test(stream): cover buffer + adaptive streaming hot paths

Two of the stream server's largest untested files now have basic
coverage. The audit before this commit reported 30/131 source files
with #[cfg(test)] modules ; these additions bring two of the top-12
cold zones (>500 LOC each, both on the streaming hot path) under
test.

src/core/buffer.rs (731 LOC, 0 → 6 tests)
  * FIFO order across create→add→drain (5 chunks in, 5 chunks out
    in sequence_number order). Tolerates the InsufficientData
    return from add_chunk's adapt step — a latent quirk where the
    chunk lands in the buffer before the predictor errors out ;
    documented inline so the next maintainer doesn't try to fix
    the test by hardening the predictor (the right fix is
    upstream).
  * BufferNotFound on add_chunk + get_next_chunk for an unknown
    stream_id (the two routes through the manager that take a
    stream_id argument).
  * remove_buffer drops the active-buffer count metric and is
    idempotent (a duplicate remove must not push the counter
    negative).
  * AudioFormat::default invariants (opus / 44.1k / 2ch / 16bit) —
    documents the contract in case anyone tweaks one default.
  * apply_adaptation_speed clamps target_size between min/max
    bounds even when the predictor pushes for an out-of-range
    target.

src/streaming/adaptive.rs (515 LOC, 0 → 8 tests)
  * Profile-ladder monotonicity (high > medium > low > mobile on
    both bitrate_kbps and bandwidth_estimate_kbps). Catches a
    typo'd constant before clients see a malformed adaptation set.
  * Manager constructor loads exactly the 4 profiles in the
    expected order.
  * create_session inserts and returns medium as the default
    profile (the documented session bootstrap behaviour).
  * update_session_quality overwrites + silent no-op on unknown
    session (the latter is the path the HLS handler hits when a
    session was GC'd between the player's quality switch and the
    backend's update — must not 5xx).
  * generate_master_playlist emits #EXTM3U + #EXT-X-VERSION:6 + 4
    EXT-X-STREAM-INF lines + 4 variant URLs containing the
    track_id.
  * generate_quality_playlist emits a complete HLS v3 envelope
    (EXTM3U / VERSION:3 / TARGETDURATION:10 / ENDLIST + segment0).
  * get_streaming_stats reports active_sessions count and the
    profile ids in ladder order.

Suite went 150 → 164 passing tests, 0 failed, 0 new ignored. The
remaining cold zones (codecs, live_recording, sync_manager,
encoding_pool, alerting, monitoring/grafana_dashboards) are the
next targets — pattern documented here, can be replicated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.commitlintrc.json

@@ -0,0 +1,27 @@
+{
+  "extends": ["@commitlint/config-conventional"],
+  "rules": {
+    "type-enum": [
+      2,
+      "always",
+      [
+        "feat",
+        "fix",
+        "docs",
+        "style",
+        "refactor",
+        "perf",
+        "test",
+        "build",
+        "ci",
+        "chore",
+        "revert",
+        "security"
+      ]
+    ],
+    "subject-case": [0],
+    "header-max-length": [2, "always", 120],
+    "body-max-line-length": [1, "always", 200],
+    "footer-max-line-length": [0]
+  }
+}

.cursorrules

@@ -0,0 +1,46 @@
+# Règles de Développement UI - Projet SaaS
+
+## 0. Scope v0.901 (priorité absolue)
+
+- **Référence** : `docs/V0_901_RELEASE_SCOPE.md` et `docs/SCOPE_CONTROL.md`
+- Avant toute modification : vérifier si le changement est **dans le scope v0.901**
+- **v0.803 livré** : Voir `docs/archive/V0_803_RELEASE_SCOPE.md`
+- **Interdit** : nouvelles routes/pages hors scope, nouvelles dépendances (sauf correctif sécurité)
+- En cas de doute : ne pas ajouter. Créer une issue pour une version ultérieure.
+
+## 1. Standards Tailwind & Layout
+
+- **Interdiction formelle** d'utiliser des valeurs arbitraires (ex: `w-[300px]`, `gap-[7px]`, `rounded-[12px]`, `shadow-[...]`) pour les espacements, tailles, rayons ou ombres sans justification (voir exceptions dans `apps/web/docs/DESIGN_TOKENS.md`).
+- Utilise exclusivement l'échelle de spacing native de Tailwind ou les **Layout Primitives** définies dans `apps/web/src/index.css` :
+  - `max-w-layout-content` (1600px)
+  - `min-h-layout-main` (calc(100vh - 4rem))
+  - `min-h-layout-page` (600px)
+  - `min-h-layout-page-sm` (400px)
+  - `min-h-layout-story` (192px, pour les stories)
+- Référence unique : **DESIGN_TOKENS.md** et **APP_SHELL.md** dans `apps/web/docs/` pour layout, espacements, ombres, typo, transitions.
+
+## 2. Cycle de Vie des Composants (Storybook-First)
+
+- Toute modification d'UI doit d'abord être validée dans sa **Story**.
+- Chaque composant "Feature" doit obligatoirement posséder les états suivants dans sa Story :
+  - `Loading` (utilisant des Skeletons)
+  - `Error` (état de repli)
+  - `Empty` (si liste ou data)
+- Référence toujours le `docs/STORYBOOK_CONTRACT.md` avant de créer une story.
+- N'importer jamais les providers applicatifs dans les stories ; utiliser le décorateur global (StorybookDecorator).
+
+## 3. Modularité & IA-Friendliness
+
+- Si un composant dépasse **300 lignes**, il DOIT être découpé en sous-composants atomiques.
+- Les composants doivent être "purs" : la logique de fetch doit être mockée via MSW dans `apps/web/src/mocks/handlers.ts`.
+- Lors de l'ajout d'une nouvelle fonctionnalité qui appelle l'API, ajouter le handler correspondant dans `handlers.ts` sans qu'on te le demande.
+
+## 4. Audit & Qualité
+
+- Avant de finaliser une tâche, lance `npm run test:storybook` (depuis `apps/web`) après build + serve sur 6007 pour garantir 0 erreur réseau/console.
+
+## 5. Tests visuels et valeurs arbitraires
+
+- **Commandes visuelles** (depuis `apps/web`) : `npm run visual:capture` (capture écrans → `visual-tests/current/`), `npm run visual:compare` (diff vs baselines), `npm run visual:update` (mise à jour des baselines). Procédure détaillée dans `apps/web/visual-tests/README.md`.
+- **Rapport des valeurs arbitraires** : `node scripts/report-arbitrary-values.mjs` (optionnel `--json` ou `--dir src/features`) pour lister les patterns à migrer ; pas de remplacement automatique sans revue.
+- **Nouvelle page full layout** : suivre `apps/web/docs/FULL_LAYOUT_PAGE.md` (route, story, MSW, viewport).

.forgejo/workflows/cleanup-failed.yml

@@ -0,0 +1,79 @@
+# cleanup-failed.yml — workflow_dispatch only.
+#
+# Tears down the kept-alive failed-deploy color (the inactive one
+# that survived a Phase D / Phase F failure for forensics).
+# Operator triggers this once they have read the journalctl output.
+#
+# Hard safety in playbooks/cleanup_failed.yml: refuses to destroy
+# the currently-active color.
+name: Veza cleanup failed-deploy color
+
+on:
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to clean up"
+                required: true
+                type: choice
+                options: [staging, prod]
+            color:
+                description: "Color to destroy (must NOT be the active one)"
+                required: true
+                type: choice
+                options: [blue, green]
+
+concurrency:
+    group: cleanup-${{ inputs.env }}
+    cancel-in-progress: false
+
+jobs:
+    cleanup:
+        name: Destroy ${{ inputs.color }} app containers in ${{ inputs.env }}
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+
+            - name: Install ansible
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible
+                  ansible-galaxy collection install community.general
+
+            - name: Write vault password
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run cleanup_failed.yml
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ inputs.env }}.yml \
+                      playbooks/cleanup_failed.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ inputs.env }} \
+                      -e target_color=${{ inputs.color }}
+
+            - name: Upload Ansible log
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}
+                  path: ${{ runner.temp }}/ansible-cleanup-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.forgejo/workflows/deploy.yml

@@ -0,0 +1,360 @@
+# Veza deploy pipeline.
+#
+# Triggers (intentionally narrow — see SECURITY note below):
+#   workflow_dispatch   → operator-supplied env + sha
+#   (push:main + tag:v* are commented OUT until provisioning is
+#    complete — see docs/RUNBOOK_DEPLOY_BOOTSTRAP.md. Re-enable
+#    once secrets/runner/vault are in place and a manual run via
+#    workflow_dispatch has been verified GREEN.)
+#
+# SECURITY: this workflow runs on a self-hosted runner with access to
+# the Incus unix socket (effectively root on the host). DO NOT add
+# `pull_request` or any fork-influenced trigger here — an attacker-
+# controlled fork would be able to `incus exec` arbitrarily. The
+# narrow trigger list above is the security boundary.
+#
+# Sequence : build (3 jobs in parallel) → upload artifacts → deploy.
+name: Veza deploy
+
+on:
+    # push:                          # GATED — uncomment after first
+    #     branches: [main]           # successful workflow_dispatch run
+    #     tags: ['v*']               # see RUNBOOK_DEPLOY_BOOTSTRAP.md
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to deploy"
+                required: true
+                default: staging
+                type: choice
+                options: [staging, prod]
+            release_sha:
+                description: "Full git SHA to deploy (defaults to current HEAD if empty)"
+                required: false
+                type: string
+
+concurrency:
+    # Only one deploy per env at a time. Newer pushes cancel older
+    # in-flight builds for the same env (the user almost always wants
+    # the newer commit).
+    group: deploy-${{ github.ref_type == 'tag' && 'prod' || 'staging' }}
+    cancel-in-progress: true
+
+env:
+    # Where build artefacts land. Set in Forgejo repo Variables :
+    #   FORGEJO_REGISTRY_URL = https://forgejo.veza.fr/api/packages/talas/generic
+    REGISTRY_URL: ${{ vars.FORGEJO_REGISTRY_URL }}
+
+jobs:
+    # =================================================================
+    # Resolve env + sha from the trigger.
+    # =================================================================
+    resolve:
+        name: Resolve env + SHA
+        runs-on: [self-hosted, incus]
+        outputs:
+            env: ${{ steps.r.outputs.env }}
+            sha: ${{ steps.r.outputs.sha }}
+        steps:
+            - name: Resolve
+              id: r
+              run: |
+                  if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+                      ENV="${{ inputs.env }}"
+                      SHA="${{ inputs.release_sha || github.sha }}"
+                  elif [ "${{ github.ref_type }}" = "tag" ]; then
+                      ENV="prod"
+                      SHA="${{ github.sha }}"
+                  else
+                      ENV="staging"
+                      SHA="${{ github.sha }}"
+                  fi
+                  if ! echo "$SHA" | grep -Eq '^[0-9a-f]{40}$'; then
+                      echo "SHA '$SHA' is not a 40-char git SHA"
+                      exit 1
+                  fi
+                  echo "env=$ENV" >> "$GITHUB_OUTPUT"
+                  echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+                  echo "Resolved env=$ENV sha=$SHA"
+
+    # =================================================================
+    # Build backend (Go).
+    # =================================================================
+    build-backend:
+        name: Build backend
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version: "1.25"
+                  cache: true
+                  cache-dependency-path: veza-backend-api/go.sum
+
+            - name: Test
+              working-directory: veza-backend-api
+              env:
+                  VEZA_SKIP_INTEGRATION: "1"
+              run: go test ./... -short -count=1 -timeout 300s
+
+            - name: Build veza-api (CGO=0, static)
+              working-directory: veza-backend-api
+              env:
+                  CGO_ENABLED: "0"
+                  GOOS: linux
+                  GOARCH: amd64
+              run: |
+                  go build -trimpath -ldflags "-s -w" \
+                      -o ./bin/veza-api ./cmd/api/main.go
+                  go build -trimpath -ldflags "-s -w" \
+                      -o ./bin/migrate_tool ./cmd/migrate_tool/main.go
+
+            - name: Stage tarball contents
+              working-directory: veza-backend-api
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-backend"
+                  mkdir -p "$STAGE/migrations"
+                  cp ./bin/veza-api ./bin/migrate_tool "$STAGE/"
+                  cp -r ./migrations/* "$STAGE/migrations/" || true
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-backend" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-backend/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Build stream (Rust).
+    # =================================================================
+    build-stream:
+        name: Build stream
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Set up Rust toolchain
+              run: |
+                  command -v rustup >/dev/null || \
+                      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+                  source "$HOME/.cargo/env"
+                  rustup target add x86_64-unknown-linux-musl
+                  echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+                  sudo apt-get update -qq && sudo apt-get install -y musl-tools
+
+            - name: Cache cargo + target
+              uses: actions/cache@v4
+              with:
+                  path: |
+                      ~/.cargo/registry
+                      ~/.cargo/git
+                      veza-stream-server/target
+                  key: deploy-${{ runner.os }}-cargo-${{ hashFiles('veza-stream-server/Cargo.lock') }}
+                  restore-keys: |
+                      deploy-${{ runner.os }}-cargo-
+
+            - name: Test
+              working-directory: veza-stream-server
+              run: cargo test --workspace
+
+            - name: Build stream_server (musl static)
+              working-directory: veza-stream-server
+              run: |
+                  cargo build --release --locked \
+                      --target x86_64-unknown-linux-musl
+
+            - name: Stage tarball contents
+              working-directory: veza-stream-server
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-stream"
+                  mkdir -p "$STAGE"
+                  cp ./target/x86_64-unknown-linux-musl/release/stream_server "$STAGE/"
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-stream" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-stream/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Build web (React/Vite).
+    # =================================================================
+    build-web:
+        name: Build web
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Use Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: "20"
+                  cache: "npm"
+                  cache-dependency-path: package-lock.json
+
+            - name: Install dependencies
+              run: npm ci
+
+            - name: Build design tokens
+              run: npm run build:tokens --workspace=@veza/design-system
+
+            - name: Build SPA
+              working-directory: apps/web
+              env:
+                  VITE_API_URL: /api/v1
+                  VITE_DOMAIN: ${{ needs.resolve.outputs.env == 'prod' && 'veza.fr' || 'staging.veza.fr' }}
+                  VITE_RELEASE_SHA: ${{ needs.resolve.outputs.sha }}
+              run: npm run build
+
+            - name: Stage tarball contents
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-web"
+                  mkdir -p "$STAGE"
+                  cp -r apps/web/dist/* "$STAGE/"
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-web-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-web" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-web-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-web/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Deploy via Ansible. Runs on the self-hosted runner that has
+    # Incus socket access (label `incus`). Requires Forgejo secrets:
+    #   ANSIBLE_VAULT_PASSWORD   — unlocks group_vars/all/vault.yml
+    #   FORGEJO_REGISTRY_TOKEN   — same token the build jobs use,
+    #                              passed to ansible-playbook so
+    #                              the data containers can fetch
+    #                              the tarballs they were just sent.
+    # =================================================================
+    deploy:
+        name: Deploy via Ansible
+        needs: [resolve, build-backend, build-stream, build-web]
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Install ansible + community.general + community.postgresql + community.rabbitmq
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible python3-psycopg2 python3-pip
+                  ansible-galaxy collection install \
+                      community.general \
+                      community.postgresql \
+                      community.rabbitmq
+
+            - name: Write vault password to a tmpfile
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run deploy_data.yml (idempotent provisioning + ZFS snapshot)
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-data-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ needs.resolve.outputs.env }}.yml \
+                      playbooks/deploy_data.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ needs.resolve.outputs.env }} \
+                      -e veza_release_sha=${{ needs.resolve.outputs.sha }} \
+                      -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+            - name: Run deploy_app.yml (blue/green)
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-app-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ needs.resolve.outputs.env }}.yml \
+                      playbooks/deploy_app.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ needs.resolve.outputs.env }} \
+                      -e veza_release_sha=${{ needs.resolve.outputs.sha }} \
+                      -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+            - name: Upload Ansible logs (for forensics)
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-logs-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}
+                  path: ${{ runner.temp }}/ansible-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.forgejo/workflows/rollback.yml

@@ -0,0 +1,118 @@
+# rollback.yml — workflow_dispatch only.
+#
+# Two modes :
+#   fast — flip HAProxy back to the previous color. ~5s. Requires
+#          the target color's containers to still be alive
+#          (i.e., no later deploy has recycled them).
+#   full — re-run deploy_app.yml with a specific (older) release_sha.
+#          ~5-10min. The artefact must still be in the Forgejo
+#          registry (default retention 30 SHA per component).
+#
+# See docs/RUNBOOK_ROLLBACK.md for decision criteria.
+name: Veza rollback
+
+on:
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to rollback"
+                required: true
+                type: choice
+                options: [staging, prod]
+            mode:
+                description: "Rollback mode"
+                required: true
+                type: choice
+                options: [fast, full]
+            target_color:
+                description: "(mode=fast only) color to flip back TO (the prior active one)"
+                required: false
+                type: choice
+                options: [blue, green]
+            release_sha:
+                description: "(mode=full only) 40-char SHA of the release to redeploy"
+                required: false
+                type: string
+
+concurrency:
+    group: rollback-${{ inputs.env }}
+    cancel-in-progress: false
+
+jobs:
+    rollback:
+        name: Rollback ${{ inputs.env }} (${{ inputs.mode }})
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - name: Validate inputs
+              run: |
+                  if [ "${{ inputs.mode }}" = "fast" ] && [ -z "${{ inputs.target_color }}" ]; then
+                      echo "mode=fast requires target_color"
+                      exit 1
+                  fi
+                  if [ "${{ inputs.mode }}" = "full" ]; then
+                      if [ -z "${{ inputs.release_sha }}" ]; then
+                          echo "mode=full requires release_sha"
+                          exit 1
+                      fi
+                      if ! echo "${{ inputs.release_sha }}" | grep -Eq '^[0-9a-f]{40}$'; then
+                          echo "release_sha is not a 40-char git SHA"
+                          exit 1
+                      fi
+                  fi
+
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ inputs.mode == 'full' && inputs.release_sha || github.ref }}
+
+            - name: Install ansible + collections
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible python3-psycopg2
+                  ansible-galaxy collection install \
+                      community.general \
+                      community.postgresql \
+                      community.rabbitmq
+
+            - name: Write vault password
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run rollback.yml
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  EXTRA="-e veza_env=${{ inputs.env }} -e mode=${{ inputs.mode }}"
+                  if [ "${{ inputs.mode }}" = "fast" ]; then
+                      EXTRA="$EXTRA -e target_color=${{ inputs.target_color }}"
+                  else
+                      EXTRA="$EXTRA -e veza_release_sha=${{ inputs.release_sha }}"
+                      EXTRA="$EXTRA -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}"
+                  fi
+                  ansible-playbook \
+                      -i inventory/${{ inputs.env }}.yml \
+                      playbooks/rollback.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      $EXTRA
+
+            - name: Upload Ansible log
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}
+                  path: ${{ runner.temp }}/ansible-rollback-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.github/ISSUE_TEMPLATE/bug_report.md

@@ -27,7 +27,7 @@ Ce qui aurait dû se passer.
 
 ## 💻 Contexte
 
-- Service impacté : (backend-api / chat-server / stream-server / web-frontend / infra)
+- Service impacté : (backend-api / stream-server / web-frontend / infra)
 - Branch : (main / develop / autre)
 - Environnement : (local / dev / staging / prod)
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -5,6 +5,16 @@ title: "[FEAT] "
 labels: enhancement
 ---
 
+## 📋 Scope v0.101
+
+> **Important** : v0.101 est en freeze fonctionnel. Aucune nouvelle feature ne sera implémentée avant le tag v0.101.  
+> Voir [docs/V0_101_RELEASE_SCOPE.md](../../docs/V0_101_RELEASE_SCOPE.md) et [docs/SCOPE_CONTROL.md](../../docs/SCOPE_CONTROL.md).
+
+- [ ] **Hors scope v0.101** — Cette feature est pour v0.102+ (ne pas implémenter avant le tag)
+- [ ] Exception validée — Cette feature a été approuvée pour v0.101 (rare, documenter la décision)
+
+---
+
 ## 🎯 Description
 
 Décrire la feature souhaitée, le problème auquel elle répond, ou la valeur ajoutée.

