==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-22.1.7.tgz",
+      "integrity": "sha512-qhoHAByh805nT4Xy4Wd2kE5FvkTc7wcg8Qps+EH6+z4KRfwGiL5cwdgooGWjTAldFCeqTgJ0BO/0dB6GHZjdkQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -283,9 +276,9 @@
       }
     },
     "node_modules/@angular/compiler-cli": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-22.1.6.tgz",
-      "integrity": "sha512-C1fQuaSLnibhfbb7Im/vurdBEcfQk+/GqPkY4+dgEKd4EPleO0xWlD+k5DwyNFX8a9w7HebWfo0Zl66HuaEwOQ==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-22.1.7.tgz",
+      "integrity": "sha512-VGg8Kyt0YymQfnUUFk79vFaM+x5xmIMHy+BZh3P2Lh/uxqCXTWhJJH8kOHKtIGGH5/wKhBEmSy2CezdcIuM9xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -306,7 +299,7 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/compiler": "22.1.6",
+        "@angular/compiler": "22.1.7",
         "typescript": ">=6.0 <6.1"
       },
       "peerDependenciesMeta": {
@@ -316,9 +309,9 @@
       }
     },
     "node_modules/@angular/core": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/core/-/core-22.1.6.tgz",
-      "integrity": "sha512-3Ln9YYOhsaU2vPufnpcu6C4dlmX4e/nJTlggVcKMT7bGZH5KlEtw3h0uh9YfANv8YhQCEk1AcuRI7KpBnh5ing==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/core/-/core-22.1.7.tgz",
+      "integrity": "sha512-T9bt1PIgoN7n+TxGHTUgu0EsomlGMQ84YMXbMB+N6HhD8C1qZxn0uCbnAtCUjcecg1am8ioKxNTO0eII9ouioQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -327,7 +320,7 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/compiler": "22.1.6",
+        "@angular/compiler": "22.1.7",
         "rxjs": "^6.5.3 || ^7.4.0",
         "zone.js": "~0.15.0 || ~0.16.0"
       },
@@ -341,9 +334,9 @@
       }
     },
     "node_modules/@angular/forms": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-22.1.6.tgz",
-      "integrity": "sha512-rfV4G4UB4l69yXSRvhaHPzTMIruvBlRO+ak9NtTcYMnsoj8O5ZCyPv0ledGIrLTBwGSI3X1j4nr9aoV+Rj/n+Q==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-22.1.7.tgz",
+      "integrity": "sha512-oc0DT39C3ZboJpDx8xKUCltgn56LHi0kbv+ThNK/dCSZLgjF2nd+muMMRYF+amdljQp2q7+hm2ORmhON3CNFog==",
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -354,16 +347,16 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "22.1.6",
-        "@angular/core": "22.1.6",
-        "@angular/platform-browser": "22.1.6",
+        "@angular/common": "22.1.7",
+        "@angular/core": "22.1.7",
+        "@angular/platform-browser": "22.1.7",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
     "node_modules/@angular/platform-browser": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-22.1.6.tgz",
-      "integrity": "sha512-jrRi6zpdz+jOle5l0OW7QL0a8xPgdnxWT5FrJabbiNKfYzQfqKcaAu02l8uJoJxtGb8fLQ8pbjkPpZEvKO2z+w==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-22.1.7.tgz",
+      "integrity": "sha512-4dT3qGw3ZHVQUcHKALzMx9MTo+pxAMzHIPxc8HUESklqXfq6GRaIIfFMvE0RsquI9iqu6admD6lOAEzLWS8DxA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -372,9 +365,9 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/animations": "22.1.6",
-        "@angular/common": "22.1.6",
-        "@angular/core": "22.1.6"
+        "@angular/animations": "22.1.7",
+        "@angular/common": "22.1.7",
+        "@angular/core": "22.1.7"
       },
       "peerDependenciesMeta": {
         "@angular/animations": {
@@ -383,9 +376,9 @@
       }
     },
     "node_modules/@angular/router": {
-      "version": "22.1.6",
-      "resolved": "https://registry.npmjs.org/@angular/router/-/router-22.1.6.tgz",
-      "integrity": "sha512-ex0vrkcVyJJdn7NzZXun+5ctaPPLTZJ/gE7A3g1dun7BM3g4Z6zT738mODFeJgtPtJNf4bTs2gpgvyegvzWH7w==",
+      "version": "22.1.7",
+      "resolved": "https://registry.npmjs.org/@angular/router/-/router-22.1.7.tgz",
+      "integrity": "sha512-CxYa2Ym5L0WmqToHU2I0Z4VEpocdryLlvx5svLfo9M3uOaP3/9icB/gjS/vXPbbQxV8/GZ59E/7/LF14anIoRg==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -394,60 +387,45 @@
         "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "22.1.6",
-        "@angular/core": "22.1.6",
-        "@angular/platform-browser": "22.1.6",
+        "@angular/common": "22.1.7",
+        "@angular/core": "22.1.7",
+        "@angular/platform-browser": "22.1.7",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
-      "version": "5.1.11",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-5.1.11.tgz",
-      "integrity": "sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg==",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-7.0.0.tgz",
+      "integrity": "sha512-IxddtGnnoidVSO6O/aiTueptbTThHvi2qGHu9/AWuD1J7i86Ox+jl+Y5SXcDH1RixzQlP2cjH/PjnlImZiAurQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@asamuzakjp/generational-cache": "^1.0.1",
-        "@csstools/css-calc": "^3.2.0",
-        "@csstools/css-color-parser": "^4.1.0",
+        "@csstools/css-calc": "^3.3.0",
+        "@csstools/css-color-parser": "^4.2.0",
         "@csstools/css-parser-algorithms": "^4.0.0",
-        "@csstools/css-tokenizer": "^4.0.0"
+        "@csstools/css-tokenizer": "^4.0.0",
+        "lru-cache": "^11.5.2"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
     "node_modules/@asamuzakjp/dom-selector": {
-      "version": "6.8.1",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-6.8.1.tgz",
-      "integrity": "sha512-MvRz1nCqW0fsy8Qz4dnLIvhOlMzqDVBabZx6lH+YywFDdjXhMY37SmpV1XFX3JzG5GWHn63j6HX6QPr3lZXHvQ==",
+      "version": "9.1.4",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-9.1.4.tgz",
+      "integrity": "sha512-ynDE7RDZM1z+YuSU+iGhRp8WcSXHqK9+G32ZEzsL35TKSoy72fYR7VfrJCQkWe3ciiIWGSTAIBc9XB5jVpqyTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@asamuzakjp/nwsapi": "^2.3.9",
-        "bidi-js": "^1.0.3",
-        "css-tree": "^3.1.0",
+        "bidi-js": "^1.1.0",
+        "css-tree": "^3.2.1",
         "is-potential-custom-element-name": "^1.0.1",
-        "lru-cache": "^11.2.6"
-      }
-    },
-    "node_modules/@asamuzakjp/generational-cache": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/generational-cache/-/generational-cache-1.0.1.tgz",
-      "integrity": "sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg==",
-      "dev": true,
-      "license": "MIT",
+        "lru-cache": "^11.5.2"
+      },
       "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       }
     },
-    "node_modules/@asamuzakjp/nwsapi": {
-      "version": "2.3.9",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/nwsapi/-/nwsapi-2.3.9.tgz",
-      "integrity": "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@babel/code-frame": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-8.0.0.tgz",
@@ -854,9 +832,9 @@
       }
     },
     "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.13.tgz",
-      "integrity": "sha512-i9ZylF5QNhmNfPA9l0vHAWK4kPrbIp6g9lKgaiIFsIBz2F/WNB7OLrzlNNcCOm+h42bkaSD2v1PG+IBPHhc3ZA==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.14.tgz",
+      "integrity": "sha512-HpbVXyrofRXpHpgkNIjU/3EWR4WJvOkO3emNK/L6X/mTJU7bGUI3AkkpoTNXznQLp0KRjLHELTGeKI5dIkI9JQ==",
       "dev": true,
       "funding": [
         {
@@ -879,9 +857,9 @@
       }
     },
     "node_modules/@csstools/css-tokenizer": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
-      "integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.1.tgz",
+      "integrity": "sha512-bPlN9S9O1A0euCpEWE4qnvB5YDuyYVsUTrxSgmAM1Is0j4tICHoVyOVAXfWMP/kS9ZrjvyIXWV2PmomiAXXqOw==",
       "dev": true,
       "funding": [
         {
@@ -4490,22 +4468,6 @@
         "url": "https://github.com/sponsors/fb55"
       }
     },
-    "node_modules/cssstyle": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-6.2.0.tgz",
-      "integrity": "sha512-Fm5NvhYathRnXNVndkUsCCuR63DCLVVwGOOwQw782coXFi5HhkXdu289l59HlXZBawsyNccXfWRYvLzcDCdDig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@asamuzakjp/css-color": "^5.0.1",
-        "@csstools/css-syntax-patches-for-csstree": "^1.0.28",
-        "css-tree": "^3.1.0",
-        "lru-cache": "^11.2.6"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
     "node_modules/data-urls": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
@@ -5283,30 +5245,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/http-proxy-agent/node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
     "node_modules/https-proxy-agent": {
       "version": "9.1.0",
       "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-9.1.0.tgz",
@@ -5529,39 +5467,38 @@
       "license": "MIT"
     },
     "node_modules/jsdom": {
-      "version": "28.1.0",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-28.1.0.tgz",
-      "integrity": "sha512-0+MoQNYyr2rBHqO1xilltfDjV9G7ymYGlAUazgcDLQaUf8JDHbuGwsxN6U9qWaElZ4w1B2r7yEGIL3GdeW3Rug==",
+      "version": "30.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.1.0.tgz",
+      "integrity": "sha512-h/Q+H+KmlGf49ITw3TrykSVbg04S75S2O7ZtJc9gMGOWBrQRZmx5AJIKLtJ01e6Kszl+/tpFthCVqxNifxhoqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@acemir/cssom": "^0.9.31",
-        "@asamuzakjp/dom-selector": "^6.8.1",
+        "@asamuzakjp/css-color": "^7.0.0",
+        "@asamuzakjp/dom-selector": "^9.1.2",
         "@bramus/specificity": "^2.4.2",
-        "@exodus/bytes": "^1.11.0",
-        "cssstyle": "^6.0.1",
+        "@csstools/css-syntax-patches-for-csstree": "^1.1.13",
+        "@exodus/bytes": "^1.15.1",
+        "css-tree": "^3.2.1",
         "data-urls": "^7.0.0",
         "decimal.js": "^10.6.0",
         "html-encoding-sniffer": "^6.0.0",
-        "http-proxy-agent": "^7.0.2",
-        "https-proxy-agent": "^7.0.6",
         "is-potential-custom-element-name": "^1.0.1",
-        "parse5": "^8.0.0",
+        "lru-cache": "^11.5.2",
+        "parse5": "^8.0.1",
         "saxes": "^6.0.0",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^6.0.0",
-        "undici": "^7.21.0",
+        "tough-cookie": "^6.0.2",
+        "undici": "^8.10.2",
         "w3c-xmlserializer": "^5.0.0",
         "webidl-conversions": "^8.0.1",
         "whatwg-mimetype": "^5.0.0",
-        "whatwg-url": "^16.0.0",
+        "whatwg-url": "^17.1.1",
         "xml-name-validator": "^5.0.0"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+        "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
       },
       "peerDependencies": {
-        "canvas": "^3.0.0"
+        "canvas": "^3.2.3"
       },
       "peerDependenciesMeta": {
         "canvas": {
@@ -5569,28 +5506,19 @@
         }
       }
     },
-    "node_modules/jsdom/node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/jsdom/node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+    "node_modules/jsdom/node_modules/whatwg-url": {
+      "version": "17.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-17.1.1.tgz",
+      "integrity": "sha512-ohjk1mdUebJVadRt3bAhQhx8lSnISq+GDttK79LFl8EHQkAPvzwctoasC4hs8tBt6kLAncBWWyq1N52qEfKvDw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
+        "@exodus/bytes": "^1.15.1",
+        "tr46": "^6.0.0",
+        "webidl-conversions": "^8.0.1"
       },
       "engines": {
-        "node": ">= 14"
+        "node": "^22.14.0 || >=24.0.0"
       }
     },
     "node_modules/jsesc": {
@@ -6708,9 +6636,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.9.6",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
-      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
+      "version": "3.9.8",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.8.tgz",
+      "integrity": "sha512-WRFq3Wn3WId7LLROfMLdH7xaFr2jR62wU8nLO6rQUOLOxNZUviyJQs1M0iIhLexSFy+L+w0ch66wtoO2jRjG0A==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -7308,13 +7236,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/symbol-tree": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -7469,13 +7390,13 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
-      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
+      "version": "8.10.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
+      "integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=22.19.0"
       }
     },
     "node_modules/unpipe": {

