chore: harden security, clean deps, add vitest baseline

- .env.example: vider les secrets (à rotater côté Plesk)
- src/lib/auth.ts: fail-fast lazy si ADMIN_JWT_SECRET < 32 chars
- src/pages/api/upload.ts: retirer .svg (anti-XSS) + try/catch FS
- src/pages/api/content/[section].ts: masquer err.message (sauf ZodError)
- retirer gsap/three/@types/three/@react-three/{fiber,drei}/lucide-react
- bump astro 6.1.10 (GHSA-xr5h-phrj-8vxv)
- zod 4: z.email()/z.url() au lieu de .email()/.url()
- nettoyer vars inutilisées + Header script is:inline

Vitest (38 tests, 615ms):
- tests/lib/auth.test.ts: verifyPassword + verifySession (round-trip, secrets distincts)
- tests/lib/content.test.ts: load/save + comportement seed
- tests/api/files.test.ts: path traversal (../, /, imbriqué) + 200
- tests/api/upload.test.ts: extension/taille/sanitize folder + bucket
- tests/middleware.test.ts: gating admin pages vs APIs vs routes publiques
- astro check: 0 errors / 0 warnings / 0 hints

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -12,6 +12,9 @@
     "start": "HOST=0.0.0.0 PORT=3100 node ./dist/server/entry.mjs",
     "astro": "astro",
     "check": "astro check",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
     "hash:password": "node scripts/hash-password.mjs"
   },
   "dependencies": {
@@ -19,30 +22,26 @@
     "@astrojs/react": "^5.0.3",
     "@hookform/resolvers": "^5.2.2",
     "@iconify-icon/react": "^3.0.3",
-    "@react-three/drei": "^10.7.7",
-    "@react-three/fiber": "^9.6.0",
     "@tailwindcss/vite": "^4.2.2",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "astro": "^6.1.8",
     "bcryptjs": "^3.0.3",
     "framer-motion": "^12.38.0",
-    "gsap": "^3.15.0",
     "jose": "^6.2.2",
     "lenis": "^1.3.23",
-    "lucide-react": "^1.8.0",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
     "react-hook-form": "^7.75.0",
     "tailwindcss": "^4.2.2",
-    "three": "^0.184.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.8",
     "@types/bcryptjs": "^2.4.6",
     "@types/node": "^25.6.0",
-    "@types/three": "^0.184.0",
-    "typescript": "^5.9.3"
+    "@vitest/coverage-v8": "^4.1.6",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.6"
   }
 }