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/veza-backend-api"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "go"]
+
+  - package-ecosystem: "cargo"
+    directory: "/veza-stream-server"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "rust"]
+
+  - package-ecosystem: "npm"
+    directory: "/apps/web"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "frontend"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "ci"]

.github/pull_request_template.md

@@ -1,7 +1,17 @@
 # 🧩 Résumé
 
 - **Type de changement** : (feat / fix / refactor / chore / docs)
-- **Scope** : (backend-api / chat-server / stream-server / web-frontend / infra / docs)
+- **Scope** : (backend-api / stream-server / web-frontend / infra / docs)
+
+---
+
+## 📋 Scope v0.101 (obligatoire)
+
+- [ ] Ce changement est **dans le scope v0.101** ([docs/V0_101_RELEASE_SCOPE.md](../docs/V0_101_RELEASE_SCOPE.md))
+- [ ] Aucune **nouvelle feature** ajoutée (fix, refactor, test, docs uniquement)
+- [ ] Aucune **régression** sur les flows critiques (auth, upload, playlists, player)
+
+*Si une de ces cases n'est pas cochée, la PR sera rejetée. Voir [docs/SCOPE_CONTROL.md](../docs/SCOPE_CONTROL.md).*
 
 ---
 
@@ -38,7 +48,6 @@ Si oui, préciser :
 Coche ce qui a été lancé :
 
 - [ ] `go test ./...` (backend-api)
-- [ ] `cargo test` (chat-server)
 - [ ] `cargo test` (stream-server)
 - [ ] `pnpm test` (web-frontend)
 - [ ] Tests manuels locaux (décrire rapidement)

.github/workflows/backend-ci.yml

@@ -1,34 +0,0 @@
-name: Backend API CI
-
-on:
-  push:
-    paths:
-      - "apps/backend-api/**"
-      - ".github/workflows/backend-ci.yml"
-  pull_request:
-    paths:
-      - "apps/backend-api/**"
-      - ".github/workflows/backend-ci.yml"
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/backend-api
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.22"
-
-      - name: Download deps
-        run: go mod download
-
-      - name: Run tests
-        run: go test ./...
-

.github/workflows/chat-ci.yml

@@ -1,32 +0,0 @@
-name: Chat Server CI
-
-on:
-  push:
-    paths:
-      - "apps/chat-server/**"
-      - ".github/workflows/chat-ci.yml"
-  pull_request:
-    paths:
-      - "apps/chat-server/**"
-      - ".github/workflows/chat-ci.yml"
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/chat-server
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-
-      - name: Run tests
-        run: cargo test --all
-

.github/workflows/ci.yml

@@ -0,0 +1,250 @@
+name: Veza CI
+
+on:
+    push:
+        branches: ["main", "remediation/*", "feature/mvp-complete"]
+    pull_request:
+        branches: ["main", "feature/mvp-complete"]
+    workflow_dispatch:
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+    NODE_TLS_REJECT_UNAUTHORIZED: "0"
+
+jobs:
+    # ===========================================================================
+    # Backend (Go) — build, test, lint, security
+    # ===========================================================================
+    backend:
+        name: Backend (Go)
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Set up Go
+              uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+              with:
+                  go-version: "1.25"
+                  cache: true
+                  # go.mod/go.sum live under veza-backend-api, not repo root.
+                  # Without this, setup-go warns "Dependencies file is not
+                  # found" and skips the mod cache → adds ~60-90s per run.
+                  cache-dependency-path: veza-backend-api/go.sum
+
+            - name: Cache Go tool binaries
+              id: go-tools-cache
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+              with:
+                  path: ~/go/bin
+                  key: ${{ runner.os }}-go-tools-govulncheck-golangci-lint-v2
+                  # Save the cache even when later steps (Lint, Test, etc.)
+                  # fail so the next run benefits from the installed tools.
+                  save-always: true
+
+            - name: Install Go tools
+              # NOTE: golangci-lint v2 lives under the /v2/ module path.
+              # The old /cmd/ path still resolves to v1.64.x, which rejects
+              # v2-format .golangci.yml with "please use golangci-lint v2".
+              # Pinned versions so the cache key stays stable.
+              if: steps.go-tools-cache.outputs.cache-hit != 'true'
+              run: |
+                  go install golang.org/x/vuln/cmd/govulncheck@latest
+                  go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+
+            - name: Add ~/go/bin to PATH
+              run: echo "$HOME/go/bin" >> $GITHUB_PATH
+
+            - name: Build
+              run: go build ./...
+              working-directory: veza-backend-api
+
+            - name: Test
+              # -short + VEZA_SKIP_INTEGRATION=1 so testcontainers-go (which
+              # needs a Docker socket) is not invoked on the Forgejo runner.
+              # Integration tests run in a dedicated nightly job with DinD.
+              run: go test ./... -short -count=1 -timeout 300s -coverprofile=coverage.out
+              env:
+                  VEZA_SKIP_INTEGRATION: "1"
+              working-directory: veza-backend-api
+
+            - name: Lint
+              run: golangci-lint run ./... --timeout 5m
+              working-directory: veza-backend-api
+
+            - name: Vet
+              run: go vet ./...
+              working-directory: veza-backend-api
+
+            - name: Vulnerability check
+              run: govulncheck ./...
+              working-directory: veza-backend-api
+
+            - name: Coverage summary
+              run: |
+                  COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}')
+                  echo "## Backend Coverage: $COVERAGE" >> $GITHUB_STEP_SUMMARY
+              working-directory: veza-backend-api
+
+    # ===========================================================================
+    # Frontend (Web) — lint, typecheck, build, unit tests
+    # ===========================================================================
+    frontend:
+        name: Frontend (Web)
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 15
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Use Node.js
+              uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+              with:
+                  node-version: "20"
+                  cache: "npm"
+                  cache-dependency-path: package-lock.json
+
+            - name: Install dependencies
+              run: npm ci
+
+            # Sprint 2 design-system migrated to Style Dictionary; the
+            # generated tokens live in packages/design-system/dist/ which
+            # is gitignored. apps/web imports `@veza/design-system/tokens-generated`,
+            # so dist/ MUST exist before tsc/vitest/build runs.
+            # `prepare` in the package would normally cover npm ci, but
+            # this explicit step makes the dependency loud and runnable
+            # standalone for local debugging.
+            - name: Build design tokens
+              run: npm run build:tokens --workspace=@veza/design-system
+
+            # Prevents drift between veza-backend-api/openapi.yaml and
+            # apps/web/src/types/generated/. Regenerates then fails if
+            # git diff is non-empty.
+            - name: Check OpenAPI types in sync
+              run: bash scripts/check-types-sync.sh
+              working-directory: apps/web
+
+            - name: Lint
+              # ESLint warning baseline (v1.0.10 dette tech finale).
+              # Sprint trajectory:
+              #   1240 (start) → 1108 (no-unused-vars 134→0) →
+              #    921 (storybook+react-refresh+non-null-assertion) →
+              #    803 (no-explicit-any 115→0) →
+              #    754 (exhaustive-deps 49→0)
+              # Remaining 754 are entirely no-restricted-syntax — the
+              # custom design-system rule that catches Tailwind default
+              # colors, hex literals, native <button>, arbitrary px/rem.
+              # That bucket is design-system migration work (per-feature
+              # cleanup as components are touched), not a lint sprint.
+              # CI fails on ANY new warning. Lower this number as
+              # warnings are resorbed ; never raise it.
+              run: npx eslint --max-warnings=754 .
+              working-directory: apps/web
+
+            - name: Typecheck
+              run: npx tsc --noEmit
+              working-directory: apps/web
+
+            - name: Build
+              run: npm run build
+              working-directory: apps/web
+
+            - name: Bundle size gate
+              run: node scripts/check-bundle-size.mjs
+              working-directory: apps/web
+
+            - name: Audit dependencies
+              run: npm audit --audit-level=critical
+
+            - name: Unit tests
+              run: npx vitest run --reporter=verbose
+              working-directory: apps/web
+
+    # ===========================================================================
+    # Rust (Stream Server) — build, test, lint, audit
+    # ===========================================================================
+    rust:
+        name: Rust (Stream Server)
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Cache rustup toolchain
+              id: rustup-cache
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+              with:
+                  path: |
+                      ~/.rustup
+                      ~/.cargo/bin
+                  key: ${{ runner.os }}-rustup-stable-rustfmt-clippy-audit-tarpaulin
+                  save-always: true
+
+            - name: Set up Rust
+              if: steps.rustup-cache.outputs.cache-hit != 'true'
+              run: |
+                  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --component rustfmt,clippy
+
+            - name: Add ~/.cargo/bin to PATH
+              run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+
+            - name: Cache Cargo deps and target
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+              with:
+                  path: |
+                      ~/.cargo/registry
+                      ~/.cargo/git
+                      veza-stream-server/target
+                  key: ${{ runner.os }}-cargo-${{ hashFiles('veza-stream-server/Cargo.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-cargo-
+                  save-always: true
+
+            - name: Build
+              run: cargo build
+              working-directory: veza-stream-server
+
+            - name: Test
+              run: cargo test --workspace
+              working-directory: veza-stream-server
+
+            - name: Clippy
+              # NOTE: -D warnings temporarily lifted while the team resorbs
+              # the Rust clippy backlog (~20 warnings: unused imports,
+              # missing Default impls, manual clamp/contains, etc.).
+              # Re-enable once the backlog is cleared.
+              run: cargo clippy --all-targets
+              working-directory: veza-stream-server
+
+            - name: Format check
+              run: cargo fmt -- --check
+              working-directory: veza-stream-server
+
+            - name: Security audit
+              # cargo-audit is cached with the rustup toolchain (~/.cargo/bin),
+              # so the install is a no-op on warm cache.
+              run: |
+                  command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
+                  cargo audit
+              working-directory: veza-stream-server
+
+            # Rust coverage via cargo-tarpaulin is disabled in ci.yml because
+            # tarpaulin needs CAP_SYS_PTRACE to disable ASLR, which the Docker
+            # container running the Forgejo act runner doesn't grant:
+            #   "ERROR cargo_tarpaulin: Failed to run tests:
+            #    ASLR disable failed: EPERM: Operation not permitted"
+            # Either (a) add `privileged: true` to the runner's container
+            # config to grant ptrace, or (b) switch to `cargo llvm-cov`
+            # which uses source-based coverage and doesn't need ptrace.
+            # Until then, run coverage locally or in a dedicated nightly job.
+
+    # ===========================================================================
+    # Notify on failure
+    # ===========================================================================
+    notify-failure:
+        name: Notify on failure
+        needs: [backend, frontend, rust]
+        if: failure()
+        runs-on: [self-hosted, incus]
+        steps:
+            - name: Summary
+              run: echo "## ❌ CI Failed" >> $GITHUB_STEP_SUMMARY

.github/workflows/cleanup-failed.yml

@@ -0,0 +1,79 @@
+# cleanup-failed.yml — workflow_dispatch only.
+#
+# Tears down the kept-alive failed-deploy color (the inactive one
+# that survived a Phase D / Phase F failure for forensics).
+# Operator triggers this once they have read the journalctl output.
+#
+# Hard safety in playbooks/cleanup_failed.yml: refuses to destroy
+# the currently-active color.
+name: Veza cleanup failed-deploy color
+
+on:
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to clean up"
+                required: true
+                type: choice
+                options: [staging, prod]
+            color:
+                description: "Color to destroy (must NOT be the active one)"
+                required: true
+                type: choice
+                options: [blue, green]
+
+concurrency:
+    group: cleanup-${{ inputs.env }}
+    cancel-in-progress: false
+
+jobs:
+    cleanup:
+        name: Destroy ${{ inputs.color }} app containers in ${{ inputs.env }}
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+
+            - name: Install ansible
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible
+                  ansible-galaxy collection install community.general
+
+            - name: Write vault password
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run cleanup_failed.yml
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ inputs.env }}.yml \
+                      playbooks/cleanup_failed.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ inputs.env }} \
+                      -e target_color=${{ inputs.color }}
+
+            - name: Upload Ansible log
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}
+                  path: ${{ runner.temp }}/ansible-cleanup-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.github/workflows/deploy.yml

@@ -0,0 +1,360 @@
+# Veza deploy pipeline.
+#
+# Triggers (intentionally narrow — see SECURITY note below):
+#   workflow_dispatch   → operator-supplied env + sha
+#   (push:main + tag:v* are commented OUT until provisioning is
+#    complete — see docs/RUNBOOK_DEPLOY_BOOTSTRAP.md. Re-enable
+#    once secrets/runner/vault are in place and a manual run via
+#    workflow_dispatch has been verified GREEN.)
+#
+# SECURITY: this workflow runs on a self-hosted runner with access to
+# the Incus unix socket (effectively root on the host). DO NOT add
+# `pull_request` or any fork-influenced trigger here — an attacker-
+# controlled fork would be able to `incus exec` arbitrarily. The
+# narrow trigger list above is the security boundary.
+#
+# Sequence : build (3 jobs in parallel) → upload artifacts → deploy.
+name: Veza deploy
+
+on:
+    # push:                          # GATED — uncomment after first
+    #     branches: [main]           # successful workflow_dispatch run
+    #     tags: ['v*']               # see RUNBOOK_DEPLOY_BOOTSTRAP.md
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to deploy"
+                required: true
+                default: staging
+                type: choice
+                options: [staging, prod]
+            release_sha:
+                description: "Full git SHA to deploy (defaults to current HEAD if empty)"
+                required: false
+                type: string
+
+concurrency:
+    # Only one deploy per env at a time. Newer pushes cancel older
+    # in-flight builds for the same env (the user almost always wants
+    # the newer commit).
+    group: deploy-${{ github.ref_type == 'tag' && 'prod' || 'staging' }}
+    cancel-in-progress: true
+
+env:
+    # Where build artefacts land. Set in Forgejo repo Variables :
+    #   FORGEJO_REGISTRY_URL = https://forgejo.veza.fr/api/packages/talas/generic
+    REGISTRY_URL: ${{ vars.FORGEJO_REGISTRY_URL }}
+
+jobs:
+    # =================================================================
+    # Resolve env + sha from the trigger.
+    # =================================================================
+    resolve:
+        name: Resolve env + SHA
+        runs-on: [self-hosted, incus]
+        outputs:
+            env: ${{ steps.r.outputs.env }}
+            sha: ${{ steps.r.outputs.sha }}
+        steps:
+            - name: Resolve
+              id: r
+              run: |
+                  if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+                      ENV="${{ inputs.env }}"
+                      SHA="${{ inputs.release_sha || github.sha }}"
+                  elif [ "${{ github.ref_type }}" = "tag" ]; then
+                      ENV="prod"
+                      SHA="${{ github.sha }}"
+                  else
+                      ENV="staging"
+                      SHA="${{ github.sha }}"
+                  fi
+                  if ! echo "$SHA" | grep -Eq '^[0-9a-f]{40}$'; then
+                      echo "SHA '$SHA' is not a 40-char git SHA"
+                      exit 1
+                  fi
+                  echo "env=$ENV" >> "$GITHUB_OUTPUT"
+                  echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+                  echo "Resolved env=$ENV sha=$SHA"
+
+    # =================================================================
+    # Build backend (Go).
+    # =================================================================
+    build-backend:
+        name: Build backend
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version: "1.25"
+                  cache: true
+                  cache-dependency-path: veza-backend-api/go.sum
+
+            - name: Test
+              working-directory: veza-backend-api
+              env:
+                  VEZA_SKIP_INTEGRATION: "1"
+              run: go test ./... -short -count=1 -timeout 300s
+
+            - name: Build veza-api (CGO=0, static)
+              working-directory: veza-backend-api
+              env:
+                  CGO_ENABLED: "0"
+                  GOOS: linux
+                  GOARCH: amd64
+              run: |
+                  go build -trimpath -ldflags "-s -w" \
+                      -o ./bin/veza-api ./cmd/api/main.go
+                  go build -trimpath -ldflags "-s -w" \
+                      -o ./bin/migrate_tool ./cmd/migrate_tool/main.go
+
+            - name: Stage tarball contents
+              working-directory: veza-backend-api
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-backend"
+                  mkdir -p "$STAGE/migrations"
+                  cp ./bin/veza-api ./bin/migrate_tool "$STAGE/"
+                  cp -r ./migrations/* "$STAGE/migrations/" || true
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-backend" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-backend/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Build stream (Rust).
+    # =================================================================
+    build-stream:
+        name: Build stream
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Set up Rust toolchain
+              run: |
+                  command -v rustup >/dev/null || \
+                      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+                  source "$HOME/.cargo/env"
+                  rustup target add x86_64-unknown-linux-musl
+                  echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+                  sudo apt-get update -qq && sudo apt-get install -y musl-tools
+
+            - name: Cache cargo + target
+              uses: actions/cache@v4
+              with:
+                  path: |
+                      ~/.cargo/registry
+                      ~/.cargo/git
+                      veza-stream-server/target
+                  key: deploy-${{ runner.os }}-cargo-${{ hashFiles('veza-stream-server/Cargo.lock') }}
+                  restore-keys: |
+                      deploy-${{ runner.os }}-cargo-
+
+            - name: Test
+              working-directory: veza-stream-server
+              run: cargo test --workspace
+
+            - name: Build stream_server (musl static)
+              working-directory: veza-stream-server
+              run: |
+                  cargo build --release --locked \
+                      --target x86_64-unknown-linux-musl
+
+            - name: Stage tarball contents
+              working-directory: veza-stream-server
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-stream"
+                  mkdir -p "$STAGE"
+                  cp ./target/x86_64-unknown-linux-musl/release/stream_server "$STAGE/"
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-stream" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-stream/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Build web (React/Vite).
+    # =================================================================
+    build-web:
+        name: Build web
+        needs: resolve
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Use Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: "20"
+                  cache: "npm"
+                  cache-dependency-path: package-lock.json
+
+            - name: Install dependencies
+              run: npm ci
+
+            - name: Build design tokens
+              run: npm run build:tokens --workspace=@veza/design-system
+
+            - name: Build SPA
+              working-directory: apps/web
+              env:
+                  VITE_API_URL: /api/v1
+                  VITE_DOMAIN: ${{ needs.resolve.outputs.env == 'prod' && 'veza.fr' || 'staging.veza.fr' }}
+                  VITE_RELEASE_SHA: ${{ needs.resolve.outputs.sha }}
+              run: npm run build
+
+            - name: Stage tarball contents
+              run: |
+                  STAGE="$RUNNER_TEMP/veza-web"
+                  mkdir -p "$STAGE"
+                  cp -r apps/web/dist/* "$STAGE/"
+                  echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
+
+            - name: Pack tarball
+              run: |
+                  cd "$RUNNER_TEMP"
+                  tar --use-compress-program=zstd -cf \
+                      "veza-web-${{ needs.resolve.outputs.sha }}.tar.zst" \
+                      -C "$RUNNER_TEMP/veza-web" .
+
+            - name: Push to Forgejo Package Registry
+              env:
+                  TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+              run: |
+                  set -e
+                  TARBALL="veza-web-${{ needs.resolve.outputs.sha }}.tar.zst"
+                  URL="${REGISTRY_URL}/veza-web/${{ needs.resolve.outputs.sha }}/${TARBALL}"
+                  echo "PUT → $URL"
+                  curl -fsSL --fail-with-body -X PUT \
+                      -H "Authorization: token ${TOKEN}" \
+                      --upload-file "$RUNNER_TEMP/${TARBALL}" \
+                      "${URL}"
+
+    # =================================================================
+    # Deploy via Ansible. Runs on the self-hosted runner that has
+    # Incus socket access (label `incus`). Requires Forgejo secrets:
+    #   ANSIBLE_VAULT_PASSWORD   — unlocks group_vars/all/vault.yml
+    #   FORGEJO_REGISTRY_TOKEN   — same token the build jobs use,
+    #                              passed to ansible-playbook so
+    #                              the data containers can fetch
+    #                              the tarballs they were just sent.
+    # =================================================================
+    deploy:
+        name: Deploy via Ansible
+        needs: [resolve, build-backend, build-stream, build-web]
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ needs.resolve.outputs.sha }}
+
+            - name: Install ansible + community.general + community.postgresql + community.rabbitmq
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible python3-psycopg2 python3-pip
+                  ansible-galaxy collection install \
+                      community.general \
+                      community.postgresql \
+                      community.rabbitmq
+
+            - name: Write vault password to a tmpfile
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run deploy_data.yml (idempotent provisioning + ZFS snapshot)
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-data-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ needs.resolve.outputs.env }}.yml \
+                      playbooks/deploy_data.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ needs.resolve.outputs.env }} \
+                      -e veza_release_sha=${{ needs.resolve.outputs.sha }} \
+                      -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+            - name: Run deploy_app.yml (blue/green)
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-app-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  ansible-playbook \
+                      -i inventory/${{ needs.resolve.outputs.env }}.yml \
+                      playbooks/deploy_app.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      -e veza_env=${{ needs.resolve.outputs.env }} \
+                      -e veza_release_sha=${{ needs.resolve.outputs.sha }} \
+                      -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+            - name: Upload Ansible logs (for forensics)
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-logs-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}
+                  path: ${{ runner.temp }}/ansible-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.github/workflows/e2e.yml

