From a38fc0bfa9c6dda4ba137bba686bd9cbf24a0cd0 Mon Sep 17 00:00:00 2001
From: NADAL Jean-Baptiste <jbnadal@cabasse.com>
Date: Mon, 14 Sep 2026 17:22:18 +0200
Subject: [PATCH] [FIX] Uge session of debugging and code coverage.

---
 .gitignore                                    |   3 +-
 AGENTS.md                                     | 127 +++-
 NAMING.md                                     | 125 ++++
 README.md                                     |  24 +-
 TODO.md                                       | 103 +++
 api/.env                                      |   2 -
 api/README.md                                 |  18 +
 api/coverage-prepend.php                      |  25 +
 api/coverage-report.php                       |  64 ++
 api/index.php                                 | 118 ++--
 api/lib/Auth.php                              |  97 +--
 api/lib/ScoreScanner.php                      | 210 ++++--
 api/router.php                                |  48 +-
 api/tests.php                                 | 558 +++++++++++++--
 deploy/deploy.sh                              |   4 +-
 partitions/.env                               |   1 -
 partitions/nginx.conf                         |  10 +-
 partitions/package-lock.json                  | 636 +++++++++++-------
 partitions/package.json                       |   9 +-
 partitions/src/lib/api.ts                     |  34 +-
 .../src/lib/components/ConfirmDialog.svelte   |  75 +++
 .../src/lib/components/PdfViewer.svelte       |  49 +-
 partitions/src/lib/instruments.ts             |  56 ++
 partitions/src/lib/stores/auth.ts             |   7 +-
 partitions/src/routes/+layout.svelte          |  43 +-
 partitions/src/routes/admin/+page.svelte      | 199 +-----
 partitions/src/routes/admin/[id]/+page.svelte | 152 ++---
 .../src/routes/scores/[id]/+page.svelte       |  71 +-
 .../routes/scores/[id]/[piece]/+page.svelte   |  41 +-
 .../[id]/[piece]/[instrument]/+page.svelte    |  73 +-
 partitions/src/routes/test-icons/+page.svelte |  83 ---
 partitions/static/favicon.png                 | Bin 0 -> 13758 bytes
 partitions/tests/e2e-smoke.mjs                | 200 ++++++
 partitions/vite.config.ts                     |   3 -
 test.sh                                       | 139 ++++
 35 files changed, 2315 insertions(+), 1092 deletions(-)
 create mode 100644 NAMING.md
 create mode 100644 TODO.md
 delete mode 100644 api/.env
 create mode 100644 api/coverage-prepend.php
 create mode 100644 api/coverage-report.php
 delete mode 100644 partitions/.env
 create mode 100644 partitions/src/lib/components/ConfirmDialog.svelte
 create mode 100644 partitions/src/lib/instruments.ts
 delete mode 100644 partitions/src/routes/test-icons/+page.svelte
 create mode 100644 partitions/static/favicon.png
 create mode 100644 partitions/tests/e2e-smoke.mjs
 create mode 100755 test.sh

diff --git a/.gitignore b/.gitignore
index f3224d7..bd10a86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@ missing.xml
 partitions/.svelte-kit/
 partitions/build/
 partitions/node_modules/
-partitions/static/pdf.worker.min.js
 api/vendor/
 api/composer.phar
+api/.env
+partitions/.env
diff --git a/AGENTS.md b/AGENTS.md
index 89defae..5573e03 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,7 +20,52 @@ site is archived in `legacy/` and must not be modified.
 - Node.js 26 / npm 11
 - Svelte 5, SvelteKit 2, `@sveltejs/adapter-static`, Vite 5, Tailwind 3
 - PHP 8.5 (CLI built-in server in development)
-- Dependencies: `axios`, `pdfjs-dist`, `lucide-svelte` (front); `setasign/fpdi`, `setasign/fpdf`, `tecnickcom/tcpdf` (back)
+
+## Dependencies
+
+### Frontend (`partitions/package.json`)
+
+Runtime:
+
+| Package | Version |
+|---|---|
+| `axios` | ^1.6.0 |
+| `pdfjs-dist` | ^4.0.379 |
+
+Dev:
+
+| Package | Version |
+|---|---|
+| `svelte` | ^5.0.0 |
+| `@sveltejs/kit` | ^2.0.0 |
+| `@sveltejs/adapter-static` | ^3.0.0 |
+| `@sveltejs/vite-plugin-svelte` | ^4.0.0 |
+| `vite` | ^5.0.0 |
+| `typescript` | ^5.0.0 |
+| `svelte-check` | ^4.0.0 |
+| `tailwindcss` | ^3.4.0 |
+| `autoprefixer` | ^10.4.16 |
+| `postcss` | ^8.4.32 |
+
+Install: `cd partitions && npm install`.
+
+### Backend (`api/composer.json`)
+
+| Package | Version |
+|---|---|
+| `setasign/fpdi` | ^2.6 (import de pages PDF) |
+| `setasign/fpdf` | ^1.8 (base PDF) |
+| `tecnickcom/tcpdf` | ^6.10 |
+
+Install: `cd api && php composer.phar install` (le dossier `vendor/` est déjà présent).
+
+PHP extensions requises (via `composer.lock`) : `gd`, `zlib`, `curl`. Déjà fournies
+ou activées avec les paquets Arch `php` + `php-gd`.
+
+### Tooling de développement
+
+- `xdebug` (paquet Arch `extra/xdebug`) — optionnel, utilisé pour mesurer la
+  couverture de code du backend (`xdebug.mode=coverage`).
 
 > PHP 8.5 note: nullable parameters MUST use explicit `?type` syntax
 > (e.g. `?string $x = null`). Implicit nullable is deprecated and pollutes API output.
@@ -46,12 +91,14 @@ cd partitions
 npm install
 npm run dev      # http://localhost:5173
 npm run build    # outputs to partitions/build
+npm run check    # svelte-check (0 errors / 0 warnings expected)
 npm run preview
 ```
 
 - `frontend` is a symlink to `partitions/build` (the deployed static site).
+- `VITE_API_URL` (build/dev env) selects the API base URL; falls back to
+  `localhost:8000` (dev) or the production URL.
 - No ESLint / test framework is configured for the frontend.
-- `VITE_API_URL` is defined but currently unused (base URL is chosen from `import.meta.env.DEV`).
 
 ### Deploy
 
@@ -65,6 +112,17 @@ npm run preview
 
 ## Testing
 
+### Run everything (single command)
+
+```bash
+./test.sh
+```
+
+Runs, in order: backend tests (`api/tests.php`), backend code coverage (Xdebug,
+if available), frontend `npm run check` (svelte-check), and the frontend E2E smoke
+test. It starts the API and dev servers if needed and stops them afterwards.
+"Test the project" means running `./test.sh`.
+
 ### PHP API tests
 
 ```bash
@@ -80,6 +138,49 @@ php tests.php
   validation, INI injection, security headers.
 - `tests.php` is kept for development only and MUST NOT be shipped in the deploy zip.
 
+### Code coverage (optional, requires Xdebug)
+
+The test suite covers ~96% of `api/` non-vendor code (`Auth.php` and `router.php`
+at 100%, `ScoreScanner.php` +99%). The remaining uncovered lines are defensive
+I/O-failure branches (rate-limiter `flock`/`fopen` failures, missing
+`SCORES_PATH`, `OOM`/partial PHP upload errors, `createScore` rollback) that
+need OS-level fault injection to trigger.
+
+```bash
+cd api
+rm -rf /tmp/ohmj_cov
+# Terminal 1: instrumented dev server
+php -d zend_extension=xdebug -d xdebug.mode=coverage \
+    -d auto_prepend_file="$PWD/coverage-prepend.php" \
+    -c php-upload.ini -S localhost:8000 router.php
+# Terminal 2: run tests through the instrumented server
+php -d zend_extension=xdebug -d xdebug.mode=coverage \
+    -d auto_prepend_file="$PWD/coverage-prepend.php" tests.php
+# Then, from the repo root:
+SHOW_MISSING=1 php api/coverage-report.php \
+    api/index.php api/router.php api/lib/Auth.php api/lib/ScoreScanner.php
+```
+
+`coverage-prepend.php` / `coverage-report.php` are dev-only and excluded from the
+deploy archive.
+
+### Frontend E2E smoke test (CDP, no dependency)
+
+Requires the API (`:8000`) and the frontend dev server (`:5173`) to be running.
+
+```bash
+cd partitions
+npm run test:e2e
+```
+
+`tests/e2e-smoke.mjs` drives the system `chromium` through the DevTools Protocol:
+it logs in via the API, injects the session, then visits `/scores`, a score
+detail, the PDF viewer and `/admin`. It asserts that every API call returns
+`< 400`, that the SPA stays on each route, and that the PDF is fetched with an
+`Authorization` header (no token in the URL).
+
+Env overrides: `API_URL`, `FRONT_URL`, `CHROME_PATH`, `LOGIN_USER`, `LOGIN_PASS`.
+
 ## Authentication
 
 - Login: `POST /login` with `{"username":"admin","password":"password"}` (development).
@@ -137,6 +238,9 @@ Admin only (`role === 'admin'`):
 
 ## Data Model (files)
 
+> Full filename/directory convention: see [`NAMING.md`](NAMING.md). It is
+> normalized and MUST NOT be changed casually (backend + frontend depend on it).
+
 ```
 legacy/Scores/<NUM>/<PIECE>/<INSTRUMENT>/<VERSION>/<PARTIE>.pdf
 legacy/Scores/<NUM>/score.ini
@@ -218,11 +322,20 @@ curl -s -I http://localhost:8000/login -X POST \
   -d '{"username":"admin","password":"password"}'
 ```
 
-> Known security findings from the latest review (not yet fixed): static file
-> passthrough in `api/router.php` exposes `.env`/`users.json`; `deleteScoreFile`
-> lacks path containment; `api/.env` is tracked by git; JWT is standard base64
-> (not base64url) and expiry is optional; stored XSS via the `ressource` link.
-> See the project issue tracker / recent review notes.
+> Security fixes applied recently: `api/router.php` no longer serves files
+> statically (`.env`/`config/users.json` are not reachable); `deleteScoreFile`
+> enforces `realpath()` containment and only deletes `.pdf`; `api/.env` and
+> `partitions/.env` are untracked/gitignored (rotate the secret since it remains
+> in git history); JWT uses base64url, requires `exp` and validates `alg`;
+> credentials errors are generic; the `ressource` link rejects non-http(s) URLs.
+>
+> Known findings still open: default `admin`/`password` credentials; login rate
+> limiter is race-prone (no `flock`) and `/api/login` bypasses it; CORS falls
+> back to `*` for unknown origins; `GET /admin/scores/:id` passes extra
+> arguments dropped by `ScoreScanner::updateScore` (so `ressource` is not
+> persisted); watermarking only keeps page 1 of multi-page PDFs; `createScore`
+> and `uploadPdf` do not validate path segments; `updateScore`/`updatePieces`
+> do not sanitize INI values.
 
 ## Temporary Files
 
diff --git a/NAMING.md b/NAMING.md
new file mode 100644
index 0000000..530a97d
--- /dev/null
+++ b/NAMING.md
@@ -0,0 +1,125 @@
+# NAMING.md - Convention des noms de partitions
+
+Référence du format de fichiers/répertoires des partitions (`legacy/Scores/`).
+Cette convention a été normalisée une fois par `scripts/convert_final_v2.js`
+(6388 fichiers convertis). **Ne pas renommer à la main** : le backend
+(`api/lib/ScoreScanner.php`) et le frontend en dépendent.
+
+## Arborescence
+
+```
+legacy/Scores/<NUM>/<PIECE>/<INSTRUMENT>/<VERSION>/<FICHIER>
+legacy/Scores/<NUM>/score.ini
+```
+
+| Segment | Rôle | Exemples |
+|---|---|---|
+| `NUM` | identifiant du morceau, **zéro-paddé sur 3 chiffres** | `102`, `390`, `072`, `098` |
+| `PIECE` | numéro de pièce (mouvement) | `1` (morceau simple), `1`..`5` (medley type `390`) |
+| `INSTRUMENT` | trigramme de l'instrument | `cla`, `sax`, `sup`… (voir table) |
+| `VERSION` | répertoire de version | `1` = version principale, `2`, `3`… = alternatives |
+| `FICHIER` | nom du PDF (grammaire ci-dessous) | `clarinette-sib-1.pdf` |
+
+> `VERSION` est un **répertoire**, pas un token du nom de fichier. Le dossier `1/`
+> est la version principale ; `2/`+ sont des versions alternatives du même morceau
+> (ex. score `210` : `cla/1/` et `cla/2/`).
+
+## Grammaire du nom de fichier
+
+```
+{instrument}[-{tonalité}][-{variante}]-{partie}[_{partie_combinée}][_{clef}][_alt{N}].pdf
+```
+
+- Séparateur de champs : **`-`**
+- Séparateur interne aux noms composés et aux suffixes : **`_`**
+- Multi-instrument (deux instruments sur la même partition) : **`+`**
+
+### Exemples réels
+
+| Fichier | Sens |
+|---|---|
+| `clarinette-sib-1.pdf` | clarinette en Si♭, partie 1 |
+| `clarinette_alto-mib-1.pdf` | clarinette alto en Mi♭, partie 1 (`_` = nom composé) |
+| `sax_alto-mib-2.pdf` | sax alto en Mi♭, partie 2 |
+| `cor-fa-1_2.pdf` | cor en Fa, parties **1 et 2 combinées** |
+| `baryton-clefa-1.pdf` | baryton, clé de fa, partie 1 (pas de tonalité) |
+| `euphonium-sib-clesol-1.pdf` | euphonium Si♭, clé de sol, partie 1 |
+| `cornet-sib-solo-1.pdf` | variante `solo` |
+| `baryton-sib-default_cor-2.pdf` | substitution `default_cor` |
+| `conducteur-1_alt1.pdf` | version alternative `alt1` |
+| `basse-sib-1+contrebasse-sib-1.pdf` | **deux instruments** sur la même partition |
+| `saxophone-mib-1+baryton-mib-1.pdf` | idem (sax + baryton) |
+| `glockenspiel-1+xylophone-1.pdf` | percussion multiple |
+| `percussion-1+gong-1+cymbale-1+triangle-1.pdf` | 3 `+` possibles |
+
+### Tonalités
+
+`sib` (Si♭), `mib` (Mi♭), `fa` (Fa), `ut` (Do — **`do` s'écrit `ut` dans les
+fichiers**), `sol`, `re`, `mi`, `si`, `reb`, `dob`, `solb`, `lab`.
+
+### Clefs
+
+`clesol` (clé de sol), `clefa` (clé de fa).
+
+### Variantes / suffixes
+
+- `solo` : partie solo.
+- `default_<instr>` : instrument de substitution (ex. `default_cor`).
+- `_altN` : version alternative dans un même dossier (ex. `_alt1`, `_alt2`).
+
+## Codes instruments
+
+| Code | Instrument | Code | Instrument |
+|---|---|---|---|
+| `dir` | Direction | `trp` | Trompette |
+| `pic` | Piccolo | `trb` | Trombone |
+| `flu` | Flûte | `tub` | Tuba |
+| `cla` | Clarinette | `htb` | Hautbois |
+| `clb` | Clarinette basse | `bas` | Basson |
+| `sax` | Saxophone alto | `per` | Percussions |
+| `sat` | Saxophone ténor | `crn` | Cornet |
+| `sab` | Saxophone baryton | `eup` | Euphonium |
+| `coa` | Cor anglais | `har` | Harpe |
+| `cba` | Contrebasse | `pia` | Piano |
+| `cor` | Cor | `sup` / `par` | Parties combinées |
+
+## `score.ini`
+
+```ini
+[info]
+name = La part d'Euterpe
+compositor = Michaël CUVILLON
+ressource = https://...        ; optionnel (lien externe)
+
+[pieces]
+count = 1
+; pour un medley (count = N) :
+; 1 = La Part d Euterpe
+; 2 = Calliope s Songs
+```
+
+- `[pieces] count` = nombre de pièces. Les clés `1`..`N` donnent leur nom.
+- `ressource` : lien externe optionnel (YouTube, éditeur…).
+
+## Points d'attention (code)
+
+- **`+` dans les chemins** : un `+` littéral dans une URL est valide en *path*,
+  mais PHP `urldecode()` le transforme en espace. Le download doit donc :
+  - encoder chaque segment côté frontend (`encodePath` dans `partitions/src/lib/api.ts`) ;
+  - utiliser `rawurldecode()` (jamais `urldecode()`) côté `api/index.php`.
+  Sinon les 167 fichiers multi-instruments (`a+b.pdf`) renvoient 403.
+- **Parsing** : `ScoreScanner::parseFilename()` détecte tonalité, clef, variante
+  et partie. Les motifs doivent être ancrés (`_sib(?:_|$)`) et du plus long au plus
+  court (`sibemol` avant `sib`) pour ne pas mal découper les noms.
+- Le matcher multi-instruments utilise `+` (et non `_et_`, supprimé par la
+  conversion).
+
+## Conversion (one-off)
+
+`scripts/convert_final_v2.js` est le convertisseur historique utilisé pour
+normaliser l'ensemble du catalogue. Il ne doit plus être nécessaire pour de
+nouveaux fichiers (uploader via l'admin respecte la convention).
+
+```bash
+node scripts/convert_final_v2.js /chemin/vers/Scores confirm
+```
diff --git a/README.md b/README.md
index 10412b9..6a8b98b 100644
--- a/README.md
+++ b/README.md
@@ -40,10 +40,26 @@ Le site déployé est exposé via le lien symbolique `frontend -> partitions/bui
 
 ## Tests
 
+Tout en une commande (backend + couverture + frontend) :
+
+```bash
+./test.sh
+```
+
+Détail manuel :
+
 ```bash
 cd api
 rm -f /tmp/rate_* 2>/dev/null
-php tests.php    # attendu : 53/53
+php tests.php    # attendu : 181/181
+```
+
+Frontend (serveurs API + dev lancés) :
+
+```bash
+cd partitions
+npm run check     # svelte-check : 0 erreur / 0 warning
+npm run test:e2e  # smoke E2E navigateur (CDP)
 ```
 
 ## Déploiement
@@ -55,6 +71,12 @@ php tests.php    # attendu : 53/53
 Le build frontend doit être présent dans `frontend/`. `legacy/` et `api/tests.php`
 ne sont pas inclus dans l'archive.
 
+## Documentation
+
+- [`AGENTS.md`](AGENTS.md) — guide de développement (stack, commandes, conventions)
+- [`NAMING.md`](NAMING.md) — convention des noms de partitions (`legacy/Scores`)
+- [`api/README.md`](api/README.md) — documentation de l'API REST
+
 ## Licence
 
 GPL v2
diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..61cf3d2
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,103 @@
+# TODO.md - Plan de travail en cours
+
+> Document de reprise : si la session est interrompue, reprendre ici.
+> Dernière mise à jour : 2026-09-14.
+
+## Comment lancer / tester
+
+```bash
+# Tout tester d'un coup (backend + couverture + frontend) : "test le projet"
+./test.sh
+
+# Serveur API (dev) - obligatoire pour les tests
+cd api && php -c php-upload.ini -S localhost:8000 router.php &
+# Front (dev)
+cd partitions && npm run dev        # http://localhost:5173
+
+# Tests backend
+cd api && rm -f /tmp/rate_* 2>/dev/null && php tests.php
+
+# Tests frontend
+cd partitions && npm run check && npm run test:e2e
+
+# Couverture (Xdebug requis) ~96.9%
+```
+
+## État actuel
+
+### Fait (session)
+- **Docs** : `AGENTS.md` réécrit (stack réelle), `README.md` + `api/README.md` corrigés,
+  `NAMING.md` recréé (convention des noms), dépendances documentées, `PLAN.md` /
+  `SECURITY_AUDIT.md` / `wordpress_list/` supprimés (commit `e79c865`).
+- **Sécurité C1-C5** : plus de service statique `.env` (`router.php`), containment
+  `deleteScoreFile`, `.env` dé-suivis + secret roté, JWT base64url + `exp` obligatoire
+  + `alg` validé + erreurs génériques, XSS `ressource` bloqué.
+- **Bugs** : `+`/encodage des chemins (167 PDF), viewer PDF (course canvas + double
+  chargement + fuite blob), en-tête `Authorization` insensible à la casse, 404/403 download.
+- **Backend** : `ressource` persisté/préservé, watermark multi-pages + échec remonté,
+  validation des segments de chemin, sanitisation INI, rate-limiter `flock`,
+  CORS sans wildcard, token download via header uniquement, `ini_set` retiré,
+  `score.ini` protégé, code mort supprimé (Auth methods).
+- **Tests** : `tests.php` porte de 53 à **181 tests** (fonctionnels + unitaires directs).
+  Tests isolés (créent/suppriment leurs propres partitions) ; le test watermark utilisait
+  un PDF invalide et écrasait `scores[0]` → corrigé.
+- **Harness couverture** : `api/coverage-prepend.php` + `api/coverage-report.php`
+  (exclus du deploy), documentés dans `AGENTS.md`.
+
+### Couverture backend : 96.9%
+- `api/router.php` : **100%**
+- `api/lib/Auth.php` : **100%**
+- `api/lib/ScoreScanner.php` : **99.5%** (restent 2 lignes)
+- `api/index.php` : **92.4%** (restent 22 lignes)
+
+Code inutile retiré (justifié en revue) : fallback `getallheaders()` (lit la même
+source que `$_SERVER['HTTP_AUTHORIZATION']`) et boucle d'auto-id morte (comparait
+un id non paddé à des dossiers paddés).
+
+Lignes non couvertes = **branches défensives d'échec I/O**, non atteignables via
+l'API sans injection de panne OS :
+
+| Fichier | Lignes | Nature |
+|---|---|---|
+| `api/index.php` | 56, 59, 60 | rate-limiter : `fopen`/`flock` échoue (fail-open) |
+| `api/index.php` | 104 | fallback `SCORES_PATH` si variable absente |
+| `api/index.php` | 222-224 | `GET /scores` renvoie 500 si dossier Scores absent |
+| `api/index.php` | 388-408 | erreurs d'upload PHP (`UPLOAD_ERR_*`, post_max_size) |
+| `api/lib/ScoreScanner.php` | 443, 444 | rollback `createScore` si écriture `score.ini` échoue |
+
+**Option** pour monter plus haut : serveur de test secondaire (port 8001) avec
+`SCORES_PATH=/nonexistent` et `upload_max_filesize=1K` pour couvrir 222-224 et
+388-395. Le reste (I/O/OS, 56/59/60, 104, 443/444) resterait non couvert.
+
+## À faire (reste)
+
+### Finitions
+- [ ] Décider du sort de `legacy/Scores/001/` (résidu de test « Test Duplicate »,
+      sans PDF) → demander avant suppression.
+- [ ] `npm audit` : 18 → **8 vulnérabilités** après `npm audit fix`. Le reste
+      (svelte/rollup/picomatch) exige `npm audit fix --force` (breaking) → à décider.
+- [ ] Committer (uniquement sur demande).
+
+## Fait (frontend, F11-F16)
+- **F11** code mort supprimé : `auth.getToken()`, `api.downloadFileWithAuth`,
+  tout le code d'upload inutilisé d'`admin/+page.svelte`.
+- **F12** maps d'instruments factorisées dans `partitions/src/lib/instruments.ts`
+  (+ helpers `getInstrumentName/Icon/DefaultKey`), réutilisées partout. `test-icons`
+  supprimé. `lucide-svelte` retiré (inutilisé).
+- **F13** migration `$app/stores` → `$app/state`, suppression des abonnements
+  manuels, état réactif dans `scores/[id]` et chargement piloté par `$effect`
+  (navigation client correcte). `<slot/>` → `{@render children()}`.
+- **F14** worker PDF pointé sur `.mjs` (fichier suivi), `nginx.conf` MIME `.mjs`,
+  `deploy.sh` simplifié, `favicon.png` ajouté.
+- **F15** route `test-icons/` supprimée ; `VITE_API_URL` réellement utilisé
+  (fallback dev/prod), `define` bogus retiré de `vite.config.ts`.
+- **F16** `svelte-check` ajouté (`npm run check`) → **0 erreur / 0 warning** ;
+  a11y corrigée (labels `for`/`id`, `<tr>`/spans cliquables → `<button>`,
+  modales → composant `ConfirmDialog.svelte` avec `role="dialog"`/Escape,
+  autofocus → action) ; `npm audit fix` appliqué.
+
+
+## Notes
+- Branche `master`. Ne pas committer sans demande explicite.
+- `legacy/Scores/` est la donnée réelle : les tests ne doivent jamais y écrire
+  (les tests de partition sont désormais auto-isolés).
diff --git a/api/.env b/api/.env
deleted file mode 100644
index f2cd75a..0000000
--- a/api/.env
+++ /dev/null
@@ -1,2 +0,0 @@
-JWT_SECRET=6jh/MWqVplwXQKsiwlKahE19TSavfR1dNCawsQFixus=
-SCORES_PATH=/home/jbnadal/sources/jb/ohmj/ohmj2/legacy/Scores/
diff --git a/api/README.md b/api/README.md
index adee533..989ee3b 100644
--- a/api/README.md
+++ b/api/README.md
@@ -2,6 +2,24 @@
 
 API REST pour la gestion des partitions de l'Harmonie de Montpellier-Jacou.
 
