[FEAT] Fix some bug and css issues.

AGENTS.md

@@ -109,6 +109,46 @@ npm run preview
 - Do NOT include `legacy/` or `api/tests.php` in the deploy archive.
 - `api/.env` (with `JWT_SECRET`) is part of the deployment.
 - The frontend build must be present in `frontend/`.
+- Production: front `https://partitions.c.nadal-fr.com`, API `https://ohmj-api.c.nadal-fr.com`.
+- **Cache**: hashed assets under `_app/immutable/` are immutable (1y); the SPA
+  shell `index.html` MUST be served with `Cache-Control: no-cache` (see
+  `partitions/nginx.conf`). Otherwise clients keep a stale shell referencing
+  hashed chunks removed by the new deploy, causing errors on some routes (e.g.
+  the PDF viewer). The front is served by the `nginx` container (Caddy only
+  `reverse_proxy`s to it and passes the headers through), so this is configured
+  in `nginx.conf`, not in the Caddyfile. After a deploy, a hard refresh can be
+  needed for already-cached clients.
+
+### Testing the deploy archive (recommended)
+
+It is worth testing the produced zip, not just the source tree. `deploy.sh`
+generates `_builds/deploy_ohmj.zip`; verify it before uploading:
+
+```bash
+# 1. Inspect the archive (no stale/test/residue files)
+unzip -l _builds/deploy_ohmj.zip | grep -E 'tests\.php|coverage-|composer\.phar|node_modules|legacy/'
+#    -> must print nothing
+unzip -p _builds/deploy_ohmj.zip api/.env          # JWT_SECRET + SCORES_PATH
+# 2. Extract and run the artifact end-to-end against the E2E smoke test
+rm -rf /tmp/deploy_test && mkdir -p /tmp/deploy_test
+unzip -q _builds/deploy_ohmj.zip -d /tmp/deploy_test
+#    - API:  cd /tmp/deploy_test/api
+#            SCORES_PATH=<repo>/legacy/Scores/ php -c php-upload.ini -S localhost:8000 router.php
+#    - front: serve /tmp/deploy_test/frontend with an SPA fallback (see below)
+API_URL=http://localhost:8000 FRONT_URL=http://localhost:4173 npm run test:e2e --prefix partitions
+# 3. Security: .env / config/users.json must NOT be served
+curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8000/.env   # -> 401
+```
+
+Notes:
+- `deploy.sh` deletes the previous zip before zipping: `zip -r` alone would
+  **merge** into an existing archive and keep stale files from earlier deploys.
+- The built frontend bakes `VITE_API_URL` **and** the CSP `connect-src`
+  (`svelte.config.js` only allows `localhost:8000` + the prod API). To test a zip
+  locally, either reuse `localhost:8000` or rebuild the front with a permitted URL
+  (`VITE_API_URL=http://localhost:8000 npm run build`).
+- The E2E smoke test accepts `API_URL` / `FRONT_URL` so it can target the
+  extracted artifact instead of the dev servers.
 
 ## Testing
 
@@ -132,7 +172,7 @@ rm -f /tmp/rate_* 2>/dev/null                          # clear rate limiting fir
 php tests.php
 ```
 
-- Expected: **53/53 tests passed (100%)**.
+- Expected: **183/183 tests passed (100%)**.
 - Covers: auth (login, bad credentials, missing/invalid token), scores CRUD,
   create-score-with-pieces, files tree, path traversal, rate limiting, upload
   validation, INI injection, security headers.
@@ -268,6 +308,12 @@ Instrument codes: `dir`, `pic`, `flu`, `cla`, `clb`, `sax`, `sat`, `sab`, `coa`,
 `cba`, `cor`, `trp`, `trb`, `tub`, `htb`, `bas`, `per`, `crn`, `eup`, `har`, `pia`,
 plus `sup`/`par` for combined parts.
 
+Admin uploads build the filename from the instrument's **ASCII** name
+(`instruments.ts` → `api/lib/ScoreScanner.php`), with `-` between fields
+(e.g. `clarinette-sib-1.pdf`). For `sup`/`par`, the **"Parties combinées"** editor
+builds the real filename base from one or more instruments (with key/clef/part),
+joined by `+` (e.g. `contrebasse-sib-clefa-1+baryton-sib-clefa-1`). See `NAMING.md`.
+
 ## Code Style
 
 ### PHP
@@ -300,7 +346,7 @@ plus `sup`/`par` for combined parts.
 - [ ] CORS origins restricted to the real domains (no wildcard fallback).
 - [ ] HTTPS enforced in production.
 - [ ] Rate limiting active (clear `/tmp/rate_*` only in tests, never in prod).
-- [ ] `php tests.php` passes 53/53.
+- [ ] `php tests.php` passes 183/183.
 - [ ] `npm audit` reviewed.
 - [ ] No secrets in code or git history.