apps/frontend/package.json

@@ -12,12 +12,12 @@
   "private": true,
   "packageManager": "npm@11.19.0",
   "dependencies": {
-    "@angular/common": "^22.1.0",
-    "@angular/compiler": "^22.1.0",
-    "@angular/core": "^22.1.0",
-    "@angular/forms": "^22.1.0",
-    "@angular/platform-browser": "^22.1.0",
-    "@angular/router": "^22.1.0",
+    "@angular/common": "^22.1.7",
+    "@angular/compiler": "^22.1.7",
+    "@angular/core": "^22.1.7",
+    "@angular/forms": "^22.1.7",
+    "@angular/platform-browser": "^22.1.7",
+    "@angular/router": "^22.1.7",
     "chart.js": "^4.5.1",
     "rxjs": "~7.8.0",
     "tslib": "^2.3.0"
@@ -25,11 +25,11 @@
   "devDependencies": {
     "@angular/build": "^22.1.8",
     "@angular/cli": "^22.1.8",
-    "@angular/compiler-cli": "^22.1.0",
+    "@angular/compiler-cli": "^22.1.7",
     "@vitest/coverage-v8": "^4.1.11",
-    "jsdom": "^28.0.0",
-    "prettier": "^3.8.1",
+    "jsdom": "^30.1.0",
+    "prettier": "^3.9.8",
     "typescript": "~6.0.2",
-    "vitest": "^4.0.8"
+    "vitest": "^4.1.11"
   }
 }

apps/frontend/sonar-project.properties

@@ -1,18 +0,0 @@
-sonar.projectKey=ProjetPiscine_EnerVision
-sonar.organization=groupe3-ener-vision
-sonar.sourceEncoding=UTF-8
-
-#  Dossier contenant le code source
-sonar.sources=apps/frontend/src,apps/backend/app
-sonar.tests=apps/backend/tests
-
-#  Liste des fichiers et dossiers à exclure de l'analyse
-#  Liste des fichiers et dossiers à exclure de l'analyse
-sonar.exclusions=**/node_modules/**,**/dist/**,**/*.spec.js,**/*.test.js,github,db,ml,docker-compose.yml,**/**/Dockerfile,**/**/proxy.conf.json,**/**/package.json,**/**/angular.json
-
-#  Chemin vers le rapport de couverture de code
-#  Fichier généré par Vitest
-#  Chemin vers le rapport de couverture de code
-#  Fichier généré par Vitest
-sonar.javascript.lcov.reportPaths=apps/frontend/coverage/frontend/lcov.info
-sonar.python.coverage.reportPaths=apps/backend/cov.info

apps/frontend/src/app/app.routes.ts

@@ -1,21 +1,36 @@
 import { Routes } from '@angular/router';
-import {authGuard} from './core/guards/auth-guard';
+import { authGuard } from './core/guards/auth-guard';
 
 export const routes: Routes = [
   { path: '', redirectTo: 'dashboard', pathMatch: 'full' },
-  { path: 'login', loadComponent: () => import('./features/auth/login/login').then(m => m.Login) },
-  { path: 'change-password', loadComponent: () => import('./features/auth/change-password/change-password').then(m => m.ChangePassword) },
-  { path: 'forgot-password', loadComponent: () => import('./features/auth/forgot-password/forgot-password').then(m => m.ForgotPassword) },
-  { path: 'reset-password', loadComponent: () => import('./features/auth/reset-password/reset-password').then(m => m.ResetPassword) },
+  {
+    path: 'login',
+    loadComponent: () => import('./features/auth/login/login').then((m) => m.Login),
+  },
+  {
+    path: 'change-password',
+    loadComponent: () =>
+      import('./features/auth/change-password/change-password').then((m) => m.ChangePassword),
+  },
+  {
+    path: 'forgot-password',
+    loadComponent: () =>
+      import('./features/auth/forgot-password/forgot-password').then((m) => m.ForgotPassword),
+  },
+  {
+    path: 'reset-password',
+    loadComponent: () =>
+      import('./features/auth/reset-password/reset-password').then((m) => m.ResetPassword),
+  },
   {
     path: 'dashboard',
     canActivate: [authGuard],
-    loadComponent: () => import('./features/dashboard/dashboard').then(m => m.Dashboard),
+    loadComponent: () => import('./features/dashboard/dashboard').then((m) => m.Dashboard),
   },
   {
     path: 'sites',
     canActivate: [authGuard],
-    loadComponent: () => import('./features/sites/site-list/site-list').then(m => m.SiteList),
+    loadComponent: () => import('./features/sites/site-list/site-list').then((m) => m.SiteList),
   },
   {
     path: 'sites/:siteId',
@@ -23,4 +38,17 @@ export const routes: Routes = [
     loadComponent: () =>
       import('./features/sites/site-detail/site-detail').then((m) => m.SiteDetail),
   },
+  {
+    path: 'recommendations',
+    canActivate: [authGuard],
+    loadComponent: () =>
+      import('./features/recommendations/recommendations').then((m) => m.RecommendationsView),
+  },
+  {
+    path: 'monitoring/sensors',
+    canActivate: [authGuard],
+    data: { role: 'admin' },
+    loadComponent: () =>
+      import('./features/monitoring/sensor-status/sensor-status').then((m) => m.SensorStatusView),
+  },
 ];

apps/frontend/src/app/core/interceptors/mock-api-interceptor.spec.ts

@@ -8,8 +8,10 @@ import { STATS_SUMMARY_FIXTURE } from '../mocks/stats-summary.fixture';
 describe('mockApiInterceptor', () => {
   let http: HttpClient;
   let httpMock: HttpTestingController;
+  let useMockFixturesInitial: boolean;
 
   beforeEach(() => {
+    useMockFixturesInitial = environment.useMockFixtures;
     TestBed.configureTestingModule({
       providers: [
         provideHttpClient(withInterceptors([mockApiInterceptor])),
@@ -21,7 +23,7 @@ describe('mockApiInterceptor', () => {
   });
 
   afterEach(() => {
-    environment.useMockFixtures = true;
+    environment.useMockFixtures = useMockFixturesInitial;
     httpMock.verify();
   });
 

apps/frontend/src/app/core/mocks/alerts.fixture.ts

@@ -2,53 +2,63 @@ import { Alert } from '../../shared/models/alert.model';
 
 export const ALERTS_FIXTURE: Alert[] = [
   {
-    alert_id: 'ALR-SITE002-1718458320',
-    timestamp: '2026-09-15T11:12:00',
+    alert_id: 5,
     site_id: 'SITE002',
+    timestamp: '2026-09-15T11:12:00Z',
+    type: 'threshold',
     severity: 'critical',
-    type: 'outage',
-    message: 'Risque de surcharge sur Usine Lyon Vénissieux',
+    message: 'Puissance appelée 812.5 kW au-dessus de la capacité du site (720.0 kW)',
     value: 812.5,
     threshold: 720.0,
+    metric: 'consumption_kw',
+    prediction_id: null,
   },
   {
-    alert_id: 'ALR-SITE003-1718458321',
-    timestamp: '2026-09-15T11:05:00',
+    alert_id: 4,
     site_id: 'SITE003',
+    timestamp: '2026-09-15T11:05:00Z',
+    type: 'outage',
     severity: 'critical',
-    type: 'sensor',
-    message: 'Perte réseau totale sur Data Center Marseille',
-    value: 0,
-    threshold: 0,
+    message: 'Aucune lecture depuis 5:00:00 (dernière lecture : 2026-09-15T06:05:00+00:00)',
+    value: null,
+    threshold: null,
+    metric: null,
+    prediction_id: null,
   },
   {
-    alert_id: 'ALR-SITE005-1718458322',
-    timestamp: '2026-09-15T10:47:00',
+    alert_id: 3,
     site_id: 'SITE005',
+    timestamp: '2026-09-15T10:47:00Z',
+    type: 'spike',
     severity: 'high',
-    type: 'threshold',
-    message: 'Usine Toulouse approche de son seuil de capacité',
+    message: 'Variation brutale entre deux lectures consécutives (260.0 kW -> 410.0 kW)',
     value: 410.0,
-    threshold: 480.0,
+    threshold: 260.0,
+    metric: 'consumption_kw',
+    prediction_id: null,
   },
   {
-    alert_id: 'ALR-SITE006-1718458323',
-    timestamp: '2026-09-15T10:30:00',
+    alert_id: 2,
     site_id: 'SITE006',
-    severity: 'medium',
+    timestamp: '2026-09-15T10:30:00Z',
     type: 'sensor',
-    message: 'Capteur de température défaillant sur Bureau Lille',
-    value: 0,
-    threshold: 0,
+    severity: 'medium',
+    message: 'Qualité de mesure degraded (capteur hors ligne, valeur nulle)',
+    value: null,
+    threshold: null,
+    metric: null,
+    prediction_id: null,
   },
   {
-    alert_id: 'ALR-SITE004-1718458324',
-    timestamp: '2026-09-15T09:58:00',
+    alert_id: 1,
     site_id: 'SITE004',
-    severity: 'low',
+    timestamp: '2026-09-15T09:58:00Z',
     type: 'anomaly',
-    message: 'Comportement de consommation inhabituel sur Bureau Bordeaux',
+    severity: 'low',
+    message: 'Écart de 13% entre la consommation mesurée (62.0 kWh) et la prévision (55.0 kWh)',
     value: 62.0,
     threshold: 55.0,
+    metric: 'consumption_kwh',
+    prediction_id: 42,
   },
 ];