+## Installation
+
+Prérequis : **PHP 8.5** avec les extensions `gd`, `zlib`, `curl`.
+
+```bash
+cd api
+php composer.phar install   # vendor/ est déjà présent dans le dépôt
+cp .env.example .env        # puis définir JWT_SECRET
+```
+
+Dépendances (`composer.json`) :
+
+| Package | Rôle |
+|---|---|
+| `setasign/fpdi` | import de pages PDF (watermark) |
+| `setasign/fpdf` | génération PDF de base |
+| `tecnickcom/tcpdf` | boîte à outils PDF |
+
 ## Base URL
 
 ```
diff --git a/api/coverage-prepend.php b/api/coverage-prepend.php
new file mode 100644
index 0000000..5581d8c
--- /dev/null
+++ b/api/coverage-prepend.php
@@ -0,0 +1,25 @@
+<?php
+// Dev-only: prepend file that enables Xdebug code coverage on the PHP
+// built-in server. Loaded via -d auto_prepend_file=... during coverage runs.
+// Not shipped in the deploy archive (see deploy/deploy.sh).
+
+if (!function_exists('xdebug_start_code_coverage')) {
+    return;
+}
+
+xdebug_set_filter(XDEBUG_FILTER_CODE_COVERAGE, XDEBUG_PATH_INCLUDE, [
+    realpath(__DIR__ . '/index.php'),
+    realpath(__DIR__ . '/router.php'),
+    realpath(__DIR__ . '/lib'),
+]);
+
+xdebug_start_code_coverage(XDEBUG_CC_UNUSED | XDEBUG_CC_DEAD_CODE);
+
+register_shutdown_function(function () {
+    $cov = xdebug_get_code_coverage();
+    $dir = sys_get_temp_dir() . '/ohmj_cov';
+    if (!is_dir($dir)) {
+        @mkdir($dir, 0777, true);
+    }
+    @file_put_contents($dir . '/cov_' . getmypid() . '_' . uniqid('', true) . '.ser', serialize($cov));
+});
diff --git a/api/coverage-report.php b/api/coverage-report.php
new file mode 100644
index 0000000..3679ca8
--- /dev/null
+++ b/api/coverage-report.php
@@ -0,0 +1,64 @@
+<?php
+// Dev-only: merges the Xdebug dumps produced by coverage-prepend.php and
+// prints per-file line coverage. Usage (from the repo root):
+//
+//   SHOW_MISSING=1 php api/coverage-report.php \
+//       api/index.php api/router.php api/lib/Auth.php api/lib/ScoreScanner.php
+
+$dir = sys_get_temp_dir() . '/ohmj_cov';
+$files = glob($dir . '/cov_*.ser') ?: [];
+$merged = [];
+
+foreach ($files as $f) {
+    $data = @unserialize(file_get_contents($f));
+    if (!is_array($data)) {
+        continue;
+    }
+    foreach ($data as $file => $lines) {
+        foreach ($lines as $line => $status) {
+            if (!isset($merged[$file][$line]) || $status === 1) {
+                $merged[$file][$line] = ($status === 1 || ($merged[$file][$line] ?? -1) === 1) ? 1 : $status;
+            }
+        }
+    }
+}
+
+$targets = array_slice($argv, 1);
+if (!$targets) {
+    $targets = array_keys($merged);
+}
+
+$grandTotal = 0;
+$grandHit = 0;
+
+foreach ($targets as $target) {
+    $target = realpath($target) ?: $target;
+    $lines = $merged[$target] ?? [];
+    $exec = [];
+    $hit = [];
+    foreach ($lines as $line => $status) {
+        if ($status === -2) {
+            continue; // dead code
+        }
+        $exec[$line] = true;
+        if ($status === 1) {
+            $hit[$line] = true;
+        }
+    }
+    $total = count($exec);
+    $covered = count($hit);
+    $grandTotal += $total;
+    $grandHit += $covered;
+    $pct = $total > 0 ? round($covered * 100 / $total, 1) : 0.0;
+    $missing = array_diff(array_keys($exec), array_keys($hit));
+    sort($missing);
+    printf("%6.1f%%  %3d/%-3d  %s\n", $pct, $covered, $total, str_replace(getcwd() . '/', '', $target));
+    if ($missing && getenv('SHOW_MISSING')) {
+        echo '        manquantes: ' . implode(', ', $missing) . "\n";
+    }
+}
+
+if ($grandTotal > 0) {
+    printf("\nTOTAL: %d/%d (%.1f%%)\n", $grandHit, $grandTotal, $grandHit * 100 / $grandTotal);
+}
+echo 'dumps: ' . count($files) . "\n";
diff --git a/api/index.php b/api/index.php
index 0a49395..71a09d9 100644
--- a/api/index.php
+++ b/api/index.php
@@ -17,10 +17,6 @@ if (file_exists(__DIR__ . '/.env')) {
     }
 }
 
-// Increase upload limits for this script
-ini_set('upload_max_filesize', '64M');
-ini_set('post_max_size', '64M');
-
 // Security headers
 header('Content-Type: application/json');
 header('X-Content-Type-Options: nosniff');
@@ -29,17 +25,14 @@ header('X-XSS-Protection: 1; mode=block');
 header('Referrer-Policy: strict-origin-when-cross-origin');
 header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
 
-// CORS - Restrict to allowed origins
+// CORS - only allowlisted origins receive the header (no wildcard fallback)
 $allowedOrigins = ['http://localhost:5173', 'http://localhost:3000', 'http://localhost:4173', 'https://ohmj2.free.fr', 'https://partitions.c.nadal-fr.com', 'https://ohmj-api.c.nadal-fr.com'];
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
 
-// Always send CORS headers for preflight requests
-if (in_array($origin, $allowedOrigins)) {
+if (in_array($origin, $allowedOrigins, true)) {
     header("Access-Control-Allow-Origin: $origin");
     header('Access-Control-Allow-Credentials: true');
-} else {
-    // For preflight without matching origin, still allow (for debugging)
-    header("Access-Control-Allow-Origin: *");
+    header('Vary: Origin');
 }
 header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
 header('Access-Control-Allow-Headers: Authorization, Content-Type');
@@ -49,31 +42,45 @@ if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
     exit;
 }
 
-// Rate limiting function
+// Normalize the path once (strip an optional /api prefix)
+$path = trim(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH), '/');
+$path = preg_replace('#^api/#', '', $path);
+
+// Rate limiting (flock-protected to avoid read-modify-write races)
 function checkRateLimit(string $key, int $maxRequests = 100, int $windowSeconds = 60): bool {
     $rateFile = sys_get_temp_dir() . '/rate_' . md5($key) . '.json';
     $now = time();
-    
-    $data = ['count' => 0, 'reset' => $now + $windowSeconds];
-    if (file_exists($rateFile)) {
-        $content = file_get_contents($rateFile);
-        $data = json_decode($content, true) ?? $data;
+
+    $fp = @fopen($rateFile, 'c+');
+    if ($fp === false) {
+        return true; // fail open if the temp dir is not writable
     }
-    
-    // Reset if window expired
-    if ($now > $data['reset']) {
+    if (!flock($fp, LOCK_EX)) {
+        fclose($fp);
+        return true;
+    }
+
+    $content = stream_get_contents($fp);
+    $data = json_decode($content, true);
+    if (!is_array($data) || !isset($data['count'], $data['reset']) || $now > $data['reset']) {
         $data = ['count' => 0, 'reset' => $now + $windowSeconds];
     }
-    
+
     $data['count']++;
-    file_put_contents($rateFile, json_encode($data));
-    
+    rewind($fp);
+    ftruncate($fp, 0);
+    fwrite($fp, json_encode($data));
+    fflush($fp);
+    flock($fp, LOCK_UN);
+    fclose($fp);
+
     return $data['count'] <= $maxRequests;
 }
 
+$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+
 // Check rate limit for login endpoint (5 attempts per minute)
-if (preg_match('#^login$#', trim(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH), '/')) && $_SERVER['REQUEST_METHOD'] === 'POST') {
-    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+if ($path === 'login' && $_SERVER['REQUEST_METHOD'] === 'POST') {
     if (!checkRateLimit('login_' . $ip, 5, 60)) {
         http_response_code(429);
         echo json_encode(['error' => 'Too many requests. Please try again later.']);
@@ -82,7 +89,6 @@ if (preg_match('#^login$#', trim(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH
 }
 
 // Check general rate limit (500 requests per minute per IP - increased for testing)
-$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
 if (!checkRateLimit('general_' . $ip, 500, 60)) {
     http_response_code(429);
     echo json_encode(['error' => 'Rate limit exceeded']);
@@ -99,30 +105,19 @@ if ($scoresPath === false || $scoresPath === '') {
 }
 $scanner = new ScoreScanner($scoresPath);
 
-// Get Authorization header
+// Get Authorization header (PHP exposes it as HTTP_AUTHORIZATION)
 $token = null;
-$headers = getallheaders();
-if (isset($headers['Authorization'])) {
-    $authHeader = $headers['Authorization'];
-    if (preg_match('/Bearer\s+(.+)/i', $authHeader, $matches)) {
-        $token = $matches[1];
-    }
+$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
+if (preg_match('/Bearer\s+(.+)/i', $authHeader, $matches)) {
+    $token = trim($matches[1]);
 }
 
 // Parse request
 $method = $_SERVER['REQUEST_METHOD'];
-$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-$path = trim($uri, '/');
-
-// Remove 'api/' prefix if present
-$path = preg_replace('#^api/#', '', $path);
-
-// Debug: log the path
-// file_put_contents('/tmp/api_debug.log', date('Y-m-d H:i:s') . " PATH: $path METHOD: $method\n", FILE_APPEND);
 
 // GET /download/:path - Download PDF (BEFORE auth check)
 if (preg_match('#^download/([^?]+)#', $path, $matches) && $method === 'GET') {
-    $filePath = urldecode($matches[1]);
+    $filePath = rawurldecode($matches[1]);
     
     // Security: Check for null bytes (must use double quotes for escape sequence)
     if (strpos($filePath, "\x00") !== false) {
@@ -134,11 +129,10 @@ if (preg_match('#^download/([^?]+)#', $path, $matches) && $method === 'GET') {
     // Security: Prevent directory traversal
     $filePath = str_replace(['../', '..\\', '..'], '', $filePath);
     
-    // Check token from header or query parameter
-    $downloadToken = $_GET['token'] ?? $token;
-    $downloadToken = urldecode($downloadToken ?? '');
+    // Security: token is read from the Authorization header only
+    $downloadToken = $token ?? '';
     
-    if ($downloadToken === null || $downloadToken === '') {
+    if ($downloadToken === '') {
         http_response_code(401);
         echo json_encode(['error' => 'Authorization required']);
         exit;
@@ -158,7 +152,12 @@ if (preg_match('#^download/([^?]+)#', $path, $matches) && $method === 'GET') {
     $realBasePath = realpath($basePath);
     $realFilePath = realpath($fullPath);
     
-    if ($realFilePath === false || strpos($realFilePath, $realBasePath) !== 0) {
+    if ($realFilePath === false) {
+        http_response_code(404);
+        echo json_encode(['error' => 'File not found']);
+        exit;
+    }
+    if ($realBasePath === false || strpos($realFilePath, $realBasePath . DIRECTORY_SEPARATOR) !== 0) {
         http_response_code(403);
         echo json_encode(['error' => 'Access denied']);
         exit;
@@ -171,12 +170,6 @@ if (preg_match('#^download/([^?]+)#', $path, $matches) && $method === 'GET') {
         exit;
     }
     
-    if (!file_exists($realFilePath) || !is_file($realFilePath)) {
-        http_response_code(404);
-        echo json_encode(['error' => 'File not found']);
-        exit;
-    }
-    
     header('Content-Type: application/pdf');
     header('Content-Length: ' . filesize($realFilePath));
     header('Content-Disposition: attachment; filename="' . basename($realFilePath) . '"');
@@ -294,16 +287,9 @@ if ($path === 'admin/scores' && $method === 'POST') {
             if ($num > $maxId) $maxId = $num;
         }
         
-        // Skip existing IDs
-        $scoresPath = getenv('SCORES_PATH') ?: __DIR__ . '/../legacy/Scores/';
-        $id = strval($maxId + 1);
-        while (is_dir($scoresPath . $id)) {
-            $id = strval(intval($id) + 1);
-        }
-        // Pad with zeros to 3 digits if needed
-        if (strlen($id) < 3) {
-            $id = str_pad($id, 3, '0', STR_PAD_LEFT);
-        }
+        // Next score id, zero-padded to 3 digits.
+        // A concurrent collision is rejected by createScore (already exists).
+        $id = str_pad((string) ($maxId + 1), 3, '0', STR_PAD_LEFT);
     }
     
     if (empty($name)) {
@@ -330,7 +316,7 @@ if (preg_match('#^admin/scores/(\d+)$#', $path, $matches) && $method === 'PUT')
     
     $name = $input['name'] ?? null;
     $compositor = $input['compositor'] ?? null;
-    $ressource = $input['ressource'] ?? '';
+    $ressource = $input['ressource'] ?? null;
     
     $result = $scanner->updateScore($scoreId, $name, $compositor, $ressource);
     
@@ -370,11 +356,7 @@ if (preg_match('#^admin/scores/(\d+)$#', $path, $matches) && $method === 'DELETE
     if ($result['success']) {
         echo json_encode(['success' => true]);
     } else {
-        if (strpos($result['error'], 'not found') !== false) {
-            http_response_code(404);
-        } else {
-            http_response_code(400);
-        }
+        http_response_code(404);
         echo json_encode(['error' => $result['error']]);
     }
     exit;
diff --git a/api/lib/Auth.php b/api/lib/Auth.php
index 9a95220..c48825e 100644
--- a/api/lib/Auth.php
+++ b/api/lib/Auth.php
@@ -7,7 +7,7 @@ class Auth {
     private string $usersFile;
     private string $jwtSecret;
     
-    public function __construct(string $usersFile = null) {
+    public function __construct(?string $usersFile = null) {
         $this->usersFile = $usersFile ?? __DIR__ . '/../config/users.json';
         
         // Load JWT secret from environment variable
@@ -19,25 +19,34 @@ class Auth {
     
     public function login(string $username, string $password): array {
         $users = $this->loadUsers();
+        $user = null;
         
-        foreach ($users['users'] as $user) {
-            if ($user['username'] === $username) {
-                if (password_verify($password, $user['password'])) {
-                    $token = $this->generateToken($user);
-                    return [
-                        'success' => true,
-                        'token' => $token,
-                        'user' => [
-                            'username' => $user['username'],
-                            'role' => $user['role']
-                        ]
-                    ];
-                }
-                return ['success' => false, 'error' => 'Invalid password'];
+        foreach ($users['users'] as $candidate) {
+            if (hash_equals($candidate['username'], $username)) {
+                $user = $candidate;
+                break;
             }
         }
         
-        return ['success' => false, 'error' => 'User not found'];
+        // Always run a password check to avoid a timing oracle on user existence
+        if ($user === null) {
+            password_verify($password, '$2y$10$usesomesillystringfore7hnbRJHxXVLeakoG8K30oukPsA.ztMG');
+            return ['success' => false, 'error' => 'Invalid credentials'];
+        }
+        
+        if (!password_verify($password, $user['password'])) {
+            return ['success' => false, 'error' => 'Invalid credentials'];
+        }
+        
+        $token = $this->generateToken($user);
+        return [
+            'success' => true,
+            'token' => $token,
+            'user' => [
+                'username' => $user['username'],
+                'role' => $user['role']
+            ]
+        ];
     }
     
     public function verifyToken(string $token): ?array {
@@ -49,8 +58,14 @@ class Auth {
         
         list($header, $payload, $signature) = $parts;
         
-        // Verify signature
-        $expectedSignature = base64_encode(
+        // Verify algorithm header before trusting anything
+        $headerData = json_decode(self::base64UrlDecode($header), true);
+        if (!is_array($headerData) || ($headerData['alg'] ?? '') !== self::JWT_ALGO) {
+            return null;
+        }
+        
+        // Verify signature (constant-time)
+        $expectedSignature = self::base64UrlEncode(
             hash_hmac('sha256', "$header.$payload", $this->jwtSecret, true)
         );
         
@@ -59,54 +74,46 @@ class Auth {
         }
         
         // Decode payload
-        $payloadData = json_decode(base64_decode($payload), true);
+        $payloadData = json_decode(self::base64UrlDecode($payload), true);
         
-        // Check expiry
-        if (isset($payloadData['exp']) && $payloadData['exp'] < time()) {
+        if (!is_array($payloadData)) {
+            return null;
+        }
+        
+        // Expiry is mandatory
+        if (!isset($payloadData['exp']) || !is_numeric($payloadData['exp']) || (int) $payloadData['exp'] < time()) {
             return null;
         }
         
         return $payloadData;
     }
     
-    public function requireAuth(string $token): array {
-        $payload = $this->verifyToken($token);
-        
-        if ($payload === null) {
-            http_response_code(401);
-            echo json_encode(['error' => 'Unauthorized']);
-            exit;
-        }
-        
-        return $payload;
+    private static function base64UrlEncode(string $data): string {
+        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
     }
     
-    public function requireAdmin(string $token): array {
-        $payload = $this->requireAuth($token);
-        
-        if ($payload['role'] !== 'admin') {
-            http_response_code(403);
-            echo json_encode(['error' => 'Forbidden']);
-            exit;
+    private static function base64UrlDecode(string $data): string {
+        $remainder = strlen($data) % 4;
+        if ($remainder !== 0) {
+            $data .= str_repeat('=', 4 - $remainder);
         }
-        
-        return $payload;
+        return base64_decode(strtr($data, '-_', '+/'));
     }
     
     private function generateToken(array $user): string {
-        $header = base64_encode(json_encode([
+        $header = self::base64UrlEncode(json_encode([
             'alg' => self::JWT_ALGO,
             'typ' => 'JWT'
         ]));
         
-        $payload = base64_encode(json_encode([
+        $payload = self::base64UrlEncode(json_encode([
             'username' => $user['username'],
             'role' => $user['role'],
             'iat' => time(),
             'exp' => time() + self::JWT_EXPIRY
         ]));
         
-        $signature = base64_encode(
+        $signature = self::base64UrlEncode(
             hash_hmac('sha256', "$header.$payload", $this->jwtSecret, true)
         );
         
@@ -121,8 +128,4 @@ class Auth {
         $content = file_get_contents($this->usersFile);
         return json_decode($content, true) ?? ['users' => []];
     }
-    
-    public function hashPassword(string $password): string {
-        return password_hash($password, PASSWORD_BCRYPT);
-    }
 }
diff --git a/api/lib/ScoreScanner.php b/api/lib/ScoreScanner.php
index 2fd01e2..cc71820 100644
--- a/api/lib/ScoreScanner.php
+++ b/api/lib/ScoreScanner.php
@@ -406,6 +406,11 @@ class ScoreScanner {
     }
     
     public function createScore(string $id, string $name, string $compositor, array $pieces = []): array {
+        // Security: the id becomes a directory name, allow digits only
+        if (!$this->isValidSegment($id, '/^\d{1,6}$/')) {
+            return ['success' => false, 'error' => 'Invalid score id'];
+        }
+        
         $scoreDir = $this->scoresPath . $id;
         
         if (is_dir($scoreDir)) {
@@ -425,12 +430,17 @@ class ScoreScanner {
         
         // Add piece names if provided
         foreach ($pieces as $piece) {
-            $num = $piece['number'];
-            $pieceName = $this->sanitizeIniValue($piece['name']);
+            $num = $piece['number'] ?? $piece['id'] ?? '';
+            if (!preg_match('/^\d{1,3}$/', (string) $num)) {
+                $this->deleteDirectory($scoreDir);
+                return ['success' => false, 'error' => 'Invalid piece number'];
+            }
+            $pieceName = $this->sanitizeIniValue($piece['name'] ?? '');
             $iniContent .= "{$num} = $pieceName\n";
         }
         
         if (file_put_contents($scoreDir . '/score.ini', $iniContent) === false) {
+            $this->deleteDirectory($scoreDir);
             return ['success' => false, 'error' => 'Failed to create score.ini'];
         }
         
@@ -445,11 +455,15 @@ class ScoreScanner {
     }
     
     private function sanitizeIniValue(string $value): string {
-        // Remove newlines and carriage returns to prevent INI injection
-        return str_replace(["\n", "\r", "\x00"], '', $value);
+        // Remove control characters that would break/inject INI lines
+        return trim(str_replace(["\n", "\r", "\x00", "\x1a"], '', $value));
+    }
+
+    private function isValidSegment(string $value, string $pattern): bool {
+        return $value !== '' && $value !== '.' && $value !== '..' && (bool) preg_match($pattern, $value);
     }
     
-    public function updateScore(string $scoreId, ?string $name, ?string $compositor): array {
+    public function updateScore(string $scoreId, ?string $name, ?string $compositor, ?string $ressource = null): array {
         $scoreDir = $this->scoresPath . $scoreId;
         $iniFile = $scoreDir . '/score.ini';
         
@@ -462,23 +476,39 @@ class ScoreScanner {
             return ['success' => false, 'error' => 'Failed to parse score.ini'];
         }
         
-        // Update values
+        $currentName = $ini['info']['name'] ?? '';
+        $currentCompositor = $ini['info']['compositor'] ?? '';
+        $currentRessource = $ini['info']['ressource'] ?? '';
+        
+        // Update values (keep existing when the field is not provided)
         if ($name !== null) {
-            $ini['info']['name'] = $name;
+            $currentName = $this->sanitizeIniValue($name);
         }
         if ($compositor !== null) {
-            $ini['info']['compositor'] = $compositor;
+            $currentCompositor = $this->sanitizeIniValue($compositor);
+        }
+        if ($ressource !== null) {
+            $ressource = trim($ressource);
+            if ($ressource !== '' && !preg_match('#^https?://#i', $ressource)) {
+                return ['success' => false, 'error' => 'Invalid ressource URL (http/https only)'];
+            }
+            $currentRessource = $this->sanitizeIniValue($ressource);
         }
         
         // Rebuild ini content
         $content = "[info]\n";
-        $content .= "name = " . ($ini['info']['name'] ?? '') . "\n";
-        $content .= "compositor = " . ($ini['info']['compositor'] ?? '') . "\n\n";
-        $content .= "[pieces]\n";
+        $content .= "name = $currentName\n";
+        $content .= "compositor = $currentCompositor\n";
+        if ($currentRessource !== '') {
+            $content .= "ressource = $currentRessource\n";
+        }
+        $content .= "\n[pieces]\n";
         
         if (isset($ini['pieces'])) {
             foreach ($ini['pieces'] as $key => $value) {
-                $content .= "$key = $value\n";
+                $safeKey = $this->sanitizeIniValue((string) $key);
+                $safeValue = $this->sanitizeIniValue((string) $value);
+                $content .= "$safeKey = $safeValue\n";
             }
         }
         
@@ -503,9 +533,9 @@ class ScoreScanner {
         }
         
         // Get existing info
-        $name = $ini['info']['name'] ?? '';
-        $compositor = $ini['info']['compositor'] ?? '';
-        $ressource = $ini['info']['ressource'] ?? '';
+        $name = $this->sanitizeIniValue($ini['info']['name'] ?? '');
+        $compositor = $this->sanitizeIniValue($ini['info']['compositor'] ?? '');
+        $ressource = $this->sanitizeIniValue($ini['info']['ressource'] ?? '');
         
         // Rebuild ini content with new pieces
         $content = "[info]\n";
@@ -518,8 +548,11 @@ class ScoreScanner {
         $content .= "count = " . count($pieces) . "\n";
         
         foreach ($pieces as $piece) {
-            $num = $piece['number'] ?? $piece['id'];
-            $pieceName = $piece['name'] ?? '';
+            $num = $piece['number'] ?? $piece['id'] ?? '';
+            if (!preg_match('/^\d{1,3}$/', (string) $num)) {
+                return ['success' => false, 'error' => 'Invalid piece number'];
+            }
+            $pieceName = $this->sanitizeIniValue($piece['name'] ?? '');
             $content .= "$num = $pieceName\n";
         }
         
@@ -562,6 +595,32 @@ class ScoreScanner {
     }
     
     public function uploadPdf(string $scoreId, array $file, string $piece, string $instrument, string $version, string $key = '', string $clef = '', string $variant = '', string $part = '1', bool $watermark = false, string $watermarkPosition = 'left'): array {
+        // Security: every input used to build a path or a filename is validated
+        if (!$this->isValidSegment($scoreId, '/^\d{1,6}$/')) {
+            return ['success' => false, 'error' => 'Invalid score id'];
+        }
+        if (!$this->isValidSegment($piece, '/^\d{1,3}$/')) {
+            return ['success' => false, 'error' => 'Invalid piece'];
+        }
+        if (!$this->isValidSegment($instrument, '/^[a-z]{2,4}$/')) {
+            return ['success' => false, 'error' => 'Invalid instrument'];
+        }
+        if (!$this->isValidSegment($version, '/^[A-Za-z0-9_-]{1,10}$/')) {
+            return ['success' => false, 'error' => 'Invalid version'];
+        }
+        if ($part !== '' && !$this->isValidSegment($part, '/^[A-Za-z0-9_+-]{1,20}$/')) {
+            return ['success' => false, 'error' => 'Invalid part'];
+        }
+        if ($key !== '' && !$this->isValidSegment($key, '/^[a-z]{2,8}$/')) {
+            return ['success' => false, 'error' => 'Invalid key'];
+        }
+        if ($clef !== '' && !$this->isValidSegment($clef, '/^[a-z]{2,8}$/')) {