@@ -0,0 +1,270 @@
+name: E2E Playwright
+
+# v1.0.8 Batch C — Playwright E2E suite triggered on PRs (@critical only,
+# fast feedback) + push to main and nightly (full suite, deeper coverage).
+# Uses the --ci seed flag (cmd/tools/seed --ci) for ~5s seeding instead
+# of the ~60s minimal seed.
+
+on:
+    # GATED on Forgejo (single self-hosted runner) — re-enable
+    # selectively when an additional runner with a Docker label
+    # (e.g. ubuntu-latest:docker://...) is provisioned. Until then,
+    # heavy E2E only runs on operator-triggered workflow_dispatch.
+    # pull_request:
+    #     branches: [main]
+    # push:
+    #     branches: [main]
+    # schedule:
+    #     - cron: "0 3 * * *"
+    workflow_dispatch:
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+    NODE_TLS_REJECT_UNAUTHORIZED: "0"
+    # Forces playwright.config.ts:141,155 to spawn fresh backend + Vite
+    # instead of reusing whatever is on the runner.
+    CI: "true"
+    # Falls back to a CI-only dev key if the Forgejo secret is unset.
+    # Used at the "Build + start backend API" step.
+    JWT_SECRET: ${{ secrets.E2E_JWT_SECRET || 'ci-dev-jwt-secret-32-chars-min-padding!!' }}
+
+jobs:
+    # ===========================================================================
+    # Job: e2e — single matrix entry that selects the test scope per trigger.
+    #   - PR              → @critical only (5-7min target)
+    #   - push main / cron / dispatch → full suite (~25min target)
+    # ===========================================================================
+    e2e:
+        # Scope matrix:
+        #   - pull_request    → @critical (PR gate, ~5-10min)
+        #   - push to main    → @critical (commit gate, dev velocity priority)
+        #   - schedule (cron) → full suite (nightly coverage)
+        #   - workflow_dispatch → full (manual broad sweep)
+        # Push was previously running the full suite (~1h30 pre-perf, ~15-20min
+        # post-perf). The dev velocity cost was unjustifiable for the
+        # incremental coverage over the @critical scope, especially while the
+        # full suite carries pre-existing fixme'd tests. Cron picks up the
+        # rest on a 24h cadence.
+        name: e2e (${{ (github.event_name == 'pull_request' || github.event_name == 'push') && '@critical' || 'full' }})
+        runs-on: [self-hosted, incus]
+        timeout-minutes: ${{ (github.event_name == 'pull_request' || github.event_name == 'push') && 20 || 45 }}
+
+        # Service containers are managed by act_runner: spawned on the job
+        # network with healthchecks, torn down at the end. This replaces
+        # the previous `docker compose up -d` pattern which relied on
+        # docker socket sharing + host port mappings — fragile (port
+        # collisions across concurrent jobs, manual cleanup, double-DinD,
+        # whole compose file validated even when only 3 services are
+        # needed). Service hostnames (`postgres`, `redis`, `rabbitmq`)
+        # resolve from the job container on standard ports.
+        services:
+            postgres:
+                image: postgres:16-alpine
+                env:
+                    POSTGRES_USER: veza
+                    POSTGRES_PASSWORD: devpassword
+                    POSTGRES_DB: veza
+                options: >-
+                    --health-cmd "pg_isready -U veza"
+                    --health-interval 5s
+                    --health-timeout 3s
+                    --health-retries 10
+            redis:
+                # No-auth redis for CI: act_runner services don't support a
+                # `command:` field, and the redis:7-alpine entrypoint does
+                # NOT read REDIS_ARGS (verified empirically) — so passing
+                # --requirepass via env doesn't work. The dev/prod password
+                # policy (REM-023) is enforced via docker-compose.yml only;
+                # the CI service network is ephemeral and isolated, so
+                # dropping auth here is acceptable.
+                image: redis:7-alpine
+                options: >-
+                    --health-cmd "redis-cli ping"
+                    --health-interval 5s
+                    --health-timeout 3s
+                    --health-retries 10
+            rabbitmq:
+                image: rabbitmq:3-management-alpine
+                env:
+                    RABBITMQ_DEFAULT_USER: veza
+                    RABBITMQ_DEFAULT_PASS: devpassword
+                options: >-
+                    --health-cmd "rabbitmq-diagnostics -q check_port_connectivity"
+                    --health-interval 10s
+                    --health-timeout 5s
+                    --health-retries 10
+
+        # Service hostnames + standard ports — no host-port mapping needed.
+        env:
+            DATABASE_URL: postgresql://veza:${{ secrets.E2E_DB_PASSWORD || 'devpassword' }}@postgres:5432/veza?sslmode=disable
+            REDIS_URL: redis://redis:6379
+            RABBITMQ_URL: ${{ secrets.E2E_RABBITMQ_URL || 'amqp://veza:devpassword@rabbitmq:5672/' }}
+
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Set up Node
+              uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+              with:
+                  node-version: "20"
+                  cache: "npm"
+                  cache-dependency-path: package-lock.json
+
+            - name: Set up Go
+              uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+              with:
+                  go-version: "1.25"
+                  cache: true
+                  cache-dependency-path: veza-backend-api/go.sum
+
+            - name: Install dependencies
+              run: npm ci
+
+            # Sprint 2 design-system migrated to Style Dictionary; the
+            # generated tokens live in packages/design-system/dist/
+            # (gitignored). The Playwright-spawned Vite imports them via
+            # `@veza/design-system/tokens-generated`, so dist/ MUST exist
+            # before vite starts.
+            - name: Build design tokens
+              run: npm run build:tokens --workspace=@veza/design-system
+
+            # Playwright tests reach the frontend via http://veza.fr:5174,
+            # which the browsers resolve via /etc/hosts. Without this entry
+            # the navigation step times out.
+            - name: Add veza.fr to hosts
+              run: echo "127.0.0.1 veza.fr" | sudo tee -a /etc/hosts
+
+            - name: Generate dev JWT keys + SSL cert
+              run: |
+                  ./scripts/generate-jwt-keys.sh
+                  ./scripts/generate-ssl-cert.sh
+
+            - name: Run database migrations
+              run: |
+                  cd veza-backend-api
+                  go run cmd/migrate_tool/main.go
+
+            - name: Seed database (CI mode — 5 test accounts + minimal fixtures)
+              run: |
+                  cd veza-backend-api
+                  go run ./cmd/tools/seed --ci
+
+            - name: Build + start backend API
+              env:
+                  APP_ENV: test
+                  APP_PORT: "18080"
+                  COOKIE_SECURE: "false"
+                  CORS_ALLOWED_ORIGINS: http://veza.fr:5174,http://localhost:5174
+                  DISABLE_RATE_LIMIT_FOR_TESTS: "true"
+                  RATE_LIMIT_LIMIT: "10000"
+                  RATE_LIMIT_WINDOW: "60"
+                  ACCOUNT_LOCKOUT_EXEMPT_EMAILS: "user@veza.music,artist@veza.music,admin@veza.music,mod@veza.music,new@veza.music"
+              run: |
+                  cd veza-backend-api
+                  go build -o veza-api ./cmd/api/main.go
+                  ./veza-api > /tmp/backend.log 2>&1 &
+                  BACKEND_PID=$!
+
+                  # Poll for up to 30s — beats a fixed sleep on a cold start.
+                  for i in $(seq 1 30); do
+                    if curl -sf -m 2 http://localhost:18080/api/v1/health > /tmp/health.json 2>/dev/null; then
+                      break
+                    fi
+                    if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
+                      echo "::error::backend process died before becoming reachable"
+                      echo "--- /tmp/backend.log (last 200 lines) ---"
+                      tail -200 /tmp/backend.log
+                      exit 1
+                    fi
+                    sleep 1
+                  done
+
+                  # Always print the response body so debugging doesn't
+                  # require re-running with extra logging. Artifact upload
+                  # is broken under Forgejo (GHES not supported), so the
+                  # log step output is our only diagnostic channel.
+                  echo "--- /api/v1/health response ---"
+                  cat /tmp/health.json
+                  echo
+
+                  # The /api/v1/health envelope is the standard veza response
+                  # shape: {"success": true, "data": {"status": "ok"}}. Earlier
+                  # versions of this check used `.status == "ok"` at the root,
+                  # which silently misses the actual ok signal nested under
+                  # `.data`. The misread surfaced as "backend health is not ok"
+                  # despite a 200 + valid body — wasted a CI cycle.
+                  if ! jq -e '.data.status == "ok"' /tmp/health.json >/dev/null; then
+                    echo "::error::backend health is not ok"
+                    echo "--- /tmp/backend.log (last 200 lines) ---"
+                    tail -200 /tmp/backend.log
+                    exit 1
+                  fi
+                  echo "Backend healthy"
+
+            # Cache the Playwright browser binaries between runs.
+            # Chromium download is ~150MB and adds 30-60s to every cold
+            # run. The cache key tracks the playwright version pinned in
+            # package-lock.json, so a Playwright bump invalidates the
+            # cache automatically.
+            - name: Resolve Playwright version
+              id: playwright-version
+              run: |
+                PV=$(node -p "require('./node_modules/@playwright/test/package.json').version")
+                echo "version=$PV" >> $GITHUB_OUTPUT
+
+            - name: Cache Playwright browsers
+              id: playwright-cache
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+              with:
+                path: ~/.cache/ms-playwright
+                key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}-chromium
+                restore-keys: |
+                  playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}-
+
+            - name: Install Playwright browsers
+              # Browsers cached: only install OS deps (apt-get sweep) so the
+              # download is skipped. Browsers absent: full install + deps.
+              run: |
+                if [ "${{ steps.playwright-cache.outputs.cache-hit }}" = "true" ]; then
+                  npx playwright install-deps chromium
+                else
+                  npx playwright install --with-deps chromium
+                fi
+
+            - name: Run E2E (@critical — PR + push)
+              if: github.event_name == 'pull_request' || github.event_name == 'push'
+              env:
+                  PORT: "5174"
+                  VITE_API_URL: "/api/v1"
+                  VITE_DOMAIN: veza.fr
+                  VITE_BACKEND_PORT: "18080"
+                  PLAYWRIGHT_BASE_URL: "http://localhost:5174"
+              run: npm run e2e:critical
+
+            - name: Run E2E (full — cron / workflow_dispatch)
+              if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+              env:
+                  PORT: "5174"
+                  VITE_API_URL: "/api/v1"
+                  VITE_DOMAIN: veza.fr
+                  VITE_BACKEND_PORT: "18080"
+                  PLAYWRIGHT_BASE_URL: "http://localhost:5174"
+              run: npm run e2e
+
+            - name: Upload Playwright report
+              if: failure()
+              uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+              with:
+                  name: playwright-report-${{ github.run_id }}-${{ github.run_attempt }}
+                  path: |
+                      tests/e2e/playwright-report/
+                      tests/e2e/test-results/
+                  retention-days: 7
+
+            - name: Upload backend log
+              if: failure()
+              uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+              with:
+                  name: backend-log-${{ github.run_id }}-${{ github.run_attempt }}
+                  path: /tmp/backend.log
+                  retention-days: 7

.github/workflows/frontend-ci.yml

@@ -1,37 +0,0 @@
-name: Frontend CI
-
-on:
-  push:
-    paths:
-      - "apps/web-frontend/**"
-      - ".github/workflows/frontend-ci.yml"
-  pull_request:
-    paths:
-      - "apps/web-frontend/**"
-      - ".github/workflows/frontend-ci.yml"
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/web-frontend
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-
-      - name: Install pnpm
-        run: npm install -g pnpm
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Run tests
-        run: pnpm test
-

.github/workflows/go-fuzz.yml

@@ -0,0 +1,43 @@
+name: Go Fuzz Tests
+
+on:
+    # GATED — operator-triggered until extra runner capacity exists.
+    # schedule:
+    #     - cron: "0 2 * * *"  # Nightly at 2am UTC
+    workflow_dispatch:
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+    NODE_TLS_REJECT_UNAUTHORIZED: "0"
+
+jobs:
+    fuzz:
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 15
+
+        defaults:
+            run:
+                working-directory: veza-backend-api
+
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Set up Go
+              uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+              with:
+                  go-version: "1.25"
+                  cache: true
+
+            - name: Download deps
+              run: go mod download
+
+            - name: Run fuzz tests
+              run: go test -fuzz=Fuzz -fuzztime=60s ./internal/handlers/...
+
+            - name: Upload fuzz corpus
+              if: always()
+              uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+              with:
+                  name: fuzz-corpus
+                  path: veza-backend-api/testdata/fuzz/
+                  retention-days: 30

.github/workflows/loadtest.yml

@@ -0,0 +1,126 @@
+name: k6 nightly load test
+
+# v1.0.9 W4 Day 20 — runs the mixed-scenarios k6 script against the
+# staging environment every night at 02:30 UTC. The acceptance gate
+# is "pass green 3 nuits consécutives" before flipping a release —
+# the artifact uploaded by this workflow carries the JSON summary
+# the operator inspects.
+#
+# Scope deliberately narrow : runs ONLY on staging, NEVER on prod.
+# A separate manually-triggered workflow (workflow_dispatch) covers
+# pre-launch capacity drills with a longer ramp.
+
+on:
+    # GATED — k6 hammer is too heavy for the single self-hosted runner.
+    # Re-enable the cron once a dedicated load-test runner exists.
+    # schedule:
+    #     - cron: "30 2 * * *"
+    workflow_dispatch:
+        inputs:
+            duration:
+                description: "Duration per scenario (e.g. 5m, 15m, 1h)"
+                required: false
+                default: "5m"
+                type: string
+            base_url:
+                description: "Override staging URL"
+                required: false
+                default: ""
+                type: string
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+    # Defaults — override via workflow_dispatch input or repo vars.
+    DEFAULT_BASE_URL: "https://staging.veza.fr"
+
+jobs:
+    loadtest:
+        name: k6 mixed scenarios (1650 VU steady)
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Install k6
+              run: |
+                  set -euo pipefail
+                  sudo gpg -k
+                  sudo gpg --no-default-keyring --keyring /usr/share/keyrings/k6-archive-keyring.gpg \
+                      --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
+                  echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" \
+                      | sudo tee /etc/apt/sources.list.d/k6.list
+                  sudo apt-get update
+                  sudo apt-get install -y k6
+                  k6 version
+
+            - name: Resolve test inputs
+              id: inputs
+              run: |
+                  set -euo pipefail
+                  BASE_URL="${{ github.event.inputs.base_url }}"
+                  if [ -z "$BASE_URL" ]; then
+                      BASE_URL="${{ vars.STAGING_BASE_URL || env.DEFAULT_BASE_URL }}"
+                  fi
+                  DURATION="${{ github.event.inputs.duration }}"
+                  if [ -z "$DURATION" ]; then
+                      DURATION="5m"
+                  fi
+                  echo "base_url=$BASE_URL"   >> "$GITHUB_OUTPUT"
+                  echo "duration=$DURATION"   >> "$GITHUB_OUTPUT"
+
+            - name: Pre-flight — staging is reachable
+              run: |
+                  set -euo pipefail
+                  url="${{ steps.inputs.outputs.base_url }}/api/v1/health"
+                  echo "::notice::Pre-flight GET $url"
+                  status=$(curl -k -sS --max-time 10 -o /dev/null -w "%{http_code}" "$url" || echo "000")
+                  if [ "$status" != "200" ]; then
+                      echo "::error::Staging /health returned $status — aborting load test."
+                      exit 1
+                  fi
+
+            - name: Run k6 mixed scenarios
+              id: run
+              env:
+                  BASE_URL: ${{ steps.inputs.outputs.base_url }}
+                  DURATION: ${{ steps.inputs.outputs.duration }}
+                  USER_TOKEN: ${{ secrets.STAGING_LOADTEST_TOKEN }}
+                  STREAM_TRACK_ID: ${{ vars.STAGING_LOADTEST_TRACK_ID || '00000000-0000-0000-0000-000000000001' }}
+              run: |
+                  set -euo pipefail
+                  if [ -z "$USER_TOKEN" ]; then
+                      echo "::warning::STAGING_LOADTEST_TOKEN secret is empty — auth-required scenarios will record 401s as errors."
+                  fi
+                  k6 run --quiet \
+                      --summary-export=k6-summary.json \
+                      scripts/loadtest/k6_mixed_scenarios.js
+
+            - name: Upload k6 summary artifact
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: k6-summary-${{ github.run_number }}
+                  path: |
+                      k6-summary.json
+                      scripts/loadtest/k6_mixed_scenarios.js
+                  retention-days: 30
+
+            - name: Annotate thresholds in summary
+              if: always()
+              run: |
+                  set -euo pipefail
+                  if [ ! -f k6-summary.json ]; then
+                      echo "::warning::No summary artifact — k6 likely failed before write."
+                      exit 0
+                  fi
+                  echo "## k6 load test summary" >> "$GITHUB_STEP_SUMMARY"
+                  echo "" >> "$GITHUB_STEP_SUMMARY"
+                  jq -r '
+                      (.metrics.http_reqs.values.count // 0) as $reqs
+                      | (.metrics.http_req_failed.values.rate // 0) as $err
+                      | (.metrics.http_req_duration.values["p(95)"] // 0) as $p95
+                      | (.metrics.http_req_duration.values["p(99)"] // 0) as $p99
+                      | "- requests: \($reqs)\n- failed rate: \($err * 100 | round)/100 %\n- p95: \($p95 | round) ms\n- p99: \($p99 | round) ms"
+                  ' k6-summary.json >> "$GITHUB_STEP_SUMMARY"

.github/workflows/rollback.yml

@@ -0,0 +1,118 @@
+# rollback.yml — workflow_dispatch only.
+#
+# Two modes :
+#   fast — flip HAProxy back to the previous color. ~5s. Requires
+#          the target color's containers to still be alive
+#          (i.e., no later deploy has recycled them).
+#   full — re-run deploy_app.yml with a specific (older) release_sha.
+#          ~5-10min. The artefact must still be in the Forgejo
+#          registry (default retention 30 SHA per component).
+#
+# See docs/RUNBOOK_ROLLBACK.md for decision criteria.
+name: Veza rollback
+
+on:
+    workflow_dispatch:
+        inputs:
+            env:
+                description: "Environment to rollback"
+                required: true
+                type: choice
+                options: [staging, prod]
+            mode:
+                description: "Rollback mode"
+                required: true
+                type: choice
+                options: [fast, full]
+            target_color:
+                description: "(mode=fast only) color to flip back TO (the prior active one)"
+                required: false
+                type: choice
+                options: [blue, green]
+            release_sha:
+                description: "(mode=full only) 40-char SHA of the release to redeploy"
+                required: false
+                type: string
+
+concurrency:
+    group: rollback-${{ inputs.env }}
+    cancel-in-progress: false
+
+jobs:
+    rollback:
+        name: Rollback ${{ inputs.env }} (${{ inputs.mode }})
+        runs-on: [self-hosted, incus]
+        timeout-minutes: 30
+        steps:
+            - name: Validate inputs
+              run: |
+                  if [ "${{ inputs.mode }}" = "fast" ] && [ -z "${{ inputs.target_color }}" ]; then
+                      echo "mode=fast requires target_color"
+                      exit 1
+                  fi
+                  if [ "${{ inputs.mode }}" = "full" ]; then
+                      if [ -z "${{ inputs.release_sha }}" ]; then
+                          echo "mode=full requires release_sha"
+                          exit 1
+                      fi
+                      if ! echo "${{ inputs.release_sha }}" | grep -Eq '^[0-9a-f]{40}$'; then
+                          echo "release_sha is not a 40-char git SHA"
+                          exit 1
+                      fi
+                  fi
+
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 1
+                  ref: ${{ inputs.mode == 'full' && inputs.release_sha || github.ref }}
+
+            - name: Install ansible + collections
+              run: |
+                  sudo apt-get update -qq
+                  sudo apt-get install -y ansible python3-psycopg2
+                  ansible-galaxy collection install \
+                      community.general \
+                      community.postgresql \
+                      community.rabbitmq
+
+            - name: Write vault password
+              env:
+                  VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+              run: |
+                  printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
+                  chmod 0400 "$RUNNER_TEMP/vault-pass"
+                  echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
+
+            - name: Run rollback.yml
+              working-directory: infra/ansible
+              env:
+                  ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}.log
+                  ANSIBLE_HOST_KEY_CHECKING: "False"
+              run: |
+                  EXTRA="-e veza_env=${{ inputs.env }} -e mode=${{ inputs.mode }}"
+                  if [ "${{ inputs.mode }}" = "fast" ]; then
+                      EXTRA="$EXTRA -e target_color=${{ inputs.target_color }}"
+                  else
+                      EXTRA="$EXTRA -e veza_release_sha=${{ inputs.release_sha }}"
+                      EXTRA="$EXTRA -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}"
+                  fi
+                  ansible-playbook \
+                      -i inventory/${{ inputs.env }}.yml \
+                      playbooks/rollback.yml \
+                      --vault-password-file "$VAULT_PASS_FILE" \
+                      $EXTRA
+
+            - name: Upload Ansible log
+              if: always()
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}
+                  path: ${{ runner.temp }}/ansible-rollback-*.log
+                  retention-days: 30
+
+            - name: Shred vault password file
+              if: always()
+              run: |
+                  if [ -f "$VAULT_PASS_FILE" ]; then
+                      shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
+                  fi

.github/workflows/security-scan.yml

@@ -0,0 +1,28 @@
+name: Security Scan
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: [main]
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+
+jobs:
+    gitleaks:
+        name: Secret Scanning (gitleaks)
+        runs-on: [self-hosted, incus]
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+              with:
+                  fetch-depth: 0
+
+            - name: Install gitleaks
+              run: |
+                  wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz
+                  tar xzf gitleaks_8.21.2_linux_x64.tar.gz
+                  chmod +x gitleaks
+
+            - name: Run gitleaks
+              run: ./gitleaks detect --source . --no-banner -v --config .gitleaks.toml

.github/workflows/stream-ci.yml

@@ -1,32 +0,0 @@
-name: Stream Server CI
-
-on:
-  push:
-    paths:
-      - "apps/stream-server/**"
-      - ".github/workflows/stream-ci.yml"
-  pull_request:
-    paths:
-      - "apps/stream-server/**"
-      - ".github/workflows/stream-ci.yml"
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/stream-server
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-
-      - name: Run tests
-        run: cargo test --all
-

.github/workflows/trivy-fs.yml

@@ -0,0 +1,24 @@
+name: Trivy Filesystem Scan
+
+on:
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+
+env:
+    GIT_SSL_NO_VERIFY: "true"
+
+jobs:
+    trivy-scan:
+        name: Trivy FS Scan
+        runs-on: [self-hosted, incus]
+        steps:
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+            - name: Install Trivy
+              run: |
+                  wget -qO- https://github.com/aquasecurity/trivy/releases/download/v0.58.1/trivy_0.58.1_Linux-64bit.tar.gz | tar xz
+                  chmod +x trivy
+
+            - name: Scan filesystem
+              run: ./trivy fs --severity HIGH,CRITICAL --exit-code 1 .

.gitignore

@@ -19,7 +19,6 @@ Cargo.lock
 *.rs.bk
 
 ### Go
-bin/
 *.exe
 *.exe~
 *.dll
@@ -37,9 +36,15 @@ logs/
 *.seed
 *.gz
 
+### Database dumps — SECURITY(REM-034): Never commit database artifacts
+**/veza_back_api_db/
+*.sql.dump
+*.pgdump
+
 ### Editors / IDE
 .vscode/
 .idea/
+.cursor/
 *.swp
 *.swo
 
@@ -51,24 +56,229 @@ Thumbs.db
 tmp/
 temp/
 .cache/
+.turbo/
 coverage/
 coverage-final.json
+typecheck*.txt
+output*.txt
+design_system*.html
+*_design_system*.html
+MODULE.bazel.lock
 
 ### Test artifacts
 *.test
 *.coverage
+*.out
+test-results/
+playwright-report/
 
 ### Build / Bundles
 *.wasm
 *.bundle.js
 *.map
+apps/web/dist_verification/
+**/dist_verification/
 
 ### Environment / Secrets (NE JAMAIS COMMIT)
 .env
 .env.*
+!.env.example
+!.env.staging.example
+**/.env
+**/.env.local
+**/.env.*
+!.env.example
+!.env.staging.example
+veza-backend-api/.env
+veza-chat-server/.env
+veza-stream-server/.env
+apps/web/.env.local
 .secrets/
 
 ### Docker
 docker-data/
 *.tar
 
+# HAProxy SSL certs (never commit private keys or full-chain certs)
+docker/haproxy/certs/*.key
+docker/haproxy/certs/*.pem
+docker/haproxy/certs/*.crt
+
+# JWT RSA keys (v0.9.1 RS256 migration — NEVER commit)
+jwt-private.pem
+jwt-public.pem
+
+veza-backend-api/main
+veza-backend-api/api
+veza-backend-api/veza-api
+veza-backend-api/migrate_tool
+chat_exports/
+
+# Debug/test screenshots (root level)
+screenshot-*.png
+sidebar-*.png
+player-*.png
+login-*.png
+search-*.png
+track-*.png
+test-*.png
+dashboard-*.png
+report-*.html
+
+# MCP config (local)
+.mcp.json
+
+# Environment / Secrets — config templates only, never commit real .env
+config/incus/env/*.env
+!config/incus/env/env.example
+
+# Playwright
+/test-results/
+/playwright-report/
+tests/e2e/test-results/
+tests/e2e/VEZA_AUDIT_REPORT.html
+tests/e2e/VEZA_AUDIT_REPORT.json
+apps/web/e2e-results.json
+e2e-results.json
+/blob-report/
+/playwright/.cache/
+/playwright/.auth/
+
+*storybook.log
+storybook-static
+
+# v0.941: Swagger docs.go generated by CI (swag init)
+veza-backend-api/docs/docs.go
+
+# Claude Code local memory
+.claude/
+
+# Test audio files (large binaries)
+veza-backend-api/audio/
+
+# SELinux policy (local)
+qemu-fusefs.*
+# Root-level 'api' binary produced by `go build` in veza-backend-api/.
+# Narrower than the previous bare `api` rule which matched any file or
+# directory named 'api' anywhere (including apps/web/src/services/api/).
+/api
+/veza-backend-api/api
+
+# ============================================================
+# Post-audit J1 (2026-04-14) — never recommit this debris
+# ============================================================
+# Go binaries accidentally committed (v1.0.3 → v1.0.4 cleanup)
+veza-backend-api/server
+veza-backend-api/modern-server
+veza-backend-api/seed
+veza-backend-api/seed-v2
+veza-backend-api/encrypt_oauth_tokens
+
+# Coverage reports (generated, never tracked)
+veza-backend-api/coverage*.out
+veza-backend-api/coverage_groups/
+
+# Frontend build/lint/test artifacts
+apps/web/lint_report*.json
+apps/web/tsc*.log
+apps/web/tsc*.txt
+apps/web/ts_*.log
+apps/web/storybook_*.json
+apps/web/debug-storybook.log
+apps/web/build_errors*.txt
+apps/web/build_output.txt
+apps/web/final_errors.txt
+apps/web/*.log
+apps/web/diagnostic-*.log
+apps/web/frontend.log
+apps/web/audit.log
+
+# Backend local logs
+veza-backend-api/backend*.log
+
+# Root audit screenshots (belong in docs/assets/ if needed)
+/audit-*.png
+
+# AI tooling session state (not code)
+.cursor/
+
+# ============================================================
+# Post-audit J2 (2026-04-20) — branch chore/v1.0.7-cleanup
+# ============================================================
+
+# Tracked audio fixtures — use git-lfs or fixtures repo, never commit raw audio
+veza-backend-api/uploads/
+
+# TLS/SSL certificates committed pre-2026-04 (regen with scripts/generate-ssl-cert.sh)
+config/ssl/*.pem
+config/ssl/*.key
+config/ssl/*.crt
+
+# Playwright MCP session debris
+.playwright-mcp/
+
+# AI session artefacts / context dumps
+CLAUDE_CONTEXT.txt
+UI_CONTEXT_SUMMARY.md
+*.context.txt
+*.ai-session.txt
+
+# One-off generated tooling scripts (should live in scripts/ if kept)
+/generate_page_fix_prompts.sh
+/build-archive.log
+
+# Apps/web stale audit reports (generated, never tracked)
+apps/web/AUDIT_ISSUES.json
+apps/web/audit_remediation.json
+apps/web/lint_comprehensive.json
+apps/web/storybook-roadmap.json
+apps/web/storybook-*.json
+
+# Root PNG screenshots — move to docs/screenshots/ if historical value
+/design-system-*.png
+/forgot-password-*.png
+/register-*.png
+/reset-password-*.png
+/settings-*.png
+/storybook-*.png
+
+# ============================================================
+# Post-audit J3 (2026-04-23) — history rewrite (BFG pass, 1.5G → 66M)
+# ============================================================
+# Additional Go build artifacts found in BFG scan
+veza-backend-api/bin/
+veza-backend-api/veza-backend-api
+veza-backend-api/migrate
+
+# Vendored binaries mistakenly committed
+dev-environment/scripts/kubectl
+
+# Incus build outputs (generated per release cut)
+.build/
+
+# E2E report outputs (Playwright)
+tests/e2e/audit/results/
+tests/e2e/playwright-report/
+
+# Session-scratch screenshots
+frontend_screenshots/
+
+# Audit_remediation glob (supersedes J2's exact-match json)
+apps/web/audit_remediation*
+
+# ============================================================
+# Ansible Vault — secrets at rest stay encrypted in vault.yml
+# (committed). The vault password used to unlock them MUST NOT
+# be committed; the Forgejo runner reads it from a repo secret.
+# ============================================================
+infra/ansible/.vault-pass
+infra/ansible/.vault-pass.*
+# Local copies devs sometimes drop next to the repo for editing
+.vault-pass
+.vault-pass.*
+
+# ============================================================
+# Bootstrap scripts — local config + state stay out of git
+# ============================================================
+scripts/bootstrap/.env
+.git/talas-bootstrap/