apps/frontend/src/app/core/services/alerts.service.spec.ts

@@ -3,6 +3,20 @@ import { provideHttpClient } from '@angular/common/http';
 import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
 import { AlertsService } from './alerts.service';
 import { environment } from '../../../environments/environment';
+import { Alert } from '../../shared/models/alert.model';
+
+const ALERT_API: Alert = {
+  alert_id: 1,
+  site_id: 'site-1',
+  timestamp: '2026-09-16T00:00:00Z',
+  type: 'threshold',
+  severity: 'high',
+  message: 'Dépassement du seuil configuré',
+  value: 812.5,
+  threshold: 720.0,
+  metric: 'consumption_kw',
+  prediction_id: null,
+};
 
 describe('AlertsService', () => {
   let service: AlertsService;
@@ -18,26 +32,35 @@ describe('AlertsService', () => {
 
   afterEach(() => httpMock.verify());
 
-  it("appelle le bon endpoint et retourne un tableau d'alertes", () => {
-    let result: unknown;
+  it("appelle le bon endpoint sans paramètre et retourne un tableau d'alertes", () => {
+    let result: Alert[] = [];
     service.getAlerts().subscribe((r) => (result = r));
 
-    const req = httpMock.expectOne(`${environment.apiUrl}/alerts`);
-    expect(req.request.method).toBe('GET');
+    const req = httpMock.expectOne(
+      (r) => r.url === `${environment.apiUrl}/alerts` && r.method === 'GET',
+    );
+    expect(req.request.params.keys()).toEqual([]);
+    req.flush([ALERT_API]);
 
-    req.flush([
-      {
-        alert_id: 'ALR-TEST-1',
-        timestamp: '2026-09-15T12:00:00',
-        site_id: 'SITE001',
-        severity: 'high',
-        type: 'threshold',
-        message: 'Test',
-        value: 100,
-        threshold: 90,
-      },
-    ]);
+    expect(result.length).toBe(1);
+    expect(result[0].alert_id).toBe(1);
+    expect(result[0].prediction_id).toBeNull();
+  });
 
-    expect((result as unknown[]).length).toBe(1);
+  it('transmet les filtres site_id et severity en paramètres de requête', () => {
+    service.getAlerts({ site_id: 'SITE001', severity: 'high' }).subscribe();
+
+    const req = httpMock.expectOne((r) => r.url === `${environment.apiUrl}/alerts`);
+    expect(req.request.params.get('site_id')).toBe('SITE001');
+    expect(req.request.params.get('severity')).toBe('high');
+    req.flush([]);
+  });
+
+  it('ne pose pas de paramètre pour un filtre omis', () => {
+    service.getAlerts({ site_id: 'SITE001' }).subscribe();
+
+    const req = httpMock.expectOne((r) => r.url === `${environment.apiUrl}/alerts`);
+    expect(req.request.params.has('severity')).toBe(false);
+    req.flush([]);
   });
 });

apps/frontend/src/app/core/services/alerts.service.ts

@@ -1,13 +1,25 @@
 import { Service, inject } from '@angular/core';
-import { HttpClient } from '@angular/common/http';
+import { HttpClient, HttpParams } from '@angular/common/http';
 import { environment } from '../../../environments/environment';
-import { Alert } from '../../shared/models/alert.model';
+import { Alert, AlertSeverity } from '../../shared/models/alert.model';
+
+export interface AlertFilters {
+  site_id?: string;
+  severity?: AlertSeverity;
+}
 
 @Service()
 export class AlertsService {
   private http = inject(HttpClient);
 
-  getAlerts() {
-    return this.http.get<Alert[]>(`${environment.apiUrl}/alerts`);
+  getAlerts(filters: AlertFilters = {}) {
+    let params = new HttpParams();
+    if (filters.site_id) {
+      params = params.set('site_id', filters.site_id);
+    }
+    if (filters.severity) {
+      params = params.set('severity', filters.severity);
+    }
+    return this.http.get<Alert[]>(`${environment.apiUrl}/alerts`, { params });
   }
 }

apps/frontend/src/app/core/services/auth.service.spec.ts

@@ -43,6 +43,31 @@ describe('AuthService', () => {
     expect(service.isAuthenticated()).toBe(true);
   });
 
+  it('garde le mot de passe provisoire pour un seul changement quand il doit être changé', () => {
+    service.login({ email: 'a@a.com', password: 'Provisoire' }).subscribe();
+    httpMock.expectOne(`${environment.apiUrl}/auth/login`).flush({
+      ...tokenResponse,
+      principal: { ...tokenResponse.principal, must_change_password: true },
+    });
+
+    expect(service.takeProvisionalPassword()).toBe('Provisoire');
+    expect(service.takeProvisionalPassword()).toBeNull();
+  });
+
+  it('ne garde aucun mot de passe quand il est déjà définitif, ni après la fin de session', () => {
+    service.login({ email: 'a@a.com', password: 'Definitif' }).subscribe();
+    httpMock.expectOne(`${environment.apiUrl}/auth/login`).flush(tokenResponse);
+    expect(service.takeProvisionalPassword()).toBeNull();
+
+    service.login({ email: 'a@a.com', password: 'Provisoire' }).subscribe();
+    httpMock.expectOne(`${environment.apiUrl}/auth/login`).flush({
+      ...tokenResponse,
+      principal: { ...tokenResponse.principal, must_change_password: true },
+    });
+    service.clearSession();
+    expect(service.takeProvisionalPassword()).toBeNull();
+  });
+
   it('efface la session au logout', () => {
     service.login({ email: 'a@a.com', password: 'secret' }).subscribe();
     httpMock.expectOne(`${environment.apiUrl}/auth/login`).flush(tokenResponse);

apps/frontend/src/app/core/services/auth.service.ts

@@ -19,6 +19,9 @@ export class AuthService {
   // mémoire. Un rechargement de page le perd, c'est voulu par le contrat.
   private accessTokenSignal = signal<string | null>(null);
   private principalSignal = signal<Principal | null>(null);
+  // Pourquoi : redemander le mot de passe provisoire qu'on vient de vérifier laisse un gestionnaire
+  // de mots de passe y coller un ancien mot de passe du site, et `/auth/password` répond 401.
+  private provisionalPassword: string | null = null;
 
   readonly principal = this.principalSignal.asReadonly();
   readonly isAuthenticated = computed(() => this.principalSignal() !== null);
@@ -37,12 +40,26 @@ export class AuthService {
   clearSession(): void {
     this.accessTokenSignal.set(null);
     this.principalSignal.set(null);
+    this.provisionalPassword = null;
   }
 
   login(credentials: LoginRequest): Observable<TokenResponse> {
     return this.http
       .post<TokenResponse>(`${environment.apiUrl}/auth/login`, credentials, { withCredentials: true })
-      .pipe(tap((response) => this.setSession(response)));
+      .pipe(
+        tap((response) => {
+          this.setSession(response);
+          this.provisionalPassword = response.principal.must_change_password
+            ? credentials.password
+            : null;
+        })
+      );
+  }
+
+  takeProvisionalPassword(): string | null {
+    const password = this.provisionalPassword;
+    this.provisionalPassword = null;
+    return password;
   }
 
   // Un seul rafraîchissement en vol à la fois, partagé entre tous les

apps/frontend/src/app/core/services/recommendations.service.spec.ts

@@ -0,0 +1,74 @@
+import { TestBed } from '@angular/core/testing';
+import { provideHttpClient } from '@angular/common/http';
+import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
+import { RecommendationsService } from './recommendations.service';
+import { environment } from '../../../environments/environment';
+import { Recommendation } from '../../shared/models/recommendation.model';
+
+const RECOMMANDATION_API: Recommendation = {
+  recommendation_id: 1,
+  alert_id: 1,
+  action: 'Vérifier la consommation',
+  explanation: 'Pic détecté',
+  rule_reference: 'spike-v1',
+  created_at: '2024-01-01T00:00:00Z',
+};
+
+describe('RecommendationsService', () => {
+  let service: RecommendationsService;
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [provideHttpClient(), provideHttpClientTesting()],
+    });
+    service = TestBed.inject(RecommendationsService);
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => httpMock.verify());
+
+  it('liste les recommandations depuis le bon endpoint', () => {
+    let result: Recommendation[] = [];
+    service.getRecommendations().subscribe((r) => (result = r));
+
+    const req = httpMock.expectOne(`${environment.apiUrl}/recommendations`);
+    expect(req.request.method).toBe('GET');
+    req.flush([RECOMMANDATION_API]);
+
+    expect(result.length).toBe(1);
+    expect(result[0].alert_id).toBe(1);
+  });
+
+  it('décrit une recommandation par son identifiant', () => {
+    service.getRecommendation(42).subscribe();
+
+    const req = httpMock.expectOne(`${environment.apiUrl}/recommendations/42`);
+    expect(req.request.method).toBe('GET');
+    req.flush({ ...RECOMMANDATION_API, recommendation_id: 42 });
+  });
+
+  it('déclenche la génération en POST avec le site en paramètre de requête', () => {
+    let result: unknown;
+    service.generate('SITE001').subscribe((r) => (result = r));
+
+    const req = httpMock.expectOne(
+      (r) => r.url === `${environment.apiUrl}/recommendations/generate` && r.method === 'POST',
+    );
+    expect(req.request.params.get('site_id')).toBe('SITE001');
+    expect(req.request.body).toBeNull();
+    req.flush({ alerts_examined: 2, recommendations_created: 3, already_present: 1 });
+
+    expect(result).toEqual({ alerts_examined: 2, recommendations_created: 3, already_present: 1 });
+  });
+
+  it('génère pour tout le parc quand aucun site n’est donné', () => {
+    service.generate().subscribe();
+
+    const req = httpMock.expectOne(
+      (r) => r.url === `${environment.apiUrl}/recommendations/generate` && r.method === 'POST',
+    );
+    expect(req.request.params.has('site_id')).toBe(false);
+    req.flush({ alerts_examined: 0, recommendations_created: 0, already_present: 0 });
+  });
+});

