chore: harden security, clean deps, add vitest baseline

- .env.example: vider les secrets (à rotater côté Plesk)
- src/lib/auth.ts: fail-fast lazy si ADMIN_JWT_SECRET < 32 chars
- src/pages/api/upload.ts: retirer .svg (anti-XSS) + try/catch FS
- src/pages/api/content/[section].ts: masquer err.message (sauf ZodError)
- retirer gsap/three/@types/three/@react-three/{fiber,drei}/lucide-react
- bump astro 6.1.10 (GHSA-xr5h-phrj-8vxv)
- zod 4: z.email()/z.url() au lieu de .email()/.url()
- nettoyer vars inutilisées + Header script is:inline

Vitest (38 tests, 615ms):
- tests/lib/auth.test.ts: verifyPassword + verifySession (round-trip, secrets distincts)
- tests/lib/content.test.ts: load/save + comportement seed
- tests/api/files.test.ts: path traversal (../, /, imbriqué) + 200
- tests/api/upload.test.ts: extension/taille/sanitize folder + bucket
- tests/middleware.test.ts: gating admin pages vs APIs vs routes publiques
- astro check: 0 errors / 0 warnings / 0 hints

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/Header.astro

@@ -198,7 +198,7 @@ const current = Astro.url.pathname;
   </div>
 </header>
 
-<script data-astro-rerun>
+<script is:inline data-astro-rerun>
   // Mobile menu
   const btn = document.getElementById('mobile-menu-btn');
   const menu = document.getElementById('mobile-menu');

src/components/ProjectCard.astro

@@ -7,7 +7,6 @@ interface Props {
 const { project } = Astro.props;
 const isArchived = project.status === 'archived';
 const isPrivate = project.status === 'private';
-const isWIP = project.status === 'wip';
 const statusLabel =
   project.status === 'live'
     ? 'Live'

src/components/islands/PatchBay.tsx

@@ -94,7 +94,7 @@ export default function PatchBay({ technical, soft }: Props) {
           Techniques
         </h3>
         <ul className="space-y-2.5">
-          {technical.map((s, i) => (
+          {technical.map((s) => (
             <li key={s} className="flex items-center gap-3 font-mono text-xs uppercase tracking-wider">
               <span className="text-[color:var(--color-text-muted)] flex-1">{s}</span>
               <span
@@ -122,7 +122,7 @@ export default function PatchBay({ technical, soft }: Props) {
           Transverses
         </h3>
         <ul className="space-y-2.5">
-          {soft.map((s, i) => (
+          {soft.map((s) => (
             <li key={s} className="flex items-center gap-3 font-mono text-xs uppercase tracking-wider">
               <span
                 data-jack="right"