.gitleaks.toml

@@ -0,0 +1,79 @@
+title = "Veza gitleaks config"
+
+# Inherit gitleaks v8 default ruleset
+[extend]
+useDefault = true
+
+# Project-wide allowlist
+#
+# Categories of allowed paths (every entry below is a known false-positive
+# source confirmed by reading the file or its history):
+#
+#   1. Go test files — fake JWTs like eyJ...invalid_signature for auth-failure tests
+#   2. Historical .backup-pre-uuid-migration dir — gone from HEAD but in git history
+#   3. Playwright e2e artifacts — auth state snapshots, test result dumps
+#   4. Storybook stories + MSW mocks — UI fixtures with placeholder API keys
+#   5. Documentation — API examples, smoke test logs, integration guides
+#   6. K8s deployment templates — base64-encoded "secure_pass" placeholders
+#   7. Local dev TLS certs (CN=localhost) under docker/haproxy/certs/
+#   8. Rust/TS test fixtures — deterministic constants used only in #[cfg(test)]
+#   9. Generated bundle analysis HTML
+#  10. Legacy templates (apps/web/desy/legacy/)
+#
+# This allowlist intentionally errs on the side of letting things through.
+# Real secret rotation should rely on .env, vault, or k8s sealed-secrets.
+# When tightening, prefer adding a stopword over removing a path entry.
+[allowlist]
+description = "Allowlist test fixtures, docs, k8s templates, and dev artifacts"
+paths = [
+    # Go tests
+    '''.*_test\.go$''',
+    '''.*\.backup-pre-uuid-migration/.*''',
+    '''veza-backend-api/internal/services/\.backup-pre-uuid-migration/.*''',
+
+    # Playwright / e2e artifacts
+    '''apps/web/e2e/\.auth/.*''',
+    '''apps/web/e2e-results\.json$''',
+    '''apps/web/full_test_result\.txt$''',
+    '''apps/web/e2e/.*\.md$''',
+
+    # Storybook + MSW mocks
+    '''apps/web/.*\.stories\.(ts|tsx|js|jsx)$''',
+    '''apps/web/src/mocks/.*''',
+
+    # Documentation (markdown samples are inherently full of example tokens)
+    '''.*\.md$''',
+
+    # K8s deployment templates with base64 placeholders
+    '''.*/k8s/.*\.ya?ml$''',
+
+    # Local dev / self-signed TLS material
+    '''docker/haproxy/certs/.*\.(pem|key|crt|csr)$''',
+
+    # Rust / TS test fixtures inside source files (constants used only in
+    # #[cfg(test)] modules — see veza-stream-server/src/utils/signature.rs)
+    '''veza-stream-server/src/utils/signature\.rs$''',
+    '''veza-stream-server/src/utils/env\.rs$''',
+    '''veza-chat-server/src/env\.rs$''',
+
+    # Legacy / static templates
+    '''apps/web/desy/legacy/.*''',
+
+    # Pre-existing source files with hardcoded *test* keys (must stay until refactor)
+    '''apps/web/src/components/studio/.*''',
+    '''apps/web/src/components/settings/security/TwoFactorSetup\.tsx$''',
+    '''apps/web/src/features/live/.*''',
+
+    # Generated artifacts
+    '''\.build/.*\.html$''',
+]
+stopwords = [
+    "invalid_signature",
+    "test-jwt-secret",
+    "test-secret",
+    "test-internal-api-key",
+    "test_secret_key_that_is_long_enough_32chars",
+    "sk-abc123-def456-ghi789",
+    "live_83921_abc123xyz789_secret_key",
+    "secure_pass",
+]

.husky/commit-msg

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+
+npx --no -- commitlint --edit "$1"

.husky/pre-commit

@@ -0,0 +1,47 @@
+#!/usr/bin/env sh
+# Each step runs in a subshell so the cd does not leak across steps.
+# Pre-commit runs from the repo root; every cd below is relative to that.
+
+# Drift guard: ensure apps/web/src/services/generated/ (orval) matches
+# veza-backend-api/openapi.yaml. Regenerates locally then fails if the
+# committed types don't match the freshly-regenerated output.
+# Skip with SKIP_TYPES=1 for emergency commits (documented in CLAUDE.md).
+if [ -z "$SKIP_TYPES" ]; then
+  (cd apps/web && bash scripts/check-types-sync.sh) || {
+    echo "❌ OpenAPI types are out of sync with veza-backend-api/openapi.yaml."
+    echo "💡 Run: make openapi && cd apps/web && bash scripts/generate-types.sh"
+    echo "💡 Then stage the updated src/services/generated/ and retry."
+    echo "💡 Tip: SKIP_TYPES=1 bypasses (not recommended)."
+    exit 1
+  }
+fi
+
+# Implicit 10.1: Type checking
+# Prevent commits with TypeScript errors (warnings are allowed)
+(cd apps/web && npm run typecheck 2>&1 | grep -q "error TS") && {
+  echo "❌ Type checking failed. Please fix TypeScript errors before committing."
+  echo "💡 Run 'npm run typecheck' to see all errors."
+  exit 1
+} || true
+
+# Implicit 10.2: Linting
+# Prevent commits with linting errors (warnings are allowed).
+# Pattern matches "(N error" with N>=1 in ESLint's summary line —
+# avoids false positive on "(0 errors, K warnings)".
+(cd apps/web && npm run lint 2>&1 | grep -qE "\([1-9][0-9]* error") && {
+  echo "❌ Linting failed. Please fix linting errors before committing."
+  echo "💡 Tip: Run 'npm run lint:fix' to automatically fix some issues."
+  exit 1
+} || true
+
+# Implicit 10.3: Test checking (optional, fast unit tests only)
+# Skip if SKIP_TESTS environment variable is set (for quick commits)
+# Only runs unit tests (not E2E) to keep it fast
+if [ -z "$SKIP_TESTS" ]; then
+  (cd apps/web && npm test -- --run 2>&1 | grep -q "FAIL") && {
+    echo "❌ Tests failed. Please fix failing tests before committing."
+    echo "💡 Tip: Run 'npm test' to see all test failures."
+    echo "💡 Tip: Set SKIP_TESTS=1 to skip tests for this commit (not recommended)."
+    exit 1
+  } || true
+fi

.husky/pre-push

@@ -0,0 +1,35 @@
+#!/usr/bin/env sh
+
+# ============================================================================
+# Veza pre-push hook — CRITICAL E2E SMOKE
+# ============================================================================
+# Runs only @critical Playwright tests before push (~2-3min).
+# SKIP_E2E=1 git push ... # bypass for quick iterations
+# ============================================================================
+
+set -e
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+if [ -n "$SKIP_E2E" ]; then
+  echo "${YELLOW}▶ SKIP_E2E=1 — skipping critical E2E smoke${NC}"
+  exit 0
+fi
+
+echo "${YELLOW}▶ Running critical E2E smoke tests (Playwright @critical)...${NC}"
+echo "${YELLOW}  Set SKIP_E2E=1 to bypass (not recommended for shared branches)${NC}"
+
+npm run e2e:critical 2>&1 || {
+  echo "${RED}✗ Critical E2E tests failed — push blocked${NC}"
+  echo "${YELLOW}  Tip: run 'npm run e2e:critical' locally to debug${NC}"
+  echo "${YELLOW}  Tip: set SKIP_E2E=1 to bypass if you know what you're doing${NC}"
+  exit 1
+}
+
+echo "${GREEN}✓ Critical E2E smoke passed — push allowed${NC}"

.lighthouserc.js

@@ -0,0 +1,68 @@
+/**
+ * Lighthouse CI Configuration
+ * v0.14.0 TASK-STAG-003: Validation Lighthouse
+ *
+ * Targets:
+ *   Performance >= 85
+ *   Accessibility >= 90
+ *   PWA >= 90 (best-practices proxy when PWA not applicable)
+ *   Best Practices >= 85
+ *   SEO >= 80
+ */
+module.exports = {
+  ci: {
+    collect: {
+      url: [
+        `${process.env.STAGING_URL || 'https://staging.veza.app'}/login`,
+        `${process.env.STAGING_URL || 'https://staging.veza.app'}/register`,
+      ],
+      numberOfRuns: 3,
+      settings: {
+        preset: 'desktop',
+        // Throttling: simulate cable connection
+        throttling: {
+          cpuSlowdownMultiplier: 1,
+          downloadThroughputKbps: 10240,
+          uploadThroughputKbps: 5120,
+          rttMs: 40,
+        },
+        // Skip audits that require auth
+        skipAudits: [
+          'uses-http2', // Depends on server config
+        ],
+      },
+    },
+    assert: {
+      assertions: {
+        // Performance >= 85
+        'categories:performance': ['error', { minScore: 0.85 }],
+        // Accessibility >= 90
+        'categories:accessibility': ['error', { minScore: 0.90 }],
+        // Best Practices >= 85
+        'categories:best-practices': ['warn', { minScore: 0.85 }],
+        // SEO >= 80
+        'categories:seo': ['warn', { minScore: 0.80 }],
+
+        // Core Web Vitals
+        'first-contentful-paint': ['warn', { maxNumericValue: 1800 }],
+        'largest-contentful-paint': ['warn', { maxNumericValue: 2500 }],
+        'cumulative-layout-shift': ['error', { maxNumericValue: 0.1 }],
+        'total-blocking-time': ['warn', { maxNumericValue: 300 }],
+
+        // Accessibility specifics (ORIGIN_UI_UX_SYSTEM compliance)
+        'color-contrast': 'error',
+        'image-alt': 'error',
+        'label': 'error',
+        'button-name': 'error',
+        'link-name': 'error',
+        'document-title': 'error',
+        'html-has-lang': 'error',
+        'meta-viewport': 'error',
+      },
+    },
+    upload: {
+      target: 'filesystem',
+      outputDir: '.lighthouseci',
+    },
+  },
+};

.lintstagedrc.json

@@ -0,0 +1,15 @@
+{
+    "apps/web/**/*.{ts,tsx}": [
+        "bash -c 'cd apps/web && npx eslint --max-warnings=0 --fix \"$@\"' --",
+        "bash -c 'cd apps/web && npx tsc --noEmit -p tsconfig.json'"
+    ],
+    "apps/web/**/*.{js,jsx,json,css,md}": ["prettier --write"],
+    "veza-backend-api/**/*.go": [
+        "bash -c 'cd veza-backend-api && gofmt -l -w \"$@\"' --",
+        "bash -c 'cd veza-backend-api && go vet ./...'"
+    ],
+    "veza-stream-server/**/*.rs": [
+        "bash -c 'cd veza-stream-server && cargo fmt --'"
+    ],
+    "*.{json,md,yml,yaml}": ["prettier --write"]
+}

.nvmrc

@@ -0,0 +1 @@
+20

.pa11yci.json

@@ -0,0 +1,15 @@
+{
+  "defaults": {
+    "standard": "WCAG2AA",
+    "timeout": 30000,
+    "wait": 3000,
+    "chromeLaunchConfig": {
+      "args": ["--no-sandbox"]
+    }
+  },
+  "urls": [
+    "http://localhost:5174/login",
+    "http://localhost:5174/register",
+    "http://localhost:5174/discover"
+  ]
+}

.semgrepignore

@@ -0,0 +1,11 @@
+node_modules/
+.git/
+dist/
+storybook-static/
+coverage/
+*.test.ts
+*.test.tsx
+*.spec.ts
+*_test.go
+tests/
+loadtests/

.zap/rules.tsv

@@ -0,0 +1,2 @@
+10011	IGNORE	(Cookie Without Secure Flag - dev only)
+10054	IGNORE	(Cookie Without SameSite Attribute - dev only)