apps/frontend/src/app/core/services/recommendations.service.ts

@@ -0,0 +1,34 @@
+import { Service, inject } from '@angular/core';
+import { HttpClient, HttpParams } from '@angular/common/http';
+import { environment } from '../../../environments/environment';
+import {
+  Recommendation,
+  RecommendationGenerationReport,
+} from '../../shared/models/recommendation.model';
+
+@Service()
+export class RecommendationsService {
+  private http = inject(HttpClient);
+
+  getRecommendations() {
+    return this.http.get<Recommendation[]>(`${environment.apiUrl}/recommendations`);
+  }
+
+  getRecommendation(recommendationId: number) {
+    return this.http.get<Recommendation>(
+      `${environment.apiUrl}/recommendations/${recommendationId}`,
+    );
+  }
+
+  generate(siteId?: string) {
+    let params = new HttpParams();
+    if (siteId) {
+      params = params.set('site_id', siteId);
+    }
+    return this.http.post<RecommendationGenerationReport>(
+      `${environment.apiUrl}/recommendations/generate`,
+      null,
+      { params },
+    );
+  }
+}

apps/frontend/src/app/core/services/sensors.service.spec.ts

@@ -0,0 +1,48 @@
+import { TestBed } from '@angular/core/testing';
+import { provideHttpClient } from '@angular/common/http';
+import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
+import { SensorsService } from './sensors.service';
+import { environment } from '../../../environments/environment';
+
+describe('SensorsService', () => {
+  let service: SensorsService;
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [provideHttpClient(), provideHttpClientTesting()],
+    });
+    service = TestBed.inject(SensorsService);
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => httpMock.verify());
+
+  it("appelle l'endpoint /sensors/status et retourne la réponse", () => {
+    let result: unknown;
+    service.getStatus().subscribe((r) => (result = r));
+
+    const req = httpMock.expectOne(`${environment.apiUrl}/sensors/status`);
+    expect(req.request.method).toBe('GET');
+
+    req.flush({
+      timestamp: '2026-09-18T08:00:00',
+      sites: [
+        {
+          site_id: 'SITE001',
+          site_name: 'Test',
+          overall: 'ok',
+          sensors: {
+            consumption: { status: 'ok', since: null },
+            electrical: { status: 'ok', since: null },
+            temperature: { status: 'ok', since: null },
+            humidity: { status: 'ok', since: null },
+            network: { status: 'ok', since: null },
+          },
+        },
+      ],
+    });
+
+    expect((result as { sites: unknown[] }).sites.length).toBe(1);
+  });
+});

apps/frontend/src/app/core/services/sensors.service.ts

@@ -0,0 +1,13 @@
+import { Service, inject } from '@angular/core';
+import { HttpClient } from '@angular/common/http';
+import { environment } from '../../../environments/environment';
+import {SensorStatusResponse} from '../../shared/models/sensor-status.model';
+
+@Service()
+export class SensorsService {
+  private http = inject(HttpClient);
+
+  getStatus() {
+    return this.http.get<SensorStatusResponse>(`${environment.apiUrl}/sensors/status`);
+  }
+}

apps/frontend/src/app/features/auth/change-password/change-password.html

@@ -7,14 +7,18 @@
         Votre mot de passe est provisoire, vous devez le modifier avant de continuer
       </p>
 
-      <label class="form-label" for="current_password">Mot de passe actuel</label>
-      <input
-        id="current_password"
-        class="form-input"
-        type="password"
-        formControlName="current_password"
-        autocomplete="current-password"
-      />
+      <input hidden type="email" autocomplete="username" [value]="email" readonly />
+
+      @if (asksCurrentPassword()) {
+        <label class="form-label" for="current_password">Mot de passe actuel</label>
+        <input
+          id="current_password"
+          class="form-input"
+          type="password"
+          formControlName="current_password"
+          autocomplete="current-password"
+        />
+      }
 
       <label class="form-label" for="new_password">Nouveau mot de passe</label>
       <input
@@ -24,7 +28,7 @@
         formControlName="new_password"
         autocomplete="new-password"
       />
-      <span class="form-hint">{{ passwordHint }}</span>
+      <app-password-requirements [password]="newPassword()" />
 
       @if (errorMessage()) {
         <ev-alert severity="danger">{{ errorMessage() }}</ev-alert>

apps/frontend/src/app/features/auth/change-password/change-password.spec.ts

@@ -1,17 +1,29 @@
 import { TestBed } from '@angular/core/testing';
 import { ReactiveFormsModule } from '@angular/forms';
 import { Router } from '@angular/router';
+import { HttpErrorResponse } from '@angular/common/http';
+import { signal } from '@angular/core';
 import { of, throwError } from 'rxjs';
 import { vi } from 'vitest';
 import { ChangePassword } from './change-password';
 import { AuthService } from '../../../core/services/auth.service';
 
+const NOUVEAU = 'Un-nouveau-mot-de-passe1!';
+
 describe('ChangePassword', () => {
-  let authMock: { changePassword: ReturnType<typeof vi.fn> };
+  let authMock: {
+    changePassword: ReturnType<typeof vi.fn>;
+    takeProvisionalPassword: ReturnType<typeof vi.fn>;
+    principal: ReturnType<typeof signal>;
+  };
   let routerMock: { navigate: ReturnType<typeof vi.fn> };
 
   beforeEach(async () => {
-    authMock = { changePassword: vi.fn() };
+    authMock = {
+      changePassword: vi.fn(),
+      takeProvisionalPassword: vi.fn().mockReturnValue(null),
+      principal: signal({ email: 'johan@enervision.fr' }),
+    };
     routerMock = { navigate: vi.fn() };
 
     await TestBed.configureTestingModule({
@@ -23,6 +35,10 @@ describe('ChangePassword', () => {
     }).compileComponents();
   });
 
+  function champActuel(fixture: { nativeElement: HTMLElement }): HTMLInputElement | null {
+    return fixture.nativeElement.querySelector('#current_password');
+  }
+
   it('ne soumet pas si le formulaire est invalide (mot de passe trop court)', () => {
     const fixture = TestBed.createComponent(ChangePassword);
     const component = fixture.componentInstance;
@@ -44,7 +60,7 @@ describe('ChangePassword', () => {
   it('redirige vers /dashboard après un changement réussi', () => {
     const fixture = TestBed.createComponent(ChangePassword);
     const component = fixture.componentInstance;
-    component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: 'Un-nouveau-mot-de-passe1!' });
+    component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: NOUVEAU });
 
     authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
 
@@ -52,46 +68,94 @@ describe('ChangePassword', () => {
     expect(routerMock.navigate).toHaveBeenCalledWith(['/dashboard']);
   });
 
-  it("affiche un message d'erreur si le mot de passe actuel est incorrect", () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  const component = fixture.componentInstance;
-  component.form.setValue({ current_password: 'mauvais-mot-de-passe', new_password: 'Un-nouveau-mot-de-passe1!' });
+  it("demande le mot de passe actuel quand la connexion ne l'a pas transmis (page rechargée)", () => {
+    const fixture = TestBed.createComponent(ChangePassword);
+    fixture.detectChanges();
 
-  authMock.changePassword.mockReturnValue(throwError(() => new Error('401')));
+    expect(champActuel(fixture)).not.toBeNull();
+  });
 
-  component.onSubmit();
-  fixture.detectChanges(); // rend le bloc @if (errorMessage())
+  it('réutilise le mot de passe provisoire de la connexion sans le redemander', () => {
+    authMock.takeProvisionalPassword.mockReturnValue('Provisoire-24-caracteres');
+    authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
+    const fixture = TestBed.createComponent(ChangePassword);
+    const component = fixture.componentInstance;
+    fixture.detectChanges();
 
-  expect(component.errorMessage()).toContain('incorrect');
-  const errorEl = fixture.nativeElement.querySelector('.ev-alert');
-  expect(errorEl?.textContent).toContain('incorrect');
+    expect(champActuel(fixture)).toBeNull();
+    component.form.controls.new_password.setValue(NOUVEAU);
+    component.onSubmit();
+
+    expect(authMock.changePassword).toHaveBeenCalledWith({
+      current_password: 'Provisoire-24-caracteres',
+      new_password: NOUVEAU,
+    });
+  });
+
+  it('associe le formulaire au compte connecté pour les gestionnaires de mots de passe', () => {
+    const fixture = TestBed.createComponent(ChangePassword);
+    fixture.detectChanges();
+
+    const identifiant = fixture.nativeElement.querySelector('input[autocomplete="username"]');
+    expect(identifiant.value).toBe('johan@enervision.fr');
+  });
+
+  it('sur un 401, dit que le mot de passe actuel est faux et le redemande', () => {
+    authMock.takeProvisionalPassword.mockReturnValue('Provisoire-perime');
+    authMock.changePassword.mockReturnValue(
+      throwError(() => new HttpErrorResponse({ status: 401 })),
+    );
+    const fixture = TestBed.createComponent(ChangePassword);
+    const component = fixture.componentInstance;
+    component.form.controls.new_password.setValue(NOUVEAU);
+
+    component.onSubmit();
+    fixture.detectChanges();
+
+    expect(component.errorMessage()).toContain('Mot de passe actuel incorrect');
+    expect(fixture.nativeElement.querySelector('.ev-alert')?.textContent).toContain('incorrect');
+    expect(champActuel(fixture)).not.toBeNull();
+    expect(component.form.controls.current_password.value).toBe('');
+  });
+
+  it('sur un 422, dit que le nouveau mot de passe ne respecte pas la politique', () => {
+    authMock.changePassword.mockReturnValue(
+      throwError(() => new HttpErrorResponse({ status: 422 })),
+    );
+    const fixture = TestBed.createComponent(ChangePassword);
+    const component = fixture.componentInstance;
+    component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: NOUVEAU });
+
+    component.onSubmit();
+
+    expect(component.errorMessage()).toContain('Nouveau mot de passe refusé');
+    expect(component.form.controls.current_password.value).toBe('ancien-mot-de-passe');
   });
 
   it('désactive le bouton tant que le formulaire est invalide', () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  fixture.detectChanges();
+    const fixture = TestBed.createComponent(ChangePassword);
+    fixture.detectChanges();
 