+            return ['success' => false, 'error' => 'Invalid clef'];
+        }
+        if ($variant !== '' && !$this->isValidSegment($variant, '/^[a-z0-9_-]{1,20}$/')) {
+            return ['success' => false, 'error' => 'Invalid variant'];
+        }
+        
         $scoreDir = $this->scoresPath . $scoreId;
         
         if (!is_dir($scoreDir)) {
@@ -578,15 +637,6 @@ class ScoreScanner {
             return ['success' => false, 'error' => 'Upload error: ' . $file['error']];
         }
         
-        // Security: Validate MIME type
-        $finfo = finfo_open(FILEINFO_MIME_TYPE);
-        $mimeType = finfo_file($finfo, $file['tmp_name']);
-        finfo_close($finfo);
-        
-        if ($mimeType !== 'application/pdf') {
-            return ['success' => false, 'error' => 'Invalid file type. Only PDF files are allowed'];
-        }
-        
         // Security: Validate extension
         $originalExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
         if ($originalExtension !== 'pdf') {
@@ -647,22 +697,38 @@ class ScoreScanner {
         
         $targetPath = $targetDir . '/' . $filename;
         
-        // Use copy for CLI testing, move_uploaded_file for real uploads
-        if (is_uploaded_file($file['tmp_name'])) {
-            $result = move_uploaded_file($file['tmp_name'], $targetPath);
+        if ($watermark) {
+            // Write to a temp file, watermark it, then move into place atomically
+            $tmpPath = $targetPath . '.tmp';
+            if (is_uploaded_file($file['tmp_name'])) {
+                $result = move_uploaded_file($file['tmp_name'], $tmpPath);
+            } else {
+                $result = copy($file['tmp_name'], $tmpPath);
+            }
+            if (!$result) {
+                return ['success' => false, 'error' => 'Failed to move uploaded file'];
+            }
+            if (!$this->addWatermark($tmpPath, $scoreId, $watermarkPosition)) {
+                @unlink($tmpPath);
+                return ['success' => false, 'error' => 'Failed to apply watermark'];
+            }
+            if (!rename($tmpPath, $targetPath)) {
+                @unlink($tmpPath);
+                return ['success' => false, 'error' => 'Failed to store watermarked file'];
+            }
         } else {
-            $result = copy($file['tmp_name'], $targetPath);
+            // Use copy for CLI testing, move_uploaded_file for real uploads
+            if (is_uploaded_file($file['tmp_name'])) {
+                $result = move_uploaded_file($file['tmp_name'], $targetPath);
+            } else {
+                $result = copy($file['tmp_name'], $targetPath);
+            }
+            if (!$result) {
+                return ['success' => false, 'error' => 'Failed to move uploaded file'];
+            }
         }
         
-        if ($result && $watermark) {
-            $this->addWatermark($targetPath, $scoreId, $watermarkPosition);
-        }
-        
-        if ($result) {
-            return ['success' => true, 'path' => "$scoreId/$piece/$instrument/$version/$filename"];
-        }
-        
-        return ['success' => false, 'error' => 'Failed to move uploaded file'];
+        return ['success' => true, 'path' => "$scoreId/$piece/$instrument/$version/$filename"];
     }
 
     public function getScoreFiles(string $scoreId): array {
@@ -709,22 +775,42 @@ class ScoreScanner {
     }
 
     public function deleteScoreFile(string $scoreId, string $filePath): array {
-        $scoreDir = $this->scoresPath . $scoreId;
-        $fullPath = $scoreDir . '/' . $filePath;
-        
-        if (!file_exists($fullPath)) {
+        $scoreDir = realpath($this->scoresPath . $scoreId);
+
+        if ($scoreDir === false || !is_dir($scoreDir)) {
+            return ['success' => false, 'error' => 'Score not found'];
+        }
+
+        // Security: reject null bytes and resolve the real target
+        if (strpos($filePath, "\x00") !== false) {
+            return ['success' => false, 'error' => 'Invalid file path'];
+        }
+
+        $fullPath = realpath($scoreDir . '/' . $filePath);
+
+        if ($fullPath === false) {
             return ['success' => false, 'error' => 'File not found'];
         }
-        
+
+        // Security: ensure the file stays inside the score directory
+        if (strpos($fullPath, $scoreDir . DIRECTORY_SEPARATOR) !== 0) {
+            return ['success' => false, 'error' => 'Access denied'];
+        }
+
+        // Security: only PDF files can be deleted, never score.ini
         if (is_dir($fullPath)) {
             return ['success' => false, 'error' => 'Cannot delete directory'];
         }
-        
+
+        if (strtolower(pathinfo($fullPath, PATHINFO_EXTENSION)) !== 'pdf') {
+            return ['success' => false, 'error' => 'Only PDF files can be deleted'];
+        }
+
         if (unlink($fullPath)) {
             $this->cleanupEmptyDirectories($scoreDir, dirname($filePath));
             return ['success' => true];
         }
-        
+
         return ['success' => false, 'error' => 'Failed to delete file'];
     }
 
@@ -750,26 +836,30 @@ class ScoreScanner {
             require_once __DIR__ . '/../vendor/autoload.php';
             
             $pdf = new \setasign\Fpdi\Fpdi();
-            $pdf->setSourceFile($pdfPath);
-            
-            $templateId = $pdf->importPage(1);
-            $size = $pdf->getTemplateSize($templateId);
-            
-            $pdf->AddPage($size['width'] > $size['height'] ? 'L' : 'P', [$size['width'], $size['height']]);
-            $pdf->useTemplate($templateId);
+            $pageCount = $pdf->setSourceFile($pdfPath);
             
             $pdf->SetFont('helvetica', 'B', 20);
             $pdf->SetTextColor(0, 0, 0);
             
-            if ($position === 'right') {
-                $pdf->SetXY($size['width'] - 45, 5);
-                $pdf->Cell(40, 10, $scoreId, 0, 0, 'R');
-            } else {
-                $pdf->SetXY(10, 5);
-                $pdf->Cell(40, 10, $scoreId, 0, 0, 'L');
+            // Apply the watermark on every page (do not truncate multi-page PDFs)
+            for ($i = 1; $i <= $pageCount; $i++) {
+                $templateId = $pdf->importPage($i);
+                $size = $pdf->getTemplateSize($templateId);
+                
+                $pdf->AddPage($size['width'] > $size['height'] ? 'L' : 'P', [$size['width'], $size['height']]);
+                $pdf->useTemplate($templateId);
+                
+                if ($position === 'right') {
+                    $pdf->SetXY($size['width'] - 45, 5);
+                    $pdf->Cell(40, 10, $scoreId, 0, 0, 'R');
+                } else {
+                    $pdf->SetXY(10, 5);
+                    $pdf->Cell(40, 10, $scoreId, 0, 0, 'L');
+                }
             }
             
-            return $pdf->Output('F', $pdfPath);
+            $pdf->Output('F', $pdfPath);
+            return true;
         } catch (\Exception $e) {
             error_log('Watermark error: ' . $e->getMessage());
             return false;
diff --git a/api/router.php b/api/router.php
index de24711..fedfbfc 100644
--- a/api/router.php
+++ b/api/router.php
@@ -1,48 +1,6 @@
 <?php
 
-// Load environment variables from .env file
-$envFile = __DIR__ . '/.env';
-if (file_exists($envFile)) {
-    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
-    foreach ($lines as $line) {
-        if (strpos($line, '#') === 0) continue;
-        if (strpos($line, '=') === false) continue;
-        list($key, $value) = explode('=', $line, 2);
-        $key = trim($key);
-        $value = trim($value);
-        if (!empty($key)) {
-            putenv("$key=$value");
-            $_ENV[$key] = $value;
-        }
-    }
-}
-
-// CORS headers - MUST be sent before any other output
-$allowedOrigins = ['http://localhost:5173', 'http://localhost:3000', 'http://localhost:4173', 'https://ohmj2.free.fr', 'https://partitions.c.nadal-fr.com', 'https://ohmj-api.c.nadal-fr.com'];
-$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-
-if (in_array($origin, $allowedOrigins)) {
-    header("Access-Control-Allow-Origin: $origin");
-    header('Access-Control-Allow-Credentials: true');
-} else {
-    header("Access-Control-Allow-Origin: *");
-}
-header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
-header('Access-Control-Allow-Headers: Authorization, Content-Type');
-
-// Handle OPTIONS preflight immediately
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
-
-// Router script for PHP built-in server
-$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-
-// Serve existing files directly
-if ($uri !== '/' && file_exists(__DIR__ . $uri)) {
-    return false;
-}
-
-// Route everything through index.php
+// Dev server router: every request goes through index.php (environment
+// loading, CORS and OPTIONS handling all live there). No file is ever served
+// statically, so .env, config/users.json and composer.phar stay unreachable.
 require __DIR__ . '/index.php';
diff --git a/api/tests.php b/api/tests.php
index 7911d37..407e85e 100644
--- a/api/tests.php
+++ b/api/tests.php
@@ -175,13 +175,18 @@ class APITest {
     public function testCreateScoreWithPieces() {
         $this->section("Create Score with Pieces - Functional");
         
-        // Test 0: Try to create score with existing ID should fail
+        // Test 0: Try to create score with existing ID should fail (self-contained)
+        $seed = $this->request('POST', 'admin/scores', ['name' => 'Seed Duplicate']);
+        $seedId = $seed['body']['score']['id'] ?? null;
         $result = $this->request('POST', 'admin/scores', [
             'name' => 'Test Duplicate',
             'compositor' => 'Test',
-            'id' => '001'
+            'id' => $seedId
         ]);
         $this->test('Create with existing ID returns error', $result['code'] === 400 && isset($result['body']['error']));
+        if ($seedId) {
+            $this->request('DELETE', "admin/scores/$seedId");
+        }
         
         // Test 1: Create score with 2 pieces
         $testName = 'Test Score ' . date('YmdHis');
@@ -300,60 +305,16 @@ class APITest {
         // Reset rate limiting
         array_map('unlink', glob(sys_get_temp_dir() . '/rate_*'));
         
-        // Get a score to upload to
-        $scores = $this->request('GET', 'scores');
-        
-        if (empty($scores['body']['scores'])) {
-            echo "  ⚠ No scores available for watermark test\n";
+        // Create a dedicated score so the test never touches real data
+        $created = $this->request('POST', 'admin/scores', ['name' => 'Watermark Test']);
+        $scoreId = $created['body']['score']['id'] ?? null;
+        if (!$scoreId) {
+            $this->test('Dedicated watermark score available', false);
             return;
         }
         
-        $scoreId = $scores['body']['scores'][0]['id'];
-        
-        // Create a minimal test PDF
-        $pdfContent = "%PDF-1.4
-1 0 obj
-<< /Type /Catalog /Pages 2 0 R >>
-endobj
-2 0 obj
-<< /Type /Pages /Kids [3 0 R] /Count 1 >>
-endobj
-3 0 obj
-<< /Type /Page /Parent 2 0 R /Resources 4 0 R /MediaBox [0 0 612 792] /Contents 5 0 R >>
-endobj
-4 0 obj
-<< /Font << /F1 6 0 R >> >>
-endobj
-5 0 obj
-<< /Length 44 >>
-stream
-BT
-/F1 12 Tf
-100 700 Td
-(Test) Tj
-ET
-endstream
-endobj
-6 0 obj
-<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
-endobj
-xref
-0 7
-0000000000 65535 f 
-0000000009 00000 n 
-0000000058 00000 n 
-0000000115 00000 n 
-0000000214 00000 n 
-0000000312 00000 n 
-0000000401 00000 n 
-trailer
-<< /Size 7 /Root 1 0 R >>
-startxref
-490
-%%EOF";
-        
-        $tmpFile = sys_get_temp_dir() . '/test_watermark_' . time() . '.pdf';
-        file_put_contents($tmpFile, $pdfContent);
+        $tmpFile = sys_get_temp_dir() . '/test_watermark_' . uniqid() . '.pdf';
+        $this->makePdf($tmpFile, 2);
         
         // Test upload with watermark left
         $result = $this->multipartRequest("admin/scores/$scoreId/upload", [
@@ -367,18 +328,16 @@ startxref
         
         $this->test('Upload with watermark left returns 200', $result['code'] === 200);
         
-        // Get files to verify it was uploaded
+        // Get files to verify it was uploaded (recursive tree)
         $files = $this->request('GET', "admin/scores/$scoreId/files");
-        $hasFile = false;
-        if (!empty($files['body']['files'])) {
-            foreach ($files['body']['files'] as $f) {
-                if (strpos($f['path'], 'direction_1.pdf') !== false) {
-                    $hasFile = true;
-                    // Clean up
-                    @unlink(SCORES_PATH . "$scoreId/" . $f['path']);
-                    break;
-                }
-            }
+        $found = $this->findTreeFile($files['body']['files'] ?? [], 'direction_1.pdf');
+        if ($found) {
+            require_once __DIR__ . '/vendor/autoload.php';
+            $check = new \setasign\Fpdi\Fpdi();
+            $pages = $check->setSourceFile(SCORES_PATH . "$scoreId/" . $found['path']);
+            $this->test('Watermark preserves all pages', $pages === 2);
+        } else {
+            $this->test('Watermarked file present', false);
         }
         
         // Test upload with watermark right
@@ -396,13 +355,32 @@ startxref
         // Clean up
         @unlink($tmpFile);
         
-        // Clean up uploaded files
+        // Clean up all uploaded files (recursive) then the dedicated score
         $files = $this->request('GET', "admin/scores/$scoreId/files");
-        if (!empty($files['body']['files'])) {
-            foreach ($files['body']['files'] as $f) {
-                if (strpos($f['path'], 'direction_') !== false) {
-                    @unlink(SCORES_PATH . "$scoreId/" . $f['path']);
+        $this->deleteTreeMatching($files['body']['files'] ?? [], $scoreId, 'direction_');
+        $this->request('DELETE', "admin/scores/$scoreId");
+    }
+    
+    private function findTreeFile($tree, $needle) {
+        foreach ($tree as $node) {
+            if (($node['type'] ?? '') === 'folder') {
+                $found = $this->findTreeFile($node['children'] ?? [], $needle);
+                if ($found) {
+                    return $found;
                 }
+            } elseif (strpos($node['path'] ?? '', $needle) !== false) {
+                return $node;
+            }
+        }
+        return null;
+    }
+    
+    private function deleteTreeMatching($tree, $scoreId, $needle) {
+        foreach ($tree as $node) {
+            if (($node['type'] ?? '') === 'folder') {
+                $this->deleteTreeMatching($node['children'] ?? [], $scoreId, $needle);
+            } elseif (strpos($node['path'] ?? '', $needle) !== false) {
+                @unlink(SCORES_PATH . "$scoreId/" . $node['path']);
             }
         }
     }
@@ -636,6 +614,443 @@ startxref
     
     // ============ SUMMARY ============
     
+    // ============ EXTRA FUNCTIONAL COVERAGE ============
+
+    private function requestWithToken($method, $endpoint, $token) {
+        $context = stream_context_create([
+            'http' => [
+                'method' => $method,
+                'header' => "Authorization: Bearer $token",
+                'ignore_errors' => true
+            ]
+        ]);
+        $response = @file_get_contents(BASE_URL . '/' . $endpoint, false, $context);
+        $code = 500;
+        foreach ($http_response_header ?? [] as $header) {
+            if (preg_match('/^HTTP\/\d+\.\d+\s+(\d+)/', $header, $m)) {
+                $code = (int) $m[1];
+            }
+        }
+        return ['code' => $code, 'body' => json_decode($response, true) ?? []];
+    }
+
+    public function testMoreEndpoints() {
+        $this->section("Endpoints - Extended");
+        array_map('unlink', glob(sys_get_temp_dir() . '/rate_*'));
+
+        // Create a dedicated score (auto id) then exercise every sub-resource
+        $created = $this->request('POST', 'admin/scores', ['name' => 'Test Coverage', 'compositor' => 'CI']);
+        $this->test('Create score (auto id) returns 200', $created['code'] === 200);
+        $scoreId = $created['body']['score']['id'] ?? null;
+        if (!$scoreId) {
+            $this->test('Dedicated score available', false);
+            return;
+        }
+
+        // Invalid id is rejected
+        $bad = $this->request('POST', 'admin/scores', ['id' => '../evil', 'name' => 'x']);
+        $this->test('Create with invalid id returns 400', $bad['code'] === 400);
+
+        // Upload a valid PDF
+        $tmpPdf = sys_get_temp_dir() . '/cov_' . uniqid() . '.pdf';
+        $this->makePdf($tmpPdf, 1);
+        $up = $this->multipartRequest("admin/scores/$scoreId/upload", [
+            ['name' => 'file', 'file' => $tmpPdf],
+            ['name' => 'piece', 'data' => '1'],
+            ['name' => 'instrument', 'data' => 'dir'],
+            ['name' => 'version', 'data' => '1'],
+        ]);
+        $this->test('Upload valid PDF returns 200', $up['code'] === 200);
+
+        // Invalid segment / invalid file type
+        $badSeg = $this->multipartRequest("admin/scores/$scoreId/upload", [
+            ['name' => 'file', 'file' => $tmpPdf],
+            ['name' => 'piece', 'data' => '1'],
+            ['name' => 'instrument', 'data' => '..'],
+            ['name' => 'version', 'data' => '1'],
+        ]);
+        $this->test('Upload invalid instrument returns 400', $badSeg['code'] === 400);
+
+        $badSeg2 = $this->multipartRequest("admin/scores/$scoreId/upload", [
+            ['name' => 'file', 'file' => $tmpPdf],
+            ['name' => 'piece', 'data' => '..'],
+            ['name' => 'instrument', 'data' => 'dir'],
+            ['name' => 'version', 'data' => '1'],
+        ]);
+        $this->test('Upload invalid piece returns 400', $badSeg2['code'] === 400);
+
+        $noFile = $this->request('POST', "admin/scores/$scoreId/upload", ['unexpected' => 'body']);
+        $this->test('Upload without file part returns 413', $noFile['code'] === 413);
+
+        // Instruments (list + filter)
+        $instr = $this->request('GET', "scores/$scoreId/instruments");
+        $this->test('Instruments returns 200', $instr['code'] === 200);
+        $instrPiece = $this->request('GET', "scores/$scoreId/instruments", null, true, ['piece' => 1]);
+        $this->test('Instruments?piece=1 returns 200', $instrPiece['code'] === 200);
+
+        // Pieces endpoint content
+        $pieces = $this->request('GET', "pieces/$scoreId");
+        $this->test('Pieces returns 200', $pieces['code'] === 200);
+
+        // Download success + failures
+        $path = "$scoreId/1/dir/1/direction_1.pdf";
+        $ok = $this->request('GET', "download/$path");
+        $this->test('Download with token returns 200', $ok['code'] === 200);
+        $noToken = $this->request('GET', "download/$path", null, false);
+        $this->test('Download without token returns 401', $noToken['code'] === 401);
+        $badToken = $this->requestWithToken('GET', "download/$path", 'not.a.token');
+        $this->test('Download with invalid token returns 401', $badToken['code'] === 401);
+        $nonPdf = $this->request('GET', "download/$scoreId/score.ini");
+        $this->test('Download non-PDF returns 403', $nonPdf['code'] === 403);
+        $missing = $this->request('GET', "download/$scoreId/1/dir/1/nope.pdf");
+        $this->test('Download missing file returns 404', $missing['code'] === 404);
+        $badApi = $this->requestWithToken('GET', 'scores', 'a.b.c');
+        $this->test('Protected route with invalid token returns 401', $badApi['code'] === 401);
+        $root = realpath(SCORES_PATH);
+        @symlink('/etc/hostname', $root . "/$scoreId/evil.pdf");
+        $escaped = $this->request('GET', "download/$scoreId/evil.pdf");
+        $this->test('Download escaped symlink returns 403', $escaped['code'] === 403);
+        @unlink($root . "/$scoreId/evil.pdf");
+
+        // updatePieces
+        $upd = $this->request('PUT', "admin/scores/$scoreId/pieces", [
+            'pieces' => [
+                ['number' => 1, 'name' => 'Mouvement A'],
+                ['number' => 2, 'name' => 'Mouvement B']
+            ]
+        ]);
+        $this->test('Update pieces returns 200', $upd['code'] === 200);
+        $badPiece = $this->request('PUT', "admin/scores/$scoreId/pieces", ['pieces' => [['number' => 'x', 'name' => 'bad']]]);
+        $this->test('Update pieces invalid number returns 400', $badPiece['code'] === 400);
+
+        // updateScore with ressource (persist + invalid)
+        $updScore = $this->request('PUT', "admin/scores/$scoreId", ['name' => 'Test Coverage', 'compositor' => 'CI', 'ressource' => 'https://example.com/x']);
+        $this->test('Update score with ressource returns 200', $updScore['code'] === 200);
+        $score = $this->request('GET', "scores/$scoreId");
+        $this->test('Ressource persisted', ($score['body']['score']['ressource'] ?? null) === 'https://example.com/x');
+        $badUrl = $this->request('PUT', "admin/scores/$scoreId", ['ressource' => 'javascript:alert(1)']);
+        $this->test('Update score invalid ressource returns 400', $badUrl['code'] === 400);
+
+        // Non-admin cannot reach admin routes
+        $userLogin = $this->request('POST', 'login', ['username' => 'user', 'password' => 'password'], false);
+        if (($userLogin['body']['token'] ?? null)) {
+            $saved = $this->token;
+            $this->token = $userLogin['body']['token'];
+            $forbidden = $this->request('POST', 'admin/scores', ['name' => 'nope']);
+            $this->test('Non-admin blocked on admin route (403)', $forbidden['code'] === 403);
+            $this->token = $saved;
+        }
+
+        // Delete uploaded file, then the score
+        $del = $this->request('DELETE', "admin/scores/$scoreId/files", null, true, ['path' => '1/dir/1/direction_1.pdf']);
+        $this->test('Delete file returns 200', $del['code'] === 200);
+        $delScore = $this->request('DELETE', "admin/scores/$scoreId");
+        $this->test('Delete score returns 200', $delScore['code'] === 200);
+
+        // Unknown route
+        $unknown = $this->request('GET', 'does/not/exist');
+        $this->test('Unknown route returns 404', $unknown['code'] === 404);
+
+        @unlink($tmpPdf);
+    }
+
+    // ============ UNIT TESTS (direct library coverage) ============
+
+    private function makePdf($path, $pages = 1) {
+        require_once __DIR__ . '/vendor/setasign/fpdf/fpdf.php';
+        $pdf = new FPDF();
+        for ($i = 0; $i < $pages; $i++) {
+            $pdf->AddPage();
+            $pdf->SetFont('Helvetica', '', 12);
+            $pdf->Cell(40, 10, 'Page ' . ($i + 1));
+        }
+        $pdf->Output('F', $path);
+    }
+
+    private function rrmdir($dir) {
+        if (!is_dir($dir)) return;
+        foreach (scandir($dir) as $item) {
+            if ($item === '.' || $item === '..') continue;
+            $p = $dir . '/' . $item;
+            is_dir($p) ? $this->rrmdir($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+
+    public function testUnits() {
+        $this->section("Unit - ScoreScanner & Auth");
+        require_once __DIR__ . '/lib/ScoreScanner.php';
+        require_once __DIR__ . '/lib/Auth.php';
+
+        $base = sys_get_temp_dir() . '/ohmj_unit_' . uniqid() . '/';
+        @mkdir($base . '001/1/cla/1', 0777, true);
+        @mkdir($base . '001/1/cor/1', 0777, true);
+        @mkdir($base . '001/1/cor/2', 0777, true);
+        @mkdir($base . '001/1/emt/1', 0777, true);
+        @mkdir($base . '001/2/xyz', 0777, true);
+        @mkdir($base . '002', 0777, true);
+        @mkdir($base . '003', 0777, true);
+        @mkdir($base . '004', 0777, true);
+        @mkdir($base . '.hidden', 0777, true);
+        @mkdir($base . 'notnum', 0777, true);
+        @mkdir($base . '005/1/cla/1', 0777, true);
+        @mkdir($base . '007/cla/1', 0777, true);
+        @mkdir($base . '008', 0777, true);
+
+        file_put_contents($base . '001/score.ini', "[info]\nname = Test\ncompositor = Comp\nressource = https://example.com\n\n[pieces]\ncount = 1\n");
+        file_put_contents($base . '002/score.ini', "name = Broken\ncompositor = Someone\nkey = \"unterminated\n");
+        file_put_contents($base . '004/score.ini', "just text no equals\n");
+        file_put_contents($base . '008/score.ini', "\"unterminated line\n");
+        file_put_contents($base . '007/cla/1/flute-ut-1.pdf', '%PDF-1.4 test');
+        file_put_contents($base . '005/score.ini', "[info]\nname = NoInstruments\n");
+
+        $this->makePdf($base . '001/1/cla/1/clarinette-sib-1.pdf', 1);
+        $this->makePdf($base . '001/1/cor/1/cor-fa-1.pdf', 1);
+        $this->makePdf($base . '001/1/cor/2/cor-fa-1.pdf', 1);
+        $this->makePdf($base . '001/1/cla/1/weird.txt', 1);
+        file_put_contents($base . '001/1/cla/1/clarinette-sib-solo-2.pdf', '%PDF-1.4 test');
+        file_put_contents($base . '001/1/cla/1/clarinette-mib-1_2.pdf', '%PDF-1.4 test');
+        file_put_contents($base . '001/1/cla/1/readme.txt', 'x');
+        file_put_contents($base . '001/1/emt/1/fake.txt', 'x');
+
+        $scanner = new ScoreScanner($base);
+
+        $scores = $scanner->listScores();
+        $this->test('Unit: listScores returns array', is_array($scores) && count($scores) >= 1);