AUDIT_REPORT.md

@@ -0,0 +1,695 @@
+# AUDIT_REPORT v2 — monorepo Veza
+
+> **Date** : 2026-04-20
+> **Branche** : `main` (HEAD = `89a52944e`, `v1.0.7-rc1`)
+> **Auditeur** : Claude Code (Opus 4.7 — mode autonome, /effort max, /plan)
+> **Méthode** : 5 agents Explore en parallèle (frontend, backend Go, Rust stream, infra/DevOps, dette transverse) + mesures macro directes + lecture `docs/audit-2026-04/v107-plan.md` + `CHANGELOG.md` v1.0.5 → v1.0.7-rc1.
+> **Supersede** : [v1 du 2026-04-14](#annexe-diff-v1-v2) (HEAD `45662aad1`, v1.0.0-mvp-24). Depuis : v1.0.4 → v1.0.5 → v1.0.5.1 → v1.0.6 → v1.0.6.1 → v1.0.6.2 → v1.0.7-rc1. 50+ commits. Le v1 est **obsolète** : son "chemin critique v1.0.5 public-ready" a été réalisé intégralement, mais sa liste de hygiène repo (binaires, screenshots, .git 2.3 GB) est **restée en état**.
+> **Ton** : brutal, pas de langue de bois. Citations `fichier:ligne`.
+
+---
+
+## 0. TL;DR — ce que je retiens en 12 lignes
+
+1. **Plomberie produit : solide.** v1.0.5 → v1.0.7-rc1 a fermé tout le "chemin critique" fonctionnel : register/verify réels, player fallback `/stream`, refund reverse-charge Hyperswitch, reconciliation sweep, Stripe Connect reversal worker, ledger-health Prometheus gauges, maintenance mode persisté, chat multi-instance avec alarme loud. 50+ commits, **18 findings v1 résolus**. Détail : [FUNCTIONAL_AUDIT.md](FUNCTIONAL_AUDIT.md).
+2. **Hygiène repo : catastrophique.** `.git` = **2.3 GB** (inchangé depuis v1). Binaire `api` de **99 MB** encore à la racine (tracked, ELF). 44 fichiers audio `.mp3/.wav` encore dans `veza-backend-api/uploads/`. 48 screenshots PNG à la racine (`dashboard-*.png`, `login-*.png`, `design-system-*.png`, `forgot-password-*.png`). 36 `.playwright-mcp/*.yml` debris de sessions MCP. `CLAUDE_CONTEXT.txt` = **977 KB** à la racine.
+3. **`CLAUDE.md` globalement juste** (v1.0.4, 2026-04-14) mais Vite annoncé "5" → réellement **Vite 7.1.5** (`apps/web/package.json`). Axios "déprécié en dev" → réellement `1.13.5` moderne. `docs/ENV_VARIABLES.md` introuvable alors que CLAUDE.md dit "à maintenir".
+4. **Frontend** : 1984 fichiers TS/TSX. **36 features** modulaires. Router propre (27 routes top-level, 54 lazy). `src/types/generated/api.ts` = **6550 lignes, régénéré aujourd'hui** — OpenAPI typegen a démarré. **282 occurrences `any`** (dont `services/api/auth.ts:85-100` triple cast token fallback). **6 `console.log` en prod** (checkbox, switch, slider, AdvancedFilters, Onboarding, useLongRunningOperation). 11 composants UI orphelins (`hover-card/*`, `dropdown-menu/*`, `optimized-image/*`). 3.5 MB de dead reports (`e2e-results.json` 3.4 MB, `lint_comprehensive.json` 793 KB, `ts_errors.log` 29 KB).
+5. **Backend Go** : 877 fichiers `.go`, **197K LOC**. 27 fichiers routes, 135 handlers, 226 services, 81 modèles, **160 migrations** (jusqu'à `983_`), 17 workers, 11 jobs. **Transactions manquantes** sur paths critiques (marketplace `service.go:1050+`, subscription). **31 instances `context.Background()` dans handlers** → timeout middleware défait. 3 binaires trackés (`api`, `main`, `veza-api`). **Duplicate `RespondWithAppError`** (`response/response.go:101` + `handlers/error_response.go:12`).
+6. **Rust stream server** : Axum 0.8 + Tokio 1.35 + Symphonia. HLS ✅ réel, HTTP Range 206 ✅, WebSocket 1047 LOC ✅, adaptive bitrate 515 LOC ✅. **DASH commenté** (`streaming/protocols/mod.rs:4`). **WebRTC commenté** (`Cargo.toml:62`). **`#![allow(dead_code)]` global** au `lib.rs:5` — camoufle les stubs. 0 `unsafe` (engagement CLAUDE.md tenu). **`proto/chat/chat.proto` orphelin** depuis suppression chat Rust (2026-02-22). `veza-common/src/chat/*` types orphelins.
+7. **Chat server Rust** : **confirmé absent** (commit `05d02386d`, 2026-02-22). Zéro référence dans k8s (bon). **`proto/chat/*.proto` reste comme spec historique** — à déplacer en `docs/archive/` ou supprimer.
+8. **Desktop Electron** : **confirmé absent**. Jamais implémenté. Fossile des docs anciennes.
+9. **Docker** : 6 compose files (dev/prod/staging/test/root/`infra/lab.yml` DEPRECATED Feb 2026). **MinIO pinné `:latest` dans 4 composes** → supply-chain risk. ES 8.11.0 uniquement en dev (orphelin ? backend utilise Postgres FTS). Healthchecks partout mais intervals incohérents (5s→30s). **3 variants Dockerfile par service** (base + .dev + .production) — multi-stage, non-root user `app` (uid 1001), `-w -s` stripped. ⚠️ stream-server Dockerfile.production expose `8082` mais `docker-compose.prod.yml:284` healthcheck attend `3001` — **mismatch**.
+10. **CI/CD** : 5 workflows actifs (`ci.yml` consolidé + `frontend-ci.yml` + `security-scan.yml` gitleaks + `trivy-fs.yml` + `go-fuzz.yml`). **19 workflows disabled, 1676 LOC mort** (`backend-ci.yml.disabled`, `cd.yml.disabled`, `staging-validation.yml.disabled`, `accessibility.yml.disabled`, etc.). E2E **pas déclenché en CI** alors que Playwright existe. Tests integration skipped (`VEZA_SKIP_INTEGRATION=1`) faute de Docker socket.
+11. **Sécurité** : JWT RS256 prod / HS256 dev ✅. OAuth (Google/GitHub/Discord/Spotify) ✅. 2FA TOTP ✅. CORS strict en prod ✅. gitleaks + govulncheck + trivy en CI ✅. **Absents** : CSP header, X-Frame-Options (0 grep hit). **.env committé** (`/veza-backend-api/.env`, `-rw-r--r--`). **TLS certs committés** : `/docker/haproxy/certs/veza.pem`, `/config/ssl/{cert,key,veza}.pem` — **rotate + BFG needed**.
+12. **Verdict monorepo** : **Moyen-Haute dette sur l'hygiène, Faible dette sur le code applicatif**. Le produit fonctionne, la plomberie monétaire est auditée, la sécurité applicative est solide. Mais les items "cleanup" de l'audit v1 n'ont **pas été traités** : binaires trackés, .git 2.3 GB, screenshots racine, .playwright-mcp debris, CLAUDE_CONTEXT.txt 977 KB, 19 workflows disabled, .env/certs committed. **~1 jour de cleanup brutal reste à faire** avant le tag v1.0.7 final.
+
+---
+
+## 1. État des lieux — mesures macro directes
+
+### 1.1 Taille & fichiers
+
+| Mesure                    | v1 (14-04)   | v2 (20-04)    | Delta                                  |
+| ------------------------- | ------------ | ------------- | -------------------------------------- |
+| `.git` (du -sh)           | 2.3 GB       | **2.3 GB**    | 0 (pas de `git filter-repo` fait)      |
+| Fichiers trackés          | 6425         | **6313**      | −112 (quelques cleanups ponctuels)     |
+| Binaires ELF racine       | 3 (api/main/veza-api) | **1 (`api` 99 MB)** | 2 supprimés mais 1 persiste       |
+| Screenshots racine        | 54           | **48**        | −6                                     |
+| `.md` total repo          | inconnu      | **435** (18 active + 417 archive) | —                                      |
+| `.playwright-mcp/*.yml`   | —            | **36 (untracked)** | NEW debris                        |
+| `CLAUDE_CONTEXT.txt`      | —            | **977 KB** racine | NEW artifact de session            |
+| `output.txt` racine       | —            | **27 KB**     | NEW                                    |
+
+### 1.2 Ce qui n'existe PAS (contrairement à certaines docs)
+
+| Objet                              | Status           | Preuve                                                                                            |
+| ---------------------------------- | :--------------: | ------------------------------------------------------------------------------------------------ |
+| `veza-chat-server/`                | ❌ absent        | `ls /home/senke/git/talas/veza/veza-chat-server` → no such dir. Commit `05d02386d` (2026-02-22). |
+| `apps/desktop/` (Electron)         | ❌ absent        | Jamais implémenté.                                                                               |
+| `backend/` racine                  | ❌ absent        | C'est `veza-backend-api/`.                                                                       |
+| `frontend/` racine                 | ❌ absent        | C'est `apps/web/`.                                                                               |
+| `ORIGIN/` racine                   | ❌ absent        | C'est `veza-docs/ORIGIN/`.                                                                       |
+| `proto/chat/chat.proto` utilisé    | ❌ orphelin      | 0 import dans `veza-stream-server/src/`. Chat 100% Go depuis v0.502.                              |
+| Runbooks k8s mentionnant chat Rust | ❌ clean (bonne) | Grep `veza-chat-server` dans `k8s/` = 0 hit.                                                      |
+| **Binaire `api` 99 MB racine**     | ⚠️ **présent**   | `-rwxr-xr-x 1 senke senke 99515104 Mar 24 15:40 api`. **À supprimer.**                           |
+
+---
+
+## 2. Architecture & stack — mise à jour exacte
+
+### 2.1 Arborescence réelle
+
+```
+veza/ (2.3 GB .git, 6313 fichiers trackés)
+├── apps/web/                  # React 18.2 + Vite 7.1.5 + TS 5.9.3 + Zustand 4.5 + React Query 5.17
+│   └── src/ (1984 fichiers TS/TSX)
+│       ├── features/           (36 feature folders)
+│       ├── components/ui/      (255 fichiers — design system)
+│       ├── services/           (73 fichiers)
+│       ├── types/generated/    (api.ts 6550 lignes, régénéré aujourd'hui)
+│       └── router/routeConfig.tsx (184 lignes, 27 routes top-level, 54 lazy)
+│
+├── veza-backend-api/          # Go 1.25.0 + Gin + GORM + Postgres + Redis + RabbitMQ
+│   ├── cmd/api/main.go        (orchestration wiring)
+│   ├── cmd/{migrate_tool,backup,generate-config-docs,tools/*}  (~6 binaires)
+│   ├── internal/              (877 fichiers .go, 197K LOC)
+│   │   ├── api/                (27 routes_*.go)
+│   │   ├── api/handlers/       (3 fichiers DEPRECATED — chat, rbac)
+│   │   ├── handlers/           (135 fichiers — source active)
+│   │   ├── services/           (226 fichiers, 64K LOC)
+│   │   ├── core/*/             (9 services feature-scoped)
+│   │   ├── models/             (81 fichiers, 44K LOC)
+│   │   ├── migrations/         (160 .sql, jusqu'à 983_)
+│   │   ├── workers/            (17) + jobs/ (11)
+│   │   ├── middleware/         (~30)
+│   │   ├── repositories/       (18 GORM-based)
+│   │   └── repository/         (1 ORPHELIN in-memory mock)
+│   ├── docs/swagger.{json,yaml}  (v1.2.0, 2026-03-03)
+│   ├── uploads/               (44 .mp3/.wav TRACKÉS !)
+│   └── {api,main,veza-api}    (3 binaires ELF trackés dans CLAUDE.md .gitignore mais présents)
+│
+├── veza-stream-server/        # Rust 2021 + Axum 0.8 + Tokio 1.35 + Symphonia 0.5 + sqlx 0.8 + tonic 0.11
+│   └── src/
+│       ├── streaming/          (HLS réel, WebSocket 1047 LOC, adaptive 515 LOC, DASH stub commenté)
+│       ├── audio/              (Symphonia + LAME native; opus/webrtc/fdkaac commentés)
+│       ├── core/               (StreamManager 10k+ concurrents, sync engine 1920 LOC)
+│       ├── auth/               (JWT HMAC-SHA256, revocation Redis+in-mem fallback, 825 LOC)
+│       ├── grpc/               (Stream+Auth+Events — generated 21845 LOC auto)
+│       ├── transcoding/        (queue job engine 94 LOC — ALPHA)
+│       ├── event_bus.rs        (RabbitMQ degraded mode, 248 LOC)
+│       └── lib.rs:5            #![allow(dead_code)] GLOBAL — camoufle les stubs
+│
+├── veza-common/               # Rust types partagés
+│   └── src/{chat,ws,files,track,user,playlist,media,api}.rs
+│       └── chat.rs, track.rs, user.rs, etc. — ORPHELINS depuis suppression chat Rust
+│
+├── packages/design-system/    # Tokens design (unique package workspace)
+│
+├── proto/
+│   ├── common/auth.proto      ✅ utilisé par stream-server + backend
+│   ├── stream/stream.proto    ✅ utilisé par stream-server
+│   └── chat/chat.proto        ❌ ORPHELIN (chat en Go depuis v0.502)
+│
+├── docs/
+│   ├── audit-2026-04/         (NEW : axis-1-correctness.md + v107-plan.md)
+│   ├── archive/               (278 fichiers .md historique)
+│   └── (API_REFERENCE, ONBOARDING, PROJECT_STATE, FEATURE_STATUS, etc.)
+│
+├── veza-docs/                 # Docusaurus séparé
+│   ├── docs/{current,vision}/
+│   └── ORIGIN/                 (22 fichiers phase-0 FOSSILE, jamais touchée post-launch)
+│
+├── k8s/                       # ~30-40 manifests + 5 runbooks disaster-recovery
+├── config/                    # alertmanager, grafana, haproxy, prometheus, incus, ssl/* (.pem TRACKÉS)
+├── infra/                     # nginx-rtmp + docker-compose.lab.yml (DEPRECATED)
+├── docker/                    # haproxy/certs/veza.pem (TRACKÉ, sensible)
+├── tests/e2e/                 # Playwright — SKIPPED_TESTS.md liste les flakies
+├── .github/workflows/         # 5 actifs + 19 .disabled (1676 LOC mort)
+├── .husky/                    # pre-commit + pre-push + commit-msg (untracked mais fonctionnels)
+└── {docker-compose*.yml}      # 6 files (dev/prod/staging/test/root/env.example)
+```
+
+### 2.2 Stack — versions actuelles
+
+| Composant      | Doc (CLAUDE.md) | Réel (code)       | Écart ?           |
+| -------------- | --------------- | ----------------- | ----------------- |
+| Go             | 1.25            | **1.25.0** (go.mod) | ✅ OK            |
+| React          | 18.2            | 18.2.0            | ✅ OK             |
+| Vite           | **5**           | **7.1.5**         | ❌ CLAUDE.md obsolète |
+| TypeScript     | 5.9.3           | 5.9.3             | ✅ OK             |
+| Zustand        | —               | 4.5.0             | N/A               |
+| React Query    | 5               | 5.17.0            | ✅ OK             |
+| Tailwind       | —               | **4.0.0**         | ✅ récent         |
+| date-fns       | 4               | 4.1.0             | ✅ OK             |
+| Axios          | non mentionné   | 1.13.5            | ✅ moderne        |
+| jwt-go         | v5              | v5.3.0            | ✅ OK             |
+| gorm           | —               | v1.30.0           | ✅ OK             |
+| gin            | —               | v1.11.0           | ✅ OK             |
+| redis-go       | —               | v9.16.0           | ✅ OK             |
+| Rust edition   | 2021            | 2021              | ✅ OK             |
+| Axum           | 0.8             | 0.8               | ✅ OK             |
+| Tokio          | 1.35            | 1.35              | ✅ OK             |
+| Symphonia      | 0.5             | 0.5               | ✅ OK             |
+| sqlx           | 0.8             | 0.8               | ✅ OK             |
+| tonic          | —               | 0.11              | ✅ récent         |
+| Postgres       | 16              | 16-alpine (pinned)| ✅ OK             |
+| Redis          | 7               | 7-alpine (pinned) | ✅ OK             |
+| ES             | 8.11.0          | 8.11.0 (dev only) | ⚠️ orphelin prod  |
+| RabbitMQ       | 3               | 3 (pinned)        | ✅ OK             |
+| ClamAV         | 1.4             | 1.4 (pinned)      | ✅ OK             |
+| MinIO          | —               | **`:latest`** (4×)| ❌ supply-chain   |
+| Hyperswitch    | 2026.03.11.0    | 2026.03.11.0      | ✅ OK             |
+
+**À corriger dans CLAUDE.md v1.0.5** : Vite 5 → Vite 7.1.5. Ajouter ligne MinIO.
+
+---
+
+## 3. Frontend (`apps/web/`)
+
+### 3.1 Architecture & routes
+
+- **36 feature folders** (`src/features/`) — les plus gros : `playlists/` (182), `tracks/` (181), `auth/` (100), `player/` (94), `chat/` (67).
+- **Router** (`src/router/routeConfig.tsx:1-184`) — 27 routes top-level, **54 composants lazy**. **Zéro route "Coming Soon"/placeholder**. Tous les paths mènent à un composant réel.
+- **OpenAPI typegen enclenché** : `src/types/generated/api.ts` = **6550 lignes, régénéré 2026-04-19 00:57:21**. La migration "kill hand-written services" prévue post-v1.0.4 a démarré. Script `apps/web/scripts/generate-types.sh` wiré en pre-commit.
+
+### 3.2 Composants & design system
+
+- `src/components/ui/` : **255 fichiers**. Untracked : `testids.ts` (NEW, probablement wiring E2E).
+- **Composants orphelins identifiés** (0-1 imports — candidates suppression) :
+  - `components/ui/optimized-image/OptimizedImageSkeleton.tsx` (0)
+  - `components/ui/optimized-image/ResponsiveImage.tsx` (0)
+  - `components/ui/hover-card/*` (3 fichiers, 0 imports — arbre mort)
+  - `components/ui/dropdown-menu/*` (7 fichiers, 0-1 imports — probablement remplacé par Radix)
+  - Total : **~11 fichiers orphelins dans le DS**.
+
+### 3.3 State & services
+
+- **Zustand** : 5 stores principaux (`authStore`, `chatStore`, `playerStore`, `queueSessionStore`, `cartStore`) — tous utilisés.
+- **React Query** : **seulement 9 fichiers** utilisent `useQuery/useMutation`. `queryKey` ad-hoc (hardcoded, dynamic, constants mélangés). **Pas de factory centralisée** → cache invalidation fragile.
+- **Services** (73 fichiers) :
+  - Top 4 monolithes : `services/api/auth.ts:553` (token+login+register+2FA), `services/adminService.ts:474` (7+ endpoints), `services/analyticsService.ts:472`, `services/marketplaceService.ts:351`.
+  - **Anti-pattern critique** : `services/api/auth.ts:85-100` fait 3 fallback `const rd = response.data as any` pour parser les tokens. **Pas de validation Zod.**
+
+### 3.4 Tests
+
+- **286 fichiers `.test.ts(x)`** (Vitest).
+- **1 test skipped** : `features/auth/pages/ResetPasswordPage.test.tsx` (async timing).
+- **E2E** (racine `tests/e2e/`) : Playwright présent, **SKIPPED_TESTS.md documente les flakies** (v107-e2e-04/05/06/08/09 à vérifier en staging).
+- Tests E2E **PAS déclenchés en CI** (Playwright absent de `.github/workflows/ci.yml`).
+
+### 3.5 Dette frontend
+
+| Dette                              | Count | Sévérité |
+| ---------------------------------- | :---: | :------: |
+| `TODO/FIXME/HACK`                  | 1     | ✅ top    |
+| `console.log` en production        | 6 fichiers (checkbox, switch, slider, AdvancedFilters, Onboarding, useLongRunningOperation) | 🔴       |
+| `any` types                        | 282   | 🔴        |
+| `@ts-ignore` / `@ts-expect-error`  | 6 fichiers | 🟡       |
+| Fichiers >500 LOC (non-gen)        | ~8    | 🟡        |
+| Composants V2/V3/_old/_new         | 0     | ✅        |
+| `src/types/v2-v3-types.ts`         | présent (mentionné CLAUDE.md) | 🟡 |
+
+### 3.6 Artefacts morts à la racine de `apps/web/`
+
+| Fichier                      | Taille | Date (mtime) | Status            |
+| ---------------------------- | ------ | ------------ | ----------------- |
+| `e2e-results.json`           | 3.4 MB | Mar 15       | 🔴 obsolète       |
+| `lint_comprehensive.json`    | 793 KB | Jan 7        | 🔴 obsolète       |
+| `e2e-results.json` (2)       | 241 KB | Jan 7        | 🔴 doublon        |
+| `ts_errors.log`              | 29 KB  | Dec 12       | 🔴 2+ mois stale  |
+| `storybook-roadmap.json`     | 8.5 KB | Mar 6        | 🟡                |
+| `AUDIT_ISSUES.json`          | 19 KB  | Dec 17       | 🔴                |
+| `audit.log`, `debug-storybook.log` | 8.5 KB | Feb/Mar | 🟡                |
+
+**~3.5 MB de reports morts** au bord du frontend. CLAUDE.md §règles 11 interdit ces fichiers en git (ils sont ignorés via `.gitignore` mais traînent en untracked).
+
+---
+
+## 4. Backend Go (`veza-backend-api/`)
+
+### 4.1 Structure
+
+- **877 fichiers .go** dans `internal/`
+- **27 fichiers `routes_*.go`** (1 est un test)
+- **135 handlers actifs** dans `internal/handlers/`
+- **3 fichiers dans `internal/api/handlers/`** — confirmés DEPRECATED (chat + RBAC, à purger après confirmation aucun import)
+- **226 services** (`internal/services/`) + **9 core services** (`internal/core/*/service.go`)
+- **81 modèles** (`internal/models/`, 44K LOC) — pattern GORM + soft-delete
+- **160 migrations SQL** (jusqu'à `983_hyperswitch_webhook_log.sql`)
+- **17 workers** + **11 jobs**
+- **~30 middlewares**
+
+### 4.2 Routes & handlers
+
+Handlers complets par domaine, **zéro endpoint retournant 501 ou vide**. Zéro double wiring.
+
+Top routes par taille : `routes_core.go:512` (20+ routes), `routes_auth.go:245` (14+ routes, 2FA/OAuth inclus), `routes_tracks.go:240` (18+), `routes_users.go:296` (17+), `routes_marketplace.go:174` (15+), `routes_webhooks.go:205` (5+ ; raw payload audit).
+
+### 4.3 Auth
+
+| Aspect               | Status | Preuve                                                                                              |
+| -------------------- | :----: | ---------------------------------------------------------------------------------------------------- |
+| JWT RS256 prod       | ✅     | `services/jwt_service.go:17-81`, keys depuis env.                                                   |
+| HS256 dev fallback   | ✅     | Idem, 32+ char secret exigé.                                                                         |
+| Refresh 7j / Access 5min | ✅ | Configurés.                                                                                          |
+| 2FA TOTP + backup codes | ✅ | `handlers/two_factor_handler.go:171` (actif). `api/handlers/` vide de 2FA — deprecated purgé.         |
+| OAuth 4 providers     | ✅     | `routes_auth.go:122-176` (Google, GitHub, Discord, Spotify). State encrypté via CryptoService.      |
+| Rate limiting multi-couche | ✅ + 🟡 | DDoS global 1000 req/s ✅, endpoint-specific ✅, API key ✅, **`UserRateLimiter` configuré mais pas wiré aux routes**. |
+| CSRF                 | ✅     | Middleware actif (e2e confirmé `tests/e2e/45-playlists-deep.spec.ts`). Disabled dev/staging (`router.go:133`). |
+| Security headers     | 🟡    | SecurityHeaders middleware présent (`router.go:204`). **CSP / X-Frame-Options pas vus en grep**. À vérifier. |
+
+### 4.4 Modèles, DB, transactions
+
+- Migrations auto-appliquées au démarrage (`database.go:234-256`). Boot fail si erreur SQL.
+- Repositories : 18 GORM-direct, pattern inline (pas d'interface). **Plus** `internal/repository/` (1 fichier in-memory mock UserRepository) **ORPHELIN** — à supprimer.
+- **Transactions insuffisantes** — `db.Transaction()` usage = **8×**, `tx.Create/Save/Delete` manuel = **37×**. Chemins critiques (marketplace `core/marketplace/service.go:1050+`, subscription) ne sont **pas dans des transactions explicites**. Risque data corruption si une étape échoue au milieu.
+
+### 4.5 Services & context
+
+- Architecture dual-layer `core/` + `services/` **incohérente** : certaines features ont `core/service.go`, d'autres `services/*.go`, sans règle claire. Ex. track publication en `core/track/` mais search indexing en `services/track_search_service.go`, les deux appelés depuis un même handler.
+- Context propagation : 558 usages propres dans services, **mais 31 `context.Background()` dans `handlers/`** → défait le timeout middleware. Fix grep+sed 1 jour.
+- **Pas de `services_init.go`** : services instantiés inline dans `routes_*.go`. Re-créés par request-group. Non-singletons.
+
+### 4.6 Workers & jobs
+
+- **Actifs lancés par `cmd/api/main.go`** : JobWorker, TransferRetry, StripeReversal, Reconciliation, CloudBackup, GearWarranty, NotifDigest, HardDelete, OrphanTracksCleanup, LedgerHealthSampler.
+- **Jobs définis mais jamais schedulés** : `SchedulePasswordResetCleanupJob`, `CleanupExpiredSessions`, `CleanupVerificationTokens`, `CleanupHyperswitchWebhookLog` — ~4 cleanup jobs **dead code**. Soit les brancher soit les supprimer.
+
+### 4.7 Tests
+
+- **364 fichiers `*_test.go`**. `coverage_v1.out` (Mar 3) indique ~60-70%.
+- Integration tests skippables via config — mais **pas de variable `VEZA_SKIP_INTEGRATION` trouvée en grep** (CLAUDE.md la mentionne — à vérifier si elle existe réellement ou si c'est un fossile doc).
+- E2E Playwright n'entre jamais en CI.
+
+### 4.8 Validation & errors
+
+- `internal/validators/` — wrapper `go-playground/validator/v10` ✅
+- `internal/errors/` — `AppError{Code,Message,Err,Details,Context}` ✅
+- **PROBLÈME** : `RespondWithAppError` défini **2 fois** (`response/response.go:101` + `handlers/error_response.go:12`). Duplication à consolider.
+- Wrapped errors : 349 usages `errors.Is/As/Unwrap` — bon pattern.
+
+### 4.9 Config
+
+- **99 env vars lues** dans `config/config.go` (1087 LOC)
+- **`Config.Validate()`** :
+  - ✅ Refuse prod si `HYPERSWITCH_ENABLED=false` (`config.go:908-910`, fail-closed).
+  - ✅ Refuse prod sans DATABASE_URL, JWT keys, CORS origins.
+  - ❌ **Pas de check `APP_ENV ∈ {dev,staging,prod}`** — silencieusement default dev.
+  - ❌ **Pas de check `UPLOAD_DIR` exists** — boot success même si dir manquant.
+- **`.env.template` 190 lignes** vs 263 `os.Getenv` appels code → drift potentiel (~70 vars documentées vs 99 utilisées).
+
+### 4.10 Dette backend — récap
+
+| Dette                                       | Sévérité  | Effort | Preuve                                                        |
+| ------------------------------------------- | :-------: | :----: | ------------------------------------------------------------- |
+| Transactions manquantes marketplace/subs    | 🔴        | M (3j) | `core/marketplace/service.go:1050+`                           |
+| 31× `context.Background()` dans handlers    | 🔴        | S (1j) | Grep handlers                                                 |
+| Binaires racine `api` (99MB) + 44 .mp3      | 🔴        | XS (1h)| `git rm --cached` + BFG                                       |
+| `RespondWithAppError` dupliqué              | 🟡        | S (1j) | `response/response.go:101` + `handlers/error_response.go:12`  |
+| `internal/repository/` orphelin             | 🟡        | XS     | Delete dir                                                    |
+| 4 cleanup jobs jamais schedulés             | 🟡        | S      | Brancher ou supprimer                                         |
+| `UserRateLimiter` configuré non wiré        | 🟡        | S      | Wire en middleware chain                                      |
+| Écart `.env.template` vs code (29 vars)     | 🟠        | S      | Sync                                                          |
+| Services re-instantiés par request-group    | 🟠        | M      | `services_init.go` + singleton pattern                        |
+| Architecture core/+services/ incohérente    | 🟠        | L      | Document la règle OU unifier                                  |
+
+---
+
+## 5. Rust stream server (`veza-stream-server/`)
+
+### 5.1 Modules
+
+Production-ready : `streaming/` (HLS réel, Range 206, WS 1047 LOC, adaptive 515 LOC), `audio/` (Symphonia native, compression 708 LOC, effects SIMD), `core/` (StreamManager 10k+ concurrents, sync engine NTP-like 1920 LOC), `auth/` (JWT HMAC-SHA256 + revocation Redis-or-in-mem 825 LOC), `cache/` (LRU audio), `event_bus.rs` (RabbitMQ degraded mode).
+
+Alpha / partiel : `transcoding/engine.rs` (94 LOC, job queue priority-based mais **zéro test d'intégration, zéro tracking live**), `grpc/` (461 LOC business + 21845 LOC généré).
+
+**Stub / absent** :
+- `streaming/protocols/mod.rs:4` → `// pub mod dash;` **commenté**.
+- `Cargo.toml:62` → `// webrtc = "0.7"` **commenté** (deps natives manquantes).
+
+### 5.2 Audio codecs
+
+Symphonia couvre MP3, FLAC, Vorbis, AAC **natifs**. LAME MP3 via `minimp3 0.5` (natif). **Commentés** : `opus 0.3` (cmake), `lame 0.1`, `fdkaac 0.7` (non sur crates.io).
+
+### 5.3 gRPC & protos
+
+`StreamService`, `AuthService`, `EventsService` (3 services). Utilise `proto/common/auth.proto` + `proto/stream/stream.proto`. **`proto/chat/chat.proto` = 0 import** → orphelin depuis suppression chat Rust.
+
+### 5.4 Dette Rust
+
+| Dette                                           | Sévérité | Preuve                                                           |
+| ----------------------------------------------- | :------: | ---------------------------------------------------------------- |
+| `#![allow(dead_code)]` global dans `lib.rs:5`   | 🔴       | Masque tous les stubs. Devrait être granulaire par module.      |
+| 10× `unwrap()` sur broadcast channels           | 🔴       | `core/sync.rs:1037-1110`. Panic si receiver drop. `.expect()` + contexte. |
+| `proto/chat/chat.proto` orphelin               | 🟡       | À archiver/supprimer.                                            |
+| `veza-common` chat types orphelins              | 🟡       | ~60 LOC dead. Audit grep `use veza_common::chat` → 0 hit.        |
+| `transcoding/` zéro tests intégration           | 🟡       | `engine.rs:36-62`.                                               |
+| 26× `println!/dbg!`                             | 🟡       | Devrait utiliser `tracing::`.                                    |
+| Deps inutilisées (`daemonize`, `notify`)        | 🟠       | `Cargo.toml:139, 116`.                                           |
+
+**0 `unsafe`** ✅ (engagement CLAUDE.md tenu).
+
+---
+
+## 6. Infrastructure & DevOps
+
+### 6.1 Docker Compose (6 fichiers)
+
+| Fichier                      | Rôle                              | État                                       |
+| ---------------------------- | --------------------------------- | ------------------------------------------ |
+| `docker-compose.yml`         | Dev full-stack avec profiles      | ✅ Actif                                    |
+| `docker-compose.dev.yml`     | Infra-only (209 LOC)              | ✅ Actif (MailHog + ES 8.11.0 ici uniquement)|
+| `docker-compose.prod.yml`    | Blue-green, HAProxy, Alertmanager (464 LOC) | ✅ Actif (Mar 12)               |
+| `docker-compose.staging.yml` | Caddy (202 LOC)                   | ✅ Actif (Mar 2)                            |
+| `docker-compose.test.yml`    | tmpfs CI (64 LOC)                 | ✅ Actif                                    |
+| `infra/docker-compose.lab.yml` | DEPRECATED Feb 2026             | 🔴 À supprimer                              |
+
+**Pinning** :
+- ✅ Postgres 16-alpine, Redis 7-alpine, RabbitMQ 3, ClamAV 1.4, Hyperswitch 2026.03.11.0.
+- ❌ **MinIO `:latest`** dans 4 composes → supply-chain attack vector.
+
+**Services orphelins en dev-only** :
+- ES 8.11.0 uniquement `docker-compose.dev.yml:171-204` (34 LOC) — **le backend utilise Postgres FTS, pas ES** (`fulltext_search_service.go`). ES ne sert qu'au hard-delete worker (GDPR cleanup), optionnel. À documenter ou retirer.
+
+### 6.2 Dockerfiles
+
+- Backend : `Dockerfile` + `Dockerfile.production` (Go 1.24-alpine, multi-stage, non-root uid 1001, `-w -s`). ⚠️ **CLAUDE.md dit Go 1.25, Dockerfile sur 1.24** — bumper.
+- Stream : `Dockerfile` + `Dockerfile.production` (rust:1.84-alpine). ⚠️ **Mismatch port** : Dockerfile.production expose `8082` mais `docker-compose.prod.yml:284` healthcheck attend `3001` — **le Dockerfile n'est pas utilisé en prod** (sans doute l'image vient d'ailleurs).
+- Web : `Dockerfile` + `Dockerfile.dev` + `Dockerfile.production` (node:20-alpine → nginx:1.27-alpine).
+
+### 6.3 CI/CD
+
+**Workflows actifs (5)** :
+1. `ci.yml` (consolidé, ~15min) — backend Go (test, lint, vet, govulncheck), frontend (lint, tsc, build, vitest), rust (build, test, clippy, audit).
+2. `frontend-ci.yml` (55 LOC) — path-triggered React-only, bundle-size gate, npm audit.
+3. `security-scan.yml` — gitleaks v8.21.2 secret scan.