-  const button = fixture.nativeElement.querySelector('button[type="submit"]');
-  expect(button.disabled).toBe(true);
-  expect(fixture.nativeElement.querySelector('.ev-alert')).toBeNull();
+    const button = fixture.nativeElement.querySelector('button[type="submit"]');
+    expect(button.disabled).toBe(true);
+    expect(fixture.nativeElement.querySelector('.ev-alert')).toBeNull();
   });
 
   it('déclenche onSubmit via la soumission réelle du formulaire (ngSubmit)', () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  const component = fixture.componentInstance;
-  component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: 'Un-nouveau-mot-de-passe1!' });
-  fixture.detectChanges();
+    const fixture = TestBed.createComponent(ChangePassword);
+    const component = fixture.componentInstance;
+    component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: NOUVEAU });
+    fixture.detectChanges();
 
-  authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
+    authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
 
-  const form = fixture.nativeElement.querySelector('form');
-  form.dispatchEvent(new Event('submit'));
-  fixture.detectChanges();
+    const form = fixture.nativeElement.querySelector('form');
+    form.dispatchEvent(new Event('submit'));
+    fixture.detectChanges();
 
-  expect(authMock.changePassword).toHaveBeenCalledWith({
-    current_password: 'ancien-mot-de-passe',
-    new_password: 'Un-nouveau-mot-de-passe1!',
+    expect(authMock.changePassword).toHaveBeenCalledWith({
+      current_password: 'ancien-mot-de-passe',
+      new_password: NOUVEAU,
+    });
   });
 });
-
-});

apps/frontend/src/app/features/auth/change-password/change-password.ts

@@ -1,17 +1,20 @@
 import { Component, inject, signal } from '@angular/core';
+import { toSignal } from '@angular/core/rxjs-interop';
 import { ReactiveFormsModule, FormBuilder, Validators } from '@angular/forms';
 import { Router } from '@angular/router';
+import { HttpErrorResponse } from '@angular/common/http';
 import { AuthService } from '../../../core/services/auth.service';
 import { Button } from '../../../shared/components/ui/button/button';
 import { Card } from '../../../shared/components/ui/card/card';
 import { Alert } from '../../../shared/components/ui/alert/alert';
 import { Brand } from '../../../shared/components/ui/brand/brand';
+import { PasswordRequirementsChecklist } from '../../../shared/components/password-requirements/password-requirements';
 import { passwordValidators, PASSWORD_HINT } from '../../../shared/validators/password.validator';
 
 @Component({
   selector: 'app-change-password',
   standalone: true,
-  imports: [ReactiveFormsModule, Button, Card, Alert, Brand],
+  imports: [ReactiveFormsModule, Button, Card, Alert, Brand, PasswordRequirementsChecklist],
   templateUrl: './change-password.html',
   styleUrl: './change-password.scss',
 })
@@ -20,30 +23,47 @@ export class ChangePassword {
   private auth = inject(AuthService);
   private router = inject(Router);
 
+  private provisionalPassword = this.auth.takeProvisionalPassword();
+
   errorMessage = signal<string | null>(null);
   isLoading = signal(false);
-  passwordHint = PASSWORD_HINT;
+  asksCurrentPassword = signal(this.provisionalPassword === null);
+  email = this.auth.principal()?.email ?? '';
 
   form = this.fb.nonNullable.group({
-    current_password: ['', Validators.required],
+    current_password: [this.provisionalPassword ?? '', Validators.required],
     new_password: ['', passwordValidators],
   });
 
+  newPassword = toSignal(this.form.controls.new_password.valueChanges, { initialValue: '' });
+
   onSubmit(): void {
     if (this.form.invalid) return;
     this.isLoading.set(true);
     this.errorMessage.set(null);
 
     this.auth.changePassword(this.form.getRawValue()).subscribe({
-      next: (response) => {
+      next: () => {
         this.router.navigate(['/dashboard']);
       },
-      error: () => {
+      error: (error: HttpErrorResponse) => {
         this.isLoading.set(false);
-        this.errorMessage.set(
-          `Mot de passe actuel incorrect, ou nouveau mot de passe invalide (${this.passwordHint}).`,
-        );
+        this.errorMessage.set(this.explique(error));
+        if (error.status === 401) {
+          this.form.controls.current_password.reset('');
+          this.asksCurrentPassword.set(true);
+        }
       },
     });
   }
+
+  private explique(error: HttpErrorResponse): string {
+    if (error.status === 401) {
+      return 'Mot de passe actuel incorrect : saisissez le mot de passe provisoire qui vous a été transmis.';
+    }
+    if (error.status === 422) {
+      return `Nouveau mot de passe refusé (${PASSWORD_HINT}).`;
+    }
+    return 'Le changement de mot de passe a échoué, réessayez dans un instant.';
+  }
 }

apps/frontend/src/app/features/dashboard/dashboard.html

@@ -10,7 +10,11 @@
       </div>
     </div>
     <div class="dashboard__actions">
+      @if (auth.principal()?.role === 'admin') {
+        <a routerLink="/monitoring/sensors" class="ev-link">Supervision des capteurs</a>
+      }
       <a routerLink="/sites" class="ev-link">Voir les sites</a>
+      <a routerLink="/recommendations" class="ev-link">Recommandations</a>
       <ev-button
         class="logout-button"
         variant="secondary"
@@ -24,87 +28,120 @@
   @if (statsError(); as message) {
     <ev-alert severity="danger" class="banner-error">{{ message }}</ev-alert>
   }
-  @if (alertsError(); as message) {
-    <ev-alert severity="danger" class="banner-error">{{ message }}</ev-alert>
-  }
   @if (predictionsError(); as message) {
     <ev-alert severity="danger" class="banner-error">{{ message }}</ev-alert>
   }
 
   @if (stats(); as s) {
-    <section class="overview">
-      <ev-card class="card card--gauge">
-        <span class="card__label">Consommation vs capacité</span>
+    <p class="dashboard__status">
+      <span class="dashboard__pulse" aria-hidden="true"></span>
+      Actualisé à {{ s.timestamp | date: 'HH:mm:ss' }} · {{ s.total_sites }} sites suivis
+    </p>
+
+    <section class="overview" aria-label="Indicateurs du parc">
+      <ev-card class="kpi kpi--gauge">
+        <span class="kpi__label">Consommation vs capacité</span>
         <app-consumption-gauge
           [consumption]="s.total_consumption_kw"
           [capacity]="s.total_capacity_kw"
         />
-        <span class="card__value"
-          >{{ s.total_consumption_kw | number: '1.0-1' }} /
-          {{ s.total_capacity_kw | number }} kW</span
+        <span class="kpi__value">
+          {{ s.total_consumption_kw | number: '1.0-1' }}
+          <small>/ {{ s.total_capacity_kw | number }} kW</small>
+        </span>
+      </ev-card>
+
+      <ev-card class="kpi">
+        <span class="kpi__label">Charge moyenne du parc</span>
+        <span class="kpi__value"
+          >{{ s.average_load_percent | number: '1.0-0' }} <small>%</small></span
         >
-      </ev-card>
-
-      <ev-card class="card">
-        <span class="card__label">Charge moyenne du parc</span>
-        <span class="card__value">{{ s.average_load_percent }} %</span>
-        <div class="progress-bar">
-          <div class="progress-bar__fill" [style.width.%]="s.average_load_percent"></div>
+        <div
+          class="progress-bar"
+          role="progressbar"
+          aria-valuemin="0"
+          aria-valuemax="100"
+          [attr.aria-valuenow]="s.average_load_percent"
+        >
+          <div
+            class="progress-bar__fill"
+            [class]="'progress-bar__fill--' + loadTone(s.average_load_percent)"
+            [style.width.%]="s.average_load_percent"
+          ></div>
         </div>
+        <span class="kpi__hint">{{ loadHint(s.average_load_percent) }}</span>
       </ev-card>
 
-      <ev-card class="card">
-        <span class="card__label">Sites suivis</span>
-        <span class="card__value">{{ s.total_sites }}</span>
+      <ev-card class="kpi">
+        <span class="kpi__label">Sites suivis</span>
+        <span class="kpi__value">{{ s.total_sites }}</span>
+        <a routerLink="/sites" class="ev-link kpi__link">Voir la liste des sites</a>
       </ev-card>
     </section>
-
-    <section class="chart-section">
-      <h2>Charge et alerte visuelle par site</h2>
-      <app-site-load-chart [sites]="s.sites" />
-    </section>
   }
 
-  @if (alerts().length > 0) {
-    <section class="alerts-section">
-      <h2>Alertes actives</h2>
-      <ul class="alerts-list">
-        @for (alert of alerts(); track alert.alert_id) {
-          <li class="alert-item">
-            <ev-badge [tone]="badgeToneForSeverity(alert.severity)">{{ alert.severity }}</ev-badge>
-            <span class="alert-item__message">{{ alert.message }}</span>
-          </li>
+  <div class="dashboard__grid">
+    <div class="dashboard__main">
+      @if (stats(); as s) {
+        <section class="chart-section">
+          <h2>Charge par site</h2>
+          <ev-card class="chart-card">
+            <app-site-load-chart [sites]="s.sites" />
+          </ev-card>
+        </section>
+      }
+
+      <section class="predictions-section">
+        <h2>Prévisions de consommation</h2>
+        @if (predictions().length > 0) {
+          <ev-card class="ev-table-card">
+            <table class="ev-table">
+              <thead>
+                <tr>
+                  <th>Site</th>
+                  <th>Prévision</th>
+                  <th>Échéance</th>
+                  <th></th>
+                </tr>
+              </thead>
+              <tbody>
+                @for (site of predictions(); track site.site_id) {
+                  <tr>
+                    <td>{{ site.site_name }}</td>
+                    @if (site.prediction; as prediction) {
+                      @if (prediction.status === 'available') {
+                        <td class="ev-table__number">
+                          {{ prediction.predicted_value | number: '1.0-1' }} kWh
+                        </td>
+                        <td>{{ prediction.target_at | date: "dd/MM 'à' HH:mm" }}</td>
+                      } @else {
+                        <td>
+                          <ev-badge [tone]="badgeToneForPredictionStatus(prediction.status)">{{
+                            prediction.status === 'insufficient_data'
+                              ? 'Historique insuffisant'
+                              : 'Erreur'
+                          }}</ev-badge>
+                        </td>
+                        <td class="ev-table__muted">-</td>
+                      }
+                    } @else {
+                      <td><ev-badge tone="neutral">Pas encore de prévision</ev-badge></td>
+                      <td class="ev-table__muted">-</td>
+                    }
+                    <td><a [routerLink]="['/sites', site.site_id]" class="ev-link">Détail</a></td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </ev-card>
+        } @else if (!predictionsError()) {
+          <p class="dashboard__empty">Aucune prévision disponible pour le moment.</p>
         }
-      </ul>
-    </section>
-  }
+      </section>
+    </div>
 