+        $this->test('Unit: getScore returns detail', is_array($scanner->getScore('001')));
+        $this->test('Unit: getScore unknown returns null', $scanner->getScore('999') === null);
+        $this->test('Unit: getScore no instruments returns detail', is_array($scanner->getScore('005')));
+        $this->test('Unit: getPieces returns 1 piece', count($scanner->getPieces('001')) === 1);
+        $this->test('Unit: getPieces unknown returns []', $scanner->getPieces('999') === []);
+        $this->test('Unit: getInstruments returns array', is_array($scanner->getInstruments('001')));
+        $this->test('Unit: getInstruments piece filter', is_array($scanner->getInstruments('001', '1')));
+
+        $bad = new ScoreScanner('/nonexistent/path/');
+        $this->test('Unit: missing scores dir returns error', isset($bad->listScores()['error']));
+        $this->test('Unit: getScore no ini returns null', $scanner->getScore('003') === null);
+        $this->test('Unit: getPieces parse failure returns []', $scanner->getPieces('002') === []);
+        $this->test('Unit: getInstruments unknown returns []', $scanner->getInstruments('999') === []);
+
+        // parseFilename branches via reflection
+        $ref = new ReflectionClass('ScoreScanner');
+        $parse = $ref->getMethod('parseFilename');
+        $parse->setAccessible(true);
+        $p1 = $parse->invoke($scanner, 'clarinette-sib-1');
+        $this->test('Unit: parse key+part', $p1['key'] === 'sib' && $p1['part'] === '1');
+        $p2 = $parse->invoke($scanner, 'clarinette-mib-1_2');
+        $this->test('Unit: parse combined part', $p2['key'] === 'mib' && $p2['part'] === '1_2');
+        $p3 = $parse->invoke($scanner, 'cornet-sib-solo-2');
+        $this->test('Unit: parse variant solo', $p3['variant'] === 'solo');
+        $p4 = $parse->invoke($scanner, 'cor-fa-1-clesol');
+        $this->test('Unit: parse clef', $p4['clef'] === 'clesol');
+        $p5 = $parse->invoke($scanner, 'baryton-sib-default-cor-2');
+        $this->test('Unit: parse variant default', $p5['variant'] === 'default');
+        $p6 = $parse->invoke($scanner, 'tuba-ut-1');
+        $this->test('Unit: parse key ut', $p6['key'] === 'ut');
+        $getName = $ref->getMethod('getInstrumentName');
+        $getName->setAccessible(true);
+        $this->test('Unit: instrument name mapping', $getName->invoke($scanner, 'cla') === 'Clarinette');
+        $this->test('Unit: instrument name fallback', $getName->invoke($scanner, 'zzz') === 'zzz');
+        $sanitize = $ref->getMethod('sanitizeIniValue');
+        $sanitize->setAccessible(true);
+        $this->test('Unit: sanitize removes newlines', $sanitize->invoke($scanner, "a\nb\rc") === 'abc');
+        $valid = $ref->getMethod('isValidSegment');
+        $valid->setAccessible(true);
+        $this->test('Unit: segment accepts digits', $valid->invoke($scanner, '12', '/^\d+$/') === true);
+        $this->test('Unit: segment rejects traversal', $valid->invoke($scanner, '..', '/^\d+$/') === false);
+        $this->test('Unit: segment rejects empty', $valid->invoke($scanner, '', '/^\d+$/') === false);
+
+        // Legacy (no piece level) paths via reflection
+        $gii = $ref->getMethod('getInstrumentInfo');
+        $gii->setAccessible(true);
+        $gpi = $ref->getMethod('getPartInfo');
+        $gpi->setAccessible(true);
+        $this->test('Unit: getInstrumentInfo missing dir returns null', $gii->invoke($scanner, '999', 'cla') === null);
+        $this->test('Unit: getPartInfo missing dir returns null', $gpi->invoke($scanner, '999', 'cla', '1') === null);
+        $legacy = $gii->invoke($scanner, '007', 'cla');
+        $this->test('Unit: getInstrumentInfo no-piece path', is_array($legacy) && isset($legacy['parts'][0]['files'][0]['path']));
+        $this->test('Unit: getInstrumentInfo empty parts returns null', $gii->invoke($scanner, '001', 'emt', '1') === null);
+
+        // createScore branches
+        $this->test('Unit: createScore invalid id', $scanner->createScore('../x', 'n', 'c')['success'] === false);
+        $this->test('Unit: createScore ok', $scanner->createScore('100', 'New', 'Comp')['success'] === true);
+        $this->test('Unit: createScore duplicate', $scanner->createScore('100', 'New', 'Comp')['success'] === false);
+        $this->test('Unit: createScore invalid piece', $scanner->createScore('101', 'New', 'Comp', [['number' => 'x', 'name' => 'y']])['success'] === false);
+        $fileAsBase = new ScoreScanner($base . '001/score.ini/');
+        $this->test('Unit: createScore mkdir failure', $fileAsBase->createScore('900', 'n', 'c')['success'] === false);
+        $this->test('Unit: createScore with pieces', $scanner->createScore('102', 'New', 'Comp', [['number' => 1, 'name' => 'A']])['success'] === true);
+
+        // updateScore branches
+        $this->test('Unit: updateScore unknown', $scanner->updateScore('999', 'a', 'b')['success'] === false);
+        $this->test('Unit: updateScore invalid ressource', $scanner->updateScore('100', null, null, 'javascript:x')['success'] === false);
+        $this->test('Unit: updateScore ok', $scanner->updateScore('100', 'Renamed', 'Comp2', 'https://ok.example')['success'] === true);
+        $read = $ref->getMethod('getScoreInfo');
+        $read->setAccessible(true);
+        $info = $read->invoke($scanner, '100');
+        $this->test('Unit: updateScore persisted ressource', ($info['ressource'] ?? '') === 'https://ok.example');
+        $this->test('Unit: updateScore preserves on partial', $scanner->updateScore('100', 'OnlyName', null)['success'] === true);
+        $info2 = $read->invoke($scanner, '100');
+        $this->test('Unit: updateScore kept ressource', ($info2['ressource'] ?? '') === 'https://ok.example');
+        $this->test('Unit: updateScore parse failure', $scanner->updateScore('002', 'x', null)['success'] === false);
+        $scanner->createScore('104', 'W', 'C');
+        @chmod($base . '104/score.ini', 0444);
+        $this->test('Unit: updateScore write failure', $scanner->updateScore('104', 'x', null)['success'] === false);
+        $this->test('Unit: updatePieces write failure', $scanner->updatePieces('104', [['number' => 1, 'name' => 'a']])['success'] === false);
+        @chmod($base . '104/score.ini', 0644);
+
+        // updatePieces branches
+        $this->test('Unit: updatePieces unknown', $scanner->updatePieces('999', [])['success'] === false);
+        $this->test('Unit: updatePieces invalid number', $scanner->updatePieces('100', [['number' => 'x', 'name' => 'a']])['success'] === false);
+        $this->test('Unit: updatePieces ok', $scanner->updatePieces('100', [['number' => 1, 'name' => 'A']])['success'] === true);
+        $this->test('Unit: updatePieces parse failure', $scanner->updatePieces('002', [])['success'] === false);
+
+        // getScoreInfo malformed / manual parse
+        $broken = $read->invoke($scanner, '002');
+        $this->test('Unit: getScoreInfo manual parse fallback', is_array($broken) || $broken === null);
+        $this->test('Unit: getScoreInfo missing ini returns null', $read->invoke($scanner, '003') === null);
+        $manual = $read->invoke($scanner, '002');
+        $this->test('Unit: getScoreInfo manual name+compositor', is_array($manual) && ($manual['compositor'] ?? '') === 'Someone');
+        $this->test('Unit: getScoreInfo manual nothing returns null', $read->invoke($scanner, '008') === null);
+
+        // uploadPdf branches (copy path, no uploaded flag)
+        $file = ['tmp_name' => $base . '001/1/cla/1/clarinette-sib-1.pdf', 'name' => 'x.pdf', 'error' => UPLOAD_ERR_OK, 'size' => 100];
+        $this->test('Unit: upload invalid score id', $scanner->uploadPdf('../x', $file, '1', 'dir', '1')['success'] === false);
+        $this->test('Unit: upload unknown score', $scanner->uploadPdf('999', $file, '1', 'dir', '1')['success'] === false);
+        $this->test('Unit: upload invalid instrument', $scanner->uploadPdf('100', $file, '1', '..', '1')['success'] === false);
+        $this->test('Unit: upload invalid extension', $scanner->uploadPdf('100', ['tmp_name' => $base . '001/1/cla/1/readme.txt', 'name' => 'r.txt', 'error' => UPLOAD_ERR_OK, 'size' => 1], '1', 'dir', '1')['success'] === false);
+        $this->test('Unit: upload bad header', $scanner->uploadPdf('100', ['tmp_name' => $base . '001/1/cla/1/readme.txt', 'name' => 'r.pdf', 'error' => UPLOAD_ERR_OK, 'size' => 1], '1', 'dir', '1')['success'] === false);
+        $weird = $base . '001/1/cla/1/weird.txt';
+        $this->test('Unit: upload pdf with wrong extension', $scanner->uploadPdf('100', ['tmp_name' => $weird, 'name' => 'weird.txt', 'error' => UPLOAD_ERR_OK, 'size' => filesize($weird)], '1', 'dir', '1')['success'] === false);
+        $big = ['tmp_name' => $base . '001/1/cla/1/clarinette-sib-1.pdf', 'name' => 'big.pdf', 'error' => UPLOAD_ERR_OK, 'size' => 999999999];
+        $this->test('Unit: upload too large', $scanner->uploadPdf('100', $big, '1', 'dir', '1')['success'] === false);
+        $okUpload = $scanner->uploadPdf('100', $file, '1', 'cla', '1', 'sib', '', 'solo', '1');
+        $this->test('Unit: upload ok (copy)', $okUpload['success'] === true);
+        $this->test('Unit: upload invalid version', $scanner->uploadPdf('100', $file, '1', 'dir', '..')['success'] === false);
+        $this->test('Unit: upload invalid part', $scanner->uploadPdf('100', $file, '1', 'dir', '1', '', '', '', '..')['success'] === false);
+        $this->test('Unit: upload invalid key', $scanner->uploadPdf('100', $file, '1', 'dir', '1', '..')['success'] === false);
+        $this->test('Unit: upload invalid clef', $scanner->uploadPdf('100', $file, '1', 'dir', '1', '', '..')['success'] === false);
+        $this->test('Unit: upload invalid variant', $scanner->uploadPdf('100', $file, '1', 'dir', '1', '', '', '..')['success'] === false);
+        $this->test('Unit: upload no file', $scanner->uploadPdf('100', [], '1', 'dir', '1')['success'] === false);
+        $this->test('Unit: upload error code', $scanner->uploadPdf('100', ['tmp_name' => $file['tmp_name'], 'name' => 'v.pdf', 'error' => UPLOAD_ERR_PARTIAL, 'size' => 1], '1', 'dir', '1')['success'] === false);
+        $this->test('Unit: upload with clef ok', $scanner->uploadPdf('100', $file, '1', 'flu', '1', 'ut', 'clesol')['success'] === true);
+        $wmPdf = $base . 'wm_src.pdf';
+        $this->makePdf($wmPdf, 2);
+        $wmFile = ['tmp_name' => $wmPdf, 'name' => 'w.pdf', 'error' => UPLOAD_ERR_OK, 'size' => filesize($wmPdf)];
+        $wmUp = $scanner->uploadPdf('100', $wmFile, '1', 'cor', '1', '', '', '', '1', true, 'left');
+        $this->test('Unit: uploadPdf watermark left ok', $wmUp['success'] === true);
+        file_put_contents($base . 'bad.pdf', '%PDF not a real pdf document');
+        $badWm = ['tmp_name' => $base . 'bad.pdf', 'name' => 'bad.pdf', 'error' => UPLOAD_ERR_OK, 'size' => 26];
+        $this->test('Unit: uploadPdf watermark failure', $scanner->uploadPdf('100', $badWm, '1', 'dir', '1', '', '', '', '1', true, 'left')['success'] === false);
+        @chmod($base . '100/1', 0555);
+        $this->test('Unit: upload mkdir failure', $scanner->uploadPdf('100', $file, '1', 'xx', '1')['success'] === false);
+        @chmod($base . '100/1', 0755);
+        @chmod($base . '100/1/cor/1', 0555);
+        $this->test('Unit: uploadPdf watermark copy failure', $scanner->uploadPdf('100', $wmFile, '1', 'cor', '1', '', '', '', '1', true, 'left')['success'] === false);
+        @chmod($base . '100/1/cor/1', 0755);
+        @chmod($base . '100/1/flu/1', 0555);
+        $this->test('Unit: upload copy failure', $scanner->uploadPdf('100', $file, '1', 'flu', '1')['success'] === false);
+        @chmod($base . '100/1/flu/1', 0755);
+        @mkdir($base . '100/1/dir/1/direction_1.pdf', 0777, true);
+        $this->test('Unit: uploadPdf rename failure', $scanner->uploadPdf('100', $wmFile, '1', 'dir', '1', '', '', '', '1', true, 'left')['success'] === false);
+        @rmdir($base . '100/1/dir/1/direction_1.pdf');
+        $this->test('Unit: getScoreFiles unknown', $scanner->getScoreFiles('999')['success'] === false);
+        $this->test('Unit: getScoreFiles ok', $scanner->getScoreFiles('100')['success'] === true);
+
+        // deleteScoreFile branches
+        $this->test('Unit: deleteFile unknown score', $scanner->deleteScoreFile('999', 'a.pdf')['success'] === false);
+        $this->test('Unit: deleteFile traversal', $scanner->deleteScoreFile('100', '../../etc/passwd')['success'] === false);
+        $this->test('Unit: deleteFile non-pdf', $scanner->deleteScoreFile('100', 'score.ini')['success'] === false);
+        $this->test('Unit: deleteFile missing', $scanner->deleteScoreFile('100', '1/cla/1/none.pdf')['success'] === false);
+        $rel = '1/cla/1/' . basename($okUpload['path']);
+        $delFile = $scanner->deleteScoreFile('100', $rel);
+        $this->test('Unit: deleteFile ok', $delFile['success'] === true);
+        @symlink('/etc/hostname', $base . '100/evil.pdf');
+        $this->test('Unit: deleteFile escaped symlink', $scanner->deleteScoreFile('100', 'evil.pdf')['success'] === false);
+        $this->test('Unit: deleteFile null byte', $scanner->deleteScoreFile('100', "bad\0.pdf")['success'] === false);
+        @mkdir($base . '100/1/cla/1/subdir', 0777, true);
+        $this->test('Unit: deleteFile directory', $scanner->deleteScoreFile('100', '1/cla/1/subdir')['success'] === false);
+        @chmod($base . '100/1/flu/1', 0555);
+        $this->test('Unit: deleteFile unlink failure', $scanner->deleteScoreFile('100', '1/flu/1/flute_ut_clesol_1.pdf')['success'] === false);
+        @chmod($base . '100/1/flu/1', 0755);
+
+        // deleteScore + deleteDirectory
+        $this->test('Unit: deleteScore unknown', $scanner->deleteScore('999')['success'] === false);
+        $this->test('Unit: deleteScore ok', $scanner->deleteScore('100')['success'] === true);
+
+        // addWatermark multi-page (via reflection)
+        $multi = $base . 'wm_multi.pdf';
+        $this->makePdf($multi, 2);
+        $wm = $ref->getMethod('addWatermark');
+        $wm->setAccessible(true);
+        $this->test('Unit: addWatermark multi-page returns true', $wm->invoke($scanner, $multi, '102', 'right') === true);
+        $wmBad = $base . 'wm_bad.pdf';
+        file_put_contents($wmBad, 'not a pdf');
+        $this->test('Unit: addWatermark invalid returns false', $wm->invoke($scanner, $wmBad, '102', 'left') === false);
+
+        // Auth branches
+        $authOk = new Auth();
+        $login = $authOk->login('admin', 'password');
+        $this->test('Unit: auth login ok', !empty($login['token']));
+        $this->test('Unit: auth login wrong password', $authOk->login('admin', 'nope')['success'] === false);
+        $this->test('Unit: auth login unknown user', $authOk->login('ghost', 'x')['success'] === false);
+        $token = $login['token'];
+        $this->test('Unit: verifyToken ok', is_array($authOk->verifyToken($token)));
+        $this->test('Unit: verifyToken garbage', $authOk->verifyToken('a.b.c') === null);
+        $this->test('Unit: verifyToken wrong parts', $authOk->verifyToken('onlyone') === null);
+        $parts = explode('.', $token);
+        $this->test('Unit: verifyToken bad signature', $authOk->verifyToken($parts[0] . '.' . $parts[1] . '.AAAA') === null);
+        // alg=none header
+        $algNone = rtrim(strtr(base64_encode(json_encode(['alg' => 'none', 'typ' => 'JWT'])), '+/', '-_'), '=');
+        $this->test('Unit: verifyToken rejects alg none', $authOk->verifyToken($algNone . '.' . $parts[1] . '.' . $parts[2]) === null);
+        // missing exp / expired payload signed with the real secret
+        $secret = getenv('JWT_SECRET') ?: ($_ENV['JWT_SECRET'] ?? '');
+        $mk = function ($payload) use ($secret) {
+            $h = rtrim(strtr(base64_encode(json_encode(['alg' => 'HS256', 'typ' => 'JWT'])), '+/', '-_'), '=');
+            $p = rtrim(strtr(base64_encode(json_encode($payload)), '+/', '-_'), '=');
+            $s = rtrim(strtr(base64_encode(hash_hmac('sha256', "$h.$p", $secret, true)), '+/', '-_'), '=');
+            return "$h.$p.$s";
+        };
+        $this->test('Unit: verifyToken missing exp', $authOk->verifyToken($mk(['username' => 'a'])) === null);
+        $this->test('Unit: verifyToken expired', $authOk->verifyToken($mk(['username' => 'a', 'exp' => time() - 10])) === null);
+        $this->test('Unit: verifyToken non-array payload', $authOk->verifyToken($mk('scalar')) === null);
+        // missing users file
+        $authNoUsers = new Auth($base . 'no_such_users.json');
+        $this->test('Unit: auth missing users file', $authNoUsers->login('x', 'y')['success'] === false);
+        // missing secret
+        $savedSecret = getenv('JWT_SECRET');
+        putenv('JWT_SECRET=');
+        unset($_ENV['JWT_SECRET']);
+        try {
+            new Auth();
+            $this->test('Unit: auth throws without secret', false);
+        } catch (Throwable $e) {
+            $this->test('Unit: auth throws without secret', true);
+        }
+        if ($savedSecret !== false) {
+            putenv('JWT_SECRET=' . $savedSecret);
+            $_ENV['JWT_SECRET'] = $savedSecret;
+        }
+
+        $this->rrmdir($base);
+    }
+
+    public function testGeneralRateLimit() {
+        $this->section("Security - General Rate Limit");
+        array_map('unlink', glob(sys_get_temp_dir() . '/rate_*'));
+
+        $got429 = false;
+        for ($i = 0; $i < 520; $i++) {
+            $r = $this->request('GET', 'does/not/exist', null, false);
+            if ($r['code'] === 429) {
+                $got429 = true;
+                break;
+            }
+        }
+        $this->test('General rate limit returns 429', $got429);
+
+        array_map('unlink', glob(sys_get_temp_dir() . '/rate_*'));
+    }
+
     public function summary() {
         echo "\n=== Summary ===\n";
         echo "Passed: {$this->passed}\n";
@@ -680,5 +1095,10 @@ $tests->testFileUploadSecurity();
 $tests->testInjectionAttacks();
 $tests->testHttpsEnforcement();
 
+// Extended functional + unit coverage
+$tests->testMoreEndpoints();
+$tests->testGeneralRateLimit();
+$tests->testUnits();
+
 // Summary
 $tests->summary();
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index ed10adb..61899b9 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -35,8 +35,6 @@ cd $DEPLOY_DIR/partitions
 rm -rf build
 npm run build
 
-# Copy .mjs to .js for correct MIME type
-cp build/pdf.worker.min.mjs build/pdf.worker.min.js 2>/dev/null || echo "pdf.worker.min.mjs not found"
 cd ../..
 
 # 5. Copy built frontend as 'frontend' directory (not symlink, for zip compatibility)
@@ -50,7 +48,7 @@ cp partitions/nginx.conf $DEPLOY_DIR/frontend/nginx.conf 2>/dev/null || echo "ng
 # 7. Create zip (without tests.php and legacy)
 echo "[7/8] Creating zip..."
 cd $DEPLOY_DIR
-zip -r ../_builds/deploy_ohmj.zip api frontend -x "*.DS_Store" "node_modules/*" ".svelte-kit/*" "api/tests.php"
+zip -r ../_builds/deploy_ohmj.zip api frontend -x "*.DS_Store" "node_modules/*" ".svelte-kit/*" "api/tests.php" "api/coverage-prepend.php" "api/coverage-report.php"
 
 # 8. Cleanup
 echo "[8/8] Cleaning up..."
diff --git a/partitions/.env b/partitions/.env
deleted file mode 100644
index 5934e2e..0000000
--- a/partitions/.env
+++ /dev/null
@@ -1 +0,0 @@
-VITE_API_URL=http://localhost:8000
diff --git a/partitions/nginx.conf b/partitions/nginx.conf
index 610e802..0b21f3d 100644
--- a/partitions/nginx.conf
+++ b/partitions/nginx.conf
@@ -10,15 +10,15 @@ server {
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
 
-    # Cache static assets (including .mjs)
-    location ~* \.(js|mjs|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+    # PDF.js worker: serve the tracked .mjs with a JS MIME type
+    location = /pdf.worker.min.mjs {
+        default_type application/javascript;
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
 
-    # Force correct MIME type for .mjs files
-    location ~* \.mjs$ {
-        add_header Content-Type application/javascript;
+    # Cache static assets
+    location ~* \.(js|mjs|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
diff --git a/partitions/package-lock.json b/partitions/package-lock.json
index 7901075..fe9889c 100644
--- a/partitions/package-lock.json
+++ b/partitions/package-lock.json
@@ -9,7 +9,6 @@
       "version": "0.0.1",
       "dependencies": {
         "axios": "^1.6.0",
-        "lucide-svelte": "^0.574.0",
         "pdfjs-dist": "^4.0.379"
       },
       "devDependencies": {
@@ -19,6 +18,7 @@
         "autoprefixer": "^10.4.16",
         "postcss": "^8.4.32",
         "svelte": "^5.0.0",
+        "svelte-check": "^4.7.6",
         "tailwindcss": "^3.4.0",
         "typescript": "^5.0.0",
         "vite": "^5.0.0"
@@ -432,6 +432,7 @@
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
       "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.0",
@@ -442,6 +443,7 @@
       "version": "2.3.5",
       "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
       "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.5",
@@ -452,6 +454,7 @@
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
       "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6.0.0"
@@ -461,12 +464,14 @@
       "version": "1.5.5",
       "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
       "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
       "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
       "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/resolve-uri": "^3.1.0",
@@ -723,6 +728,26 @@
         "url": "https://github.com/sponsors/Brooooooklyn"
       }
     },
+    "node_modules/@napi-rs/lzma-linux-x64-gnu": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@napi-rs/lzma-linux-x64-gnu/-/lzma-linux-x64-gnu-1.5.1.tgz",
+      "integrity": "sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^22.20 || ^24.12 || >=25"
+      }
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -769,9 +794,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
-      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.63.3.tgz",
+      "integrity": "sha512-w3Jnvi1ocaVm/c7yVPpfB98XeSRBMyzp6njL5MVVbGyXjpmUkN+s6Hp4t0PqhGCCaI1ZHMKXt/w0lA1RCaLVcw==",
       "cpu": [
         "arm"
       ],
@@ -783,9 +808,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
-      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.63.3.tgz",
+      "integrity": "sha512-uI/ESiaIbbRYAEhzy8PCUWDp1hB0bjAqM06mW9flOoNO4Q8DQpeoREhBR5Hegfl+wpXiguyJv6XSPzEN7OxyHQ==",
       "cpu": [
         "arm64"
       ],
@@ -797,9 +822,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
-      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.63.3.tgz",
+      "integrity": "sha512-oxhrd1jmXLwWZ83eQYDXxuqRdkqkzrjR3JobKeuUyfdNZo11FuQIvqEOZhyIT7OBHxXoGslDDjN0cQcM6T0TqQ==",
       "cpu": [
         "arm64"
       ],
@@ -811,9 +836,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
-      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.63.3.tgz",
+      "integrity": "sha512-7/YiIMghVE8DrxKvNdorAaJVdriOFgOIpdStnPx8ppx5zfTwC3jBCSEAIzB7JD5404m65THl6H93UTTVUvypmg==",
       "cpu": [
         "x64"
       ],
@@ -825,9 +850,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
-      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.63.3.tgz",
+      "integrity": "sha512-GXFZRRoMAytaI5z6N3Zhfw0WL18Q0M8r95D5hlC4GqE/lGk8pbSJNUBoOWDfbm6dTciqHj2nU87tI5f6XhQiOg==",
       "cpu": [
         "arm64"
       ],
@@ -839,9 +864,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
-      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.63.3.tgz",
+      "integrity": "sha512-77W+8X3ddYgPxUpB8nZFQs2Mq+wc4HVlcSRtApXLjYBcnPMkttrSnU8VwKQjeWYhMsITHFs5cWBQ8vz1Q+5RHQ==",
       "cpu": [
         "x64"
       ],
@@ -853,13 +878,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
-      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.63.3.tgz",
+      "integrity": "sha512-FVkwK+iUC+mq+GipVK46rRVticfAPtvPUNlqlGXUDxdVk/UGjQiiiUVPUrEXdSpU2ufU0XxLGyTqDtBidDOVmg==",
       "cpu": [
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -867,13 +895,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
-      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.63.3.tgz",
+      "integrity": "sha512-+aGU1t3398yQOVj1Bz8o3e+KtswxAPvO+mtxtNdfXYMkXIHu7XhhkCD7/DEH9q8tF8uhDnMWvfpUKI8y1sZJsg==",
       "cpu": [
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -881,13 +912,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
-      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.63.3.tgz",
+      "integrity": "sha512-cR0kjpRXR2KJ2oQK8E2KTPtphs+b9hZ8IhTZubNryt/RsqgdOZBQ2Zq0q5UedtiIi0rs3jVhJh55RE1ZHUVGUA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -895,13 +929,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
-      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.63.3.tgz",
+      "integrity": "sha512-y1RYi4Q3/9ByVWSSt9kX2ustE0B7kFYbJ6zZdVZVyqopZs3yhCTwRfrjIX4vezUJInma/Gs6BOFDJg7yZmJ0IQ==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -909,13 +946,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
-      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.63.3.tgz",
+      "integrity": "sha512-DNhEA5viIj3Z5bZLE4z4oV8N5ozWqDwyt7T6KG7VdLDJ0nW+rNOYlphBl4/3HQkK75qipPLsVOfStHHOwN9WSg==",
       "cpu": [