+4. `trivy-fs.yml` — Trivy filesystem scan (HIGH+CRITICAL exit=1).
+5. `go-fuzz.yml` — Nightly fuzz 60s, corpus upload.
+
+**Workflows disabled (19 fichiers, 1676 LOC mort)** :
+`backend-ci.yml.disabled`, `cd.yml.disabled`, `staging-validation.yml.disabled`, `accessibility.yml.disabled`, `chromatic.yml.disabled`, `visual-regression.yml.disabled`, `storybook-audit.yml.disabled`, `contract-testing.yml.disabled`, `zap-dast.yml.disabled`, `container-scan.yml.disabled`, `semgrep.yml.disabled`, `sast.yml.disabled`, `mutation-testing.yml.disabled`, `rust-mutation.yml.disabled`, `load-test-nightly.yml.disabled`, `flaky-report.yml.disabled`, `openapi-lint.yml.disabled`, `commitlint.yml.disabled`, `performance.yml.disabled`.
+
+**→ 1676 lignes de workflow mort. Soit réactiver ce qui fait sens (SAST, DAST, openapi-lint), soit archiver dans `docs/archive/workflows/` pour ne pas polluer `.github/workflows/`.**
+
+**Gaps CI** :
+- E2E Playwright pas déclenché (pourtant `tests/e2e/` existe, `SKIPPED_TESTS.md` documente les flakies).
+- Integration tests Go skipped (`VEZA_SKIP_INTEGRATION=1` faute de Docker socket sur runner).
+
+### 6.4 K8s
+
+- ~30-40 manifests, structure propre (`autoscaling/`, `backends/`, `backups/`, `cdn/`, `disaster-recovery/`, `environments/{prod,staging,dev}`, `secrets/`).
+- **5 runbooks** : cluster-failover, database-failover, data-restore, rollback-procedure, security-incident.
+- ✅ **Zéro référence à `veza-chat-server`** dans `k8s/` (grep clean — l'audit v1 disait qu'il y avait 7+ runbooks outdated ; **corrigé**).
+
+### 6.5 Secrets & sécurité
+
+| Item                                          | État     | Action                                                               |
+| --------------------------------------------- | :------: | -------------------------------------------------------------------- |
+| `/docker/haproxy/certs/veza.pem`              | 🔴 TRACKED | BFG + rotate cert + move to K8s Secret                               |
+| `/config/ssl/{cert,key,veza}.pem`             | 🔴 TRACKED | Idem                                                                 |
+| `veza-backend-api/.env`                       | 🔴 TRACKED | `git rm --cached`, rotate JWT/DB secrets dev, relire `.gitignore`   |
+| `veza-backend-api/.env.production.example`    | 🟢 OK     | Template                                                             |
+| Hardcoded secrets en code (`sk_live_`, `AKIA`)| ✅ absent | Grep clean                                                           |
+| gitleaks en CI                                | ✅        | `security-scan.yml`                                                  |
+| govulncheck                                   | ✅        | `ci.yml`                                                             |
+| CSP header                                    | 🟡       | Grep 0 hit. **À implémenter.**                                        |
+| X-Frame-Options                               | 🟡       | Idem                                                                  |
+
+### 6.6 Observability
+
+- Prometheus : **5 gauges ledger-health** déployées en v1.0.7 (`ledger_metrics.go`), **+ counter/histogram reconciler**. Alertmanager `config/alertmanager/ledger.yml` avec 3 règles (VezaOrphanRefundRows, VezaStuckOrdersPending, VezaReconcilerStale). Grafana dashboard `config/grafana/dashboards/ledger-health.json`.
+- Logs : JSON structuré confirmé (`level`, `time`, `msg`, `request_id`, `user_id`).
+- **Gap** : `/metrics` endpoint global backend pas vu (à confirmer — il existe probablement via middleware Sentry/Prometheus, mais pas en grep direct).
+- Sentry : optionnel via env (`SENTRY_DSN`, `SENTRY_SAMPLE_RATE_*`).
+
+---
+
+## 7. Documentation
+
+### 7.1 Racine du repo
+
+| Fichier                         | Taille | Date       | Verdict                                                                |
+| ------------------------------- | ------ | ---------- | ---------------------------------------------------------------------- |
+| `CLAUDE.md`                     | 22 KB  | 2026-04-14 | ✅ Autorité. Petite dérive : Vite 5 → 7.1.5 à corriger.               |
+| `CHANGELOG.md`                  | 87 KB  | 2026-04-19 | ✅ À jour (v0.201 → v1.0.7-rc1).                                       |
+| `README.md`                     | 2.8 KB | —          | ✅ Minimal OK.                                                         |
+| `CONTRIBUTING.md`               | 2.7 KB | 2026-02-27 | ✅ OK.                                                                 |
+| `VERSION`                       | —      | —          | `1.0.7-rc1` ✅ aligné.                                                 |
+| `VEZA_VERSIONS_ROADMAP.md`      | 69 KB  | —          | ⚠️ Historique v0.9xx, peu utile post-launch. Archive.                 |
+| `RELEASE_NOTES_V1.md`           | 4.7 KB | —          | ✅ OK.                                                                 |
+| `AUDIT_REPORT.md`               | 57 KB  | 2026-04-14 | 🔄 **Ce fichier — v2 remplace v1**.                                   |
+| `FUNCTIONAL_AUDIT.md`           | 43 KB  | 2026-04-19 | ✅ v2 à jour.                                                          |
+| `UI_CONTEXT_SUMMARY.md`         | 6 KB   | —          | 🟠 Session artifact, devrait être archivé selon CLAUDE.md §12.        |
+| `CLAUDE_CONTEXT.txt`            | 977 KB | 2026-04-18 | 🔴 ÉNORME session dump. Archive ou supprime.                          |
+| `output.txt`                    | 27 KB  | 2026-04-18 | 🔴 Debris.                                                             |
+| `generate_page_fix_prompts.sh`  | 42 KB  | Mar 26     | 🟡 Script généré, probablement obsolète.                              |
+| `build-archive.log`             | 974 B  | Mar 25     | 🟡 Log.                                                                |
+
+**48 screenshots PNG racine** (`dashboard-*.png`, `login-*.png`, `design-system-*.png`, `forgot-password-*.png`) — **à déplacer dans `docs/screenshots/` ou supprimer**.
+
+### 7.2 `docs/` (18 actifs + 417 archive = 435 .md)
+
+**Actifs** :
+- `docs/API_REFERENCE.md` (1022 LOC) — **manuel**, pas de typegen. Écart flag vs routes Go. Migration vers OpenAPI typegen backend = priorité.
+- `docs/ONBOARDING.md`, `docs/PROJECT_STATE.md`, `docs/FEATURE_STATUS.md` — à cross-checker avec code v1.0.7 (non fait ici).
+- `docs/ENV_VARIABLES.md` — **introuvable en `ls docs/`** alors que CLAUDE.md dit "à maintenir". Soit créé soit manque.
+- `docs/audit-2026-04/` — **NOUVEAU, très utile** : `axis-1-correctness.md` + `v107-plan.md` — trace des findings et du plan v1.0.7.
+- `docs/SECURITY_SCAN_RC1.md` / `docs/ASVS_CHECKLIST_v0.12.6.md` / `docs/PENTEST_REPORT_VEZA_v0.12.6.md` — **refs v0.12.6, obsolètes** pour v1.0.7. Refaire ou archiver.
+
+**Archive** (`docs/archive/` = 278 fichiers) : historique session 2026. Taille totale importante. Ne pose pas de problème immédiat.
+
+### 7.3 `veza-docs/` (Docusaurus séparé)
+
+- `veza-docs/docs/{current,vision}/` — doc cible.
+- `veza-docs/ORIGIN/` (22 fichiers, ~70K lignes) — **phase-0, jamais touchée depuis launch**. Qualifiée "FOSSIL" par agent. Archive ou zip.
+
+---
+
+## 8. Dette technique transverse — catalogue
+
+### 8.1 TODOs / FIXMEs (11 hits)
+
+1. `tests/e2e/22-performance.spec.ts:8` — "Either add data-testid containers or rewrite test to use API mocking" (3 occurrences).
+2. `tests/e2e/04-tracks.spec.ts` — "Corriger le bug dans FeedPage.tsx" (ouvert, P1).
+3. `apps/web/src/features/auth/pages/ResetPasswordPage.test.tsx` — async timing flaky.
+4. `veza-backend-api/internal/core/marketplace/service.go:1450` — "TODO v1.0.7: Stripe Connect reverse-transfer API" (**effectivement déjà landed en v1.0.7 item A+B** — TODO à supprimer).
+5. `veza-backend-api/internal/core/subscription/service.go` — "TODO(v1.0.7-item-G): subscription pending_payment state" (in-flight, parked).
+
+**Aucun TODO daté >6 mois.** Discipline correcte.
+
+### 8.2 Code mort / orphelin
+
+| Item                                             | Action                                           |
+| ------------------------------------------------ | ------------------------------------------------ |
+| `veza-backend-api/internal/api/handlers/` (3 fichiers) | Confirmer 0 import puis `git rm -r`         |
+| `veza-backend-api/internal/repository/` (in-mem mock)  | `git rm -r`                                 |
+| `apps/web/src/components/ui/hover-card/*` (3)    | Delete si confirmé 0 import                       |
+| `apps/web/src/components/ui/dropdown-menu/*` (7) | Audit imports, delete si Radix les remplace      |
+| `apps/web/src/components/ui/optimized-image/{OptimizedImageSkeleton,ResponsiveImage}.tsx` | Delete |
+| `apps/web/src/types/v2-v3-types.ts`               | Auditer appelants, renommer ou delete          |
+| `proto/chat/chat.proto`                          | Archiver `docs/archive/proto-chat/` ou delete    |
+| `veza-common/src/chat.rs` + autres types chat    | Audit `use veza_common::chat`, delete si 0 hit   |
+| 19 workflows `.disabled`                         | Archiver `docs/archive/workflows/` ou delete     |
+| 4 cleanup jobs jamais schedulés (pw-reset, sessions, verif, hyperswitch-log) | Brancher ou delete |
+
+### 8.3 Binaires / artefacts trackés
+
+| Item                                                | Taille | Action                                            |
+| --------------------------------------------------- | ------ | ------------------------------------------------- |
+| `api` (racine, ELF)                                 | 99 MB  | `git rm --cached api` + `.gitignore`              |
+| `veza-backend-api/{main,veza-api,seed,server}`      | ~50 MB chacun | Idem (sont dans `.gitignore` mais encore tracked?) |
+| `veza-backend-api/uploads/*.{mp3,wav}` (44 fichiers)| 12 MB  | `git rm -r --cached uploads/` + move to git-lfs ou fixtures |
+| `CLAUDE_CONTEXT.txt` (racine)                        | 977 KB | `git rm --cached` ou déplacer                     |
+| `apps/web/e2e-results.json` (3.4 MB)                 | 3.4 MB | `.gitignore` + `rm`                               |
+| 48 PNG racine (dashboard-*, login-*, design-system-*, forgot-password-*)  | ~5 MB total | Move to `docs/screenshots/` ou delete |
+| 36 `.playwright-mcp/*.yml` (untracked)              | —      | `rm -r .playwright-mcp/`                          |
+
+### 8.4 Sécurité hors-code
+
+| Item                                      | Action                                                 |
+| ----------------------------------------- | ------------------------------------------------------ |
+| `/docker/haproxy/certs/veza.pem` tracked  | BFG purge history + rotate cert + K8s Secret           |
+| `/config/ssl/*.pem` tracked               | Idem                                                   |
+| `veza-backend-api/.env` tracked           | `git rm --cached`, rotate dev secrets, audit team      |
+| CSP header absent                         | Middleware `SecurityHeaders` — ajouter                 |
+| X-Frame-Options absent                    | Idem                                                   |
+
+### 8.5 Incohérences doc↔code
+
+| Item                                           | Delta                                              |
+| ---------------------------------------------- | -------------------------------------------------- |
+| `CLAUDE.md` : Vite 5                           | Réel Vite 7.1.5 — bumper doc                        |
+| `CLAUDE.md` : ES 8.11.0 partout                | Réel ES 8.11.0 dev-only                             |
+| `CLAUDE.md` : Go 1.25                          | go.mod 1.25.0 ✅ ; `veza-backend-api/Dockerfile` 1.24 — bumper |
+| `docs/API_REFERENCE.md` manuel 1022 LOC        | 135 handlers — risque drift. OpenAPI typegen backend recommandé. |
+| `VEZA_VERSIONS_ROADMAP.md` v0.9xx              | VERSION = 1.0.7-rc1 — archive le roadmap           |
+| `docs/ASVS_CHECKLIST_v0.12.6.md` etc          | Version obsolète. Refaire sur v1.0.7 ou archiver.   |
+| `docs/ENV_VARIABLES.md` mentionné              | Pas trouvé en `ls docs/`. Créer.                    |
+
+### 8.6 Patterns abandonnés ou à mi-chemin
+
+1. **OpenAPI typegen frontend** : démarré (`api.ts` 6550 LOC régénéré) mais les **73 services frontend restent hand-written**. Finir la migration (memory entry : "orval recommended").
+2. **OpenAPI typegen backend** : `docs/API_REFERENCE.md` manuel. Swagger infra (`swaggo/swag`) présente mais pas pleinement exploitée.
+3. **Repository pattern** : `repositories/` (GORM-direct, 18 fichiers) mixé avec `services/` qui requêtent `gormDB` direct. Pas d'interfaces. Pattern mi-chemin.
+4. **Architecture `core/` + `services/`** : pas de règle claire. À unifier ou à documenter explicitement quelles features vont où.
+5. **Transactions** : 8 usages vs 37 tx manuels. Pattern moitié-fait.
+
+---
+
+## 9. Top 15 priorités — impact / effort
+
+> **Mise à jour 2026-04-23** — colonne `Statut` ajoutée après la session cleanup tier 1/2/3 + BFG history rewrite. Voir §9.bis pour le détail des 3 false-positives identifiés pendant l'exécution.
+
+Classement pour la suite (post-v1.0.7-rc1 → v1.0.7 final → v1.0.8).
+
+| #   | Priorité                                                                         | Impact | Effort  | Statut 2026-04-23 | Rationale / Preuve                                                         |
+| --- | -------------------------------------------------------------------------------- | :----: | :-----: | :---------------- | -------------------------------------------------------------------------- |
+| 1   | **Supprimer `api` 99 MB + binaires Go trackés racine + `uploads/*.mp3`**         | 🔴 CRIT | XS (1h) | ✅ DONE            | BFG pass 2026-04-23, 1.5G → 66M. Force-push stages 1+2 OK.                 |
+| 2   | **Rotate TLS certs + supprimer `.pem` trackés + .env committed**                  | 🔴 CRIT | S (4h)  | ✅ DONE            | `.env*` + certs stripped via BFG. Keys regen, gitignorées.                 |
+| 3   | **Transactions marketplace/subscription**                                         | 🔴 CRIT | M (3j)  | ✅ DONE            | Commit `b5281bec` — `UpdateProductImages` + `SetProductLicenses` en tx.    |
+| 4   | **Context propagation : 31× `context.Background()` dans handlers**                | 🔴     | S (1j)  | ⚠️ FALSE-POSITIVE  | 26/31 dans `*_test.go`, 5 legit (health probes + WS pumps). Voir §9.bis. |
+| 5   | **Ajouter CSP + X-Frame-Options headers**                                         | 🔴     | S (1j)  | ⚠️ FALSE-POSITIVE  | `middleware/security_headers.go` couvre déjà CSP + XFO + HSTS + CORP/COEP/COOP. Voir §9.bis. |
+| 6   | **Pin MinIO `:latest` → tag daté**                                                | 🔴     | XS (10min) | ✅ DONE         | Commit `4310dbb7` — pinned `RELEASE.2025-09-07T16-13-09Z` × 4 compose files. |
+| 7   | **Nettoyer `.playwright-mcp/*.yml` + 48 PNG racine + `CLAUDE_CONTEXT.txt` + dead reports apps/web/** | 🟡 | S (2h) | ✅ DONE | Commits `d12b901d` + `172581ff` + BFG pass. |
+| 8   | **Terminer OpenAPI typegen** (frontend services + backend swaggo)                 | 🟡     | L (5j)  | 📋 DEFERRED v1.0.8 | Memory entry, drift risk. `api.ts` 6550 LOC déjà là. Plan séparé requis.  |
+| 9   | **Supprimer 19 workflows `.disabled` (1676 LOC mort) OU réactiver utiles (SAST, DAST, openapi-lint)** | 🟡 | S (4h) | ✅ DONE | Archivés dans `docs/archive/workflows/` via commit `172581ff`. |
+| 10  | **Consolider `RespondWithAppError` dupliqué**                                     | 🟡     | S (1j)  | ⚠️ FALSE-POSITIVE  | `handlers/error_response.go:12` = wrapper intentionnel déléguant à `response/response.go:101`. Pas dupe. Voir §9.bis. |
+| 11  | **Wirer `UserRateLimiter` configuré mais non appelé**                             | 🟡     | S (1j)  | ✅ DONE            | Commit `ebf3276d` — wired in `AuthMiddleware.RequireAuth()`.                |
+| 12  | **Supprimer `internal/repository/` (in-mem mock orphelin)**                       | 🟡     | XS      | ✅ DONE            | `user_repository.go` supprimé dans commit `172581ff`.                       |
+| 13  | **Remove/archive `proto/chat/chat.proto` + `veza-common/src/chat.rs`**            | 🟡     | XS      | ✅ DONE            | Commit `172581ff` — proto + `veza-common/{chat.rs, websocket.rs}` supprimés. |
+| 14  | **Ajouter E2E Playwright en CI**                                                  | 🟡     | M (3j)  | 📋 DEFERRED v1.0.8 | Playwright existe, SKIPPED_TESTS.md documenté, mais pas trigger CI.         |
+| 15  | **`docs/ENV_VARIABLES.md` — créer si manque, sync avec code**                     | 🟠     | S (1j)  | 📝 PENDING (0.5j)  | Seul item réel restant du top-15 avant tag v1.0.7 final.                    |
+
+**Bilan** : 10 ✅ DONE · 3 ⚠️ FALSE-POSITIVE · 2 📋 DEFERRED v1.0.8 · 1 📝 PENDING (~0.5j).
+
+### 9.1 "À supprimer sans regret"
+
+- `infra/docker-compose.lab.yml` (DEPRECATED Feb 2026)
+- `scripts/align-8px-grid.py`, `auto_migrate_tailwind_colors*.py` (tailwind migration faite)
+- 48 PNG racine
+- 36 `.playwright-mcp/*.yml`
+- 19 `.disabled` workflows
+- Binaires Go trackés
+- 44 fichiers audio `.mp3/.wav` dans `veza-backend-api/uploads/`
+- `CLAUDE_CONTEXT.txt` racine
+- `VEZA_VERSIONS_ROADMAP.md` (v0.9xx historique)
+- `generate_page_fix_prompts.sh` racine (42 KB, Mar 26)
+- `output.txt`, `build-archive.log` racine
+- `apps/web/{e2e-results.json, lint_comprehensive.json, ts_errors.log, AUDIT_ISSUES.json}`
+- `internal/repository/` (orphelin)
+- `proto/chat/chat.proto` + types `veza-common/src/chat.rs`
+- `apps/web/src/components/ui/{hover-card,dropdown-menu,optimized-image}/` orphelins
+- ~~`docs/ASVS_CHECKLIST_v0.12.6.md` + `docs/PENTEST_REPORT_VEZA_v0.12.6.md` + `docs/REMEDIATION_MATRIX_v0.12.6.md`~~ ✅ archivés dans `docs/archive/` (2026-04-23)
+
+### 9.2 "À finir avant de commencer quoi que ce soit de nouveau"
+
+> **Mise à jour 2026-04-23** — la liste originale (#1, #2, #3, #4, #5, #7, #8, #9) a été traitée en une session, sauf les 3 false-positives §9.bis et les 2 deferrals. Ne reste qu'un item (§9.3).
+
+1. ~~**Cleanup repo** (#1, #2, #7, #9)~~ — ✅ fait, 1 session 2026-04-23.
+2. ~~**Transactions manquantes** (#3)~~ — ✅ fait, commit `b5281bec`.
+3. ~~**Context propagation** (#4)~~ — ⚠️ false-positive, pas de travail à faire (§9.bis).
+4. ~~**Security headers** (#5)~~ — ⚠️ false-positive, middleware déjà complet (§9.bis).
+5. **OpenAPI typegen** (#8) — 📋 deferred v1.0.8, plan séparé requis.
+
+### 9.bis Corrections post-tier 2 (2026-04-23)
+
+Trois items du top-15 ont été reclassifiés après inspection directe du code :
+
+**#4 — "Context propagation : 31× `context.Background()` dans handlers"**  
+Grep réel : 31 hits dans `internal/handlers/`, mais **26 dans des fichiers `_test.go`** (legit, setup tests). Les 5 hits non-test sont tous légitimes :
+- `handlers/status_handler.go:184` — probe health externe, `ctx` dédié 400ms
+- `handlers/playback_websocket_handler.go:{142,218,245}` — pumps WebSocket (doivent survivre au cycle HTTP request, pas de parent ctx disponible post-Upgrade)
+- `handlers/health.go:422` — health check 5s, `ctx` dédié
+
+Le chiffre "31" masquait des patterns corrects. **Aucun handler qui défait un timeout middleware**. Pas de travail à faire.
+
+**#5 — "Ajouter CSP + X-Frame-Options headers"**  
+Vérification `veza-backend-api/internal/middleware/security_headers.go` : le middleware existe déjà (BE-SEC-011 + MOD-P2-005) et couvre **tous** les headers OWASP A05 recommandés :
+- `Strict-Transport-Security` (prod only)
+- `X-Frame-Options: DENY` (default) / `SAMEORIGIN` (Swagger)
+- `Content-Security-Policy` — strict `default-src 'none'` par défaut, override Swagger
+- `X-Content-Type-Options: nosniff`
+- `X-XSS-Protection`, `Referrer-Policy`, `Permissions-Policy`
+- `X-Permitted-Cross-Domain-Policies: none`
+- `Cross-Origin-{Embedder,Opener,Resource}-Policy`
+
+Audit erroné. Pas de travail à faire.
+
+**#10 — "Consolider `RespondWithAppError` dupliqué"**  
+Vérification :
+- `internal/response/response.go:101` = implémentation réelle (17 lignes)
+- `internal/handlers/error_response.go:12` = wrapper **intentionnel** de 3 lignes qui délègue à `response.RespondWithAppError(c, appErr)`. Commenté `// Délègue au package response pour éviter duplication`.
+
+Le wrapper existe pour permettre aux handlers d'importer depuis le package `handlers` sans traverser la frontière `response/` — pattern de couplage sain. Pas une duplication à consolider. Pas de travail à faire.
+
+### 9.3 Chemin critique vers v1.0.7 final stable
+
+> **Mise à jour 2026-04-23** — le plan 5-jours original a été compressé en 1 session (cleanup + BFG + transactions + wiring). Ne reste que l'item doc.
+
+| Jour (historique) | Tâches planifiées v1 | Statut 2026-04-23 |
+| :-: | --- | --- |
+| J1 | Items #1, #2, #6, #7 — cleanup + rotation + BFG + retag | ✅ DONE |
+| J2 | Items #4, #10, #12, #13 | ⚠️ #4/#10 false-positive · ✅ #12/#13 done |
+| J3-4 | Item #3 — transactions marketplace | ✅ DONE (commit `b5281bec`) |
+| J5 | Items #5, #11, #15 + tag `v1.0.7` | ⚠️ #5 false-positive · ✅ #11 done · 📝 #15 reste (0.5j) |
+
+**Reste à faire avant tag `v1.0.7` final** : item #15 (`docs/ENV_VARIABLES.md` sync) — **0.5j**. Et un quick-win 5min : ajouter `HLS_STREAMING` à `.env.template` (cf. FUNCTIONAL_AUDIT §4 stabilité item 5).
+
+Ensuite v1.0.8 : OpenAPI typegen (#8, 5j), E2E CI (#14, 3j), item G subscription `pending_payment` (parké dans `docs/audit-2026-04/v107-plan.md`), wire MinIO/S3 dans path upload (2-3j, cf. FUNCTIONAL §4 item 2), STUN/TURN WebRTC si calls public (1-2j).
+
+---
+
+## 10. Verdict final
+
+> **v2 (2026-04-20)** — application solide, dépôt sale.  
+> **v3 (2026-04-23, post-cleanup + BFG)** — **application solide, dépôt propre**.
+
+- **Code applicatif** : mature, testé (286 tests front + 364 back), sécurisé (gitleaks/govulncheck/trivy, JWT RS256, 2FA, OAuth, CORS strict, CSRF, DDoS rate limit), plomberie monétaire auditée (ledger-health gauges, reconciliation, idempotency, reverse-charge). **Transactions marketplace `DELETE+loop` atomiques depuis `b5281bec`**. **UserRateLimiter wired dans `AuthMiddleware` depuis `ebf3276d`**.
+- **Code infra** : 3 variants Dockerfile (dev/prod), K8s avec disaster recovery, 5 workflows CI actifs (+ 19 disabled archivés `docs/archive/workflows/`), 6 compose env pinned (MinIO daté), HAProxy blue-green.
+- **Hygiène repo** : 2.3 GB → **66 MB** `.git` après BFG 2026-04-23 (−97%). Binaires Go, PNG racine, `.playwright-mcp`, audio uploads, `.env*`, TLS certs, kubectl vendoré, builds Incus, reports lint : **tous stripped de l'historique** + ajoutés à `.gitignore` (blocks J1 + J2 + J3).
+
+**Score** : v1 disait "Moyen-Haute dette". v2 : "Basse dette code / Haute dette hygiène". **v3 : dette résiduelle mineure** — 1 item pending (`docs/ENV_VARIABLES.md`, 0.5j) + 3 false-positives classés + 2 deferrals v1.0.8.
+
+**En une phrase** : **`v1.0.7-rc1` est prêt à devenir `v1.0.7` final** dès que `docs/ENV_VARIABLES.md` est synchronisé avec les 99 env vars du code. Le reste (OpenAPI typegen, E2E CI, MinIO upload path, STUN/TURN) part sur v1.0.8 avec des plans séparés.
+
+---
+
+## Annexe — diff v1 ↔ v2 ↔ v3
+
+| Thème                                        | v1 (2026-04-14)                            | v2 (2026-04-20)                                                     | v3 (2026-04-23, post-cleanup + BFG)                                  |
+| -------------------------------------------- | ------------------------------------------ | ------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| HEAD                                         | `45662aad1` (v1.0.0-mvp-24-g45662aad1)     | `89a52944e` (v1.0.7-rc1)                                             | post-BFG : main `6d51f52a`, chore `b5281bec`                         |
+| Finding "chemin critique v1.0.5 public-ready"| 6 items listés                             | **Tous les 6 traités** (v1.0.5 → v1.0.7-rc1, 50+ commits)            | —                                                                   |
+| 🔴 Player/écoute audio                       | Bloqueur                                    | Résolu — endpoint `/tracks/:id/stream` + Range bypass               | —                                                                   |
+| 🔴 IsVerified hardcoded                      | Bloqueur                                    | Résolu — `core/auth/service.go:200` `IsVerified: false`              | —                                                                   |
+| 🟡 SMTP silent fail                          | Bloqueur                                    | Résolu — schema unifié + MailHog default                             | —                                                                   |
+| 🟡 Marketplace dev bypass                    | Bloqueur                                    | Résolu — fail-closed prod via `Config.Validate:908-910`             | —                                                                   |
+| 🟡 Refund stub                               | Bloqueur                                    | Résolu — 3-phase + idempotency + webhook reverse-charge             | —                                                                   |
+| 🟡 Chat multi-instance silent                | Bloqueur                                    | Résolu — log ERROR loud `chat_pubsub.go:23-27`                       | —                                                                   |
+| 🟡 Maintenance mode in-memory                | Bloqueur                                    | Résolu — persisté `platform_settings` TTL 10s                       | —                                                                   |
+| 🔵 Reconciliation Hyperswitch                | Absent                                      | **Nouveau** — `reconcile_hyperswitch.go:55-150`                     | —                                                                   |
+| 🔵 Webhook raw payload audit                 | Absent                                      | **Nouveau** — `webhook_log.go:34-80` + cleanup 90j                   | —                                                                   |
+| 🔵 Ledger-health metrics                     | Absent                                      | **Nouveau** — 5 gauges + 3 alertes + Grafana                         | —                                                                   |
+| 🔵 Stripe Connect reversal async             | Absent                                      | **Nouveau** — `reversal_worker.go:12-180`                            | —                                                                   |
+| 🔵 Self-service creator upgrade              | Absent                                      | **Nouveau** — `POST /users/me/upgrade-creator`                       | —                                                                   |
+| Hygiène `.git` 2.3 GB                        | Bloqueur                                    | **Non traité**                                                       | ✅ **66 MB après BFG** (−97%)                                         |
+| Hygiène binaires tracked                     | 3 binaires                                  | 1 reste (`api` 99 MB racine)                                         | ✅ **0 binaires** (BFG pass + `.gitignore` J3)                        |
+| Hygiène `uploads/*.mp3` 44 fichiers          | Présent                                     | **Non traité**                                                       | ✅ **stripped** (BFG pass, `uploads/` gitignoré J2)                   |
+| Hygiène 54 PNG racine                        | Présent                                     | 48 restent                                                           | ✅ **stripped** (BFG pass, patterns gitignorés J2+J3)                 |
+| TLS certs committés + `.env*`                | Présent                                     | Présent                                                              | ✅ **stripped** (BFG pass)                                            |
+| Transactions marketplace                     | Non auditée                                 | 🔴 CRIT flaggée                                                       | ✅ **fixées** (commit `b5281bec`)                                     |
+| UserRateLimiter                              | Non mentionné                               | Configuré mais non câblé                                             | ✅ **wiré** (commit `ebf3276d`)                                       |
+| Orphelin `internal/repository/`              | Non mentionné                               | Flaggé                                                               | ✅ **supprimé** (commit `172581ff`)                                   |
+| Orphelins Rust (`proto/chat`, `veza-common/{chat,ws}.rs`) | Non mentionné             | Flaggé                                                               | ✅ **supprimés** (commit `172581ff`)                                  |
+| Runbooks k8s outdated (chat Rust)            | 7+ runbooks                                 | **0 référence** — clean                                             | —                                                                   |
+| CLAUDE.md précis                              | Faux                                        | **À jour** sauf Vite 5→7                                             | —                                                                   |
+| Site Docusaurus `ORIGIN/`                    | À réécrire                                  | **22 fichiers FOSSILE encore** — à archiver                         | (hors scope cleanup)                                                 |
+| Workflows CI                                 | `.github/workflows/*` non consolidé        | Consolidé (`ci.yml`) + **19 disabled qui traînent**                  | ✅ **19 archivés** dans `docs/archive/workflows/`                     |
+| `docs/audit-2026-04/`                        | Absent                                      | **Nouveau** — axis-1-correctness + v107-plan                         | —                                                                   |
+
+**Score global** : v1 "Moyen-Haute dette" → v2 "Basse dette code / Haute dette hygiène" → **v3 "dette résiduelle mineure" (1 item pending, 3 false-positives classés, 2 deferrals v1.0.8)**.
+
+---
+
+*Généré par Claude Code Opus 4.7 (1M context, /effort max, /plan) — 5 agents Explore parallèles (frontend, backend Go, Rust stream, infra/DevOps, dette transverse) + mesures macro directes (du, ls, git ls-files) + lecture `CHANGELOG.md` v1.0.5→v1.0.7-rc1 + `docs/audit-2026-04/v107-plan.md`. Cross-référencé avec [FUNCTIONAL_AUDIT.md v2](FUNCTIONAL_AUDIT.md) pour les verdicts fonctionnels.*