-  @if (predictions().length > 0) {
-    <section class="predictions-section">
-      <h2>Prévisions de consommation</h2>
-      <ul class="predictions-list">
-        @for (site of predictions(); track site.site_id) {
-          <li class="prediction-item">
-            <span class="prediction-item__site">{{ site.site_name }}</span>
-            @if (site.prediction; as prediction) {
-              @if (prediction.status === 'available') {
-                <span class="prediction-item__value">
-                  {{ prediction.predicted_value | number: '1.0-1' }} kWh
-                  <span class="prediction-item__target"
-                    >{{ prediction.target_at | date: "dd/MM 'à' HH:mm" }}</span
-                  >
-                </span>
-              } @else {
-                <ev-badge [tone]="badgeToneForPredictionStatus(prediction.status)">{{
-                  prediction.status === 'insufficient_data' ? 'Historique insuffisant' : 'Erreur'
-                }}</ev-badge>
-              }
-            } @else {
-              <ev-badge tone="neutral">Pas encore de prévision</ev-badge>
-            }
-          </li>
-        }
-      </ul>
-    </section>
-  }
+    <aside class="dashboard__side" aria-label="Alertes actives">
+      <app-alert-feed />
+    </aside>
+  </div>
 </div>

apps/frontend/src/app/features/dashboard/dashboard.scss

@@ -8,9 +8,11 @@
 
 .dashboard__header {
   display: flex;
+  flex-wrap: wrap;
   align-items: flex-start;
   justify-content: space-between;
-  margin-bottom: 2rem;
+  gap: var(--space-3);
+  margin-bottom: var(--space-3);
 }
 
 .dashboard__brand {
@@ -20,8 +22,9 @@
 
   h1 {
     margin: 0;
-    font-size: 1.75rem;
+    font-size: var(--font-size-xl);
     font-weight: 700;
+    letter-spacing: -0.01em;
   }
 }
 
@@ -31,19 +34,69 @@
 
 .dashboard__subtitle {
   margin: 0.25rem 0 0;
+  font-size: var(--font-size-sm);
   color: var(--color-text-muted);
 }
 
 .dashboard__actions {
   display: flex;
+  flex-wrap: wrap;
   align-items: center;
-  gap: 1rem;
+  gap: var(--space-2);
+
+  .ev-link {
+    padding: 0.45rem 0.9rem;
+    border-radius: var(--radius-pill);
+    background: var(--color-primary-light);
+    color: var(--color-primary-hover);
+    font-size: var(--font-size-sm);
+    transition: background 0.15s ease;
+
+    &:hover {
+      background: var(--color-primary);
+      color: var(--color-text-inverse);
+      text-decoration: none;
+    }
+  }
+}
+
+.dashboard__status {
+  display: flex;
+  align-items: center;
+  gap: var(--space-2);
+  margin: 0 0 var(--space-4);
+  font-size: var(--font-size-sm);
+  color: var(--color-text-muted);
+}
+
+.dashboard__pulse {
+  width: 0.6rem;
+  height: 0.6rem;
+  border-radius: 50%;
+  background: var(--color-success);
+  animation: pulse 2s ease-out infinite;
+}
+
+@keyframes pulse {
+  0% {
+    box-shadow: 0 0 0 0 rgba(22, 163, 74, 0.45);
+  }
+
+  100% {
+    box-shadow: 0 0 0 8px rgba(22, 163, 74, 0);
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .dashboard__pulse {
+    animation: none;
+  }
 }
 
 h2 {
-  font-size: 1.1rem;
+  margin: 0 0 var(--space-3);
+  font-size: var(--font-size-lg);
   font-weight: 600;
-  margin: 0 0 1rem;
 }
 
 .banner-error {
@@ -54,107 +107,124 @@ h2 {
 .overview {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
-  gap: 1rem;
-  margin-bottom: 2.5rem;
+  gap: var(--space-3);
+  margin-bottom: var(--space-5);
 }
 
-.card {
-  padding: 1.25rem;
-  gap: 0.35rem;
+.kpi {
+  position: relative;
+  overflow: hidden;
+  padding: var(--space-4);
+  gap: var(--space-1);
+  transition:
+    box-shadow 0.15s ease,
+    transform 0.15s ease;
+
+  &::before {
+    content: '';
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 3px;
+    background: var(--color-primary);
+  }
+
+  &:hover {
+    box-shadow: var(--shadow-card-hover);
+    transform: translateY(-1px);
+  }
 }
 
-.card--gauge {
+.kpi--gauge {
   align-items: center;
   text-align: center;
 }
 
-.card__label {
-  font-size: 0.8rem;
+.kpi__label {
+  font-size: var(--font-size-xs);
+  font-weight: 600;
   color: var(--color-text-muted);
   text-transform: uppercase;
-  letter-spacing: 0.02em;
+  letter-spacing: 0.06em;
 }
 
-.card__value {
-  font-size: 1.6rem;
+.kpi__value {
+  font-size: var(--font-size-2xl);
   font-weight: 700;
+  line-height: 1.1;
+  font-variant-numeric: tabular-nums;
+
+  small {
+    font-size: var(--font-size-sm);
+    font-weight: 500;
+    color: var(--color-text-muted);
+  }
+}
+
+.kpi__hint {
+  font-size: var(--font-size-xs);
+  color: var(--color-text-muted);
+}
+
+.kpi__link {
+  margin-top: auto;
+  font-size: var(--font-size-sm);
 }
 
 .progress-bar {
-  height: 6px;
+  height: 8px;
+  margin: var(--space-1) 0;
   background: var(--color-border-light);
   border-radius: var(--radius-pill);
   overflow: hidden;
-  margin-top: 0.25rem;
 }
 
 .progress-bar__fill {
   height: 100%;
-  background: var(--color-primary);
   border-radius: var(--radius-pill);
+  background: var(--color-success);
   transition: width 0.3s ease;
 }
 
+.progress-bar__fill--warning {
+  background: var(--color-warning);
+}
+
+.progress-bar__fill--danger {
+  background: var(--color-danger);
+}
+
+.dashboard__grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(320px, 380px);
+  gap: var(--space-4);
+  align-items: start;
+}
+
+.dashboard__side {
+  position: sticky;
+  top: var(--space-3);
+}
+
 .chart-section {
-  margin-bottom: 2.5rem;
+  margin-bottom: var(--space-5);
 }
 
-.alerts-list {
-  list-style: none;
+.chart-card {
+  padding: var(--space-3);
+}
+
+.dashboard__empty {
   margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.alert-item {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 0.7rem 1rem;
-  border-radius: var(--radius-md);
-  background: var(--color-danger-bg);
-  border: 1px solid var(--color-danger-border);
-}
-
-.alert-item__message {
-  font-size: 0.9rem;
-}
-
-.predictions-list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.prediction-item {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-  padding: 0.7rem 1rem;
-  border-radius: var(--radius-md);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border-light);
-}
-
-.prediction-item__site {
-  font-size: 0.9rem;
-  font-weight: 600;
-}
-
-.prediction-item__value {
-  font-size: 0.9rem;
-  font-weight: 600;
-}
-
-.prediction-item__target {
-  margin-left: 0.35rem;
-  font-size: 0.8rem;
-  font-weight: 400;
+  font-size: var(--font-size-sm);
   color: var(--color-text-muted);
 }
+
+@media (max-width: 900px) {
+  .dashboard__grid {
+    grid-template-columns: 1fr;
+  }
+
+  .dashboard__side {
+    position: static;
+  }
+}

apps/frontend/src/app/features/dashboard/dashboard.spec.ts

@@ -1,12 +1,13 @@
 import { TestBed } from '@angular/core/testing';
 import { vi } from 'vitest';
-import { of, throwError } from 'rxjs';
+import { Observable, of, throwError } from 'rxjs';
+import { Router, provideRouter } from '@angular/router';
 import { Dashboard } from './dashboard';
 import { StatsService } from '../../core/services/stats.service';
 import { AlertsService } from '../../core/services/alerts.service';
+import { SitesService } from '../../core/services/sites.service';
 import { PredictionsService } from '../../core/services/predictions.service';
-import {AuthService} from '../../core/services/auth.service';
-import {Router, provideRouter} from '@angular/router';
+import { AuthService } from '../../core/services/auth.service';
 
 vi.mock('chart.js', () => {
   class ChartMock {
@@ -18,66 +19,73 @@ vi.mock('chart.js', () => {
   return { Chart: ChartMock, registerables: [] };
 });
 
+const STATS = { total_sites: 7, sites: [] };
+
 function predictionsMock(sites: unknown[] = []) {
-  return { getPredictions: vi.fn().mockReturnValue(of({ timestamp: '2026-09-18T09:00:00Z', sites })) };
+  return {
+    getPredictions: vi.fn().mockReturnValue(of({ timestamp: '2026-09-18T09:00:00Z', sites })),
+  };
+}
+
+function setup(
+  options: {
+    stats?: Observable<unknown>;
+    predictions?: { getPredictions: ReturnType<typeof vi.fn> };
+    auth?: Record<string, unknown>;
+  } = {},
+) {
+  const statsMock = { getSummary: vi.fn().mockReturnValue(options.stats ?? of(STATS)) };
+  const predictions = options.predictions ?? predictionsMock();
+  TestBed.configureTestingModule({
+    imports: [Dashboard],
+    providers: [
+      { provide: StatsService, useValue: statsMock },
+      { provide: AlertsService, useValue: { getAlerts: vi.fn().mockReturnValue(of([])) } },
+      { provide: SitesService, useValue: { getSites: vi.fn().mockReturnValue(of([])) } },
+      { provide: PredictionsService, useValue: predictions },
+      ...(options.auth ? [{ provide: AuthService, useValue: options.auth }] : []),
+      provideRouter([]),
+    ],
+  });
+  return { fixture: TestBed.createComponent(Dashboard), statsMock, predictions };
 }
 
 describe('Dashboard', () => {
   afterEach(() => vi.useRealTimers());
 