         "loong64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -923,13 +963,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
-      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.63.3.tgz",
+      "integrity": "sha512-17gQCqrIpXBX2Cmi9/TygnVOqGbzsba/iaqcYSL8FY7lNugg+7AiYNs5c5nKWD+NRQha36Sa0CqkJqH4XVHwnQ==",
       "cpu": [
         "loong64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -937,13 +980,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
-      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.63.3.tgz",
+      "integrity": "sha512-6LwVnZRIyINpdku/yOcI8Tm9YqLmhHK5emmlOOnW9tO0SYEm1FmKPcsSAGp0NBlqR2P04xaND4jvN6sTHqhq8A==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -951,13 +997,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
-      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.63.3.tgz",
+      "integrity": "sha512-xMUqkTXlEUtI/p5AAukMwBRr1enU3efsTeF+bskeFfk8t1C9rcC8sLREcZXmTfAXEbvRdJVSonVJez3TMlbR3w==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -965,13 +1014,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.63.3.tgz",
+      "integrity": "sha512-S3E94co9F9WRRqEaUoQZ38K1gCz6KiM+nL7/3ijq7fDGF3OznjS5TasgYITlvl27GQKtu4lOAOsr5MFwkijvOA==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -979,13 +1031,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
-      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.63.3.tgz",
+      "integrity": "sha512-1QtRDwG42x5BJI3s9mxu5rEjDnfbSnk20HQ9/ylTAYnSwYwxMVb+Vgu34wzzTQ7ogqBybebgQNUDAvZVQ38DbA==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -993,13 +1048,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
-      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.63.3.tgz",
+      "integrity": "sha512-BQhejF6ZXOpxbngiNTP12GCGQeaDVL2QXGeBVViKIYzFHM5RKxTxwUMB1fr1BeNFphFMpnRqC5QSXFSa4z6UQw==",
       "cpu": [
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1007,13 +1065,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.63.3.tgz",
+      "integrity": "sha512-SXagRwnI2Wlwlitllu59UK/nGVbD1CKPcNqDplHwIC4BqJcpXFjD32d1R/RbuISa95HdQrZM3/7v4bKiowFaLA==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1021,13 +1082,16 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.57.1.tgz",
-      "integrity": "sha512-HFps0JeGtuOR2convgRRkHCekD7j+gdAuXM+/i6kGzQtFhlCtQkpwtNzkNj6QhCDp7DRJ7+qC/1Vg2jt5iSOFw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.63.3.tgz",
+      "integrity": "sha512-2IPozoEALRCziGqE8O9KMK60PMu5TS1huv4fwoeCexj+WjmcwFtX9CTOVbfXCUqcELAubEwRFPYlzb/WvwY2HQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1035,9 +1099,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
-      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.63.3.tgz",
+      "integrity": "sha512-AoxqosUHT9IX54hFn2TiN6A7d6ZKTtE6pd2bqWtqkkNJ6HJGaU6FRouGX8L1O7R/ZwsnCnpQrHzb4pDEx+UHRQ==",
       "cpu": [
         "x64"
       ],
@@ -1049,9 +1113,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
-      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.63.3.tgz",
+      "integrity": "sha512-d+CaftKgmkFBzCwezMqqy1d0QNNYugqLCMcYVQWBy5SS2YfeMP8Q8ripkgx9O8IyBXXLHrJ+aaCV4U96usv6Yg==",
       "cpu": [
         "arm64"
       ],
@@ -1063,9 +1127,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
-      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.63.3.tgz",
+      "integrity": "sha512-xXlDF6nR1eOuXbdDy5Hl5fmtY7teUDevF/k0O7IPoZe4Tpmdv+lgdE5JRsnhQtt37ql9P0VF2kAN9a0OCZdo+Q==",
       "cpu": [
         "arm64"
       ],
@@ -1077,9 +1141,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
-      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.63.3.tgz",
+      "integrity": "sha512-YtXAgLN+JP7Ay6qG3eWhc7IHMQPzLc8r3uvhAvlJIoCz/4Q32+Bl9Fmnywidh8v1GOIMmymjovfqY9ETAtysvA==",
       "cpu": [
         "ia32"
       ],
@@ -1091,9 +1155,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.63.3.tgz",
+      "integrity": "sha512-WuWtSJRNo549vzcfZyEgfqb6zeSgn1F+UE5kQ+BCjzz0W4MGCjntUHkZVc1VRuAM7+ULaSyhiPxD1spyewFvkQ==",
       "cpu": [
         "x64"
       ],
@@ -1105,9 +1169,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
-      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.63.3.tgz",
+      "integrity": "sha512-+lIKX7O0+IGe7WuhATaAMMeT7B76vfhXH/l9wLQL+nvyhbw2ohYCKIdWL56JfDu75CWt5oKRP4QFH/jkMtBquA==",
       "cpu": [
         "x64"
       ],
@@ -1126,9 +1190,10 @@
       "license": "MIT"
     },
     "node_modules/@sveltejs/acorn-typescript": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.9.tgz",
-      "integrity": "sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA==",
+      "version": "1.0.13",
+      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.13.tgz",
+      "integrity": "sha512-wgKggnhZVL9Bfx1OaKKTrYY9BFRk6C8UAkQNUcIv1+llzYrIqy+RZm5HPKzn0NpEBvTVhTqB4kQyllZywsRBRQ==",
+      "dev": true,
       "license": "MIT",
       "peerDependencies": {
         "acorn": "^8.9.0"
@@ -1145,24 +1210,22 @@
       }
     },
     "node_modules/@sveltejs/kit": {
-      "version": "2.52.0",
-      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.52.0.tgz",
-      "integrity": "sha512-zG+HmJuSF7eC0e7xt2htlOcEMAdEtlVdb7+gAr+ef08EhtwUsjLxcAwBgUCJY3/5p08OVOxVZti91WfXeuLvsg==",
+      "version": "2.70.3",
+      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.70.3.tgz",
+      "integrity": "sha512-UDvEYuZqAMbfB/oXIoqKvbKcb7YczK5zYrzmsGV1zRJk03jntwp8dXiYoIJotxAndsKvcPFtx9H1GRSKFdSHgg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
+        "@sveltejs/acorn-typescript": "^1.0.9",
         "@types/cookie": "^0.6.0",
-        "acorn": "^8.14.1",
+        "acorn": "^8.16.0",
         "cookie": "^0.6.0",
-        "devalue": "^5.6.2",
+        "devalue": "^5.8.1",
         "esm-env": "^1.2.2",
         "kleur": "^4.1.5",
         "magic-string": "^0.30.5",
         "mrmime": "^2.0.0",
-        "sade": "^1.8.1",
         "set-cookie-parser": "^3.0.0",
         "sirv": "^3.0.0"
       },
@@ -1174,10 +1237,10 @@
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.0.0",
-        "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0",
+        "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
         "svelte": "^4.0.0 || ^5.0.0-next.0",
-        "typescript": "^5.3.3",
-        "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0"
+        "typescript": "^5.3.3 || ^6.0.0",
+        "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "@opentelemetry/api": {
@@ -1188,13 +1251,22 @@
         }
       }
     },
+    "node_modules/@sveltejs/load-config": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.2.3.tgz",
+      "integrity": "sha512-VT3qmUb8pRV2QrZjd8iAmtg8lf4W0TIjZbvXtz5MKei/q96teWZgGJyyidJzOjzZzvdq616eSRVeMYIQChUTAQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 18.0.0"
+      }
+    },
     "node_modules/@sveltejs/vite-plugin-svelte": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-4.0.4.tgz",
       "integrity": "sha512-0ba1RQ/PHen5FGpdSrW7Y3fAMQjrXantECALeOiOdBdzR5+5vPP6HVZRLmZaQL+W8m++o+haIAKq5qT+MiZ7VA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@sveltejs/vite-plugin-svelte-inspector": "^3.0.0-next.0||^3.0.0",
         "debug": "^4.3.7",
@@ -1237,23 +1309,18 @@
       "license": "MIT"
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "license": "MIT"
-    },
-    "node_modules/@types/trusted-types": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/acorn": {
-      "version": "8.15.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1261,6 +1328,18 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
     "node_modules/any-promise": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
@@ -1290,9 +1369,10 @@
       "license": "MIT"
     },
     "node_modules/aria-query": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
-      "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
+      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
+      "dev": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
@@ -1342,33 +1422,38 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.13.5",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
-      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz",
+      "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.11",
-        "form-data": "^4.0.5",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/axobject-query": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
       "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+      "dev": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.19",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
-      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "version": "2.11.23",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz",
+      "integrity": "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/binary-extensions": {
@@ -1398,9 +1483,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.28.9",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz",
+      "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==",
       "dev": true,
       "funding": [
         {
@@ -1417,13 +1502,12 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.11.20",
+        "caniuse-lite": "^1.0.30001810",
+        "electron-to-chromium": "^1.5.420",
+        "node-releases": "^2.0.54",
+        "update-browserslist-db": "^1.3.2"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1456,9 +1540,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001770",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001770.tgz",
-      "integrity": "sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -1518,6 +1602,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
       "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -1572,7 +1657,6 @@
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -1606,9 +1690,10 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.2.tgz",
-      "integrity": "sha512-nPRkjWzzDQlsejL1WVifk5rvcFi/y1onBRxjaFMjZeR9mFpqu2gmAZ9xUB9/IEanEP/vBtGeGganC/GO1fmufg==",
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.2.tgz",
+      "integrity": "sha512-po4PAY5c53tw5XMocSnf8A/5OHhbbUftpr93aEN6BBoAdntUmK7vu7wOATqvt7cXO7m1Cl4gMVn6p7n6n4mj0w==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/didyoumean": {
@@ -1640,9 +1725,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.286",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.286.tgz",
-      "integrity": "sha512-9tfDXhJ4RKFNerfjdCcZfufu49vg620741MNs26a9+bhLThdB+plgMeou98CAaHu/WATj2iHOOHTp1hWtABj2A==",
+      "version": "1.5.427",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.427.tgz",
+      "integrity": "sha512-n14zb3FdsChZ2BNobqNHAJMcP3ifFv4paox2LvCrfVAQcqGiSURgbJl+PfMpHVCNFkStnNc+RRVtPBTVW5PDgw==",
       "dev": true,
       "license": "ISC"
     },
@@ -1665,9 +1750,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -1744,15 +1829,25 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
       "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/esrap": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
-      "integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
+      "version": "2.3.7",
+      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.3.7.tgz",
+      "integrity": "sha512-n2nf7fZR3c9yXf0BPEuHuXqT+KW0SJVj4cN5FMEkpCZ3scLjOQWpiccyCxVzCC2q1wubTghuEGzngJY/7Ah0Ow==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.4.15"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/types": "^8.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@typescript-eslint/types": {
+          "optional": true
+        }
       }
     },
     "node_modules/fast-glob": {
@@ -1809,9 +1904,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.11",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "funding": [
         {
           "type": "individual",
@@ -1829,16 +1924,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -1972,9 +2067,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -1983,6 +2078,19 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/is-binary-path": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
@@ -2049,6 +2157,7 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
       "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.6"
@@ -2060,7 +2169,6 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -2099,21 +2207,14 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
       "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
+      "dev": true,
       "license": "MIT"
     },
-    "node_modules/lucide-svelte": {
-      "version": "0.574.0",
-      "resolved": "https://registry.npmjs.org/lucide-svelte/-/lucide-svelte-0.574.0.tgz",
-      "integrity": "sha512-KhMbh4uFO8jm60bYPWHV5GmNy1P5hs1M6BfDYUjw0CZ5tJoJ+lMzAdTBBb9L+Gj3xOlHIgjsLMVnjQK3qcWrEA==",
-      "license": "ISC",
-      "peerDependencies": {
-        "svelte": "^3 || ^4 || ^5.0.0-next.42"
-      }
-    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
       "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.5"
@@ -2197,7 +2298,6 @@
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/mz": {
@@ -2213,9 +2313,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
       "dev": true,
       "funding": [
         {
@@ -2232,11 +2332,14 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "version": "2.0.55",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz",
+      "integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -2328,9 +2431,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.28",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
+      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
       "dev": true,
       "funding": [
         {
@@ -2347,9 +2450,8 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.18",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -2471,9 +2573,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2492,10 +2594,13 @@
       "license": "MIT"
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
@@ -2574,13 +2679,13 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
-      "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
+      "version": "4.63.3",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.63.3.tgz",
+      "integrity": "sha512-1i2XreiAoMMXuPGD6Msj2xWrMMkHojNRKivInxGQcg7/1KuPuYlfUutLyh4drnOxUTHX9cHI4wFoat8D/NKaBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.8"
+        "@types/estree": "1.0.9"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -2590,31 +2695,32 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.57.1",
-        "@rollup/rollup-android-arm64": "4.57.1",
-        "@rollup/rollup-darwin-arm64": "4.57.1",
-        "@rollup/rollup-darwin-x64": "4.57.1",
-        "@rollup/rollup-freebsd-arm64": "4.57.1",
-        "@rollup/rollup-freebsd-x64": "4.57.1",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
-        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
-        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
-        "@rollup/rollup-linux-arm64-musl": "4.57.1",
-        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
-        "@rollup/rollup-linux-loong64-musl": "4.57.1",
-        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
-        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
-        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
-        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
-        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-musl": "4.57.1",
-        "@rollup/rollup-openbsd-x64": "4.57.1",
-        "@rollup/rollup-openharmony-arm64": "4.57.1",
-        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
-        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
-        "@rollup/rollup-win32-x64-gnu": "4.57.1",
-        "@rollup/rollup-win32-x64-msvc": "4.57.1",
+        "@napi-rs/lzma-linux-x64-gnu": "1.5.1",
+        "@rollup/rollup-android-arm-eabi": "4.63.3",
+        "@rollup/rollup-android-arm64": "4.63.3",
+        "@rollup/rollup-darwin-arm64": "4.63.3",
+        "@rollup/rollup-darwin-x64": "4.63.3",
+        "@rollup/rollup-freebsd-arm64": "4.63.3",
+        "@rollup/rollup-freebsd-x64": "4.63.3",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.63.3",
+        "@rollup/rollup-linux-arm-musleabihf": "4.63.3",
+        "@rollup/rollup-linux-arm64-gnu": "4.63.3",
+        "@rollup/rollup-linux-arm64-musl": "4.63.3",
+        "@rollup/rollup-linux-loong64-gnu": "4.63.3",
+        "@rollup/rollup-linux-loong64-musl": "4.63.3",
+        "@rollup/rollup-linux-ppc64-gnu": "4.63.3",
+        "@rollup/rollup-linux-ppc64-musl": "4.63.3",
+        "@rollup/rollup-linux-riscv64-gnu": "4.63.3",
+        "@rollup/rollup-linux-riscv64-musl": "4.63.3",
+        "@rollup/rollup-linux-s390x-gnu": "4.63.3",
+        "@rollup/rollup-linux-x64-gnu": "4.63.3",
+        "@rollup/rollup-linux-x64-musl": "4.63.3",
+        "@rollup/rollup-openbsd-x64": "4.63.3",
+        "@rollup/rollup-openharmony-arm64": "4.63.3",
+        "@rollup/rollup-win32-arm64-msvc": "4.63.3",
+        "@rollup/rollup-win32-ia32-msvc": "4.63.3",
+        "@rollup/rollup-win32-x64-gnu": "4.63.3",
+        "@rollup/rollup-win32-x64-msvc": "4.63.3",
         "fsevents": "~2.3.2"
       }
     },
@@ -2724,24 +2830,23 @@
       }
     },
     "node_modules/svelte": {
-      "version": "5.51.2",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.51.2.tgz",
-      "integrity": "sha512-AqApqNOxVS97V4Ko9UHTHeSuDJrwauJhZpLDs1gYD8Jk48ntCSWD7NxKje+fnGn5Ja1O3u2FzQZHPdifQjXe3w==",
+      "version": "5.57.0",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.57.0.tgz",
+      "integrity": "sha512-NdbDn7fl4be1ViUG0oq/lvG6OZy3oENolV2ONjiqqsfVoeAfzaQAKUcEX3MrQod/Bebv1PgwET9rfXhgn9s4Kg==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jridgewell/remapping": "^2.3.4",
         "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
+        "@sveltejs/acorn-typescript": "^1.0.10",
         "@types/estree": "^1.0.5",
-        "@types/trusted-types": "^2.0.7",
         "acorn": "^8.12.1",
-        "aria-query": "^5.3.1",
+        "aria-query": "5.3.1",
         "axobject-query": "^4.1.0",
         "clsx": "^2.1.1",
-        "devalue": "^5.6.2",
+        "devalue": "^5.8.1",
         "esm-env": "^1.2.1",
-        "esrap": "^2.2.2",
+        "esrap": "^2.2.12",
         "is-reference": "^3.0.3",
         "locate-character": "^3.0.0",
         "magic-string": "^0.30.11",
@@ -2751,6 +2856,79 @@
         "node": ">=18"
       }
     },
+    "node_modules/svelte-check": {
+      "version": "4.7.6",
+      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.7.6.tgz",
+      "integrity": "sha512-t2scM//ZuVbSY/T2w6FSBw1v9s2NEmh/g+sy1lqtosW5ylBV5AF4wFb1Ts9Kf3MbfPDUDJDZ9L436YT0SPTdvw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "@sveltejs/load-config": "^0.2.3",
+        "chokidar": "^4.0.1",
+        "fdir": "^6.2.0",
+        "picocolors": "^1.0.0",
+        "sade": "^1.7.4"
+      },
+      "bin": {
+        "svelte-check": "bin/svelte-check"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "peerDependencies": {
+        "svelte": "^4.0.0 || ^5.0.0-next.0",
+        "typescript": "^5.0.0 || ^6.0.0"
+      }
+    },
+    "node_modules/svelte-check/node_modules/chokidar": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
+      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "readdirp": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 14.16.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/svelte-check/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/svelte-check/node_modules/readdirp": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.18.0"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/tailwindcss": {
       "version": "3.4.19",
       "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.19.tgz",
@@ -2848,12 +3026,11 @@
       }
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2897,7 +3074,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -2907,9 +3083,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz",
+      "integrity": "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==",
       "dev": true,
       "funding": [
         {
@@ -2950,7 +3126,6 @@
       "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.21.3",
         "postcss": "^8.4.43",
@@ -3029,6 +3204,7 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
       "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
+      "dev": true,
       "license": "MIT"
     }
   }
diff --git a/partitions/package.json b/partitions/package.json
index a05f928..d8f26a4 100644
--- a/partitions/package.json
+++ b/partitions/package.json
@@ -5,7 +5,9 @@
   "scripts": {
     "dev": "vite dev",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "check": "svelte-check --tsconfig ./tsconfig.json",
+    "test:e2e": "node tests/e2e-smoke.mjs"
   },
   "devDependencies": {
     "@sveltejs/adapter-static": "^3.0.0",
@@ -14,13 +16,16 @@
     "autoprefixer": "^10.4.16",
     "postcss": "^8.4.32",
     "svelte": "^5.0.0",
+    "svelte-check": "^4.7.6",
     "tailwindcss": "^3.4.0",
     "typescript": "^5.0.0",
     "vite": "^5.0.0"
   },
   "dependencies": {
     "axios": "^1.6.0",
-    "lucide-svelte": "^0.574.0",
     "pdfjs-dist": "^4.0.379"
+  },
+  "allowScripts": {
+    "esbuild@0.21.5": true
   }
 }
diff --git a/partitions/src/lib/api.ts b/partitions/src/lib/api.ts
index 6553133..9297f57 100644
--- a/partitions/src/lib/api.ts
+++ b/partitions/src/lib/api.ts
@@ -6,7 +6,12 @@ import { get } from 'svelte/store';
 const API_BASE_URL_LOCAL = 'http://localhost:8000';
 const API_BASE_URL_PROD = 'https://ohmj-api.c.nadal-fr.com';
 
-const API_BASE_URL = import.meta.env.DEV ? API_BASE_URL_LOCAL : API_BASE_URL_PROD;
+const API_BASE_URL =
+	import.meta.env.VITE_API_URL || (import.meta.env.DEV ? API_BASE_URL_LOCAL : API_BASE_URL_PROD);
+
+function encodePath(path: string): string {
+	return path.split('/').map(encodeURIComponent).join('/');
+}
 
 const api = axios.create({
 	baseURL: API_BASE_URL,
@@ -30,9 +35,13 @@ api.interceptors.response.use(
 	(error: AxiosError) => {
 		// Only logout on actual 401 from the server, not network/CORS errors
 		if (error.response?.status === 401 && !error.message?.includes('Network Error')) {
-			auth.logout();
-			if (browser) {
-				window.location.href = '/';
+			const url = error.config?.url || '';
+			console.error('[API 401]', url, error.response?.data);
+			if (!url.includes('/login')) {
+				auth.logout();
+				if (browser) {
+					window.location.href = '/';
+				}
 			}
 		}
 		return Promise.reject(error);
@@ -104,26 +113,15 @@ export const apiService = {
 	},
 
 	async downloadPdf(path: string): Promise<Blob> {
-		const response = await api.get(`/download/${path}`, {
+		const response = await api.get(`/download/${encodePath(path)}`, {
 			responseType: 'blob'
 		});
 		return response.data;
 	},
 
 	getDownloadUrl(path: string): string {
-		// Pass token in URL for direct browser access (PDF viewer, iframe, etc.)
-		// Safe over HTTPS
-		const authState = get(auth);
-		const token = authState.token ? encodeURIComponent(authState.token) : '';
-		return `${API_BASE_URL}/download/${path}?token=${token}`;
-	},
-
-	// New method to download with proper auth header
-	async downloadFileWithAuth(path: string): Promise<Blob> {
-		const response = await api.get(`/download/${path}`, {
-			responseType: 'blob'
-		});
-		return response.data;
+		// Full URL used by the PDF viewer; auth is sent via the axios interceptor
+		return `${API_BASE_URL}/download/${encodePath(path)}`;
 	},
 
 	async createScore(name: string, compositor: string, pieces: { number: number; name: string }[] = []): Promise<{ success: boolean; score?: any; error?: string }> {
diff --git a/partitions/src/lib/components/ConfirmDialog.svelte b/partitions/src/lib/components/ConfirmDialog.svelte
new file mode 100644
index 0000000..93cc5cd
--- /dev/null
+++ b/partitions/src/lib/components/ConfirmDialog.svelte
@@ -0,0 +1,75 @@
+<script lang="ts">
+	interface Props {
+		open: boolean;
+		title: string;
+		message?: string;
+		detail?: string;
+		confirmLabel?: string;
+		busy?: boolean;
+		onconfirm: () => void;
+		oncancel: () => void;
+	}
+
+	let {
+		open,
+		title,
+		message = '',
+		detail = '',
+		confirmLabel = 'Supprimer',
+		busy = false,
+		onconfirm,
+		oncancel
+	}: Props = $props();
+
+	$effect(() => {
+		if (!open) return;
+		const onKey = (e: KeyboardEvent) => {
+			if (e.key === 'Escape') oncancel();
+		};
+		window.addEventListener('keydown', onKey);
+		return () => window.removeEventListener('keydown', onKey);
+	});
+</script>
+
+{#if open}
+	<div class="fixed inset-0 z-50 flex items-center justify-center">
+		<button
+			type="button"
+			class="absolute inset-0 w-full h-full bg-black bg-opacity-50 cursor-default"
+			aria-label="Fermer"
+			onclick={oncancel}
+		></button>
+		<div
+			class="relative bg-white rounded-lg shadow-xl p-6 max-w-md w-full mx-4"
+			role="dialog"
+			aria-modal="true"
+			aria-labelledby="confirm-dialog-title"
+		>
+			<h3 id="confirm-dialog-title" class="text-lg font-semibold text-gray-900 mb-2">{title}</h3>
+			{#if message}
+				<p class="text-gray-600 mb-6">{message}</p>
+			{/if}
+			{#if detail}
+				<p class="text-sm text-gray-500 mb-6 font-mono bg-gray-100 p-2 rounded">{detail}</p>
+			{/if}
+			<div class="flex gap-3 justify-end">
+				<button
+					type="button"
+					onclick={oncancel}
+					disabled={busy}
+					class="px-4 py-2 text-gray-700 hover:bg-gray-100 rounded transition-colors disabled:opacity-50"