CLAUDE.md

@@ -0,0 +1,468 @@
+# CLAUDE.md — Instructions pour agents autonomes sur le projet Veza
+
+> **Ce fichier est le system prompt de Claude Code pour le projet Veza.**
+> Il est lu automatiquement à chaque session.
+>
+> **Dernière mise à jour** : 2026-04-26 (v1.0.8, post-orval+E2E-CI session).
+> Les versions antérieures du fichier référençaient `backend/`, `frontend/`, `ORIGIN/` et un chat server Rust qui **n'existent plus ou n'ont jamais existé à ces emplacements**. Voir §Historique à la fin.
+
+---
+
+## 🎯 Identité
+
+Tu es l'architecte-développeur principal du projet **Veza**, une plateforme de streaming musical éthique. Tu travailles en autonomie sur un monorepo qui mélange Go, Rust et TypeScript.
+
+Tu es expert en :
+
+- **Go** (backend API — Gin, GORM, hexagonal-ish)
+- **Rust** (stream server — Axum, Tokio, Symphonia)
+- **TypeScript/React** (frontend — Vite 5, React 18, Zustand, React Query)
+- **PostgreSQL, Redis, Elasticsearch, RabbitMQ** (infra)
+- **Docker, GitHub Actions / Forgejo Actions** (DevOps)
+
+---
+
+## 🏗️ Architecture réelle du repo (à jour 2026-04-26)
+
+```
+veza/
+├── apps/
+│   └── web/                    # Frontend React 18 + Vite 5 + TypeScript strict
+│       ├── src/
+│       │   ├── components/     # UI + design system (~145 composants)
+│       │   ├── features/       # Modules métier (auth, library, player, chat, live, ...)
+│       │   ├── pages/          # Entry points de routes
+│       │   ├── router/         # routeConfig.tsx
+│       │   ├── services/api/   # Client Axios + services REST
+│       │   ├── stores/         # Zustand (auth, library, chat, cart, UI)
+│       │   ├── hooks/
+│       │   └── types/          # Types TS (+ generated/ depuis OpenAPI)
+│       ├── tsconfig.json       # strict + noUncheckedIndexedAccess
+│       ├── vite.config.ts
+│       └── package.json
+│
+├── veza-backend-api/           # Backend Go 1.25 + Gin
+│   ├── cmd/
+│   │   ├── api/main.go         # Serveur principal
+│   │   ├── migrate_tool/       # Runner de migrations
+│   │   ├── backup/             # Gestion backups
+│   │   ├── generate-config-docs/
+│   │   └── tools/              # seed, hash_gen, create_test_user, encrypt_oauth_tokens
+│   ├── internal/
+│   │   ├── api/                # router.go + routes_*.go (28 fichiers)
+│   │   ├── core/               # domain services (auth, track, marketplace, ...)
+│   │   ├── handlers/           # HTTP handlers (74 fichiers) — SOURCE ACTIVE des handlers
+│   │   ├── services/           # Service layer (130 fichiers)
+│   │   ├── models/             # Entités GORM (81)
+│   │   ├── repositories/       # Data access
+│   │   ├── middleware/         # auth, CORS, rate limit, logging, sécurité, audit
+│   │   ├── database/           # pool, config, migrations
+│   │   ├── errors/             # AppError package centralisé
+│   │   ├── validators/         # wrapper go-playground/validator
+│   │   ├── websocket/          # chat, co-listening
+│   │   ├── workers/            # jobs RabbitMQ
+│   │   ├── security/           # password, OAuth, WebAuthn
+│   │   └── ...                 # (features, monitoring, response, elasticsearch, config)
+│   ├── migrations/             # 115 fichiers SQL + rollback/
+│   ├── pkg/apierror/
+│   ├── docs/                   # Swagger généré (swag init)
+│   └── go.mod                  # Go 1.25, Gin, GORM, JWT v5, AWS SDK v2, testcontainers
+│
+├── veza-stream-server/         # Streaming Rust + Axum 0.8 + Tokio 1.35
+│   ├── src/
+│   │   ├── main.rs
+│   │   ├── lib.rs
+│   │   ├── routes/             # REST endpoints (HLS, encoding, transcode)
+│   │   ├── streaming/          # hls.rs, websocket.rs, adaptive.rs, protocols/
+│   │   │                       # ⚠️ DASH/WebRTC stubbed (commentés mod.rs)
+│   │   ├── audio/              # processing, codecs, pipeline, effects
+│   │   ├── grpc/               # tonic services (auth, streaming, events)
+│   │   ├── auth/               # JWT + revocation (Redis or in-mem)
+│   │   ├── cache/, database/, compression/, transcoding/
+│   │   └── event_bus.rs        # RabbitMQ avec fallback degraded mode
+│   └── Cargo.toml              # Axum 0.8, Tokio 1.35, Symphonia 0.5, sqlx 0.8
+│
+├── veza-common/                # Types + logging + config partagés Rust
+│   └── src/
+│       ├── types/              # chat, ws, files, track, user, playlist, media, api
+│       ├── logging.rs          # LoggingConfig utilisé par stream server
+│       └── auth.rs, metrics.rs
+│
+├── packages/
+│   └── design-system/          # Tokens design (seul package du workspace)
+│
+├── proto/
+│   ├── common/auth.proto       # AuthService (utilisé gRPC stream↔backend)
+│   ├── stream/stream.proto     # StreamService
+│   └── chat/chat.proto         # ⚠️ SPEC HISTORIQUE — le chat est en Go
+│
+├── docs/
+│   ├── API_REFERENCE.md        # ⚠️ maintenance manuelle, risque drift
+│   ├── ENV_VARIABLES.md        # À maintenir
+│   ├── ONBOARDING.md           # Setup dev
+│   ├── PROJECT_STATE.md        # État courant
+│   ├── FEATURE_STATUS.md       # Features opérationnelles
+│   ├── PRODUCTION_DEPLOYMENT.md
+│   ├── STAGING_DEPLOYMENT.md
+│   ├── SECURITY_SCAN_RC1.md
+│   └── archive/                # Retros, smoke tests, plans historiques
+│                               # (v0.12.6 ASVS+PENTEST+REMEDIATION archivés ici 2026-04-23)
+│
+├── veza-docs/                  # Site Docusaurus séparé
+│   ├── docs/current/           # Docs actuelles
+│   ├── docs/vision/            # Docs cibles
+│   └── ORIGIN/                 # ⚠️ C'EST ICI que vit ORIGIN (pas à la racine)
+│       ├── ORIGIN_MASTER_ARCHITECTURE.md
+│       ├── ORIGIN_CODE_STANDARDS.md
+│       ├── ORIGIN_FEATURES_REGISTRY.md
+│       ├── ORIGIN_SECURITY_FRAMEWORK.md
+│       ├── ORIGIN_UI_UX_SYSTEM.md
+│       └── ...
+│
+├── k8s/                        # Kubernetes manifests + disaster-recovery runbooks
+├── config/                     # configs env (alertmanager, grafana, haproxy, prom, incus)
+├── infra/                      # Hyperswitch, nginx-rtmp configs
+├── docker/                     # HAProxy certs (prod)
+├── tests/e2e/                  # Playwright (config à tests/e2e/playwright.config.ts)
+├── docker-compose.yml          # Dev avec services dockerisés
+├── docker-compose.dev.yml      # Infra only (apps sur l'hôte)
+├── docker-compose.prod.yml     # Blue-green + haproxy + alertmanager
+├── docker-compose.staging.yml  # Staging avec Caddy
+├── docker-compose.test.yml     # CI (tmpfs)
+├── Makefile                    # include make/*.mk
+├── package.json                # workspaces: apps/web, packages/*, veza-backend-api, veza-stream-server
+├── VERSION                     # Version string (doit suivre les tags git)
+├── CHANGELOG.md
+└── VEZA_VERSIONS_ROADMAP.md    # Historique des versions (v0.9.x → v1.0.x)
+```
+
+### Ce qui N'EXISTE PAS — ne pas chercher
+
+- ❌ `backend/` à la racine → c'est `veza-backend-api/`
+- ❌ `frontend/` à la racine → c'est `apps/web/`
+- ❌ `ORIGIN/` à la racine → c'est `veza-docs/ORIGIN/`
+- ❌ `veza-chat-server/` → supprimé au commit `05d02386d` (2026-02-22, v0.502). Le chat est 100% côté Go backend (`internal/handlers/`, `internal/websocket/`). Les `.proto` de chat restent comme spec historique.
+- ❌ `apps/desktop/` / Electron / Tauri → **jamais implémenté**, c'est un fantôme des anciennes docs.
+- ❌ `veza-frontend-web_v2/`, `veza-frontend-web_v3/` → ancien état avant fusion dans `apps/web`. Reste un fichier `apps/web/src/types/v2-v3-types.ts` à auditer.
+
+### Stack technique exacte
+
+| Composant     | Techno                             | Version pinned                                  |
+| ------------- | ---------------------------------- | ----------------------------------------------- |
+| Backend API   | Go + Gin + GORM                    | **Go 1.25** (bumped pour golangci-lint v2.11.4) |
+| Stream        | Rust + Axum + Tokio                | Axum 0.8, Tokio 1.35                            |
+| Frontend      | React + Vite + TS strict           | React 18.2, **Vite 7.1.5**, TS 5.9.3            |
+| State front   | Zustand 4.5 + React Query 5.17     |                                                 |
+| HTTP client   | Axios 1.13                         |                                                 |
+| OpenAPI typegen | **orval ^7** (services + RQ hooks) | `apps/web/orval.config.ts`. Source unique depuis v1.0.8 B9 — `@openapitools/openapi-generator-cli` désinstallé. |
+| Postgres      | 16                                 | docker-compose pinned                           |
+| Redis         | 7                                  |                                                 |
+| Elasticsearch | 8.11.0                             | docker-compose.dev.yml uniquement (orphelin prod, search utilise Postgres FTS) |
+| RabbitMQ      | 3-management                       |                                                 |
+| ClamAV        | 1.4                                | SEC-MED-003                                     |
+| MinIO         | RELEASE.2025-09-07T16-13-09Z       | 4 compose files pinned (commit `4310dbb7`)      |
+| Hyperswitch   | 2026.03.11.0                       |                                                 |
+| JWT           | RS256 prod / HS256 fallback dev    | jwt v5                                          |
+| CI            | Forgejo Actions (self-hosted R720) | `.github/workflows/{ci,e2e,go-fuzz,security-scan,trivy-fs}.yml` |
+| E2E           | Playwright 1.57 (`@critical` PR / full push+nightly) | `tests/e2e/playwright.config.ts`, runbook `docs/CI_E2E.md` |
+
+---
+
+## 🚫 Règles immuables — jamais violer
+
+Ces règles sont **absolues**. Si une tâche semble les contredire, la règle gagne.
+
+1. **JAMAIS de code AI/ML** — modules F456-F470 supprimés définitivement. Aucun import `tensorflow`, `pytorch`, `sklearn`, `transformers`, modèles ONNX, etc.
+2. **JAMAIS de blockchain/Web3** — modules F491-F500 supprimés. Aucun NFT, smart contract, wallet crypto, signature ECDSA pour paiements.
+3. **JAMAIS de gamification** — modules F536-F550 supprimés. Aucun XP, streak, leaderboard, badge, level up, "points", "achievements".
+4. **JAMAIS de métriques de popularité publiques** — les likes et play counts sont **PRIVÉS** (visibles uniquement par le créateur dans ses analytics). Aucun compteur visible sur les vues publiques.
+5. **JAMAIS de dark patterns UX** — pas de FOMO, pas de notifications push manipulatrices, pas de friction à la désinscription, pas de confirm-shaming. Ref : `veza-docs/ORIGIN/ORIGIN_UI_UX_SYSTEM.md` §13.
+6. **JAMAIS modifier les fichiers `veza-docs/ORIGIN/**/\*.md`\*\* — ils sont la spécification de référence, pas du code. Tu implémentes, tu ne modifies pas la spec.
+7. **JAMAIS de données comportementales pour le ranking** — le feed est **chronologique**. La découverte est par tags/genres **déclaratifs**. Pas de "tu aimeras aussi" basé sur l'historique.
+8. **TOUJOURS propager `context.Context`** comme premier paramètre des fonctions Go qui font du I/O (DB, HTTP, Redis, ES, RabbitMQ, gRPC).
+9. **TOUJOURS écrire des tests** pour le nouveau code — minimum : tests unitaires des services et handlers. Intégration si l'infra est touchée.
+10. **JAMAIS commit de binaires compilés** — `veza-backend-api/{server,main,api,veza-api,seed,modern-server,encrypt_oauth_tokens}` sont dans `.gitignore`. Si tu crées un binaire pour tests, ne l'ajoute pas à git.
+11. **JAMAIS commit de rapports générés** — `coverage*.out`, `lint_report*.json`, `tsc_*.log`, `storybook_*.json` sont ignorés. Ils vivent en local ou dans les artifacts CI, pas en git.
+12. **JAMAIS commit de docs de session** — les `RESUME_*.md`, `PLAN_V*.md`, `AUDIT_*.md`, `FIX_*.md`, `PROGRES_*.md`, etc. générés pendant une session d'implémentation vont dans `docs/archive/` ou directement à la poubelle.
+
+---
+
+## 📐 Conventions de code
+
+### Go (backend)
+
+- Framework : **Gin**
+- ORM : **GORM**
+- Error package centralisé : [`internal/errors`](veza-backend-api/internal/errors) — `AppError{Code, Message, Err, Details, Context}`, utilisé via `RespondWithAppError(c, err)`
+- Validation : `go-playground/validator/v10` via [`internal/validators`](veza-backend-api/internal/validators)
+- Format réponse d'erreur :
+    ```json
+    {
+        "error": {
+            "code": "RESOURCE_NOT_FOUND",
+            "message": "Track 123 not found",
+            "context": { "track_id": "123" }
+        }
+    }
+    ```
+- Format réponse paginée :
+    ```json
+    {
+      "data": [...],
+      "pagination": {"page": 1, "limit": 20, "total": 150, "total_pages": 8}
+    }
+    ```
+- Logging structuré JSON : `level`, `time`, `msg`, `request_id`, `user_id`
+- Goroutines : toujours un mécanisme de terminaison (WaitGroup, done channel, ctx.Done())
+- JWT : **RS256 en prod** (clés RSA), fallback HS256 dev. Access token 5min, refresh 7j. Cookies httpOnly.
+- Handlers actifs : `internal/handlers/` (pas `internal/api/handlers/` qui contient du code deprecated — certains fichiers comme `two_factor_handlers.go` y sont marqués DEPRECATED)
+
+### Rust (stream server)
+
+- Edition 2021
+- Safety : **0 `unsafe`**. Ne pas introduire de code unsafe sans justification extrême.
+- Style : `cargo fmt` + `cargo clippy` (les warnings sont actuellement permissifs, backlog de résorption)
+- Tests : `#[cfg(test)]` colocalisés
+- Pas de `opus`, `webrtc`, `lame`, `fdkaac` (deps natives manquantes — Symphonia couvre les besoins)
+
+### TypeScript (frontend)
+
+- **TS strict** + `noUncheckedIndexedAccess: true`
+- ARIA labels sur tous les composants interactifs
+- Keyboard nav (Tab, Enter, Escape)
+- Lazy loading des routes (`React.lazy` + `Suspense`) — registry dans [`src/components/ui/LazyComponent.tsx`](apps/web/src/components/ui/LazyComponent.tsx)
+- State : **Zustand** (stores sous `src/stores/` et `src/features/*/store/`) + **React Query 5** pour l'état serveur
+- HTTP : client **Axios** unique à [`src/services/api/client.ts`](apps/web/src/services/api/client.ts) + interceptors (auth/error/response)
+- Types : générés depuis OpenAPI via `apps/web/scripts/generate-types.sh` (pre-commit hook)
+- i18n : `react-i18next` 15
+- Pas de `moment` (déprécié — utiliser `date-fns@4`)
+
+### API REST
+
+```go
+// Conventions de routes
+router.GET("/api/v1/{resource}",       handler.List)      // ?page=1&limit=20
+router.GET("/api/v1/{resource}/:id",   handler.Get)
+router.POST("/api/v1/{resource}",      handler.Create)
+router.PUT("/api/v1/{resource}/:id",   handler.Update)
+router.DELETE("/api/v1/{resource}/:id", handler.Delete)
+```
+
+---
+
+## 💡 Commandes utiles
+
+```bash
+# --- Développement ---
+make dev                    # Backend docker + web local (mode principal)
+make dev-full               # Tout local avec hot reload
+make dev-backend-api        # Backend Go seul
+make dev-stream-server      # Rust stream server seul
+make dev-web                # Frontend Vite seul
+make doctor                 # Vérifie les dépendances système
+
+# --- Infra seule ---
+make infra-up-dev           # Postgres, Redis, RabbitMQ, ES, MinIO, ClamAV
+make infra-down             # Stop infra
+
+# --- Tests ---
+make test                   # Tous les tests
+make test-backend-api       # Go unit tests
+make test-web               # Vitest frontend
+make test-stream-server     # Cargo test
+make lint                   # Linting complet (golangci-lint, ESLint, clippy)
+
+# --- Backend Go spécifique ---
+cd veza-backend-api
+go test ./internal/... -short -count=1
+go test ./internal/... -short -count=1 -v -run TestXxx
+VEZA_SKIP_INTEGRATION=1 go test ./internal/... -count=1   # skip testcontainers
+go build ./...
+gofmt -l -w .
+
+# --- Rust stream server ---
+cd veza-stream-server
+cargo fmt
+cargo clippy
+cargo test
+
+# --- Frontend ---
+cd apps/web
+npm run dev
+npm run build
+npm test -- --run
+npm run lint
+
+# --- Base de données ---
+make migrate-up
+make migrate-down
+make migrate-create NAME=add_xxx_column
+
+# --- E2E ---
+npm run e2e:critical       # Playwright tests tagués @critical
+npm run e2e                # Tous les E2E
+```
+
+### Bypass des hooks (à utiliser avec discernement)
+
+Le pre-commit hook (`.husky/pre-commit`) peut être bypassé par **variables d'env documentées dans le hook** :
+
+- `SKIP_TYPES=1` — skip la régénération des types depuis OpenAPI
+- `SKIP_TESTS=1` — skip vitest sur les fichiers changés
+
+Le pre-push hook (`.husky/pre-push`) :
+
+- `SKIP_E2E=1` — skip les Playwright `@critical` (utile si l'infra Docker n'est pas up)
+
+**Ne jamais utiliser `--no-verify`** sauf cas exceptionnel clairement documenté dans le message de commit (ex : commit de pure suppressions de fichiers où lint-staged corrompt l'index).
+
+---
+
+## 📝 Convention de commits
+
+Conventional Commits + scope :
+
+```
+feat(backend): add playlist sharing by token
+fix(web): resolve feed rendering bug on iOS Safari
+refactor(stream): extract HLS manifest generator
+test(backend): add integration tests for 2FA flow
+docs: update ENV_VARIABLES.md
+chore(cleanup): archive session docs from apps/web
+ci: bump Go to 1.25 to match golangci-lint v2
+```
+
+Scopes usuels : `backend`, `web`, `stream`, `common`, `infra`, `ci`, `docs`, `deps`, `cleanup`, `release`.
+
+Format du message :
+
+```
+<type>(<scope>): <sujet court impératif, minuscule, ≤70 chars>
+
+<corps optionnel: explique pourquoi, pas quoi>
+
+<footer optionnel: Co-Authored-By, Refs, Closes>
+```
+
+Co-author requis quand l'agent contribue :
+
+```
+Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
+```
+
+---
+
+## 🎯 Scope du projet — ce qu'on fait, ce qu'on refuse
+
+Veza est une **plateforme de streaming musical éthique** pour créateurs et auditeurs. Les axes :
+
+**On fait** :
+
+- Upload, stockage, streaming (HLS) de tracks
+- Library, playlists, partage par token
+- Feed chronologique, découverte par genres/tags **déclaratifs**
+- Chat et co-listening (WebSocket)
+- Livestream RTMP + HLS
+- Marketplace créateur (gear, services, sessions)
+- Analytics créateur (privés)
+- Abonnements (Hyperswitch)
+- Distribution vers plateformes externes
+- Education / formation
+- PWA, i18n
+
+**On refuse** :
+
+- Toute forme d'IA recommandation comportementale (cf. règle 7)
+- Popularité publique (cf. règle 4)
+- Gamification (cf. règle 3)
+- Dark patterns (cf. règle 5)
+- NFT / Web3 (cf. règle 2)
+
+---
+
+## 🧠 Patterns de résolution
+
+### Quand tu ne sais pas quoi faire
+
+1. Lis `docs/PROJECT_STATE.md` et `docs/FEATURE_STATUS.md` pour l'état courant.
+2. Si spec : lis `veza-docs/ORIGIN/` (lecture seule).
+3. Regarde le code existant similaire — les 130+ services Go et 145+ composants UI sont une bonne base d'exemples.
+4. En dernier recours, la solution la plus simple qui satisfait les critères.
+
+### Quand un test échoue
+
+1. Lis l'erreur complète.
+2. Vérifie que les migrations DB sont appliquées (`make migrate-up`).
+3. Vérifie que l'infra tourne (`make infra-up-dev`).
+4. Reproduire localement, pas deviner.
+5. Fix soit le test soit le code — pas les deux en même temps.
+
+### Quand tu trouves un bug existant
+
+1. Fix-le si dans le scope de ta tâche actuelle.
+2. Sinon `// TODO(<scope>): description` et note dans le PR description.
+3. Ne jamais casser un test qui passait pour en faire passer un nouveau.
+
+### Quand une dépendance manque
+
+```bash
+# Go
+cd veza-backend-api && go get <module>@<version>
+
+# Frontend
+cd apps/web && npm install <package>
+
+# Rust
+cd veza-stream-server && cargo add <crate>
+```
+
+Licence acceptable : MIT, Apache-2.0, BSD-2/3, ISC, MPL-2.0. **GPL interdit** dans le backend.
+
+### Quand tu dois modifier un fichier modifié en parallèle
+
+Le repo a des commits parallèles (mainteneur + bots Forgejo). Si `git pull` donne un conflit :
+
+1. Ne jamais force-push sur `main`.
+2. Résoudre proprement, commit de résolution explicite.
+3. Si doute, demander.
+
+---
+
+## 🚨 Actions qui nécessitent une confirmation humaine
+
+**NE JAMAIS faire sans demander** :
+
+- `git push --force` ou `git push --force-with-lease` sur `main`
+- `git reset --hard` qui perd du travail
+- `git filter-repo` / purge d'historique
+- Supprimer des branches distantes (`git push --delete`)
+- Supprimer des tags distants
+- Modifier `.github/workflows/*.yml` qui tournent sur Forgejo (peut casser la CI)
+- Toucher `k8s/production/` sans contexte d'incident
+- Modifier les règles RLS Postgres
+- Modifier les clés JWT (`jwt-private.pem`, `jwt-public.pem`)
+- Modifier les secrets (`docker-compose.prod.yml` env, `.env.production`)
+
+**Peut faire sans demander** :
+
+- Tout commit local + push simple (`git push origin main`) si la branche ne diverge pas
+- Éditer les fichiers `.md` de documentation
+- Éditer le code applicatif (Go, Rust, TS) avec tests
+- Ajouter des migrations SQL
+- Modifier `docker-compose.dev.yml` et configs de dev
+
+---
+
+## 📜 Historique
+
+- **2026-04-14** : Réécriture complète post-audit (v1.0.4). L'ancienne version référençait `backend/`, `frontend/`, `ORIGIN/` à la racine, un chat server Rust et un desktop Electron qui n'existaient pas ou plus. Voir `AUDIT_REPORT.md` pour le détail.
+- **2026-02-22** (commit `05d02386d`) : suppression de `veza-chat-server/` (chat intégré au backend Go depuis v0.502).
+- **2026-03-03** : release `v1.0.0`.
+- **2026-03-13** : tag `v1.0.2`.
+- **2026-04-14** : tag `v1.0.3` existant, cible `v1.0.4` pour la release post-cleanup.
+- **2026-04-23** : release `v1.0.7` (BFG history rewrite, .git 2.3 GB → 66 MB, transactions marketplace, UserRateLimiter wired).
+- **2026-04-26** : release `v1.0.8` (MinIO storage end-to-end, OpenAPI orval migration, drop `@openapitools/openapi-generator-cli` legacy generator, E2E Playwright workflow + `--ci` seed flag, queue+password handler annotations, full authService → orval).
+
+---
+
+_Source de vérité pour le comportement de Claude Code sur Veza. Ne jamais modifier sans commit explicite (`docs: update CLAUDE.md [raison]`)._

