feat: onglets Réglages & Aide + icône Gitea

Réglages : préférences (langue, notifications push + test), gestion complète des tokens d'accès (liste/création/révocation, garde anti lock-out sur le dernier token), URL Gitea configurable, infos serveur en lecture seule (port/bind/origines/VAPID + flags CLI). Aide : documentation bilingue EN/FR de toutes les fonctionnalités, avec recherche. Icône Gitea (lien externe) dans la nav (sidebar + MoreSheet mobile).

Backend : routes /api/v1/auth/tokens (GET/POST/DELETE) + tokenId dans /me ; routes/settings.ts (GET/PATCH, allow-list stricte gitea_url, aucun secret exposé, URL validée http/https anti-XSS) ; AuthService.listTokens/revokeToken (transaction). Front : NavItem gère les liens externes, nav primaire/secondaire, store settings, vues SettingsView/HelpView.

236 tests verts (+15 nouveaux : auth-tokens, settings-routes).

packages/web/src/i18n/en.ts

@@ -174,6 +174,9 @@ export default {
     sessions: 'Sessions',
     groups: 'Groups',
     settings: 'Settings',
+    help: 'Help',
+    more: 'More',
+    gitea: 'Open Gitea',
     waiting: 'waiting',
   },
   controls: {
@@ -292,4 +295,64 @@ export default {
     count: 'no session waiting | 1 session waiting | {n} sessions waiting',
     empty: 'Nothing waiting',
   },
+  settings: {
+    title: 'Settings',
+    // Préférences
+    preferences: 'Preferences',
+    preferencesHint: 'These apply to this browser only.',
+    language: 'Language',
+    notifications: 'Notifications',
+    notificationsEnabled: 'Enabled — you will be notified when a session needs input.',
+    notificationsDisabled: 'Disabled.',
+    enableNotifications: 'Enable notifications',
+    disableNotifications: 'Disable notifications',
+    testNotification: 'Send a test',
+    testSent: 'Test notification sent',
+    pushUnsupported: 'Push needs HTTPS (e.g. Tailscale Serve); on iOS, install the app to your home screen first.',
+    // Accès & sécurité
+    security: 'Access & security',
+    securityHint: 'Tokens grant full access to this server. Create one per device and revoke any you no longer use.',
+    tokens: 'Access tokens',
+    newTokenLabel: 'Label',
+    newTokenPlaceholder: 'e.g. phone, laptop',
+    createToken: 'Create token',
+    tokenCreated: 'Token created',
+    copyTokenHint: 'Copy this token now — for security it will never be shown again.',
+    copy: 'Copy',
+    copied: 'Copied',
+    current: 'current',
+    created: 'Created {date}',
+    lastUsed: 'last used {date}',
+    neverUsed: 'never used',
+    revoke: 'Revoke',
+    confirmRevoke: 'Confirm revoke',
+    tokenRevoked: 'Token revoked',
+    lastTokenError: 'You cannot revoke the last active token — create another one first.',
+    // Intégrations
+    integrations: 'Integrations',
+    gitea: 'Gitea',
+    giteaUrlLabel: 'Gitea instance URL',
+    giteaUrlPlaceholder: 'https://git.example.com',
+    giteaUrlHint: 'Adds a shortcut icon to the navigation. Leave empty to hide it.',
+    save: 'Save',
+    saved: 'Saved',
+    // Serveur (lecture seule)
+    server: 'Server',
+    serverHint: 'Set at startup via CLI flags — changing them requires restarting the daemon.',
+    version: 'Version',
+    port: 'Port',
+    bind: 'Bind address',
+    allowedOrigins: 'Allowed origins',
+    dataDir: 'Data directory',
+    vapidPublicKey: 'VAPID public key',
+    vapidContact: 'VAPID contact',
+    none: 'none',
+    flagHint: 'CLI flag: {flag}',
+  },
+  help: {
+    title: 'Help',
+    intro: 'Everything Arboretum can do, and how to use it.',
+    searchPlaceholder: 'Search help…',
+    noMatch: 'No matching topic',
+  },
 };