+				>
+					Annuler
+				</button>
+				<button
+					type="button"
+					onclick={onconfirm}
+					disabled={busy}
+					class="px-4 py-2 bg-red-600 text-white hover:bg-red-700 rounded transition-colors disabled:opacity-50"
+				>
+					{busy ? 'Suppression...' : confirmLabel}
+				</button>
+			</div>
+		</div>
+	</div>
+{/if}
diff --git a/partitions/src/lib/components/PdfViewer.svelte b/partitions/src/lib/components/PdfViewer.svelte
index 8be0b05..121b3c4 100644
--- a/partitions/src/lib/components/PdfViewer.svelte
+++ b/partitions/src/lib/components/PdfViewer.svelte
@@ -1,27 +1,20 @@
 <script lang="ts">
-	import { onMount, onDestroy } from 'svelte';
+	import { onMount, onDestroy, tick } from 'svelte';
 	import * as pdfjsLib from 'pdfjs-dist';
 	import { api } from '$lib/api';
 
-	pdfjsLib.GlobalWorkerOptions.workerSrc = '/pdf.worker.min.js';
+	pdfjsLib.GlobalWorkerOptions.workerSrc = '/pdf.worker.min.mjs';
 
 	interface Props {
 		pdfUrl: string;
 		title?: string;
-		key?: string;
 	}
 
-	let { pdfUrl, title = 'Partition', key = '' }: Props = $props();
+	let { pdfUrl, title = 'Partition' }: Props = $props();
 
-	// Force re-render when key changes
-	$effect(() => {
-		if (key) {
-			loadPdf();
-		}
-	});
-
-	let canvas: HTMLCanvasElement;
+	let canvas = $state<HTMLCanvasElement>();
 	let pdfDoc: pdfjsLib.PDFDocumentProxy | null = null;
+	let objectUrl: string | null = null;
 	let currentPage = $state(1);
 	let totalPages = $state(0);
 	let scale = $state(1.2);
@@ -33,29 +26,41 @@
 	async function loadPdf() {
 		loading = true;
 		error = '';
+
+		// Clean up any previous document / object URL
+		if (pdfDoc) {
+			pdfDoc.destroy();
+			pdfDoc = null;
+		}
+		if (objectUrl) {
+			URL.revokeObjectURL(objectUrl);
+			objectUrl = null;
+		}
+
 		try {
-			// pdfUrl already contains the full URL with token
-			// Use it directly with axios
 			const response = await api.get(pdfUrl, {
 				responseType: 'blob'
 			});
 			const blob = new Blob([response.data], { type: 'application/pdf' });
-			const url = URL.createObjectURL(blob);
-			
-			const loadingTask = pdfjsLib.getDocument(url);
-			pdfDoc = await loadingTask.promise;
+			objectUrl = URL.createObjectURL(blob);
+
+			pdfDoc = await pdfjsLib.getDocument(objectUrl).promise;
 			totalPages = pdfDoc.numPages;
+			currentPage = 1;
+
+			// The canvas only exists once `loading` is false: render after mount
+			loading = false;
+			await tick();
 			await renderPage(currentPage);
 		} catch (err) {
 			console.error('Error loading PDF:', err);
 			error = 'Erreur lors du chargement du PDF';
-		} finally {
 			loading = false;
 		}
 	}
 
 	async function renderPage(pageNum: number) {
-		if (!pdfDoc || rendering) return;
+		if (!pdfDoc || !canvas || rendering) return;
 		rendering = true;
 
 		try {
@@ -118,7 +123,6 @@
 	}
 
 	onMount(() => {
-		loadPdf();
 		window.addEventListener('keydown', handleKeydown);
 	});
 
@@ -127,6 +131,9 @@
 		if (pdfDoc) {
 			pdfDoc.destroy();
 		}
+		if (objectUrl) {
+			URL.revokeObjectURL(objectUrl);
+		}
 	});
 
 	$effect(() => {
diff --git a/partitions/src/lib/instruments.ts b/partitions/src/lib/instruments.ts
new file mode 100644
index 0000000..0ee34bd
--- /dev/null
+++ b/partitions/src/lib/instruments.ts
@@ -0,0 +1,56 @@
+export interface InstrumentInfo {
+	code: string;
+	name: string;
+	icon: string;
+	defaultKey: string;
+}
+
+export const INSTRUMENTS: InstrumentInfo[] = [
+	{ code: 'dir', name: 'Direction', icon: '🎼', defaultKey: '' },
+	{ code: 'pic', name: 'Piccolo', icon: '/icons/piccolo.png', defaultKey: 'do' },
+	{ code: 'flu', name: 'Flûte', icon: '/icons/flute.png', defaultKey: 'do' },
+	{ code: 'cla', name: 'Clarinette', icon: '/icons/clarinette.png', defaultKey: 'sib' },
+	{ code: 'clb', name: 'Clarinette Basse', icon: '/icons/clarinette_basse.png', defaultKey: 'sib' },
+	{ code: 'sax', name: 'Sax Alto', icon: '/icons/sax-alto.png', defaultKey: 'mib' },
+	{ code: 'sat', name: 'Sax Ténor', icon: '/icons/sax-tenor.png', defaultKey: 'sib' },
+	{ code: 'sab', name: 'Sax Baryton', icon: '/icons/sax-barython.png', defaultKey: 'mib' },
+	{ code: 'coa', name: 'Cor Anglais', icon: '/icons/cor-anglais.jpg', defaultKey: 'fa' },
+	{ code: 'cba', name: 'Contrebasse', icon: '/icons/contrebasse.png', defaultKey: 'sib' },
+	{ code: 'cor', name: 'Cor', icon: '/icons/cor.png', defaultKey: 'fa' },
+	{ code: 'trp', name: 'Trompette', icon: '/icons/trumpet.png', defaultKey: 'sib' },
+	{ code: 'crn', name: 'Cornet', icon: '/icons/cornet.png', defaultKey: 'sib' },
+	{ code: 'trb', name: 'Trombone', icon: '/icons/tronbonne.png', defaultKey: 'do' },
+	{ code: 'eup', name: 'Euphonium', icon: '/icons/euphonium.png', defaultKey: 'sib' },
+	{ code: 'tub', name: 'Tuba', icon: '/icons/tuba.png', defaultKey: 'do' },
+	{ code: 'htb', name: 'Hautbois', icon: '/icons/hautbois.png', defaultKey: 'do' },
+	{ code: 'bas', name: 'Basson', icon: '/icons/basson.png', defaultKey: 'do' },
+	{ code: 'per', name: 'Percussions', icon: '/icons/percussion.png', defaultKey: '' },
+	{ code: 'pia', name: 'Piano', icon: '🎹', defaultKey: '' },
+	{ code: 'har', name: 'Harpe', icon: '/icons/harpe.png', defaultKey: '' },
+	{ code: 'sup', name: 'Parties supplémentaires', icon: '📄', defaultKey: '' },
+	{ code: 'par', name: 'Parties', icon: '📄', defaultKey: '' }
+];
+
+export const INSTRUMENT_NAMES: Record<string, string> = Object.fromEntries(
+	INSTRUMENTS.map((i) => [i.code, i.name])
+);
+
+export const INSTRUMENT_ICONS: Record<string, string> = Object.fromEntries(
+	INSTRUMENTS.map((i) => [i.code, i.icon])
+);
+
+export function getInstrumentName(code: string): string {
+	return INSTRUMENT_NAMES[code] ?? code;
+}
+
+export function getInstrumentIcon(code: string): string {
+	return INSTRUMENT_ICONS[code] ?? '🎵';
+}
+
+export function getInstrument(code: string): InstrumentInfo | undefined {
+	return INSTRUMENTS.find((i) => i.code === code);
+}
+
+export function getDefaultKey(code: string): string {
+	return getInstrument(code)?.defaultKey ?? '';
+}
diff --git a/partitions/src/lib/stores/auth.ts b/partitions/src/lib/stores/auth.ts
index b7bb533..1c71220 100644
--- a/partitions/src/lib/stores/auth.ts
+++ b/partitions/src/lib/stores/auth.ts
@@ -40,7 +40,7 @@ function createAuthStore() {
 		}
 	}
 
-	const { subscribe, set, update } = writable<AuthState>(initial);
+	const { subscribe, set } = writable<AuthState>(initial);
 
 	return {
 		subscribe,
@@ -56,11 +56,6 @@ function createAuthStore() {
 			if (browser) {
 				localStorage.removeItem('auth');
 			}
-		},
-		getToken: () => {
-			let token: string | null = null;
-			update((s) => (token = s.token));
-			return token;
 		}
 	};
 }
diff --git a/partitions/src/routes/+layout.svelte b/partitions/src/routes/+layout.svelte
index e8bf1e4..99df375 100644
--- a/partitions/src/routes/+layout.svelte
+++ b/partitions/src/routes/+layout.svelte
@@ -2,40 +2,21 @@
 	import '../app.css';
 	import { auth } from '$lib/stores/auth';
 	import { goto } from '$app/navigation';
-	import { page } from '$app/stores';
-	import { onMount } from 'svelte';
-	import { get } from 'svelte/store';
+	import { page } from '$app/state';
+
+	let { children } = $props();
 
 	const publicRoutes = ['/'];
 
-	let isAuthenticated = false;
-	let currentPath = '/';
-	let userRole = '';
+	let isAuthenticated = $derived(!!$auth.token);
+	let userRole = $derived($auth.user?.role || '');
+	let currentPath = $derived(page.url.pathname);
 
-	auth.subscribe((state) => {
-		isAuthenticated = !!state.token;
-		userRole = state.user?.role || '';
-	});
-
-	page.subscribe(($page) => {
-		currentPath = $page.url.pathname;
-	});
-
-	onMount(() => {
-		const unsubscribe = page.subscribe(($page) => {
-			const path = $page.url.pathname;
-			const isPublic = publicRoutes.includes(path);
-			
-			// Get current auth state directly
-			const authState = get(auth);
-			const authenticated = !!authState.token;
-			
-			if (!isPublic && !authenticated) {
-				goto('/');
-			}
-		});
-
-		return unsubscribe;
+	$effect(() => {
+		const isPublic = publicRoutes.includes(currentPath);
+		if (!isPublic && !isAuthenticated) {
+			goto('/');
+		}
 	});
 
 	function logout() {
@@ -72,7 +53,7 @@
 	{/if}
 
 	<main class="flex-1">
-		<slot />
+		{@render children()}
 	</main>
 
 	{#if isAuthenticated && currentPath !== '/'}
diff --git a/partitions/src/routes/admin/+page.svelte b/partitions/src/routes/admin/+page.svelte
index 0519294..c5ed665 100644
--- a/partitions/src/routes/admin/+page.svelte
+++ b/partitions/src/routes/admin/+page.svelte
@@ -3,119 +3,34 @@
 	import { apiService, type Score } from '$lib/api';
 	import { auth } from '$lib/stores/auth';
 	import { goto } from '$app/navigation';
-
-	const INSTRUMENTS = [
-		{ code: 'dir', name: 'Direction', defaultKey: '' },
-		{ code: 'pic', name: 'Piccolo', defaultKey: 'do' },
-		{ code: 'flu', name: 'Flûte', defaultKey: 'do' },
-		{ code: 'cla', name: 'Clarinette', defaultKey: 'sib' },
-		{ code: 'clb', name: 'Clarinette Basse', defaultKey: 'sib' },
-		{ code: 'sax', name: 'Saxophone Alto', defaultKey: 'mib' },
-		{ code: 'sat', name: 'Saxophone Ténor', defaultKey: 'sib' },
-		{ code: 'sab', name: 'Saxophone Baryton', defaultKey: 'mib' },
-		{ code: 'coa', name: 'Cor Anglais', defaultKey: 'fa' },
-		{ code: 'htb', name: 'Hautbois', defaultKey: 'do' },
-		{ code: 'bas', name: 'Basson', defaultKey: 'do' },
-		{ code: 'cor', name: 'Cor', defaultKey: 'fa' },
-		{ code: 'trp', name: 'Trompette', defaultKey: 'sib' },
-		{ code: 'crn', name: 'Cornet', defaultKey: 'sib' },
-		{ code: 'trb', name: 'Trombone', defaultKey: 'do' },
-		{ code: 'eup', name: 'Euphonium', defaultKey: 'sib' },
-		{ code: 'tub', name: 'Tuba', defaultKey: 'do' },
-		{ code: 'cba', name: 'Contrebasse', defaultKey: 'sib' },
-		{ code: 'per', name: 'Percussions', defaultKey: '' },
-		{ code: 'pia', name: 'Piano', defaultKey: '' },
-		{ code: 'har', name: 'Harpe', defaultKey: '' }
-	];
+	import ConfirmDialog from '$lib/components/ConfirmDialog.svelte';
 
 	let scores: Score[] = $state([]);
 	let loading = $state(true);
 	let error = $state('');
-	let userRole = $state('');
+	let userRole = $derived($auth.user?.role || '');
 	let isAdmin = $derived(userRole === 'admin');
 
 	// Form for new score
 	let showForm = $state(false);
 	let newName = $state('');
 	let newCompositor = $state('');
-	let newRessource = $state('');
 	let newPieceCount = $state(1);
 	let newPieceNames = $state<string[]>(['']);
 	let saving = $state(false);
-
-	 // Upload form
-	let uploadScoreId = $state('');
-	let uploadPiece = $state('1');
-	let uploadInstrument = $state('');
-	let uploadVersion = $state('1');
-	let uploadFile: File | null = $state(null);
-	let uploading = $state(false);
-	let uploadError = $state('');
-	let uploadSuccess = $state('');
-	let selectedScorePieceCount = $state(1);
-	let selectedScorePieces = $state<{id: string; name: string}[]>([]);
-	let showAdvanced = $state(false);
 	let deleteConfirmId = $state<string | null>(null);
-	let uploadKey = $state('');
-	let uploadClef = $state('');
-	let uploadVariant = $state('');
-	let uploadPart = $state('1');
-	let uploadWatermark = $state(false);
 
 	function handlePieceCountChange(count: number) {
 		newPieceCount = count;
 		newPieceNames = Array(count).fill('').map((_, i) => newPieceNames[i] || '');
 	}
 
-	// When score is selected, get piece count
-	async function handleScoreSelect(e: Event) {
-		const target = e.target as HTMLSelectElement;
-		uploadScoreId = target.value;
-		if (uploadScoreId) {
-			try {
-				const pieces = await apiService.getPieces(uploadScoreId);
-				selectedScorePieceCount = pieces.length;
-				selectedScorePieces = pieces.map((p: any) => ({
-					id: String(p.id),
-					name: p.name || `Partie ${p.id}`
-				}));
-				if (selectedScorePieceCount === 1) {
-					uploadPiece = '1';
-				}
-			} catch (err) {
-				console.error(err);
-				selectedScorePieceCount = 1;
-				selectedScorePieces = [];
-			}
-		}
-	}
-
-	function getExpectedFilename(): string {
-		if (!uploadInstrument) return '';
-		const inst = INSTRUMENTS.find(i => i.code === uploadInstrument);
-		const instName = inst ? inst.name.toLowerCase().replace(/ /g, '_') : uploadInstrument;
-		const key = uploadKey || inst?.defaultKey || '';
-		const keyStr = key ? `_${key}` : '';
-		const clef = uploadClef ? `_${uploadClef}` : '';
-		const variant = uploadVariant ? `_${uploadVariant}` : '';
-		return `${instName}${variant}${keyStr}${clef}_${uploadPart}.pdf`;
-	}
-
-	let expectedFilename = $derived(getExpectedFilename());
-
 	onMount(async () => {
-		await new Promise(resolve => setTimeout(resolve, 100));
-		
-		const unsubscribe = auth.subscribe((state) => {
-			userRole = state.user?.role || '';
-		});
-		
 		if (userRole !== 'admin') {
-			unsubscribe();
 			goto('/scores');
 			return;
 		}
-		
+
 		await loadScores();
 	});
 
@@ -146,7 +61,6 @@
 				showForm = false;
 				newName = '';
 				newCompositor = '';
-				newRessource = '';
 				newPieceCount = 1;
 				newPieceNames = [''];
 				await loadScores();
@@ -174,48 +88,6 @@
 			console.error(err);
 		}
 	}
-
-	function handleFileSelect(e: Event) {
-		const target = e.target as HTMLInputElement;
-		if (target.files && target.files[0]) {
-			uploadFile = target.files[0];
-		}
-	}
-
-	async function uploadPdf() {
-		if (!uploadFile || !uploadInstrument || !uploadScoreId) {
-			uploadError = 'Veuillez remplir tous les champs';
-			return;
-		}
-		uploading = true;
-		uploadError = '';
-		uploadSuccess = '';
-		try {
-			const result = await apiService.uploadPdf(
-				uploadScoreId,
-				uploadFile,
-				uploadPiece,
-				uploadInstrument,
-				uploadVersion,
-				uploadKey,
-				uploadClef,
-				uploadVariant,
-				uploadPart,
-				uploadWatermark
-			);
-			if (result.success) {
-				uploadSuccess = 'Fichier uploadé avec succès!';
-				uploadFile = null;
-			} else {
-				uploadError = result.error || 'Erreur';
-			}
-		} catch (err) {
-			uploadError = 'Erreur lors de l\'upload';
-			console.error(err);
-		} finally {
-			uploading = false;
-		}
-	}
 </script>
 
 <svelte:head>
@@ -263,8 +135,9 @@
 				<div class="mt-4 p-4 bg-gray-50 rounded-lg">
 					<form onsubmit={(e) => { e.preventDefault(); createScore(); }} class="space-y-4">
 						<div>
-							<label class="block text-sm font-medium text-gray-700">Nom</label>
+							<label for="new-name" class="block text-sm font-medium text-gray-700">Nom</label>
 							<input
+								id="new-name"
 								type="text"
 								bind:value={newName}
 								required
@@ -273,8 +146,9 @@
 							/>
 						</div>
 						<div>
-							<label class="block text-sm font-medium text-gray-700">Compositeur</label>
+							<label for="new-compositor" class="block text-sm font-medium text-gray-700">Compositeur</label>
 							<input
+								id="new-compositor"
 								type="text"
 								bind:value={newCompositor}
 								class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-ohmj-primary focus:border-ohmj-primary"
@@ -282,8 +156,9 @@
 							/>
 						</div>
 						<div>
-							<label class="block text-sm font-medium text-gray-700">Nombre de parties</label>
+							<label for="new-piece-count" class="block text-sm font-medium text-gray-700">Nombre de parties</label>
 							<select
+								id="new-piece-count"
 								value={newPieceCount}
 								onchange={(e) => handlePieceCountChange(parseInt((e.target as HTMLSelectElement).value))}
 								class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white"
@@ -294,17 +169,18 @@
 							</select>
 						</div>
 						{#if newPieceCount > 1}
-						<div class="space-y-2">
-							<label class="block text-sm font-medium text-gray-700">Nom des parties</label>
+						<fieldset class="space-y-2">
+							<legend class="block text-sm font-medium text-gray-700">Nom des parties</legend>
 							{#each newPieceNames as pieceName, i}
 								<input
 									type="text"
 									bind:value={newPieceNames[i]}
+									aria-label="Nom de la partie {i + 1}"
 									class="block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-ohmj-primary focus:border-ohmj-primary"
 									placeholder="Partie {i + 1}"
 								/>
 							{/each}
-						</div>
+						</fieldset>
 						{/if}
 						<button
 							type="submit"
@@ -320,12 +196,12 @@
 
 		<!-- List of scores -->
 		<div class="bg-white rounded-lg shadow overflow-x-auto">
-			<table class="w-full min-w-[700px]">
+			<table class="w-full">
 				<thead class="bg-gray-50">
 					<tr>
 						<th class="px-3 py-3 text-left text-xs font-medium text-gray-500 uppercase whitespace-nowrap w-16">ID</th>
-						<th class="px-3 py-3 text-left text-xs font-medium text-gray-500 uppercase whitespace-nowrap">Nom</th>
-						<th class="px-3 py-3 text-left text-xs font-medium text-gray-500 uppercase whitespace-nowrap">Compositeur</th>
+						<th class="px-3 py-3 text-left text-xs font-medium text-gray-500 uppercase">Nom</th>
+						<th class="px-3 py-3 text-left text-xs font-medium text-gray-500 uppercase">Compositeur</th>
 						<th class="px-3 py-3 text-right text-xs font-medium text-gray-500 uppercase whitespace-nowrap w-24">Actions</th>
 					</tr>
 				</thead>
@@ -333,8 +209,8 @@
 					{#each scores as score}
 						<tr class="hover:bg-gray-50">
 							<td class="px-3 py-4 whitespace-nowrap text-sm font-medium text-gray-900">{score.id}</td>
-							<td class="px-3 py-4 whitespace-nowrap text-sm text-gray-700">{score.name}</td>
-							<td class="px-3 py-4 whitespace-nowrap text-sm text-gray-500">{score.compositor || '-'}</td>
+							<td class="px-3 py-4 text-sm text-gray-700">{score.name}</td>
+							<td class="px-3 py-4 text-sm text-gray-500">{score.compositor || '-'}</td>
 							<td class="px-3 py-4 whitespace-nowrap text-right text-sm">
 								<div class="flex justify-end gap-3">
 									<a
@@ -361,32 +237,15 @@
 		</div>
 	{/if}
 
-	{#if deleteConfirmId}
-		<div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50" onclick={() => deleteConfirmId = null}>
-			<div class="bg-white rounded-lg shadow-xl p-6 max-w-md w-full mx-4" onclick={(e) => e.stopPropagation()}>
-				<h3 class="text-lg font-semibold text-gray-900 mb-2">Confirmer la suppression</h3>
-				<p class="text-gray-600 mb-6">
-					Êtes-vous sûr de vouloir supprimer cette partition ? Cette action est irréversible et supprimera également tous les fichiers associés.
-				</p>
-				<div class="flex gap-3 justify-end">
-					<button
-						onclick={() => deleteConfirmId = null}
-						class="px-4 py-2 text-gray-700 hover:bg-gray-100 rounded transition-colors"
-					>
-						Annuler
-					</button>
-					<button
-						onclick={async () => {
-							const id = deleteConfirmId;
-							deleteConfirmId = null;
-							if (id) await deleteScore(id);
-						}}
-						class="px-4 py-2 bg-red-600 text-white hover:bg-red-700 rounded transition-colors"
-					>
-						Supprimer
-					</button>
-				</div>
-			</div>
-		</div>
-	{/if}
+	<ConfirmDialog
+		open={!!deleteConfirmId}
+		title="Confirmer la suppression"
+		message="Êtes-vous sûr de vouloir supprimer cette partition ? Cette action est irréversible et supprimera également tous les fichiers associés."
+		onconfirm={async () => {
+			const id = deleteConfirmId;
+			deleteConfirmId = null;
+			if (id) await deleteScore(id);
+		}}
+		oncancel={() => (deleteConfirmId = null)}
+	/>
 </div>
diff --git a/partitions/src/routes/admin/[id]/+page.svelte b/partitions/src/routes/admin/[id]/+page.svelte
index 5774462..2e9bd95 100644
--- a/partitions/src/routes/admin/[id]/+page.svelte
+++ b/partitions/src/routes/admin/[id]/+page.svelte
@@ -3,42 +3,23 @@
 	import { apiService } from '$lib/api';
 	import { auth } from '$lib/stores/auth';
 	import { goto } from '$app/navigation';
-	import { page } from '$app/stores';
+	import { page } from '$app/state';
+	import { INSTRUMENTS, getInstrument } from '$lib/instruments';
+	import ConfirmDialog from '$lib/components/ConfirmDialog.svelte';
 
-	const INSTRUMENTS = [
-		{ code: 'dir', name: 'Direction', defaultKey: '' },
-		{ code: 'pic', name: 'Piccolo', defaultKey: 'do' },
-		{ code: 'flu', name: 'Flûte', defaultKey: 'do' },
-		{ code: 'cla', name: 'Clarinette', defaultKey: 'sib' },
-		{ code: 'clb', name: 'Clarinette Basse', defaultKey: 'sib' },
-		{ code: 'sax', name: 'Saxophone Alto', defaultKey: 'mib' },
-		{ code: 'sat', name: 'Saxophone Ténor', defaultKey: 'sib' },
-		{ code: 'sab', name: 'Saxophone Baryton', defaultKey: 'mib' },
-		{ code: 'coa', name: 'Cor Anglais', defaultKey: 'fa' },
-		{ code: 'htb', name: 'Hautbois', defaultKey: 'do' },
-		{ code: 'bas', name: 'Basson', defaultKey: 'do' },
-		{ code: 'cor', name: 'Cor', defaultKey: 'fa' },
-		{ code: 'trp', name: 'Trompette', defaultKey: 'sib' },
-		{ code: 'crn', name: 'Cornet', defaultKey: 'sib' },
-		{ code: 'trb', name: 'Trombone', defaultKey: 'do' },
-		{ code: 'eup', name: 'Euphonium', defaultKey: 'sib' },
-		{ code: 'tub', name: 'Tuba', defaultKey: 'do' },
-		{ code: 'cba', name: 'Contrebasse', defaultKey: 'sib' },
-		{ code: 'per', name: 'Percussions', defaultKey: '' },
-		{ code: 'pia', name: 'Piano', defaultKey: '' },
-		{ code: 'har', name: 'Harpe', defaultKey: '' },
-		{ code: 'sup', name: 'Parties supplémentaires', defaultKey: '' }
-	];
-
-	let scoreId = $derived($page.params.id || '');
+	let scoreId = $derived(page.params.id || '');
 	let scoreName = $state('');
 	let scoreCompositor = $state('');
 	let scoreRessource = $state('');
 	let loading = $state(true);
 	let error = $state('');
-	let userRole = $state('');
+	let userRole = $derived($auth.user?.role || '');
 	let isAdmin = $derived(userRole === 'admin');
 
+	function focusOnMount(node: HTMLElement) {
+		node.focus();
+	}
+
 	// Edit mode
 	let editingField = $state<string | null>(null);
 	let editValue = $state('');
@@ -88,7 +69,7 @@
 	// Auto-set default key when instrument changes
 	$effect(() => {
 		if (uploadInstrument) {
-			const inst = INSTRUMENTS.find(i => i.code === uploadInstrument);
+			const inst = getInstrument(uploadInstrument);
 			if (inst?.defaultKey) {
 				uploadKey = inst.defaultKey;
 			}
@@ -147,7 +128,7 @@
 
 	function getExpectedFilename(): string {
 		if (!uploadInstrument) return '';
-		const inst = INSTRUMENTS.find(i => i.code === uploadInstrument);
+		const inst = getInstrument(uploadInstrument);
 		const instName = inst ? inst.name.toLowerCase().replace(/ /g, '_') : uploadInstrument;
 		const key = uploadKey || inst?.defaultKey || '';
 		const keyStr = key ? `_${key}` : '';
@@ -159,18 +140,11 @@
 	let expectedFilename = $derived(getExpectedFilename());
 
 	onMount(async () => {
-		await new Promise(resolve => setTimeout(resolve, 100));
-		
-		const unsubscribe = auth.subscribe((state) => {
-			userRole = state.user?.role || '';
-		});
-		
 		if (userRole !== 'admin') {
-			unsubscribe();
 			goto('/scores');
 			return;
 		}
-		
+
 		await loadScoreInfo();
 		await handleScoreSelect();
 		await loadFiles();
@@ -311,12 +285,12 @@
 		
 				<!-- Name -->
 				<div class="flex items-center gap-4 py-3 border-b border-gray-100">
-					<label class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Nom</label>
+					<span class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Nom</span>
 					{#if editingField === 'name'}
 						<input
 							type="text"
 							bind:value={editValue}
-							autofocus
+							use:focusOnMount
 							onkeydown={(e) => { if (e.key === 'Enter') saveEdit('name'); if (e.key === 'Escape') cancelEdit(); }}
 							class="flex-1 text-xl font-bold text-ohmj-primary border-b-2 border-ohmj-primary bg-transparent px-3 py-2 focus:outline-none"
 						/>
@@ -327,9 +301,9 @@
 							<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path></svg>
 						</button>
 					{:else}
-						<span class="flex-1 text-xl font-bold text-ohmj-primary cursor-pointer hover:text-ohmj-secondary px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('name', scoreName)} title="Cliquer pour modifier">
+						<button type="button" class="flex-1 text-left text-xl font-bold text-ohmj-primary cursor-pointer hover:text-ohmj-secondary px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('name', scoreName)} title="Cliquer pour modifier">
 							{scoreName || 'Sans titre'}
-						</span>
+						</button>
 						<button onclick={() => startEdit('name', scoreName)} class="text-gray-400 hover:text-ohmj-primary p-2 rounded-full hover:bg-gray-100" title="Modifier">
 							<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"></path></svg>
 						</button>
@@ -338,12 +312,12 @@
 
 				<!-- Compositor -->
 				<div class="flex items-center gap-4 py-3 border-b border-gray-100">
-					<label class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Compositeur</label>
+					<span class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Compositeur</span>
 					{#if editingField === 'compositor'}
 						<input
 							type="text"
 							bind:value={editValue}
-							autofocus
+							use:focusOnMount
 							placeholder="Compositeur"
 							onkeydown={(e) => { if (e.key === 'Enter') saveEdit('compositor'); if (e.key === 'Escape') cancelEdit(); }}
 							class="flex-1 text-lg text-gray-700 border-b-2 border-ohmj-primary bg-transparent px-3 py-2 focus:outline-none"
@@ -355,9 +329,9 @@
 							<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path></svg>
 						</button>
 					{:else}