-  it('charge les stats, les alertes et les prévisions au démarrage', async () => {
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([{ alert_id: 'A1' }])) };
-    const predictions = predictionsMock([{ site_id: 'SITE001', site_name: 'Test', prediction: null }]);
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictions },
-        provideRouter([]),
-      ],
+  it('charge les stats et les prévisions au démarrage', async () => {
+    const { fixture, statsMock, predictions } = setup({
+      predictions: predictionsMock([{ site_id: 'SITE001', site_name: 'Test', prediction: null }]),
     });
 
-    const fixture = TestBed.createComponent(Dashboard);
     fixture.detectChanges();
-
-    // laisse le timer(0, ...) se déclencher avant de vérifier
     await new Promise((resolve) => setTimeout(resolve, 0));
     fixture.detectChanges();
 
     expect(statsMock.getSummary).toHaveBeenCalled();
-    expect(alertsMock.getAlerts).toHaveBeenCalled();
     expect(predictions.getPredictions).toHaveBeenCalled();
-    expect(fixture.componentInstance.alerts().length).toBe(1);
     expect(fixture.componentInstance.predictions().length).toBe(1);
     expect(fixture.componentInstance.statsError()).toBeNull();
-    expect(fixture.componentInstance.alertsError()).toBeNull();
     expect(fixture.componentInstance.predictionsError()).toBeNull();
   });
 
+  it('délègue les alertes au widget app-alert-feed', () => {
+    const { fixture } = setup();
+
+    fixture.detectChanges();
+
+    expect(fixture.nativeElement.querySelector('app-alert-feed')).not.toBeNull();
+  });
+
   it("signale l'indisponibilité puis repart au rafraîchissement suivant", () => {
     vi.useFakeTimers();
-    const statsMock = {
-      getSummary: vi
-        .fn()
-        .mockReturnValueOnce(throwError(() => new Error('API injoignable')))
-        .mockReturnValue(of({ total_sites: 7, sites: [] })),
-    };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictionsMock() },
-        provideRouter([]),
-      ],
+    const { fixture, statsMock } = setup({
+      stats: throwError(() => new Error('API injoignable')),
     });
+    statsMock.getSummary
+      .mockReturnValueOnce(throwError(() => new Error('API injoignable')))
+      .mockReturnValue(of(STATS));
 
-    const fixture = TestBed.createComponent(Dashboard);
     fixture.detectChanges();
 
     vi.advanceTimersByTime(1);
@@ -91,45 +99,11 @@ describe('Dashboard', () => {
     expect(fixture.componentInstance.statsError()).toBeNull();
   });
 
-  it("n'interrompt pas la page quand le chargement des alertes échoue", () => {
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(throwError(() => new Error('nope'))) };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictionsMock() },
-        provideRouter([]),
-      ],
-    });
-
-    const fixture = TestBed.createComponent(Dashboard);
-    fixture.detectChanges();
-
-    expect(fixture.componentInstance.alerts().length).toBe(0);
-    expect(fixture.componentInstance.alertsError()).not.toBeNull();
-  });
-
   it("n'interrompt pas la page quand le chargement des prévisions échoue", () => {
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-    const predictions = {
-      getPredictions: vi.fn().mockReturnValue(throwError(() => new Error('nope'))),
-    };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictions },
-        provideRouter([]),
-      ],
+    const { fixture } = setup({
+      predictions: { getPredictions: vi.fn().mockReturnValue(throwError(() => new Error('nope'))) },
     });
 
-    const fixture = TestBed.createComponent(Dashboard);
     fixture.detectChanges();
 
     expect(fixture.componentInstance.predictions().length).toBe(0);
@@ -138,25 +112,11 @@ describe('Dashboard', () => {
 
   it("un rafraîchissement de stats n'efface pas une erreur de prévisions en attente", () => {
     vi.useFakeTimers();
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-    const predictions = {
-      getPredictions: vi.fn().mockReturnValue(throwError(() => new Error('nope'))),
-    };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictions },
-        provideRouter([]),
-      ],
+    const { fixture } = setup({
+      predictions: { getPredictions: vi.fn().mockReturnValue(throwError(() => new Error('nope'))) },
     });
 
-    const fixture = TestBed.createComponent(Dashboard);
     fixture.detectChanges();
-
     expect(fixture.componentInstance.predictionsError()).not.toBeNull();
 
     // Plusieurs cycles de `timer(0, 10_000)` (stats) plus tard, l'erreur des prévisions doit
@@ -168,105 +128,106 @@ describe('Dashboard', () => {
   });
 
   it('appelle logout et redirige vers /login au clic sur le bouton de déconnexion', () => {
-  const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-  const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-  const authMock = { logout: vi.fn().mockReturnValue(of(undefined)), clearSession: vi.fn() };
+    const authMock = {
+      logout: vi.fn().mockReturnValue(of(undefined)),
+      clearSession: vi.fn(),
+      principal: vi.fn().mockReturnValue({ role: 'admin' }),
+    };
+    const { fixture } = setup({ auth: authMock });
+    fixture.detectChanges();
+    const router = TestBed.inject(Router);
+    const navigateSpy = vi.spyOn(router, 'navigate').mockResolvedValue(true);
 
-  TestBed.configureTestingModule({
-    imports: [Dashboard],
-    providers: [
-      { provide: StatsService, useValue: statsMock },
-      { provide: AlertsService, useValue: alertsMock },
-      { provide: PredictionsService, useValue: predictionsMock() },
-      { provide: AuthService, useValue: authMock },
-      provideRouter([]),
-    ],
+    fixture.nativeElement.querySelector('.logout-button').click();
+
+    expect(authMock.logout).toHaveBeenCalled();
+    expect(navigateSpy).toHaveBeenCalledWith(['/login']);
   });
 
-  const fixture = TestBed.createComponent(Dashboard);
-  fixture.detectChanges();
-
-  const router = TestBed.inject(Router);
-  const navigateSpy = vi.spyOn(router, 'navigate').mockResolvedValue(true);
-
-  const button = fixture.nativeElement.querySelector('.logout-button');
-  button.click();
-
-  expect(authMock.logout).toHaveBeenCalled();
-  expect(navigateSpy).toHaveBeenCalledWith(['/login']);
-  });
   it('déconnecte localement et redirige vers /login même si logout échoue côté réseau', () => {
-  const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-  const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-  const authMock = {
-    logout: vi.fn().mockReturnValue(throwError(() => new Error('réseau indisponible'))),
-    clearSession: vi.fn(),
-  };
-  TestBed.configureTestingModule({
-    imports: [Dashboard],
-    providers: [
-      { provide: StatsService, useValue: statsMock },
-      { provide: AlertsService, useValue: alertsMock },
-      { provide: PredictionsService, useValue: predictionsMock() },
-      { provide: AuthService, useValue: authMock },
-      provideRouter([]),
-    ],
+    const authMock = {
+      logout: vi.fn().mockReturnValue(throwError(() => new Error('réseau indisponible'))),
+      clearSession: vi.fn(),
+      principal: vi.fn().mockReturnValue({ role: 'admin' }),
+    };
+    const { fixture } = setup({ auth: authMock });
+    fixture.detectChanges();
+    const router = TestBed.inject(Router);
+    const navigateSpy = vi.spyOn(router, 'navigate').mockResolvedValue(true);
+
+    fixture.nativeElement.querySelector('.logout-button').click();
+
+    expect(authMock.clearSession).toHaveBeenCalled();
+    expect(navigateSpy).toHaveBeenCalledWith(['/login']);
   });
 
-  const fixture = TestBed.createComponent(Dashboard);
-  fixture.detectChanges();
-
-  const router = TestBed.inject(Router);
-  const navigateSpy = vi.spyOn(router, 'navigate').mockResolvedValue(true);
-
-  const button = fixture.nativeElement.querySelector('.logout-button');
-  button.click();
-
-  expect(authMock.clearSession).toHaveBeenCalled();
-  expect(navigateSpy).toHaveBeenCalledWith(['/login']);
-});
-
-  it('distingue le ton des sévérités high et critical', () => {
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictionsMock() },
-        provideRouter([]),
-      ],
+  it('affiche l’heure du dernier relevé et les indicateurs du parc', () => {
+    vi.useFakeTimers();
+    const { fixture } = setup({
+      stats: of({
+        timestamp: '2026-09-18T09:00:00Z',
+        total_sites: 7,
+        total_consumption_kw: 1234.5,
+        total_capacity_kw: 5000,
+        average_load_percent: 24.7,
+        sites: [],
+      }),
     });
 
-    const fixture = TestBed.createComponent(Dashboard);
+    fixture.detectChanges();
+    vi.advanceTimersByTime(1);
+    fixture.detectChanges();
+
+    const texte = fixture.nativeElement.textContent as string;
+    expect(texte).toContain('Actualisé à');
+    expect(texte).toContain('7 sites suivis');
+    expect(texte).toContain('Marge confortable');
+    expect(fixture.nativeElement.querySelector('.progress-bar__fill--success')).not.toBeNull();
+  });
+
+  it('présente les prévisions en tableau avec un lien vers chaque site', () => {
+    const { fixture } = setup({
+      predictions: predictionsMock([
+        {
+          site_id: 'SITE001',
+          site_name: 'Usine Nantes',
+          prediction: {
+            target_at: '2026-09-18T10:00:00Z',
+            target_metric: 'consumption_kwh',
+            period_minutes: 60,
+            predicted_value: 118.4,
+            status: 'available',
+            failure_reason: null,
+            model_reference: 'lightgbm-v1',
+            created_at: '2026-09-18T09:00:00Z',
+          },
+        },
+        { site_id: 'SITE002', site_name: 'Bureau Lille', prediction: null },
+      ]),
+    });
+
+    fixture.detectChanges();
+
+    const table = fixture.nativeElement.querySelector('table.ev-table');
+    expect(table).not.toBeNull();
+    expect(table.textContent).toContain('118.4 kWh');
+    expect(table.textContent).toContain('Pas encore de prévision');
+    expect(fixture.nativeElement.querySelector('a[href="/sites/SITE001"]')).not.toBeNull();
+  });
+
+  it('colore la charge moyenne selon les seuils 70 % et 90 %', () => {
+    const { fixture } = setup();
     const dashboard = fixture.componentInstance;
 
