feat: clean install (Gitea en dur, scan off) + durcissement sécurité entreprise

Gitea
- lien « Code source » hardcodé (REPO_SOURCE_URL) vers le dépôt, toujours visible
- retrait complet du réglage configurable (api.ts, route+store settings, SettingsView, i18n, help, tests)

Découverte des dépôts
- aucune racine de scan par défaut → pas de scan au premier démarrage (clean install)
- corrige la découverte des dépôts à l'INTÉRIEUR d'une racine qui est elle-même un repo
  (depth 0 = conteneur de scan, on descend ; depth > 0 = feuille)

Sécurité « enterprise-deployable »
- en-têtes HTTP durcis (CSP, X-Frame-Options, nosniff, Referrer-Policy, HSTS conditionnel, no-store API), header Server retiré
- permissions DB 0o600 / dossier de données 0o700 ; error handler sanitisé ; garde Content-Type sur les mutations
- chiffrement au repos AES-256-GCM des secrets (server_secret, clé privée VAPID) via SecretBox
- journal d'audit (migration #7) + endpoint /audit-logs + RGPD export/effacement + UI Réglages
- SECURITY.md, docs/ENTERPRISE_DEPLOYMENT.md, sections README EN/FR, SBOM CycloneDX en CI

CI
- pack-smoke packe depuis le contexte du package (cd packages/server) au lieu de « npm pack -w » :
  corrige l'embarquement de @arboretum/shared dans le tarball

Purge des données personnelles du dépôt public
- suppression de spikes/s4-discovery/result.json, reformulation du VERDICT
- chemin de test générique, anonymisation des 5 fixtures de dialogues

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/web/src/views/SettingsView.vue

@@ -102,25 +102,6 @@
       </ul>
     </section>
 
-    <!-- Intégrations : Gitea -->
-    <section class="card flex flex-col gap-3">
-      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
-        <Puzzle :size="16" /> {{ t('settings.integrations') }}
-      </h2>
-      <form class="flex flex-col gap-2" @submit.prevent="saveGitea">
-        <label class="flex flex-col gap-1">
-          <span class="text-xs text-zinc-400">{{ t('settings.giteaUrlLabel') }}</span>
-          <div class="flex flex-wrap items-center gap-2">
-            <input v-model="giteaInput" type="url" class="input min-w-48 flex-1" :placeholder="t('settings.giteaUrlPlaceholder')" />
-            <BaseButton type="submit" variant="primary" :loading="settings.saving" :disabled="!giteaDirty">
-              {{ t('settings.save') }}
-            </BaseButton>
-          </div>
-        </label>
-        <p class="text-xs text-zinc-500">{{ t('settings.giteaUrlHint') }}</p>
-      </form>
-    </section>
-
     <!-- Découverte des dépôts -->
     <section class="card flex flex-col gap-3">
       <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
@@ -156,6 +137,26 @@
       </div>
     </section>
 