-						<span class="flex-1 text-lg text-gray-700 cursor-pointer hover:text-ohmj-primary px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('compositor', scoreCompositor)} title="Cliquer pour modifier">
+						<button type="button" class="flex-1 text-left text-lg text-gray-700 cursor-pointer hover:text-ohmj-primary px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('compositor', scoreCompositor)} title="Cliquer pour modifier">
 							{scoreCompositor || 'Aucun compositeur'}
-						</span>
+						</button>
 						<button onclick={() => startEdit('compositor', scoreCompositor)} class="text-gray-400 hover:text-ohmj-primary p-2 rounded-full hover:bg-gray-100" title="Modifier">
 							<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"></path></svg>
 						</button>
@@ -366,12 +340,12 @@
 
 				<!-- Ressource -->
 				<div class="flex items-center gap-4 py-3">
-					<label class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Ressource</label>
+					<span class="w-32 text-sm font-semibold text-gray-600 flex-shrink-0">Ressource</span>
 					{#if editingField === 'ressource'}
 						<input
 							type="url"
 							bind:value={editValue}
-							autofocus
+							use:focusOnMount
 							placeholder="URL (YouTube, Google Drive, etc.)"
 							onkeydown={(e) => { if (e.key === 'Enter') saveEdit('ressource'); if (e.key === 'Escape') cancelEdit(); }}
 							class="flex-1 text-sm text-blue-600 border-b-2 border-ohmj-primary bg-transparent px-3 py-2 focus:outline-none"
@@ -384,13 +358,13 @@
 						</button>
 					{:else}
 						{#if scoreRessource}
-							<span class="flex-1 text-sm text-blue-600 cursor-pointer hover:text-blue-800 px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('ressource', scoreRessource)} title="Cliquer pour modifier">
+							<button type="button" class="flex-1 text-left text-sm text-blue-600 cursor-pointer hover:text-blue-800 px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('ressource', scoreRessource)} title="Cliquer pour modifier">
 								🔗 {scoreRessource}
-							</span>
+							</button>
 						{:else}
-							<span class="flex-1 text-sm text-gray-400 cursor-pointer hover:text-gray-600 px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('ressource', '')} title="Cliquer pour ajouter">
+							<button type="button" class="flex-1 text-left text-sm text-gray-400 cursor-pointer hover:text-gray-600 px-3 py-2 rounded-lg hover:bg-gray-50" onclick={() => startEdit('ressource', '')} title="Cliquer pour ajouter">
 								Aucune ressource
-							</span>
+							</button>
 						{/if}
 						<button onclick={() => startEdit('ressource', scoreRessource)} class="text-gray-400 hover:text-ohmj-primary p-2 rounded-full hover:bg-gray-100" title="Modifier">
 							<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z"></path></svg>
@@ -468,8 +442,9 @@
 			<form onsubmit={(e) => { e.preventDefault(); uploadPdf(); }} class="space-y-4">
 				<div class="grid grid-cols-2 md:grid-cols-4 gap-4">
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Instrument</label>
+						<label for="up-instrument" class="block text-sm font-medium text-gray-700">Instrument</label>
 						<select
+							id="up-instrument"
 							bind:value={uploadInstrument}
 							required
 							class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white"
@@ -496,8 +471,9 @@
 				<div class="grid grid-cols-2 md:grid-cols-7 gap-4 p-3 bg-gray-100 rounded">
 					{#if selectedScorePieceCount > 1}
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Pièce</label>
+						<label for="up-piece" class="block text-sm font-medium text-gray-700">Pièce</label>
 						<select
+							id="up-piece"
 							bind:value={uploadPiece}
 							required
 							class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white"
@@ -509,8 +485,9 @@
 					</div>
 					{/if}
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Version</label>
+						<label for="up-version" class="block text-sm font-medium text-gray-700">Version</label>
 						<input
+							id="up-version"
 							type="number"
 							min="1"
 							bind:value={uploadVersion}
@@ -520,19 +497,19 @@
 						/>
 					</div>
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Tonalité</label>
-						<select bind:value={uploadKey} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
+						<label for="up-key" class="block text-sm font-medium text-gray-700">Tonalité</label>
+						<select id="up-key" bind:value={uploadKey} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
 							<option value="">-</option>
-							<option value="sib">Si♭ (sib)</option>
-							<option value="mib">Mi♭ (mif)</option>
-							<option value="fa">Fa (fa)</option>
-							<option value="do">Do (ut)</option>
-							<option value="sol">Sol</option>
+							<option value="sib">Si♭ (B♭)</option>
+							<option value="mib">Mi♭ (E♭)</option>
+							<option value="fa">Fa (F)</option>
+							<option value="do">Do (C/Ut)</option>
+							<option value="sol">Sol (G)</option>
 						</select>
 					</div>
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Clé</label>
-						<select bind:value={uploadClef} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
+						<label for="up-clef" class="block text-sm font-medium text-gray-700">Clé</label>
+						<select id="up-clef" bind:value={uploadClef} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
 							<option value="">-</option>
 							<option value="clesol">Sol</option>
 							<option value="clefa">Fa</option>
@@ -540,8 +517,8 @@
 						</select>
 					</div>
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Partie</label>
-						<select bind:value={uploadPart} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
+						<label for="up-part" class="block text-sm font-medium text-gray-700">Partie</label>
+						<select id="up-part" bind:value={uploadPart} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
 							<option value="1">1</option>
 							<option value="2">2</option>
 							<option value="3">3</option>
@@ -549,8 +526,8 @@
 						</select>
 					</div>
 					<div>
-						<label class="block text-sm font-medium text-gray-700">Variante</label>
-						<select bind:value={uploadVariant} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
+						<label for="up-variant" class="block text-sm font-medium text-gray-700">Variante</label>
+						<select id="up-variant" bind:value={uploadVariant} class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm bg-white">
 							<option value="">-</option>
 							<option value="solo">Solo</option>
 							<option value="default">Default</option>
@@ -569,7 +546,7 @@
 				{/if}
 
 				<div>
-					<label class="block text-sm font-medium text-gray-700">Fichier PDF</label>
+					<label for="file-input" class="block text-sm font-medium text-gray-700">Fichier PDF</label>
 					<div class="flex items-center gap-3 mt-1">
 						<label class="relative inline-flex items-center cursor-pointer whitespace-nowrap">
 							<input type="checkbox" bind:checked={uploadWatermark} class="sr-only peer" />
@@ -682,32 +659,13 @@
 	{/if}
 
 	<!-- Delete Confirmation Modal -->
-	{#if deleteFilePath}
-		<div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50" onclick={() => deleteFilePath = null}>
-			<div class="bg-white rounded-lg shadow-xl p-6 max-w-md w-full mx-4" onclick={(e) => e.stopPropagation()}>
-				<h3 class="text-lg font-semibold text-gray-900 mb-2">Confirmer la suppression</h3>
-				<p class="text-gray-600 mb-6">
-					Êtes-vous sûr de vouloir supprimer ce fichier ? Cette action est irréversible.
-				</p>
-				<p class="text-sm text-gray-500 mb-6 font-mono bg-gray-100 p-2 rounded">
-					{deleteFilePath}
-				</p>
-				<div class="flex gap-3 justify-end">
-					<button
-						onclick={() => deleteFilePath = null}
-						class="px-4 py-2 text-gray-700 hover:bg-gray-100 rounded transition-colors"
-					>
-						Annuler
-					</button>
-					<button
-						onclick={deleteFile}
-						disabled={deletingFile}
-						class="px-4 py-2 bg-red-600 text-white hover:bg-red-700 rounded transition-colors disabled:opacity-50"
-					>
-						{deletingFile ? 'Suppression...' : 'Supprimer'}
-					</button>
-				</div>
-			</div>
-		</div>
-	{/if}
+	<ConfirmDialog
+		open={!!deleteFilePath}
+		title="Confirmer la suppression"
+		message="Êtes-vous sûr de vouloir supprimer ce fichier ? Cette action est irréversible."
+		detail={deleteFilePath ?? ''}
+		busy={deletingFile}
+		onconfirm={deleteFile}
+		oncancel={() => (deleteFilePath = null)}
+	/>
 </div>
diff --git a/partitions/src/routes/scores/[id]/+page.svelte b/partitions/src/routes/scores/[id]/+page.svelte
index 6b7369d..8275a86 100644
--- a/partitions/src/routes/scores/[id]/+page.svelte
+++ b/partitions/src/routes/scores/[id]/+page.svelte
@@ -1,70 +1,47 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
-	import { page } from '$app/stores';
-	import { apiService, type Score, type Piece } from '$lib/api';
-	import { goto } from '$app/navigation';
+	import { page } from '$app/state';
+	import { apiService, type Score, type Piece, type Instrument } from '$lib/api';
+	import { getInstrumentIcon, getInstrumentName } from '$lib/instruments';
 
-	const INSTRUMENT_ICONS: Record<string, string> = {
-		dir: '🎼', pic: '/icons/piccolo.png', flu: '/icons/flute.png', cla: '/icons/clarinette.png', clb: '/icons/clarinette_basse.png',
-		sax: '/icons/sax-alto.png', sab: '/icons/sax-barython.png', sat: '/icons/sax-tenor.png', coa: '/icons/cor-anglais.jpg', cba: '/icons/contrebasse.png',
-		cor: '/icons/cor.png', trp: '/icons/trumpet.png', trb: '/icons/tronbonne.png', tub: '/icons/tuba.png', htb: '/icons/hautbois.png',
-		bas: '/icons/basson.png', per: '/icons/percussion.png', crn: '/icons/cornet.png', eup: '/icons/euphonium.png', har: '/icons/harpe.png',
-		pia: '🎹', sup: '📄', par: '📄'
-	};
-
-	const INSTRUMENT_NAMES: Record<string, string> = {
-		dir: 'Direction', pic: 'Piccolo', flu: 'Flûte', cla: 'Clarinette',
-		clb: 'Clarinette Basse', sax: 'Sax Alto', sat: 'Sax Ténor', sab: 'Sax Baryton',
-		coa: 'Cor Anglais', cba: 'Contrebasse', cor: 'Cor', trp: 'Trompette',
-		trb: 'Trombone', tub: 'Tuba', htb: 'Hautbois', bas: 'Basson',
-		per: 'Percussions', crn: 'Cornet', eup: 'Euphonium', har: 'Harpe',
-		pia: 'Piano', sup: 'Parties supplementaires', par: 'Parties'
-	};
-
-	function getInstrumentIcon(code: string): string {
-		return INSTRUMENT_ICONS[code] || '🎵';
+	function isSafeUrl(url: string): boolean {
+		return /^https?:\/\//i.test(url.trim());
 	}
 
-	function getInstrumentName(code: string): string {
-		return INSTRUMENT_NAMES[code] || code;
-	}
-
-	let scoreId = '';
-	let score: Score | null = null;
-	let pieces: Piece[] = [];
-	let instruments: any[] = [];
+	let scoreId = $derived(page.params.id || '');
+	let score = $state<Score | null>(null);
+	let pieces = $state<Piece[]>([]);
+	let instruments = $state<Instrument[]>([]);
 	let loading = $state(true);
 	let error = $state('');
 	let selectedPiece = $state(1);
 
-	page.subscribe(($page) => {
-		scoreId = $page.params.id || '';
-		// Read piece from URL param or query string
-		const pieceParam = $page.params.piece || $page.url.searchParams.get('piece');
+	$effect(() => {
+		if (!scoreId) return;
+		const pieceParam = page.url.searchParams.get('piece');
 		if (pieceParam) {
 			selectedPiece = parseInt(pieceParam) || 1;
 		}
+		loadScore(scoreId);
 	});
 
-	onMount(async () => {
+	async function loadScore(id: string) {
+		loading = true;
+		error = '';
 		try {
-			score = await apiService.getScore(scoreId);
-			pieces = await apiService.getPieces(scoreId);
-			
-			// Set default piece to 1 if not in URL
-			if (pieces.length > 0 && !pieces.find(p => p.id === selectedPiece)) {
+			score = await apiService.getScore(id);
+			pieces = await apiService.getPieces(id);
+			// Default to the first piece if the requested one does not exist
+			if (pieces.length > 0 && !pieces.find((p) => p.id === selectedPiece)) {
 				selectedPiece = pieces[0].id;
 			}
-			
-			// Load instruments for the selected piece
-			await loadInstrumentsForPiece(selectedPiece);
+			instruments = await apiService.getInstruments(id, selectedPiece);
 		} catch (err) {
 			error = 'Erreur lors du chargement';
 			console.error(err);
 		} finally {
 			loading = false;
 		}
-	});
+	}
 
 	async function loadInstrumentsForPiece(pieceId: number) {
 		loading = true;
@@ -107,7 +84,7 @@
 			{#if score?.compositor}
 				<p class="text-gray-600 mt-1 text-lg">{score.compositor}</p>
 			{/if}
-			{#if score?.ressource}
+			{#if score?.ressource && isSafeUrl(score.ressource)}
 				<a
 					href={score.ressource}
 					target="_blank"
@@ -143,7 +120,7 @@
 			{:else}
 				<div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-4 gap-4">
 					{#each instruments as instrument}
-						{@const code = instrument.id || instrument.code || ''}
+						{@const code = instrument.id || ''}
 						{@const title = instrument.title || getInstrumentName(code)}
 						{@const fileCount = instrument.parts?.[0]?.files?.length || 0}
 						{@const icon = getInstrumentIcon(code)}
diff --git a/partitions/src/routes/scores/[id]/[piece]/+page.svelte b/partitions/src/routes/scores/[id]/[piece]/+page.svelte
index 039c7c3..bab0c3b 100644
--- a/partitions/src/routes/scores/[id]/[piece]/+page.svelte
+++ b/partitions/src/routes/scores/[id]/[piece]/+page.svelte
@@ -1,43 +1,32 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
-	import { page } from '$app/stores';
-	import { apiService, type Score, type Instrument } from '$lib/api';
+	import { page } from '$app/state';
+	import { apiService, type Instrument } from '$lib/api';
+	import { getInstrumentIcon } from '$lib/instruments';
 
-	const INSTRUMENT_ICONS: Record<string, string> = {
-		dir: '🎼', pic: '/icons/piccolo.png', flu: '/icons/flute.png', cla: '/icons/clarinette.png', clb: '/icons/clarinette_basse.png',
-		sax: '/icons/sax-alto.png', sab: '/icons/sax-barython.png', sat: '/icons/sax-tenor.png', coa: '/icons/cor-anglais.jpg', cba: '/icons/contrebasse.png',
-		cor: '/icons/cor.png', trp: '/icons/trumpet.png', trb: '/icons/tronbonne.png', tub: '/icons/tuba.png', htb: '/icons/hautbois.png',
-		bas: '/icons/basson.png', per: '/icons/percussion.png', crn: '/icons/cornet.png', eup: '/icons/euphonium.png', har: '/icons/harpe.png',
-		pia: '🎹', sup: '📄', par: '📄'
-	};
-
-	function getInstrumentIcon(code: string): string {
-		return INSTRUMENT_ICONS[code] || '🎵';
-	}
-
-	let scoreId = '';
-	let pieceId = '';
-	let instruments: Instrument[] = $state([]);
+	let scoreId = $derived(page.params.id || '');
+	let pieceId = $derived(page.params.piece || '');
+	let instruments = $state<Instrument[]>([]);
 	let loading = $state(true);
 	let error = $state('');
 
-	page.subscribe(($page) => {
-		scoreId = $page.params.id || '';
-		pieceId = $page.params.piece || '';
+	$effect(() => {
+		if (!scoreId) return;
+		loadInstruments(scoreId, pieceId);
 	});
 
-	onMount(async () => {
+	async function loadInstruments(id: string, piece: string) {
+		loading = true;
+		error = '';
 		try {
-			const score = await apiService.getScore(scoreId);
-			// Filter instruments by piece
-			instruments = (score.instruments || []).filter(i => i.piece === pieceId);
+			const score = await apiService.getScore(id);
+			instruments = (score.instruments || []).filter((i) => i.piece === piece);
 		} catch (err) {
 			error = 'Erreur lors du chargement';
 			console.error(err);
 		} finally {
 			loading = false;
 		}
-	});
+	}
 </script>
 
 <svelte:head>
diff --git a/partitions/src/routes/scores/[id]/[piece]/[instrument]/+page.svelte b/partitions/src/routes/scores/[id]/[piece]/[instrument]/+page.svelte
index 0edb42a..61bf804 100644
--- a/partitions/src/routes/scores/[id]/[piece]/[instrument]/+page.svelte
+++ b/partitions/src/routes/scores/[id]/[piece]/[instrument]/+page.svelte
@@ -1,41 +1,14 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
-	import { page } from '$app/stores';
+	import { page } from '$app/state';
 	import { apiService, type Part, type PdfFile } from '$lib/api';
+	import { getInstrumentName } from '$lib/instruments';
 	import PdfViewer from '$lib/components/PdfViewer.svelte';
 
-	const INSTRUMENT_NAMES: Record<string, string> = {
-		dir: 'Direction',
-		pic: 'Piccolo',
-		flu: 'Flûte',
-		cla: 'Clarinette',
-		clb: 'Clarinette basse',
-		sax: 'Saxophone',
-		sab: 'Saxophone baryton',
-		sat: 'Saxophone ténor',
-		cba: 'Contrebasse',
-		cor: 'Cor',
-		trp: 'Trompette',
-		trb: 'Trombone',
-		tub: 'Tuba',
-		htb: 'Hautbois',
-		bas: 'Basson',
-		per: 'Percussion',
-		crn: 'Cornet',
-		eup: 'Euphonium',
-		har: 'Harpe',
-		pia: 'Piano'
-	};
-
-	function getInstrumentName(code: string): string {
-		return INSTRUMENT_NAMES[code] || code;
-	}
-
-	let scoreId = '';
-	let pieceId = '';
-	let instrumentCode = '';
-	let instrumentTitle = '';
-	let parts: Part[] = $state([]);
+	let scoreId = $derived(page.params.id || '');
+	let pieceId = $derived(page.params.piece || '');
+	let instrumentCode = $derived(page.params.instrument || '');
+	let instrumentTitle = $state('');
+	let parts = $state<Part[]>([]);
 	let loading = $state(true);
 	let error = $state('');
 	let selectedFile = $state('');
@@ -44,27 +17,29 @@
 	let pieceCount = $state(0);
 
 	let pdfViewerUrl = $derived(selectedFile ? apiService.getDownloadUrl(selectedFile) : '');
-	let pdfFileName = $derived(selectedFile ? selectedFile.split('/').pop() || 'Partition' : 'Partition');
+	let pdfFileName = $derived(
+		selectedFile ? selectedFile.split('/').pop() || 'Partition' : 'Partition'
+	);
 
-	page.subscribe(($page) => {
-		scoreId = $page.params.id || '';
-		pieceId = $page.params.piece || '';
-		instrumentCode = $page.params.instrument || '';
+	$effect(() => {
+		if (!scoreId) return;
+		loadInstrument(scoreId, pieceId, instrumentCode);
 	});
 
-	onMount(async () => {
+	async function loadInstrument(id: string, piece: string, code: string) {
+		loading = true;
+		error = '';
 		try {
-			// Get pieces info
-			const pieces = await apiService.getPieces(scoreId);
+			const pieces = await apiService.getPieces(id);
 			pieceCount = pieces.length;
-			const piece = pieces.find(p => p.id.toString() === pieceId);
-			if (piece) {
-				pieceName = piece.name;
+			const found = pieces.find((p) => p.id.toString() === piece);
+			if (found) {
+				pieceName = found.name;
 			}
-			
-			const score = await apiService.getScore(scoreId);
+
+			const score = await apiService.getScore(id);
 			const instrument = (score.instruments || []).find(
-				i => i.id === instrumentCode && i.piece === pieceId
+				(i) => i.id === code && i.piece === piece
 			);
 			if (instrument) {
 				instrumentTitle = instrument.title;
@@ -79,7 +54,7 @@
 		} finally {
 			loading = false;
 		}
-	});
+	}
 
 	function getFileInfo(file: PdfFile): string {
 		const info = [];
diff --git a/partitions/src/routes/test-icons/+page.svelte b/partitions/src/routes/test-icons/+page.svelte
deleted file mode 100644
index fb296fc..0000000
--- a/partitions/src/routes/test-icons/+page.svelte
+++ /dev/null
@@ -1,83 +0,0 @@
-<script lang="ts">
-	const INSTRUMENT_ICONS: Record<string, string> = {
-		dir: '🎼',
-		pic: '/icons/piccolo.png',
-		flu: '/icons/flute.png',
-		cla: '/icons/clarinette.png',
-		clb: '/icons/clarinette_basse.png',
-		sax: '/icons/sax-alto.png',
-		sab: '/icons/sax-barython.png',
-		sat: '/icons/sax-tenor.png',
-		coa: '/icons/cor-anglais.jpg',
-		cba: '/icons/contrebasse.png',
-		cor: '/icons/cor.png',
-		trp: '/icons/trumpet.png',
-		trb: '/icons/tronbonne.png',
-		tub: '/icons/tuba.png',
-		htb: '/icons/hautbois.png',
-		bas: '/icons/basson.png',
-		per: '/icons/percussion.png',
-		crn: '/icons/cornet.png',
-		eup: '/icons/euphonium.png',
-		har: '/icons/harpe.png',
-		pia: '🎹',
-		sup: '📄',
-		par: '📄'
-	};
-
-	const INSTRUMENT_NAMES: Record<string, string> = {
-		dir: 'Direction',
-		pic: 'Piccolo',
-		flu: 'Flûte',
-		cla: 'Clarinette',
-		clb: 'Clarinette Basse',
-		sax: 'Sax Alto',
-		sat: 'Sax Ténor',
-		sab: 'Sax Baryton',
-		coa: 'Cor Anglais',
-		cba: 'Contrebasse',
-		cor: 'Cor',
-		trp: 'Trompette',
-		trb: 'Trombone',
-		tub: 'Tuba',
-		htb: 'Hautbois',
-		bas: 'Basson',
-		per: 'Percussions',
-		crn: 'Cornet',
-		eup: 'Euphonium',
-		har: 'Harpe',
-		pia: 'Piano',
-		sup: 'Parties supplementaires',
-		par: 'Parties'
-	};
-
-	const instruments = Object.entries(INSTRUMENT_NAMES).map(([code, name]) => ({
-		code,
-		name,
-		icon: INSTRUMENT_ICONS[code] || '❓'
-	}));
-</script>
-
-<svelte:head>
-	<title>Test icônes instruments - OHMJ</title>
-</svelte:head>
-
-<div class="container mx-auto px-4 py-8">
-	<h1 class="text-3xl font-bold text-ohmj-primary mb-8">Test icônes instruments</h1>
-
-	<div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-4 gap-4">
-		{#each instruments as inst}
-			<div class="bg-white p-6 rounded-lg shadow border border-gray-200 text-center">
-				<div class="text-5xl mb-2">
-					{#if inst.icon.startsWith('/')}
-						<img src={inst.icon} alt={inst.name} class="w-12 h-12 mx-auto object-contain" />
-					{:else}
-						{inst.icon}
-					{/if}
-				</div>
-				<p class="font-semibold">{inst.name}</p>
-				<p class="text-sm text-gray-400">{inst.code}</p>
-			</div>
-		{/each}
-	</div>
-</div>
diff --git a/partitions/static/favicon.png b/partitions/static/favicon.png
new file mode 100644
index 0000000000000000000000000000000000000000..dd281a81689f9590461b09e4e3c87eb6159bafa0
GIT binary patch
literal 13758
zcmZX5XE<El`}NT~gXq14h~8@uMokcc7`-#m38D|t6D@jA^e%d5f)I>|9=%1c(Yyb7
ze&62fJ=ZleUz~I9eb=?t-lAS<su1DR;sXFcq^1hh0e^?V&owSK_>JDv;|~C$VQSFl
zy6<QA1K?@8lMUx>=dzw<zIk-^Th3o>Ql3Le>E*u%OZ4tyZfRI{LbGT-EwcBeN&J?8
zYP>w?h(fTk2KHt8KmD@UOUlWi^e92wHvQ|@w(Xj-Uy^>+hbj$yXszK@2W3@@hbPNy
zzQ0NXreKGQ4wW6}hKS(*=X&0TW-~U_{%_vpm07^=k&5*<{Ho}{O<D^^<PP2=%c%!4
zAfa(@@5n|RWu8xrP4gn-N|*y(9uesXC=s4w=QANO0D2teL!-k@oZnbTQou9jVgJSF
zP_#YFZ+J*CNC4VK0Ca*mAoyrq{FjimkbPzW?DCQ*q~V}<`MG%((a|<=jCKnA#*=5p
zlUoBy(7sV2Ef7;7M|_9|Oeu-LL1P=;KITfblQD8}waWIjv@3dq3Yr9|yc{4|DRIt>
zFacz-N1p<RWcIt4TpkShvf(0dD_>G=7U5hha}mU$c!se)Euj{M1hCA2SVVtMgXkbH
z`X$Vf#iD_)pFAV}VqFRYU?f<63UFe48#nM`L<|ERn9HK@E7^|KjhP&6F2xMW{t(!-
zkvSvg(R<r_LByCC^_M3&qy9h;l|rDH^H^5AHZS-`M{k@d4J89;E=kj>v0h=y*IU4Z
z5Nt7j(^bBR_8kfqsNtKY3sdBf@AabOfJ-~Tx52HJK1POuIYR?!%o5;N-R#r&&xa6B
z=5-vvOpCR#1W-r)yjLsg#`uQzMFs8lFtk()C#IEVtXGi|5~W~!M*uwF$WME*ue}BM
zNuwe{>%B7c`r|n$yKy1e#2awn7v{1<g!>dQMLK#Yzsj`6DQA=C7%rmHACf*jgSsvT
z0%KHlD?0Mgkvy#bmez_<m7=Qx1y^Dg_~}<(h-!@AEJ}w|*sk>xRHIv3+R=R?xvDRj
z<ZKQ!^FzW#VnSOQlhO~dj@asNH9K*Zapk1}M>Gjl=#Av(cP(-0yPYRv?6)Xm^-xXJ
zJRO4Q6%*nH{Rwo)rA!E+1RP*~3+$foQ6`_`hA#$o5~>g%?h$Rsp*5Fa*&ROx=D<gd
zvZ7bA<e7BWI`DV7rNmxXJY-!ExGRWCR(Ogda0Fdh(r_@g7O3m(OD_yGps)S!v$Xg-
z?gh!2?Oh6dZmxuMnHEJ6=?{O>@Dm-C%CWvNBHe*%;1BMX|6Z)-U1sLHYFpZnI&64`
z?kb2lM5F$sD&|?c<iLw3`NPgGz%g<>R#g!bmFs50WSfI^l*ay)5~Bpuo`!T7?da?2
z)h-!KgY3sG4LKfk29t1Ib)(w=_yJhEN3n6dfCsr>X~fa3T1&zI3%PT1=OZLaIgCt=
z^@S)YFJ@FRvfbh~sfDPNa_YZOFz*ak1fg$~qb0Gsg<KLM*@0YICe9wUI`fT&>~tRv
z#EV2|8aAXu{R>RtTHnO&gdE<Kcn=l?%&`1<#TgOs0LVZ8%y>td(3}Eu5$+v$HO7<X
z89?c9_XH{T{De)DmNer2g8grvTVhUyn)eE?|7{=Oa7bu-i@)rVC;+zyTp&?&{aWdM
ze@g7a6KubucKr$OY0`oSn44NOWl4vz1jcLYyc-%=sR(RM-w+;YrC(8s$SM8AvggBd
zo4y>-nxvr^hK#k#_>uXTUa|^|p#5%1SNsEolHkKT{C^DB^*HIp^N-|MbB)mSEW^!Z
z8`8@)F%W)gKl?QXHLh8{lI;4d<ixaC53_v29u;D3)mB|1a7q^dTtPSbp{^NN-FPES
z<qK3*@_u3;5qx93AIvIMelaHn-xx_tBiJy*pq~A-bO!i_$xqv^Qv|;IF|1_`P4ff;
zO)Ym-x*yV88JU(j9ChhwwQ*xo{PkxEoK9?n64jbxP|n0mX8KF>NSpz2uVUEQ1{R@L
zpHv(FaHph7%P)Sk&ITIUT%6@V)_=wSUT?H2o6N1M_q6h}Ug<=U^<fE+EK3XjXXg(M
ztqF`<KOj!T>PHPQkACEuU*;4q0=mmVcufkxAiL#NV!w}w9OQVJ?OpH;*BdmA1rUzh
z(i%Q;1Ivx-#LhI+WuhS_fkP+aQ?-&MsW|qQ2ASpTC70HlMou)XG^y&~&|3mTi^R2H
zn8C{}g73`*HT2cbjhKhK`&|fuOFTp@UaKaZ>Tj2RjSP=3&+vWb3nV82M)WPG+w$;t
zGDjHx7<e#8-A1DL@JOU#c7$r93+ofkJZYz(gUx-|?>Cy+-tnQ$bjWi|Cby>s55Ggd
z%mHvpRQuuxO73~VpZD#!AGW$8d;L<4FE+ihJBEPJ_+9yT;;cW!R*CTitU@-!TWK3K
zti~W{hULO&vYgNB97~z6P|X7#FPk4BDa1#npsPfXj!4xUSo?%@R72~$s!)uYa8REo
z*>XAAsm=N4FWYMzBc%eC_f&mafn~vwjA-$ZEpIWJ-+!;zt&3qFpO%p(My6rrlt<bJ
zL#Cdxt>#xy86I-v!6NJbMN-*?oNX&d!&UzqP-JzCajG+a-q%okp(%>KA0>qkKOez3
zbwh9RHs2`U9BG~s`uwshnS(B2mHHp!t{${LK6KuucP@0fusS?6?L%)ZRyg_B->QPc
zs*2Engg*xl9Pw$=&SQzQkxivvkmNj}XIcnKPFFuUTSlvbH01)Az^<==D_Z<dM`f29
z{k9l;D?EHu6~>AUluUSy2-mpLeCkY=?S}{pkpl&AG86f*g=As%9jzb#NMtCCIWP?v
zrXu(6VC6DwKi&zBL`t!cNq(gIn098TT;WzRq`(L*NHJ>PQiI;bU>Y&0#32Ppuzm|K
zMkPir(#frFQ|{h3tX+_>);knem|i7RW(!>5OW{-CZ*0H%iA`ED-%d~A=&D?0+}6N*
zC3a%>(jNmU8u_j=mf{K}bG^Sgr2pyeLMVTrlzn)pjx%91d<2kyY}O4vUrn?ocE0-d
zyyfqS1~Uuxj%)Myeb*g@^_4r!=P|(3RAd;^B8&ji2Fj~XK3w?#O^v1Nra$8vrgHmz
zoWp@EJ(HRnL7=GL?x|Y73@5>|FqwdeKKW=Pdt9|}+rhj0*|Pqe8_(k9IZgE6*lp!%
zX8MK1(_JLYi#@h?2D_TTIgOs?SFN53>Br_7XviA|sWSoIV=|<TxJ(~Vt$2H7F9~c?
z;}yw5mKATq9v<P|d~#a&gaAf4fPa*#JizZ^RsORAuIIP?KrF;QpVZF7fUOgNxFi+>
z2wCO#rJNf4y=D?tB!~{>tl>+@SQ++{#S$ho>gLOJIcl_`Xps<Hz*BiXGowB;ROA_Z
zW-vFW+%_po!endnF_IF_p2j+M=}!h+e0&gW@A4S<7fWildX$7Me9nANi@uPwc^QNG
z8k*5$`W{!cK!sy;N-*_dP_=I6JFurvkl-Y9M2crokjgryyEpe2<M-qHuy75}8+JrG
zLobupK{u+1!>~*>zhP6cpt|7sTri3G+IT^<2wYrZZi-oG)17b(A0A*m#m84layV!7
zBWJpe7uN%fRjBIgVgQI=Ke6`Gk0~pE9h}oKA0n*W(s9^4WN)IJ5U%<`(&_VqDsD`#
zdP@;L8W4vjK>--}RJ}3s!$q0eUsNgHcst77evf3a!2LJ)Gj57Ueaz)4yDsq{Ggkqg
z^?HONk;<y9ry7*kBP4!q3MNJtVzA5VpWa4A6C?+i^SetVCZi`EV;H=9^c-KH--x>{
zOI4RnPcuPF_<o~bA_4Z1Ccwzj_19NLM(#=5^PteBT%x>QHrOYf-rT}{K?fUMNu`2+
zN!SQz+0UfT)5{n&Gbdfe4s4H1!DscGo`8pf(rV!&W(AU7rYuQSg^ZYW-2`PN)jH1L
z$s*1V9&;Tc4F}P^Z%x;J&`hh@GNvIb*TWXDGp^lBSvB%4ItbiyG5<POBySVpJrc*p
zAah-kAVL1an{OSkwkpUH@dy6BX*m2T-^O<=Pda=UdpW`yFpxn8JX>w&Cd}Jcj(M#~
zi%A-EpGc%x;_uXlq(mRil(>ZUE?M5=uF8F|igz3n3Fjx5^pIUG<aBmy`mvi5^dO@q
zufVYbVueuy9G1o54eZ2=RK^V$140xJl~n9d=v)8hxm3g;1}f|K4S~gah>s(B(*XyW