-    expect(dashboard.badgeToneForSeverity('low')).toBe('success');
-    expect(dashboard.badgeToneForSeverity('medium')).toBe('warning');
-    expect(dashboard.badgeToneForSeverity('high')).toBe('danger');
-    expect(dashboard.badgeToneForSeverity('critical')).toBe('critical');
-    expect(dashboard.badgeToneForSeverity('high')).not.toBe(
-      dashboard.badgeToneForSeverity('critical'),
-    );
+    expect(dashboard.loadTone(69.9)).toBe('success');
+    expect(dashboard.loadTone(70)).toBe('warning');
+    expect(dashboard.loadTone(89.9)).toBe('warning');
+    expect(dashboard.loadTone(90)).toBe('danger');
+    expect(dashboard.loadHint(95)).toBe('Proche de la capacité du parc');
   });
 
   it('distingue le ton des statuts de prévision', () => {
-    const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-    const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-
-    TestBed.configureTestingModule({
-      imports: [Dashboard],
-      providers: [
-        { provide: StatsService, useValue: statsMock },
-        { provide: AlertsService, useValue: alertsMock },
-        { provide: PredictionsService, useValue: predictionsMock() },
-        provideRouter([]),
-      ],
-    });
-
-    const fixture = TestBed.createComponent(Dashboard);
+    const { fixture } = setup();
     const dashboard = fixture.componentInstance;
 
     expect(dashboard.badgeToneForPredictionStatus('available')).toBe('success');

apps/frontend/src/app/features/dashboard/dashboard.ts

@@ -6,11 +6,10 @@ import { Router, RouterLink } from '@angular/router';
 import { StatsService } from '../../core/services/stats.service';
 import { ConsumptionGauge } from '../../shared/components/consumption-gauge/consumption-gauge';
 import { SiteLoadChart } from '../../shared/components/site-load-chart/site-load-chart';
-import { AlertsService } from '../../core/services/alerts.service';
+import { AlertFeed } from '../../shared/components/alert-feed/alert-feed';
 import { PredictionsService } from '../../core/services/predictions.service';
 import { AuthService } from '../../core/services/auth.service';
 import { StatsSummary } from '../../shared/models/stats.model';
-import { Alert, AlertSeverity } from '../../shared/models/alert.model';
 import { PredictionStatus, SitePredictionSummary } from '../../shared/models/prediction.model';
 import { Card } from '../../shared/components/ui/card/card';
 import { Alert as EvAlert } from '../../shared/components/ui/alert/alert';
@@ -22,22 +21,19 @@ const REFRESH_INTERVAL_MS = 10000;
 const UNAVAILABLE_MESSAGE =
   'Données indisponibles, les valeurs affichées datent du dernier relevé.';
 
-const TON_PAR_SEVERITE: Record<AlertSeverity, BadgeTone> = {
-  low: 'success',
-  medium: 'warning',
-  high: 'danger',
-  critical: 'critical',
-};
-
-// `error` n'a pas de précédent dans les fixtures ou l'API à ce jour, mais figure dans le
-// domaine du schéma backend (`ck_prediction_status`) : mieux vaut une couleur définie que
-// tomber sur `undefined` si ce statut apparaît un jour.
+// `error` n'a pas encore de précédent côté API mais figure dans `ck_prediction_status` :
+// mieux vaut un ton défini que `undefined` le jour où ce statut apparaît.
 const TON_PAR_STATUT_PREDICTION: Record<PredictionStatus, BadgeTone> = {
   available: 'success',
   insufficient_data: 'warning',
   error: 'danger',
 };
 
+const SEUIL_CHARGE_SOUTENUE = 70;
+const SEUIL_CHARGE_CRITIQUE = 90;
+
+export type LoadTone = 'success' | 'warning' | 'danger';
+
 @Component({
   selector: 'app-dashboard',
   standalone: true,
@@ -47,6 +43,7 @@ const TON_PAR_STATUT_PREDICTION: Record<PredictionStatus, BadgeTone> = {
     RouterLink,
     ConsumptionGauge,
     SiteLoadChart,
+    AlertFeed,
     Card,
     EvAlert,
     Badge,
@@ -58,32 +55,20 @@ const TON_PAR_STATUT_PREDICTION: Record<PredictionStatus, BadgeTone> = {
 })
 export class Dashboard implements OnInit {
   private statsService = inject(StatsService);
-  private alertsService = inject(AlertsService);
+  public auth = inject(AuthService);
   private predictionsService = inject(PredictionsService);
-  private auth = inject(AuthService);
   private router = inject(Router);
   private destroyRef = inject(DestroyRef);
 
   stats = signal<StatsSummary | null>(null);
-  alerts = signal<Alert[]>([]);
   predictions = signal<SitePredictionSummary[]>([]);
 
-  // Un signal par flux, pas un seul `error` partagé : sinon le tick suivant de `timer` (stats)
-  // efface silencieusement un message d'échec des prévisions ou des alertes après 10s au plus,
-  // sans retry ni indication pour l'utilisateur que la section correspondante est restée vide.
+  // Piège : un signal d'erreur par flux, sinon le tick suivant de `timer` (stats) efface en
+  // silence l'échec des prévisions après 10 s au plus, sans retry ni indication à l'utilisateur.
   statsError = signal<string | null>(null);
-  alertsError = signal<string | null>(null);
   predictionsError = signal<string | null>(null);
 
   ngOnInit(): void {
-    this.alertsService
-      .getAlerts()
-      .pipe(catchError(() => this.reportUnavailable(this.alertsError)))
-      .subscribe((alerts) => {
-        this.alertsError.set(null);
-        this.alerts.set(alerts);
-      });
-
     // Les prévisions viennent d'un scoring hors ligne, pas d'un calcul à la demande : un seul
     // chargement au démarrage suffit, pas besoin du rafraîchissement périodique de `stats`.
     this.predictionsService
@@ -99,7 +84,9 @@ export class Dashboard implements OnInit {
     timer(0, REFRESH_INTERVAL_MS)
       .pipe(
         switchMap(() =>
-          this.statsService.getSummary().pipe(catchError(() => this.reportUnavailable(this.statsError))),
+          this.statsService
+            .getSummary()
+            .pipe(catchError(() => this.reportUnavailable(this.statsError))),
         ),
         takeUntilDestroyed(this.destroyRef),
       )
@@ -109,14 +96,28 @@ export class Dashboard implements OnInit {
       });
   }
 
-  badgeToneForSeverity(severity: AlertSeverity): BadgeTone {
-    return TON_PAR_SEVERITE[severity];
-  }
-
   badgeToneForPredictionStatus(status: PredictionStatus): BadgeTone {
     return TON_PAR_STATUT_PREDICTION[status];
   }
 
+  loadTone(percent: number): LoadTone {
+    if (percent >= SEUIL_CHARGE_CRITIQUE) {
+      return 'danger';
+    }
+    return percent >= SEUIL_CHARGE_SOUTENUE ? 'warning' : 'success';
+  }
+
+  loadHint(percent: number): string {
+    switch (this.loadTone(percent)) {
+      case 'danger':
+        return 'Proche de la capacité du parc';
+      case 'warning':
+        return 'Charge soutenue';
+      default:
+        return 'Marge confortable';
+    }
+  }
+
   onLogout(): void {
     this.auth.logout().subscribe({
       next: () => this.router.navigate(['/login']),

apps/frontend/src/app/features/monitoring/sensor-status/sensor-status.html

@@ -0,0 +1,51 @@
+<div class="sensor-status">
+  <nav class="ev-breadcrumb">
+    <a routerLink="/dashboard">Tableau de bord</a>
+  </nav>
+
+  <header class="sensor-status__header">
+    <a routerLink="/dashboard" class="ev-brand-link">
+      <ev-brand class="sensor-status__logo" />
+    </a>
+    <div>
+      <h1>Supervision des capteurs</h1>
+      <p class="sensor-status__subtitle">État de santé par capteur et par site</p>
+    </div>
+  </header>
+
+  @if (error(); as message) {
+    <ev-alert severity="danger" class="banner-error">{{ message }}</ev-alert>
+  }
+
+  @if (data(); as d) {
+    <div class="sites-grid">
+      @for (site of d.sites; track site.site_id) {
+        <ev-card class="site-card" data-testid="site-card">
+          <div class="site-card__header">
+            <span class="site-card__name">{{ site.site_name }}</span>
+            <ev-badge [tone]="badgeToneForOverall(site.overall)">{{ site.overall }}</ev-badge>
+          </div>
+
+          <ul class="sensor-list">
+            @for (entry of sensorEntries; track entry[0]) {
+              @let diagnostic = sensorOf(site.sensors, entry[0]);
+              <li class="sensor-item">
+                <span class="sensor-dot" [class]="'sensor-dot--' + diagnostic.status"></span>
+                <span class="sensor-item__label">{{ entry[1] }}</span>
+                @if (diagnostic.status === 'failing') {
+                  <span class="sensor-item__since">
+                    @if (diagnostic.since; as since) {
+                      dernière lecture le {{ since | date: 'dd/MM/yyyy HH:mm' }}
+                    } @else {
+                      aucune lecture reçue
+                    }
+                  </span>
+                }
+              </li>
+            }
+          </ul>
+        </ev-card>
+      }
+    </div>
+  }
+</div>

apps/frontend/src/app/features/monitoring/sensor-status/sensor-status.scss

@@ -0,0 +1,90 @@
+:host {
+  display: block;
+  color: var(--color-text);
+  padding: 2.5rem 2rem;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+
+.sensor-status__header {
+  display: flex;
+  align-items: center;
+  gap: 0.85rem;
+  margin-bottom: 2rem;
+
+  h1 {
+    margin: 0;
+    font-size: 1.75rem;
+    font-weight: 700;
+  }
+}
+
+.sensor-status__logo {
+  font-size: 1.3rem;
+}
+
+.sensor-status__subtitle {
+  margin: 0.25rem 0 0;
+  color: var(--color-text-muted);
+}
+
+.banner-error {
+  display: block;
+  margin: 0 0 1.5rem;
+}
+
+.sites-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+  gap: 1rem;
+}
+
+.site-card__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 0.75rem;
+}
+
+.site-card__name {
+  font-weight: 600;
+}
+
+.sensor-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.sensor-item {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.85rem;
+}
+
+.sensor-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  flex-shrink: 0;
+
+  &--ok {
+    background: var(--color-success);
+  }
+  &--failing {
+    background: var(--color-danger);
+  }
+}
+
+.sensor-item__label {
+  flex: 1;
+}
+
+.sensor-item__since {
+  color: var(--color-text-muted);
+  font-size: 0.75rem;
+}