+    <!-- Sécurité & conformité -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <Shield :size="16" /> {{ t('settings.compliance') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.complianceHint') }}</p>
+      <div class="flex flex-wrap gap-2">
+        <BaseButton size="sm" :icon="Download" :loading="exporting" @click="exportData">{{ t('settings.exportData') }}</BaseButton>
+        <BaseButton variant="ghost" size="sm" :icon="RefreshCw" :loading="auditing" @click="loadAudit">{{ t('settings.refreshAudit') }}</BaseButton>
+        <BaseButton variant="ghost" size="sm" :icon="Trash2" @click="deleteMyData">{{ t('settings.deleteData') }}</BaseButton>
+      </div>
+      <ul v-if="audit.length" class="flex flex-col divide-y divide-zinc-800/80 text-xs">
+        <li v-for="e in audit" :key="e.id" class="flex items-center justify-between gap-3 py-1.5">
+          <span class="font-mono text-zinc-300">{{ e.action }}</span>
+          <span class="truncate text-zinc-500">{{ e.actor }}</span>
+          <span class="shrink-0 text-zinc-600">{{ new Date(e.ts).toLocaleString() }}</span>
+        </li>
+      </ul>
+    </section>
+
     <!-- Serveur (lecture seule) -->
     <section class="card flex flex-col gap-3">
       <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
@@ -183,8 +184,16 @@
 <script setup lang="ts">
 import { computed, onMounted, ref } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { Bell, BellOff, Check, Copy, FolderOpen, KeyRound, Plus, Puzzle, ScanSearch, Send, Server, Shield, SlidersHorizontal, Trash2, X } from '@lucide/vue';
-import type { CreateTokenResponse, TokenInfo, TokensListResponse } from '@arboretum/shared';
+import { Bell, BellOff, Check, Copy, Download, FolderOpen, KeyRound, Plus, RefreshCw, ScanSearch, Send, Server, Shield, SlidersHorizontal, Trash2, X } from '@lucide/vue';
+import type {
+  AuditLogEntry,
+  AuditLogsResponse,
+  CreateTokenResponse,
+  DataExportResponse,
+  DeleteMyDataResponse,
+  TokenInfo,
+  TokensListResponse,
+} from '@arboretum/shared';
 import { api, ApiError } from '../lib/api';
 import { useSettingsStore } from '../stores/settings';
 import { usePushStore } from '../stores/push';
@@ -272,19 +281,6 @@ async function copy(text: string, target?: 'new'): Promise<void> {
   }
 }
 
-// ---- Gitea ----
-const giteaInput = ref('');
-const giteaDirty = computed(() => giteaInput.value.trim() !== (settings.giteaUrl ?? ''));
-async function saveGitea(): Promise<void> {
-  try {
-    await settings.save({ giteaUrl: giteaInput.value.trim() || null });
-    giteaInput.value = settings.giteaUrl ?? '';
-    toasts.success(t('settings.saved'));
-  } catch (e) {
-    toasts.error(e);
-  }
-}
-
 // ---- Découverte des dépôts ----
 const rootsDraft = ref<string[]>([]);
 const intervalDraft = ref(0);
@@ -313,9 +309,55 @@ async function saveDiscovery(): Promise<void> {
   }
 }
 
+// ---- Sécurité & conformité (audit / RGPD) ----
+const audit = ref<AuditLogEntry[]>([]);
+const auditing = ref(false);
+const exporting = ref(false);
+
+async function loadAudit(): Promise<void> {
+  auditing.value = true;
+  try {
+    audit.value = (await api.get<AuditLogsResponse>('/api/v1/audit-logs?limit=20')).entries;
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    auditing.value = false;
+  }
+}
+
+async function exportData(): Promise<void> {
+  exporting.value = true;
+  try {
+    const data = await api.get<DataExportResponse>('/api/v1/data/export');
+    const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = 'arboretum-data-export.json';
+    a.click();
+    URL.revokeObjectURL(url);
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    exporting.value = false;
+  }
+}
+
+async function deleteMyData(): Promise<void> {
+  if (!window.confirm(t('settings.deleteConfirm'))) return;
+  try {
+    const pending = await api.post<DeleteMyDataResponse>('/api/v1/data/delete-my-data', {});
+    if (pending.status !== 'pending' || !pending.confirm) return;
+    const done = await api.post<DeleteMyDataResponse>('/api/v1/data/delete-my-data', { confirm: pending.confirm });
+    toasts.success(t('settings.deleteDone'));
+    if (done.summary.tokenRevoked) window.location.reload(); // token courant révoqué → re-login
+  } catch (e) {
+    toasts.error(e);
+  }
+}
+
 onMounted(async () => {
   await Promise.all([loadTokens(), settings.loaded ? Promise.resolve() : settings.fetch()]);
-  giteaInput.value = settings.giteaUrl ?? '';
   syncDiscoveryDraft();
   void push.refresh();
 });