zo^p&4)l&Kl$4j3Kvn-!|O93;g;()~u--|K+B<y$_$~wN%xo)}yOTGNdGB=IS<Yc2?
z!P8y)%&I*f6S{zmv~OTjSRG2D#U{aWbw^h;W+|97pOE-bu<}z*7V8_+KfS^lBz24H
z6cPWYOc~DPOeZQfwdZ(XS^Ii6bXH65!Xlw9u^T^)B1dJ|a{0^MlBYkK-D40RE*u5)
zGL<<4M+abA7ki9&t&tIFrnru3r*lhnUnKwzFw9@**j~qG*S~qqU`;`V^O5dBgvs!O
z=kbMpl<F73W&IkL*RsNzDz}vz-jGq>{BHQlIKU2tAO|sXre8Y*OgfA#CM13L>|AC|
zE%20h9i{~}pW4Lme~aF92$<idzhfD0R`U=cz2j$P8GfJZ9r*3Qb+h0}GQ{2kmg%<q
zqra*q{Y(OYxh?LHj_zKCJ=3^;*&1J@Z8MGWhyH=hN5bLm5bT2m?4RPk|CAW}wsBiV
zl42NnD*TK;SY;2>K7s33nr#6K%Ud+V@XPZ2KR_T)LGq__FGD})jpSC(?AvIC1+*_*
zsudpR%20Gs>}_a9WK{SA&KH^B&759ClRFTci8?gU_-{S~>{5J`Q4m9I#jfsAAU7S!
z)(v#n&%iA5JK=UY0XBIZ*+`E7lz+B<6<7K-QQN2IhR<&*{hdBO$Xn8k=8~-p4>_k<
z{7q*SNpBRi*cm?n)5y$rgBuc5I(v_5wgbUhQEaYIQ|DQcyZiUOzI|!DQF+9Wq2H32
znpz|zw8Ww?>oDt(<v4WY&94ln^Z64r`jg1e-}t?R{L^xfNWV|O7c^fC_NOsBMO<)N
z-h6Ke+~uO<@{M5Ur{E^aU#%-H;8cbu_gHry24yg81{w6%d{^kz*Zf6#d_`Z~I%`qb
z`J6T(d;d>1!3VIYbKaIb^m&AhY=j7pxX1Ar=?o(M`dNolL*b7qu!ge`UClJhU2(a$
zNu%@c9uon^K11!ZRQK+~OQcb!y_x4ZL>o&2|K0+XwWKOK&XQ}1XNOH?kKR=D9b0@j
ztx=UX{E*S5HVBx0RrN;uaC!!3Wr##;$7j}7+8e51f=TRNd!?ghwk|o>w2gpUPY`5t
zIB_hfjW^HgqQA#a@GovY!$xfi?aoo5T00es@O3u+HnWGGICZ~r$IS<P@zvC|gzT}#
z1Tdhhya-cu-Qu(>!>OIAu(+l8)ToeCPd-N=ifu`7=rfsMF$MIrJGAr!^>kcc6$AK>
zK5=$CvUiql;2d#J`3}C&nor7xhrA=+^M?7XxJccrMFmWt-`eY&euXQ~O@X(7U_NAP
z1R$#nT(z6(ni{-01KEI5rD;BZ+tsBJ`leycpMvP)&ZTfat@t=_m#x}<bC-L&XzyUe
zJ`5I~KBg}*l8kvJ>zku(09{?D$4Uj=aehKLPdTgRx&|D!5V^K=im#YqB|6tgw!#k@
zC~8tS_Y@8wYwHH1wwy((`)vUvZ^on*0aMpk>-$epYJMzU3rW`ZpCQZ$w%8yY<2W|v
zRyy`ZT2ZI9f|k8-8X#&Ua?2ao$yB1>a5F5mQ~fz^8t7hoTSd`hz96PvrQ-~QB(7if
zU>%7BFVf3halM{zuS~=SKs+~Swb6y~zKG_Y2rvNREGlzfJKG<3!=^X=dnPQyiNnY4
z32#9pTTfytbhI=df<##JqyUtpqf8(#p%Z$V!BT*Rz<a$Z3W<t9YoGM@3w@D(6<9e*
zeqv`VeVbXXd2K7%CA3LtD6o4SXy_B98+b*P?BuQ1Z6(J>=1u9v<PUNi-#nN`Hhvq)
zQ@M8Up6YZEyNqW@rtko7(EZCc!*k3oFJrXSh8Ck}4hyn>Q+D0r=<eOLf83mSh^HY(
zW5i_ru3twt<b*NGpkSD(Q946t3<u0n>s{!=E*xZC&|~)@-;k?RL%)X+4_Xe%#|*xR
zF-3#wXMQ-QzPEjR5f{#v2~*cF+d$l9asZbDVe@Hqg8u46V~>-}M&ak<qVAX2)gm#r
zv>;{lETpUIB1h(;ooeEzr)ya*kFsr^64^LO6`;43hw4$V9~&<52X6nP<E_-I4xd%D
zBXcDZjzfBXeuD?8smVO`K8F*dr~RtfjLWrl9}>zDk!Q~n3+n4t0`4)8`KqRZ?@HbG
zvRW+`I>O1Lf6Bh%MxWyjt*#BWc4}6_s|N?dXP76>Z!L#IGTTl}d2!hk6t4LT_Piq;
zw0XScD=-Y{sxUtmjkV~W|IlP&WRcKX7aAij`@lC=`5Rv1v%Qk;LagX+#w+4!f`<dP
zZoX<Z(swNMN`Fg370JMC8!b+rBZV>mgky##m`5`}D_d>#qcf8~(QU$4vWNrp%m2N@
z+13eD?Sj%Y=UG$|72_Z(2u%Q;cg8Cljr2T{o}_k>Wmh%+kIOTP9ivMgd7SjK8gZ#8
z9)ak{-!Z|#=7d<ya;#x|QY`mkfj=MYi<6t)dh2eK7<b9O+m6aD52-LxGdPUPJS~6^
zPUNUzK+BfJuf<5vF2#Y$84Y>1F}?y?jYAeS=&voD&kd_y1`TsNN29+=3M_JEbp71p
zxE;b%`9wL=S%$^GnQwSzQ~PtLxjZMg+Z4v~aX2@;8uAuVqvb#+Xi3Dgi@QGc7&j^+
zQmFsi17@=kSEzqlq_dJj7|tA}ffxg>Ihi@jcPQ^OGn#t6F#ripHU;K?;*h&XNdMl2
zkvgJ;KC=G5=mcoIUF@HpORXlo)@;<2_1SX6z&`DIxAmKaO~*1Ppx-#tGl0?HAt~Jj
zQ-FEAXl}1E!n)X7%xG!8ncbcRxk`63t_gs)yvr9H(TV)X*DB8_;rc~_nvmFye)BzG
zCvXBc+||h)xwzmnX`Me>iC_xo=WjIhhzE5ey_@62L_1&SEe3%ibbm<%U-~hr0shgn
zZHV&2j|x6`$helA-us;C!m29gZ)*}C#9S6-6dV{!8>C{>yWBGVoV2f%mzUQ86GcfP
zAgPb3qek|DJ@wLKYVibhDT%a0`#A)R*+bCG1@P=y5c%Zcs_H!jlzop=jbGke93C2*
zm@JIDWsNCD5Sx@VFcvl(%&C4Z>iq78+QK$}J*alVZ?>s+(O`FIKwlx<9xWP&CP0x8
zkbNt589)p8JL}=d{TC+)8gDEEl#Rt-|9S9IiKn~UFG;Jdqm>??udhn#Y+xV6o#)>t
zO!+41l!*&(HdoPkEXdmO9m^b^<|lCQ+P1yfcp0`CE+w#=i1dGk7>#@<oCv>-p_a!&
zXrcLr;4*my`L6$)Ju|h-<9MS%wu-3s*z{0oZ@Kiy--%kAb*TQ@;4r<R|K<(V(?VbJ
zQLLQJ7-vW7`LOi5j1&K%+MM0Rj+=%TseIn!u_9*uU}wZhJ98s6#@=uPH07-^giIiB
z-~D}{g7T9^Ii>Kw@|z(NKKfqDd2TV{$0Sbz>W|+v`%GeE=)|!d=W;hCR)W>H37(BG
zR3`0UeGwMkWIwqGg=9L-$$Af^INgkO%SacQbI4Jkf4c&4>UF;UL3@_g#eE2`n@Y1v
zr@l`hgU5A%J1OQ77D9>HmjJ2E@^{fKu@jb?@l1<FhlCv;x8L21Fm@xA{%3V%B~7#K
za7JCS&L;MU?_{<IKN5<*^Kz)z9<UekV8$;NT#?1tsT1=viER-;)EcHZJATc~?n2C)
z9QfL@J?aO~g9C(SN>5t_Eo+&OZvk##7XL^Jz~Ox9(|V<p4zu%X5WNZ~QxR{`uQtu5
z!w<Xm$r1NjX!YcTjLKJ@$ya&?IvA>;=C!#zpCUw^LPVBmpILWczz%Wc07}g4^$$A`
z^W;st{iZ+Mk+*Ggf_@Rdj<@@~cM<uU9dM}oxG^+CUk~^bt2#67%Q}l`P9-1l-^}q4
zdaO23;dx3vi%KC5^ABe=yLvqH-Ta%D05$#DLE9lQhJF0h+gEE*<_X;^YL#b&`N}c3
zyT|KHp>ve*&dRK7ZZgty@n14AoSdGG&+>1Vv@(`1olV?M9c@UyxFZ-?wTX}e1N``A
zmunFjqI^MaYKoW3!EAdz&xjaeV}yT6@Rql>UQ0}SM(~@qH&;(x(^sD18Se6Nai~F)
zBNY@PI{?`Poj}LAMteVQjZZZ^$0F7mPed$s+W8%78+Kyb-rD2VO`U~PF7=jZv)wf`
zh!!?9H1tG5A3ora<P<i54fO|#XB@#!OuEmOCklvN-`(5D=H9{F-2QbceOx>jbGf(O
zZmH)aQlqggd?$sHA6?eh>!Zf~>6qnrFw=Q=bKy-8k)4zBID%2)+k=1MsT!)4uI{)H
zO-+V%b_CT{khB{hyJXbpR6RH}G<WhHhr3hiLxc0e=#Xi_Gq|<pfkky=A6DHA;mg-q
zJ{zj#Wo2a^67&bGg`)18zp|~8b&B6sev}y*R{wyfMXLRnR8Ng7^~S%msW6G#czQt#
zN|Y(?62sk`c)vmO{ZWRh@FyB!LwYG))1Rp9^s9Od9O6%BGA<IrRIOEWl9L=%q;P-&
zs;dMo_m^E_W$9G`o~ply<2I|`+PBS4(g+&+#-foC&;G)J5B>e+Vuv5!EA{NJ4SZ1R
z&1aK=Q5<;?Qax3!H)>o<@j86dhD`XF=n+#Du#3sq`y!3u!;i`51=>Vs-w)sEirH%$
zd(AwqhmRK_rsmbu1ud64J2u;@q#wz1342@FO8-!_1}s>hj}eoyxh`P8(PM`EF?#jt
zo88qhiP0%ae>SnmE%jOBWVkBcoY-hNrhwO;&+*ZUqSA`%`>k*yI(}CZJ9{hQH~g9y
zL7yW<NEs*<9OHF5iyBOAU{j2&vn}xP6n!TpOPfDU7f|L`Hcud#1D?ysdrh6eMB{0O
zI?vq{S*VDy!$NsWRIHjvOIf6Swhin>x{rsx{`uS7ky*Fnfu6UU!+sn#7<Hen>q(6L
z|0&f6J>16<5q&48=aex&Tztj}E(jm_Z$R_i%ZU<*!USa07I1KyGgX0p1cSb@v$He1
z(DpD%3_sfu<zgsd(Gb$W%_Z6Mkz$}__@8?$dctLLN5r2z!Y7&meHEp?t!-EyjLQ0W
zI^bH(miNYS&UF9cCRL3~?r=0;WwN}wGp7-aSuuk>Z}~Jq^Gt<_aZGbp+^TKA(Wu6H
z;PZTI>ujKUsWY9pv&^{Xf?(_#q3uSj>bNhV0xmx%=VlENo$SN%&_ko`aBKbjuW%7H
z=$BIo&%YmR8Y-1OgXum<9H!8Zw)GEe)H&;|2h^2kQHHxR?5|krAN!;1rHUGUd7F5j
z_C`(n$E(Zzi04qE2Fcy+xf;fNitl}iwjCyz<OEK0e0Q624{k-9KAR4e5x~}8iCDSG
zay(K=fLM*|0*@s{jmtYi;VT?9|Fv|^c)DYGE$+=P`IA{~+A(UtF3YXe<n`-ptS`B{
zt@*_C60V(_KAg=}bEOR<DfA!M`4G&cPE9<!igS%rJ~<aKO-)UkCg+8+M#q^kjD%Sd
zh741uOU#iIUlyNdv4rqh5;e`bw{PFNM{Y^<yD6unGRZ7~gE+Dzcd8YLku=WAlgA+C
zvL#mM@+M%BJ-zY=i*4@U;-+bReO<4@pys$-V{5W}+8mWuN4!5%XP3R(8j#`3SI6f{
zUmU@rQA@8hM+~3#JgRKf-Nq%7zr+xgqF)L>B?-F3s0qBgegQh9T1TBB?q|3qi*Rug
zdkhqhbd+zXR+dr$oT}a)&dvw1d3mcJK2mlpSSw$w{&=AnaC08WfP8E(1s7%xrS_QA
zd((N<O~7BvqTzv)mTR`FuN!KqOK)4Klag^L^Z|1}?n0J}mpClM%6R%tt~5oQv;|tP
zrQY&6U5+_VBe3hC?pL-n)2**wN`r%y>7x{gwxlqXIE~=Z#Mb^?(>hv-U;$i1z(LQ9
z>E+~zgKf#HC(d@~Et@%OVEtF!xYxXOsv=-Hf5A0vU%7O0wa1_nJ-N{4y>xOucPJ+9
zb#QX!)l$_)p77aN<5KjktBs9~8Mt#ZCX$L{D7?Du(#N$3dwF!hJ7id$B-M?|Hk{>0
zd&O61+=DVINMgG7@1(f8!t$$X-6{LM-=xy29(3>Ho+0yYXF_tT^?)jNEsIgf(Fdyg
zRy7gxy-I8-%z=s~c5iP_BX+IAZew)76bOSvr2Dklz}k3*E{N+)#~K_)sn+^p94<ez
z1K%uvsHg>1uMf$&#>sUq8A0FKB(Y&OCb{p0QRO_ui7&o?K{qC1x2pfNGnr#jHaI@I
z;o6tsG%Y?e^No?2Sr-pIv3RP;eA-sCiF!*MP4&&)xqIbVY<G8eIQYy{z#K#o291tB
z<v)8H_Y1+!#3Y<52Ip)&fJG29>_n=1f~9(no}L)+yS&_kbTd8CW+=r2Y=ldS1&UtG
znx7|tl6oG8x};+U;BdCFLllBL@vx=xM%t{3V~GzkYWQ<tU;zf&q3>WaTW^+sGd(?>
z3z*liXh?_PWA7rfUSW<j?%(BXPTE&uXy1M|1SoU{8K9>{kktUz**VY?D=wMFx&EJh
zsaDF$tMG@@{{3mBp8sy#?}kk`RxjM^X@6jJbaOYS`1QAMrRTKEU3EMpFILsDo~H#9
zX@qL;cwMZStQbyM8g#vF*W92{_1^VnzpER8c9;63&^gw9Co$6g@=wj?K+{s73e6Zb
z^v5@go}E-alk2KYA3Fk;w_%XXf}|Jp{XX0fT>78G!waLuT1&J1;y{zrTyQeC9Gor@
z@1!4EpPKHcA~>q7r>px;setDjOU(1}_uwnvBN6u_V7YWHb+v$~H<yZn;?2WJZuQPP
zp(e6k#>z8JATOcljRd{aXnfH#Ec9BBw|d`Ls2}e~{H%?o4P2;)4|zd%)a@RD&0*tw
zd)y(De7%BH*e;@H1r1nyIqglVJe<h$s%t?WY9X>eK#-oDIGOXe8+CN$|03$iqn-x4
zPt<PFBk>&C^)+IA&ep<WzJgK;etTMV(UD%g3K_0{ww+ZInf)20vD5}z#Y76x1+a+Y
z!aslh{6QhoX0&SD(3>PIgp+2Bedis;BMD}F+q8Q~eae1}$YJMAr{zZSC<le@xnGWV
zBN$RNysxAK`p)Xy{-!1-)8|i^<{HJxwRzH)@A^MUa+|9rMmDTT%%=>F&Hi|N#%@y|
z5*8}5HS`((@5Y8RL;)H@{I*i7tfYiTv_K753Gg$~e>$(9)LmZXWw6Uk7<-U^?H>^a
z(H^HvYk_hd5-MguQ4B-<)-WUa`bS7I2rui9FD23uGE5nayn|Q@Au`c!2@^WgxjvLt
zkMq_D$sQl|&{(Kf8`S6sTj>!7#!wJPXa$^($`$11W*;b=r@kW)+|8B7Ip^M&;JFQ4
z*v>l1T4TDlYTITvhf&h^w_FF`9GZDvJiBnT-#tvs&Tgox($o{DB!CY>cja6b+j*dd
zV{~J^(H8t2gO}$m|43w&{6Zk;hP$JnaKg`hGgDt%+u<Zlz5HMt8LnZtYhNs>g&!8u
zfmSdHwaBw`B1px!96znCtzWpzG}RBkDbivR>ZsUDyWzRJK9fdYUZB3ssDg?}Ei8h$
z62mJ6RAC-%;v95!u@m93MQ-uf24W)x-z4<$>|dZk364|?Cw%givn{}^7P-hYscN{d
zzBz2GW{$yKW6K*#zmf!sp=Ww`_ZSM1C7#vEI?q7lR!amY%pe#*y|J$>22I|L#||Ap
zKYDGOL$uudCj@O~E)-I8`SdQ*9swq}aq~@88xO$HwXcPdhG~8cnm(@^vwwecFofkw
zg^)vk^69LTT$5VI4mLISzf^JuN3T=U0@w;`8WWdBn2$eSq59amRk$1N*lOiO@4n+O
z+D}pxkFM~K8OmWVZvw|_Ee|tx4}<F4Bxq3Sr}FBh1hSXrJ}E33;d#rb(W;{>Vx_iN
z|4wU9)nDkYA9Z%7$A<<D3wMv%NaP4vcluEtXvRd$EV(_Kb)8^_@lOBsG3|<ujs}4P
z4StYzjb&jT2RnY3T)J@aFscbin;7f$+4AlpUva$@0Y=c8apk)sen@%kH5=jngAt~B
zQ7R<Sj#)p!Uh*NS(<v>%okc_5@v3FvFuj*=t@1+?mK#D9i@picuP~r-Jau^Y=tRVf
z%kvkAHmJv_>j~W=?Z*xo{RK*U(@phl{c^->M%krh%dXTOi9Y#laPEsos;A;dFKpKA
zyf7=HnBhfut}C+vqeK|6Su><v1&*8qN_14bWRDW?0i3apH~~SYG9ix<gDQeB1;2F3
zGLn*{9TV`fS4|8)0&wSI%P^%L?NRnyd7$-<Yka{FmIIcfw{2`{(?hvf^CD<9x(Zab
zqCb8lnQQD2qwG@VngmasV0=w`uA|@Q3V%U0^#tpP8WHru`iIZol?b<`)9nBNWxJsk
zS>5>#b$Pj_7n^jf!5Y0W{TDKd#imTishB~im=}|6i2E2|Bv&v#M&4cY-&P)W9m<CG
zth@$pi4vxQc)bSeYwE|{S)ayzhtjS2ICrvWC`<8VX-?X!H%vX0CP{hv!eA4y>(1?Q
zEa9Ns^jtONP#$Hsee@$G!f7IVd;2XrRjc2$TNul5AipRzS#-VY5|~G#JOD!Y56PmO
zNZGiRR{F{o5ZYje@NlpELhG031cr&4h|vYeku)l7zrZ|oWW6R5mc#sF<S^*4)~7Le
zNYbvTJr<WXGi8|Tw-UBV050VN>X#&Lp0%^<2FCy?6aKOqOK+MAW8mek>`PM8XM?CN
zWq<9~zg&5cT*&CkR(XtUb$fezIhdKxMJG7t|CF|*5F_lnq(jpmAoyX}V%Gw9^;2DT
z8=3Lu#4vYNML%Hg6ASe#!`H9J$KyH1SAk*sy@{85=mI420gr??MSuq%(Bo9XCocgx
zB?9H2mZ2ESs)T_W@(v3#@qNs&KN?VPveC5|^*@jJtT#5%vT}(r<jy9>6+ogEwW8By
z1G6hQ_K#uFu>Eea;mfri06l$#D7t-$9-qjEkt=>kqsk@smHHPeyi)6CuWk}eG2<mZ
z=HK;6g-GkEou|+LB4HwXn2^@pgEj|Xo`^Yxf|E29O$6Ffv<$YvxN_!jh$S1T68AR2
z$m_eOPoK6?k6A+^ONdb#IjZbK$A_19A8H1>fSSn?0xfQCE1=nXwti4~6{XDnn2+Xn
zq@%(;AyO`n)P#%TO_3+aoK&FNbJ#+=RV%I~6Y(4$mM15g&7F0$)zq0j=LR*N?FOam
z>+55f(;_(Y(%#m5Ax0)b-(ew&E!}3<l%7BD&oGG27xvJU*gF+05LCtPd`$*7guxyo
z{LoNpzja>&Dd^4E$e?*?r&&9a`vY%Y9kR;>?<Ei8Y2G*`mj-<<g1AiOhJ9dsaPVny
zYVyKN^X$v$Q8{!(2VhG&Dtw`t*;q`0GQ>m=Hh=Ocx~e&4a;QQi{qOjtziIs^K>ume
z+ku-}im2D1futRw_8P^k6qb~bQIf(Wk|t~mK;D4}$bC&1px-cc7eONTL#SW?a`~cF
zG(Jg#am8k2mwL8NdPgNy2VI^=dYM+6)ey8JR+Y<zGcSn#g9I&71>hiH;aCK%A8R{o
zDb^FFqotb(w`{H=A(aCCjyoTXpPG#Scnua)5VfA>f{Q$`r&{p5SZFIuYN8L5pn!^`
zMpmH<9On2PR%(Rpp$CJf7NRMCVGDbgR#$5c%+Ril*8{o%Ca0a511dZ|c4nk@zOWhI
zm>>oMb5Vp}r2W;ii^a^bDvz(PwjhYNP%Zl5R2@pRKcll&BHS7qU!+pT<IIF7y)c@w
zkXoUTHK0B7Z8v~eI;_Ta6$nr6V<L`t{W-x&KO^PaP#EB_FpHPTC){6n8q+(Ity#M}
zQCdewi2Y&3RpKe!cv?d(m$7cF9&p#BUd5lQdf8WZaJ}zhb*GsuF(|8H)PoGhP|Vrf
z|Fmvc_=pBv{Bby;UWKRUXGSXdg4&lN6D;8+uUoCo_c&o(>jfv&L~ujk!(qEh-DX(g
zWsK#_oovY8^|Z%7#uWCjh{=scJ>2pC8+sq^7^J;k7Sl*kB@BMy#V*v<Ql$N`fowTz
zoSVIU0U@oewOljg*%k{I!Pc;N&Cw1G6`Ap@F?N9IpM&ik7wp!UWNH*aPspwFk`(mx
z)>90shQVa=G~qN?9XG{gD_mNtY~zm#oyq2^wb)3j<)Wpf?Jd(Q|Ku|jXrLJ4C=I(I
z)J_x?CROK}n4AP>Hg$nCA)Jtq5UxW)g22VhaNO%P+zh)od@&^({!uk7O^k%=@$m_P
z<zi6OIx>Sr!{}Q>I-2tM!tZ+GEpvestA1Lf9WceFlLwb$r4XSzs$RpH1O|nb0&_O|
z>c?}lvt!7$=x2A<gkisUfnh=h;>YC&FkECc1ip}pg(UgH&1z%)f>f=B6nHD7;ANQK
zDchK1fHKzB(OCtp^T!xxbrMv#+>k}tve7V86Q+!$pXins6Vsfaz6^J7o)i|Wfk!h5
zf(r=q&*Eg7e2jg!A2&M9nOLz8Q-Q-5Gd<Dc$v{l@ELP{GWdz7)^9-t-?Cncl{-BQ0
z8drGr-JAlihLSL@;W}D|9h$~dZrpa@EHF*07C;WFyljZocZ~V}J>JASS?`r=4IyUt
z3I<MR^ikv<{lb+WRkINHi?hx(KDH7UEiv_E0gs6g8fbxsyE`o*TnIN`c7Yl@w&qRU
zUpBTcRvKccyEI90>@gAh;l5%)`z2;pffKIC%H$Q&x$}MT0zvy}>SxzHUmIe%+&M!3
zILw`|=zbbcv*SXlab`z`hli5`6V5ZWPN@m1n3Iz#_>uOnJ{7>sbak^n%SXfDIzYc$
zG(-Otf8m7ETAztC<`^!h1qygP7*tIfRtKI<PS=Cb8Tm7z*iJguqv=0=@M`Co-}xiz
zQeZPnIGny;Qp<s%fgB)(bJ^&X^}SUckERx~{#H^^LBHv<C<^dYPL`^~($m1%G3aIe
zCFVRAJS+*Rlfa=q8_&_>Hs{pTebP>@@b&k*N>4sOz@u@~hl+?%M%8win|yVPYsbfw
z3(+ZfEllS$ci#=(@$Y)Knj%c$t4jS;K&MS+oZXb7&{6UUsbn{VBGtqT&nL$_eX5l`
zd}yY&q6yTo^j%aFzf+6tvCo~f8zt#1-JI{0HykkHhw(9p*aJ3y9Bv?zH{=w4=X(Pu
zGKV_7-{cgbEVlPs+r_yS;F$dpNm^`hc6Rort;)|KpEW>*BuPgOFQTWv=?%@~#6(tU
zL+mzg5yaAt8KS!F!wL%I%1%yBIQ?$Uwi{N;VYEFJ;<>&%t}}~&h2I|`iE}m=rjq<S
z`JMs~sDXhQ2hg@BTwIdq<~}0jid<)h4Go_APd|&ft%|yuT+kQlzC6@`63ONsPEv5|
zzXi?d^E>37YINe~$m4LphWckNyJ$*Syoz`i#98<VsKEM$i7bv3Ns7Mt^KY#1MYPOF
z8+l~qi#mv<lfM4ctZr8qiv~Bdw6tGTlDkd)ZvE6|SkFqi`ir*Lt%=I&R}zSiKo-fe
zA5g`bw}f_y!zxPXl^<2BQ&_kVw&}AbGeSqYHX@Z`GhA9$CY7{vA>LwFi3kaaP5y4~
zTBY-rUHB&B$O*k__r4b7l1#GKTR|0Fcjsn>`_c;mBhMIFA1~4Zx*}B))$`&3txWQE
zwv8EYv%rKMsM=lh`Lz6VR6l)RXHeYxa53}Pn=^l`@<V5UU#f4;MeCHWtBBonZN)T3
zFj7m*d0sc+>#v}GFu7;cOYv&9m`O|JnRlDAr9Ayldr0KeeHO5+avI1$@OS~r&HY@y
z3xJM#%$dw#>`G4rmXHQ9n@Wxaxb(~<ozx$KaF-;V`)3TeR$%HHH11(I!KTnzqi6l2
z()V2@WLm1K4*D^07;^=e?B|<@wDt5nOE-PG&>=58wISLaPIDw^Sz?vY0`1Ky#gUw6
zyY>1YHMg?*whqb$M5#K?G=i3wDNb{Z9!5byh3zY`<o8;Yo`(j9|E~NWevXU;S?|xD
z#eyZ)+Zk{JcCXqOT%IXYt#1gM-ZAHCt8a^1_2*ptm~C*F+iN4C^BVhdeSO{aq)_wY
z%nHZ#eB-{+ROMW}K2bR#+>pk5-c6;a)pOSyB)p`;o6t5>2a{!qU)vNE6h=2^yKMm@
zIUP=Kf6#~@xPzRQu%xQ$zPgV>Ouu`AbhP8~<AudP9nu{c?KETcLW}+<yr+jt-dZ4F
zSE)SPuJOmH^!y5H4j{AV*OcC$s5EMFb|6ode(|C$zqZ!>l>l|tzQnH<H;Mb%&6B%^
zFJG1uK>6W(Y`+5>5r~Dhi>=R}S0@d3$E_L;(<RLu?mBjM-Zm8!ykGdL7?CZ)`RSX}
z&C7l_Tkb;5xDNuL&<x75K`qV;;q`<qbYlg$Fj#PSMMcF(vW``Hi`A#zfhohdQ9~*U
zO0RnnPR_Q*B96Q0cRB8Z12Dr~P`D2WNyqu2NX^ol0^U?gW%_=!53C?$eBUzn#Kc5i
z&_m#j$#msEnM32=_ve@haG#>AfiXKfyTb#CSi9I;>`*EED5-C3JR$lBKUp$XI3~TV
zuke$OzKxyT(o~IAzqhHs+w<9L=Wr3O-kfKCpm@@LCY#Iu!XbdxQp@2pY91_R7a}5}
z1>e)Hn$j;{6g`!cYz7}W9W4h30#wqmCw3zzeQaZhr?!w$(xKWwQ=KuV`?12Ij(7L}
zJ+m)?ZL-W^nvXkq41HNU(yAvt9o+X~1Et)^^pn<iT=P@;Di^IEaEz)Gm&2$`nd|B>
ziYF&0ler25hfx@i&7u}a9-p-Ijb_)<!`@&rll1oeFd=*lh#+|*0kZX*mt1;ZlB6Ux
z3)yV>CJb})lcZF*^d>s|ng&@EHB07e);>~xtj+eEO26ORtI)<FVQla5%oZw~*n0ma
zmEUZsw!#cliXN8Y<V-2v5-bg|I~I{@N;^R<Y;4v8KyunD;h%NLBd;^~3^1is@TbPb
z)W5vD&(00JPS3>5GY}P>><Ib3Y+pEW1v2J_scf=<9EfGL4Q#w&>cngB&y20_74=vF
z&GqSaazD!ZX<=X=%4hhx848L*7zTYPCR-aDhTn!Rj}#c6@bOj2{p%&~iF+otRucI8
zqATcYz|rz|$9}igaD}gE>ZPX8cV#+nMTAp@>Kr%zOsR1lK6(1om(7GskO)32p!|vY
zpt`KAec+_Mt$s>L?dDGc;qFu5#$VQ~Ww*7>-NVDA->nhkhrTSKs1g1xGb5u!w$LZe
zdlci@>C(b=axg0}SGU1j{ZG#1VEEPlAK(S|%}WTw6s$gcUq0>oX_z_U#gXUEwLUH>
zDH)_X9rJ=5*S<%>b(z`D2CH%X?_VCvjnzI(tsuI`A3y5^Zd}~BU<lZa7x8*JW!x%1
z8)pJ{;73Lc%{E#O7Sv0Fo$MzqSf$ttv(i&j#hc2?-g+B}^rO_rv9-0ew{yUl?Q(N-
zo7rvPv(iqav1q_wrqFV&FGX&p2Fovpo$ZS27g`O*!QiuKno`@)7hIwu^u!N;+_K8)
zFtFe!40Hp>(Mj%_rlyN3V7Ooc<DJ1Q8gxI7R*Eloc6Y-iV*P5Sc5n=LgEjP8;THBR
zy_&4PF!igE+uK{4a{WqT+p;~-uM*fqwDPjK)kXmUcVL)RE6>6JU*WoiylBOOs4Ya2
zdkthYTb}uw1V6vaE)G-0t8_jOaJqGaFk@(NaL^egGv<~x3Y~~ZkFc+76Y%&Vxs(|x
z!&=6k#|y|dIr$|!%^iY{b2O^4v}t}eFauIDLElqYFq=wQE4cBo2w;QzBH&2@6$d8_
z1f;vssqLp5y`}A+Mxsj3<lWYW7-(>kdl$sAJjp%AX^t+k_ZKMPPj+4`S~^#|ix$9D
zns>^$;R~$|!L6-Q=!hzlHp8&6uq!kFe_^;0J>Y(Yc>R>8w3j0ZI>;hamOAgUK&g9N
jcuZK}|GOe%A4o7TMc9EH=0))TvH&$DO=y*ZdC30(3SM-O

literal 0
HcmV?d00001

diff --git a/partitions/tests/e2e-smoke.mjs b/partitions/tests/e2e-smoke.mjs
new file mode 100644
index 0000000..ab60f6b
--- /dev/null
+++ b/partitions/tests/e2e-smoke.mjs
@@ -0,0 +1,200 @@
+/**
+ * End-to-end smoke test (dependency-free) driving the system Chromium via CDP.
+ *
+ * Prerequisites:
+ *   - API running:  cd api && php -c php-upload.ini -S localhost:8000 router.php
+ *   - Front running: cd partitions && npm run dev
+ *
+ * Run: npm run test:e2e
+ *
+ * Env overrides: API_URL, FRONT_URL, CHROME_PATH, LOGIN_USER, LOGIN_PASS
+ */
+import { spawn } from 'node:child_process';
+
+const API = process.env.API_URL || 'http://localhost:8000';
+const FRONT = process.env.FRONT_URL || 'http://localhost:5173';
+const CHROME = process.env.CHROME_PATH || 'chromium';
+const USER = process.env.LOGIN_USER || 'admin';
+const PASS = process.env.LOGIN_PASS || 'password';
+const CDP_PORT = 9300 + Math.floor(Math.random() * 400);
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let passed = 0;
+let failed = 0;
+function check(name, cond) {
+	if (cond) {
+		console.log(`✓ ${name}`);
+		passed++;
+	} else {
+		console.log(`✗ ${name}`);
+		failed++;
+	}
+}
+
+async function waitForCdp() {
+	for (let i = 0; i < 60; i++) {
+		try {
+			const list = await (await fetch(`http://127.0.0.1:${CDP_PORT}/json`)).json();
+			const page = list.find((t) => t.type === 'page');
+			if (page) return page.webSocketDebuggerUrl;
+		} catch {
+			/* retry */
+		}
+		await sleep(250);
+	}
+	throw new Error('CDP endpoint not available');
+}
+
+const chrome = spawn(
+	CHROME,
+	[
+		`--remote-debugging-port=${CDP_PORT}`,
+		'--headless=new',
+		'--no-sandbox',
+		'--disable-gpu',
+		'--window-size=1280,900',
+		`--user-data-dir=/tmp/opencode/e2e-profile-${CDP_PORT}`,
+		'about:blank'
+	],
+	{ stdio: 'ignore' }
+);
+
+let ws;
+try {
+	// 1. Verify servers are up
+	const apiLogin = await fetch(`${API}/login`, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ username: USER, password: PASS })
+	}).then((r) => r.json());
+	check('API login succeeds', apiLogin.success === true && !!apiLogin.token);
+
+	const frontStatus = await fetch(FRONT).then((r) => r.status).catch(() => 0);
+	check('Frontend dev server reachable', frontStatus === 200);
+
+	// 2. Connect to Chromium
+	ws = new WebSocket(await waitForCdp());
+	await new Promise((res, rej) => {
+		ws.onopen = res;
+		ws.onerror = rej;
+	});
+
+	let id = 0;
+	const pending = new Map();
+	const apiResponses = [];
+	const downloadRequests = [];
+	ws.onmessage = (ev) => {
+		const m = JSON.parse(ev.data);
+		if (m.id && pending.has(m.id)) {
+			pending.get(m.id).res(m.result);
+			pending.delete(m.id);
+		} else if (m.method === 'Network.responseReceived' && m.params.response.url.startsWith(API)) {
+			apiResponses.push({ status: m.params.response.status, url: m.params.response.url });
+		} else if (m.method === 'Network.requestWillBeSent' && m.params.request.url.includes('/download/')) {
+			downloadRequests.push({
+				url: m.params.request.url,
+				method: m.params.request.method,
+				headers: m.params.request.headers
+			});
+		}
+	};
+	const send = (method, params = {}) =>
+		new Promise((res) => {
+			const i = ++id;
+			pending.set(i, { res });
+			ws.send(JSON.stringify({ id: i, method, params }));
+		});
+
+	await send('Page.enable');
+	await send('Runtime.enable');
+	await send('Network.enable');
+
+	// 3. Login through the API then inject the session (same as the app does)
+	await send('Page.navigate', { url: `${FRONT}/` });
+	await sleep(2500);
+	await send('Runtime.evaluate', {
+		expression: `localStorage.setItem('auth', ${JSON.stringify(JSON.stringify({ token: apiLogin.token, user: apiLogin.user }))})`
+	});
+
+	async function visit(path, expectation) {
+		apiResponses.length = 0;
+		await send('Page.navigate', { url: FRONT + path });
+		await sleep(3500);
+		const body = await send('Runtime.evaluate', {
+			expression: 'document.body.innerText',
+			returnByValue: true
+		});
+		const text = body.result.value || '';
+		const bad = apiResponses.filter((r) => r.status >= 400);
+		check(`${path}: no API error`, bad.length === 0);
+		check(`${path}: ${expectation.label}`, expectation.test(text));
+		const pathname = await send('Runtime.evaluate', {
+			expression: 'window.location.pathname',
+			returnByValue: true
+		});
+		check(`${path}: stays on page`, pathname.result.value === path);
+		return text;
+	}
+
+	// 4. Public pages
+	await visit('/scores', { label: 'renders repertoire', test: (t) => t.includes('Répertoire') });
+	await visit('/admin', { label: 'renders admin', test: (t) => t.includes('Administration') });
+
+	// 5. Pick a real score/instrument through the API and open the viewer
+	const token = apiLogin.token;
+	const auth = { Authorization: `Bearer ${token}` };
+	const scores = await fetch(`${API}/scores`, { headers: auth }).then((r) => r.json());
+	const candidates = scores.scores || [];
+	check('API returns at least one score', candidates.length > 0);
+
+	// Find a score that actually has an instrument with files (skip empty ones)
+	let chosen = null;
+	for (const score of candidates.slice(0, 25)) {
+		const instr = await fetch(`${API}/scores/${score.id}/instruments`, { headers: auth }).then((r) => r.json());
+		const instrument = (instr.instruments || []).find((i) => i.parts?.[0]?.files?.length);
+		if (instrument) {
+			chosen = { scoreId: score.id, instrument };
+			break;
+		}
+	}
+	check('API returns a playable score/instrument', !!chosen);
+
+	if (chosen) {
+		await visit(`/scores/${chosen.scoreId}`, {
+			label: 'renders score detail',
+			test: (t) => t.length > 0
+		});
+
+		const viewerPath = `/scores/${chosen.scoreId}/${chosen.instrument.piece}/${chosen.instrument.id}`;
+		downloadRequests.length = 0;
+		await visit(viewerPath, { label: 'renders instrument', test: (t) => t.length > 0 });
+		check('Viewer fetches the PDF', downloadRequests.some((r) => r.method === 'GET'));
+		const getDownloads = downloadRequests.filter((r) => r.method === 'GET');
+		const hasAuthHeader = getDownloads.every((r) =>
+			Object.keys(r.headers).some((k) => k.toLowerCase() === 'authorization')
+		);
+		check(
+			'PDF download uses Authorization header',
+			hasAuthHeader && getDownloads.every((r) => !r.url.includes('token='))
+		);
+
+		await visit(`/admin/${chosen.scoreId}`, {
+			label: 'renders admin detail',
+			test: (t) => t.includes('Informations de la partition')
+		});
+	}
+
+	console.log(`\n=== E2E Summary ===\nPassed: ${passed}\nFailed: ${failed}\nTotal: ${passed + failed}`);
+	if (failed > 0) {
+		console.log('\n⚠ Some E2E checks failed!');
+		process.exitCode = 1;
+	} else {
+		console.log('\n✓ All E2E checks passed!');
+	}
+} catch (err) {
+	console.error('E2E error:', err.message || err);
+	process.exitCode = 1;
+} finally {
+	if (ws) ws.close();
+	chrome.kill();
+}
diff --git a/partitions/vite.config.ts b/partitions/vite.config.ts
index 1707138..18f2561 100644
--- a/partitions/vite.config.ts
+++ b/partitions/vite.config.ts
@@ -5,8 +5,5 @@ export default defineConfig({
 	plugins: [sveltekit()],
 	server: {
 		port: 5173
-	},
-	define: {
-		'import.meta.env.VITE_API_URL': JSON.stringify(process.env.VITE_API_URL || 'http://localhost:8000')
 	}
 });
diff --git a/test.sh b/test.sh
new file mode 100755
index 0000000..b778c98
--- /dev/null
+++ b/test.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+#
+# Run the whole OHMJ test suite:
+#   1. Backend functional tests (api/tests.php)
+#   2. Backend code coverage (Xdebug, if available)
+#   3. Frontend type/a11y check (svelte-check)
+#   4. Frontend E2E smoke test (Chromium via CDP)
+#
+# Usage: ./test.sh
+# Servers are started automatically if not already running, and stopped at the end.
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+API_DIR="$ROOT/api"
+FRONT_DIR="$ROOT/partitions"
+API_URL="http://localhost:8000"
+FRONT_URL="http://localhost:5173"
+COV_DIR="${TMPDIR:-/tmp}/ohmj_cov"
+
+API_PID=""
+FRONT_PID=""
+STARTED_API=0
+STARTED_FRONT=0
+FAILED=0
+
+cleanup() {
+	rm -f "${TMPDIR:-/tmp}"/rate_* 2>/dev/null || true
+	if [ "$STARTED_API" = "1" ] && [ -n "$API_PID" ]; then
+		kill -TERM "-$API_PID" 2>/dev/null || kill "$API_PID" 2>/dev/null || true
+	fi
+	if [ "$STARTED_FRONT" = "1" ] && [ -n "$FRONT_PID" ]; then
+		kill -TERM "-$FRONT_PID" 2>/dev/null || kill "$FRONT_PID" 2>/dev/null || true
+	fi
+}
+trap cleanup EXIT
+
+wait_http() {
+	local url="$1" tries="${2:-40}"
+	for _ in $(seq 1 "$tries"); do
+		if curl -s -m 2 -o /dev/null "$url"; then
+			return 0
+		fi
+		sleep 0.5
+	done
+	return 1
+}
+
+has_xdebug() {
+	php -d zend_extension=xdebug -r 'exit(function_exists("xdebug_start_code_coverage") ? 0 : 1);' 2>/dev/null
+}
+
+# Xdebug is present but commented in php.ini: load it explicitly via -d.
+XDEBUG=0
+if has_xdebug; then
+	XDEBUG=1
+fi
+
+echo "=== OHMJ test suite ==="
+echo "Backend : php -c php-upload.ini -S localhost:8000 router.php"
+echo "Frontend: npm run check && npm run test:e2e"
+echo "Coverage: $([ "$XDEBUG" = "1" ] && echo 'Xdebug available' || echo 'Xdebug not found (skipped)')"
+echo
+
+# ---------- Backend + coverage ----------
+rm -rf "$COV_DIR" 2>/dev/null || true
+rm -f "${TMPDIR:-/tmp}"/rate_* 2>/dev/null || true
+
+echo "--- [1/4] Backend tests ---"
+if curl -s -m 2 -o /dev/null "$API_URL/login" -X POST -H 'Content-Type: application/json' -d '{}' 2>/dev/null; then
+	echo "API already running, reusing it (coverage may be skipped)."
+else
+	if [ "$XDEBUG" = "1" ]; then
+		( cd "$API_DIR" && setsid php -d zend_extension=xdebug -d xdebug.mode=coverage \
+			-d auto_prepend_file="$API_DIR/coverage-prepend.php" \
+			-c php-upload.ini -S localhost:8000 router.php >/tmp/ohmj_api.log 2>&1 </dev/null & echo $! >/tmp/ohmj_api.pid )
+	else
+		( cd "$API_DIR" && setsid php -c php-upload.ini -S localhost:8000 router.php >/tmp/ohmj_api.log 2>&1 </dev/null & echo $! >/tmp/ohmj_api.pid )
+	fi
+	API_PID="$(cat /tmp/ohmj_api.pid)"
+	STARTED_API=1
+	wait_http "$API_URL/login" || { echo "API failed to start (see /tmp/ohmj_api.log)"; exit 1; }
+fi
+
+rm -f "${TMPDIR:-/tmp}"/rate_* 2>/dev/null || true
+if ( cd "$API_DIR" && php tests.php ); then
+	echo "Backend tests: OK"
+else
+	echo "Backend tests: FAILED"
+	FAILED=1
+fi
+
+echo
+echo "--- [2/4] Backend coverage ---"
+if [ "$XDEBUG" = "1" ] && [ "$STARTED_API" = "1" ]; then
+	rm -f "${TMPDIR:-/tmp}"/rate_* 2>/dev/null || true
+	( cd "$API_DIR" && php -d zend_extension=xdebug -d xdebug.mode=coverage \
+		-d auto_prepend_file="$API_DIR/coverage-prepend.php" tests.php >/dev/null 2>&1 )
+	( cd "$ROOT" && SHOW_MISSING=1 php api/coverage-report.php \
+		api/index.php api/router.php api/lib/Auth.php api/lib/ScoreScanner.php )
+elif [ "$XDEBUG" != "1" ]; then
+	echo "Xdebug not available: run 'omarchy-pkg-install xdebug' to enable coverage."
+else
+	echo "External API detected: coverage skipped (it needs the instrumented server)."
+	echo "Stop the running API and re-run ./test.sh to measure coverage."
+fi
+
+# ---------- Frontend ----------
+echo
+echo "--- [3/4] Frontend check (svelte-check) ---"
+if ( cd "$FRONT_DIR" && npm run check ); then
+	echo "Frontend check: OK"
+else
+	echo "Frontend check: FAILED"
+	FAILED=1
+fi
+
+echo
+echo "--- [4/4] Frontend E2E smoke test ---"
+if curl -s -m 2 -o /dev/null "$FRONT_URL/"; then
+	echo "Frontend already running, reusing it."
+else
+	( cd "$FRONT_DIR" && setsid npm run dev -- --port 5173 >/tmp/ohmj_front.log 2>&1 </dev/null & echo $! >/tmp/ohmj_front.pid )
+	FRONT_PID="$(cat /tmp/ohmj_front.pid)"
+	STARTED_FRONT=1
+	wait_http "$FRONT_URL/" || { echo "Frontend failed to start (see /tmp/ohmj_front.log)"; exit 1; }
+fi
+
+if ( cd "$FRONT_DIR" && npm run test:e2e ); then
+	echo "E2E: OK"
+else
+	echo "E2E: FAILED"
+	FAILED=1
+fi
+
+echo
+if [ "$FAILED" = "1" ]; then
+	echo "=== RESULT: FAILURES ==="
+	exit 1
+fi
+echo "=== RESULT: ALL GREEN ==="