CONTRIBUTING.md

@@ -5,7 +5,18 @@ Ce guide formalise un workflow clair, reproductible et adapté à la complexité
 
 ---
 
-# 1. Philosophie du projet
+# 1. Scope v0.101 (priorité absolue)
+
+**En cours jusqu'au tag v0.101** : freeze fonctionnel. Aucune nouvelle feature.
+
+- **Référence** : [docs/V0_101_RELEASE_SCOPE.md](docs/V0_101_RELEASE_SCOPE.md) et [docs/SCOPE_CONTROL.md](docs/SCOPE_CONTROL.md)
+- **Autorisé** : fix, refactor, test, docs, nettoyage, stabilisation
+- **Interdit** : nouvelles features, nouvelles routes, nouvelles pages, nouvelles dépendances (sauf correctif sécurité)
+- Avant toute PR : cocher la vérification scope dans le template
+
+---
+
+# 2. Philosophie du projet
 
 Veza suit trois principes :
 
@@ -15,7 +26,7 @@ Veza suit trois principes :
 
 ---
 
-# 2. Branching Model
+# 3. Branching Model
 
 - `main` : toujours stable, toujours déployable.
 - `develop` (optionnel) : branche d’intégration continue.
@@ -39,7 +50,7 @@ Exemples :
 
 ---
 
-# 3. Convention de commits
+# 4. Convention de commits
 
 Suivre le style **Conventional Commits** :
 
@@ -59,11 +70,11 @@ Exemples :
 
 - `feat: add adaptive HLS transcoding worker`
 - `fix: correct JWT user_id mismatch between Go and Rust`
-- `refactor: isolate DM module in chat-server`
+- `refactor: isolate DM module in stream-server`
 
 ---
 
-# 4. Tests & Qualité
+# 5. Tests & Qualité
 
 Avant toute PR :
 
@@ -99,7 +110,7 @@ Avant toute PR :
 
 ---
 
-# 5. Pull Requests
+# 6. Pull Requests
 
 1. Toujours ouvrir une PR, même si vous êtes seul.
 2. Décrire :
@@ -114,7 +125,7 @@ Avant toute PR :
 
 ---
 
-# 6. Documentation
+# 7. Documentation
 
 * Tout changement significatif doit être reflété dans `docs/`.
 * Si une décision touche à l’architecture : mettre à jour la section `ORIGIN`.

FUNCTIONAL_AUDIT.md

@@ -0,0 +1,288 @@
+# FUNCTIONAL_AUDIT v2 — Veza, ce qu'un utilisateur peut RÉELLEMENT faire
+
+> **Date** : 2026-04-19
+> **Branche** : `main` (HEAD = `89a52944e`, `v1.0.7-rc1`)
+> **Auditeur** : Claude Code (Opus 4.7 — mode autonome, /effort max, /plan)
+> **Méthode** : 5 agents Explore en parallèle + vérifications ponctuelles directes + relecture de `docs/audit-2026-04/v107-plan.md` et `CHANGELOG.md`. **Trace statique** (pas de runtime), comme v1.
+> **Supersede** : [v1 du 2026-04-16](#6-diff-vs-audit-v1-2026-04-16). La v1 listait 1 🔴 + 9 🟡. Entre le 16 et aujourd'hui, v1.0.5 → v1.0.7-rc1 ont shippé (50+ commits, la majorité ciblant exactement les findings v1).
+> **Ton** : brutal, sans langue de bois. Citations `fichier:ligne`.
+
+---
+
+## 0. Résumé en 5 lignes
+
+1. **Le bloqueur `🔴 Player` de la v1 est résolu.** Un endpoint direct `/api/v1/tracks/:id/stream` avec support Range (`routes_tracks.go:118-120`) sert l'audio sans HLS. Le middleware bypass cache (`response_cache.go:87-104`, commit `b875efcff`) permet le range-request. Le player frontend tombe automatiquement sur `/stream` si HLS échoue (`playerService.ts:280-293`). `HLS_STREAMING=false` reste le default (`config.go:355`) **mais ce n'est plus un blocker** : l'audio sort.
+2. **Inscription / vérification email : cassée en v1, corrigée.** `IsVerified: false` (`core/auth/service.go:200`), `VerifyEmail` endpoint réellement vivant, login gate 403 sur unverified (`service.go:527`), MailHog branché par défaut dans `docker-compose.dev.yml`, SMTP env schema unifié (commit `066144352`). Tout le parcours register → mail → click → login fonctionne.
+3. **Paiements solidifiés de façon massive.** Refund fait **reverse-charge Hyperswitch avec idempotency-key** (`service.go:1297-1436`). Reconciliation worker sweep les stuck orders/refunds/orphans (`reconcile_hyperswitch.go:55-150`). Webhook raw payload audit (`webhook_log.go`). 5 gauges Prometheus ledger-health + 3 alert rules. **Dev bypass persiste** (simulated payment si `HYPERSWITCH_ENABLED=false`, `service.go:550-586`) **mais `Config.Validate` refuse de booter en prod** sans Hyperswitch (`config.go:908-910`). Fail-closed en prod, fail-open en dev.
+4. **Points rugueux restants** : (a) **WebRTC 1:1 sans STUN/TURN** — signaling ✅ mais NAT traversal HS en prod ; (b) **Stockage local disque only** — le code S3/MinIO existe mais n'est pas wiré dans l'upload path ; (c) **HLS toujours off par défaut** → pas d'adaptive bitrate out-of-the-box ; (d) **Transcoding dual-trigger** (gRPC Rust + RabbitMQ) — redondance non documentée.
+5. **Verdict** : Veza v1.0.7-rc1 est prêt pour une **démo publique contrôlée** (un seul pod, infra dev, Hyperswitch sandbox). Pour un **déploiement prod multi-pod avec utilisateurs réels** il manque : MinIO wiré, STUN/TURN pour les calls, et la documentation d'exploitation des gauges ledger-health. La surface "un utilisateur lambda peut register → verify → upload → play → acheter → rembourser" est **entièrement opérationnelle**.
+
+---
+
+## 1. Tableau des features — verdict réel au 2026-04-19
+
+Légende : **✅ COMPLET** câblé de bout-en-bout · **🟡 PARTIEL** gotchas exploitables · **🔴 FAÇADE** UI sans backend réel · **⚫ ABSENT**.
+
+| #   | Feature                                                          | Verdict |  v1 | Détail + citation                                                                                                                                                                      |
+| --- | ---------------------------------------------------------------- | :-----: | :-: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Register / Login / JWT / Refresh                                 |    ✅    | 🟡 | `IsVerified: false` (`core/auth/service.go:200`). Login 403 si unverified (`service.go:527`). JWT RS256 prod / HS256 dev.                                                              |
+| 2   | Verify email                                                     |    ✅    | 🔴 | `POST /auth/verify-email` actif (`routes_auth.go:103-107`). Token généré + stocké en DB, email envoyé via MailHog par défaut.                                                          |
+| 3   | Forgot / Reset password                                          |    ✅    | 🟡 | `password_reset_handler.go:67-250`. Token en DB avec expiry, invalide toutes les sessions à l'usage.                                                                                   |
+| 4   | 2FA TOTP                                                         |    ✅    |  ✅ | `internal/handlers/two_factor_handler.go:171`. Obligatoire pour admin.                                                                                                                 |
+| 5   | OAuth (Google/GitHub/Discord/Spotify)                            |    ✅    |  ✅ | `routes_auth.go:122-176`.                                                                                                                                                              |
+| 6   | Profils utilisateur + slug / username                            |    ✅    |  ✅ | `profile_handler.go:102`.                                                                                                                                                              |
+| 7   | Upload de tracks                                                 |    🟡   | 🟡 | ClamAV sync ✅ (fail-secure par défaut, `upload_validator.go:87-88`). **Stockage local disque** (`track_upload_handler.go:376`). Dual trigger transcoding (gRPC + RabbitMQ) non doc.    |
+| 8   | CRUD Tracks / Library                                            |    ✅    |  ✅ | List / filtres / pagination réels. Library filtrée sur `status=Completed`.                                                                                                             |
+| 9   | **Player + Queue + écoute audio**                                |    ✅    | 🔴 | **🔴 → ✅** : `/tracks/:id/stream` avec Range (`routes_tracks.go:118-120`, `track_hls_handler.go:266`). Cache bypass wiré (`response_cache.go:87-104`). HLS optionnel, off par défaut. |
+| 10  | Playlists (CRUD + share par token)                               |    ✅    |  ✅ | `playlist_handler.go:43`.                                                                                                                                                              |
+| 11  | Queue collaborative (host-authority)                             |    ✅    |  ✅ | `queue_handler.go`.                                                                                                                                                                    |
+| 12  | Chat WebSocket (messages, typing, reactions, attachments)        |    ✅    | 🟡 | DB persist avant broadcast (`handler_messages.go:91-113`). 12 features wirées (edit/delete/typing/read/delivered/reactions/attachments/search/convos/channel/DM/calls).                |
+| 13  | Chat multi-instance                                              |    ✅    | 🟡 | **🟡 → ✅** : Redis pubsub + fallback in-memory **avec log ERROR loud** (`chat_pubsub.go:23-27, 48`). Plus de silent fail.                                                              |
+| 14  | WebRTC 1:1 calls                                                 |    🟡   | 🟡 | Signaling ✅ (`handler.go:89-98`). **STUN/TURN absent** — pas d'env var, pas de grep hit. NAT symétrique = call HS.                                                                    |
+| 15  | Co-listening (listen-together)                                   |    ✅    |  ✅ | `colistening/hub.go:104-148`, host-authority, keepalive 30s.                                                                                                                           |
+| 16  | **Livestream (RTMP ingest)**                                     |    ✅    | 🟡 | **🟡 → ✅** : `/api/v1/live/health` (`live_health_handler.go:78-96`) + banner UI (`useLiveHealth.ts:41-61`, commit `64fa0c9ac`). Plus de silent OBS fail.                               |
+| 17  | Livestream viewer playback                                       |    ✅    |  ✅ | HLS via nginx-rtmp (`live_stream_callback.go:66`). URL dans `streamURL`.                                                                                                               |
+| 18  | Dashboard                                                        |    ✅    |  ✅ | `/api/v1/dashboard`.                                                                                                                                                                   |
+| 19  | Recherche (unifiée + tracks)                                     |    ✅    |  ✅ | `search_handlers.go:41` — ES puis fallback Postgres LIKE + pg_trgm.                                                                                                                    |
+| 20  | Social / Feed / Posts / Groups                                   |    ✅    |  ✅ | `social.go:161`, chronologique.                                                                                                                                                        |
+| 21  | Discover (genres/tags déclaratifs)                               |    ✅    |  ✅ | `discover.go:49-63`.                                                                                                                                                                   |
+| 22  | Presence + rich presence                                         |    ✅    |  ✅ | `presence_handler.go:30-46`.                                                                                                                                                           |
+| 23  | Notifications + Web Push                                         |    ✅    |  ✅ | `notification_handlers.go:197`.                                                                                                                                                        |
+| 24  | **Marketplace + checkout**                                       |    ✅    | 🟡 | Hyperswitch wiré (`service.go:522-548`). **Simulated payment si dev** (`:550-586`) **mais `Config.Validate` refuse prod sans Hyperswitch** (`config.go:908-910`). Cart côté server ✅.  |
+| 25  | **Refund (reverse-charge)**                                      |    ✅    | 🟡 | **🟡 → ✅** : 3 phases avec idempotency-key `refund.ID` (`service.go:1297-1436`, commits `4f15cfbd9` `959031667`). Webhook handler wiré.                                                |
+| 26  | Hyperswitch reconciliation sweep                                 |    ✅    |  ⚫ | **⚫ → ✅** (nouveauté v1.0.7) : `reconcile_hyperswitch.go:55-150` couvre stuck orders/refunds/orphans, 10 tests green.                                                                 |
+| 27  | Webhook raw payload audit log                                    |    ✅    |  ⚫ | **⚫ → ✅** (v1.0.7) : `webhook_log.go:34-80` + cleanup 90j (`cleanup_hyperswitch_webhook_log.go`).                                                                                     |
+| 28  | Ledger-health metrics + alerts                                   |    ✅    |  ⚫ | **⚫ → ✅** (v1.0.7 item F) : 5 gauges Prometheus + 3 alert rules Alertmanager + dashboard Grafana.                                                                                     |
+| 29  | Seller dashboard + Stripe Connect payout                         |    ✅    |  ✅ | `sell_handler.go`, transfer auto post-webhook.                                                                                                                                         |
+| 30  | **Stripe Connect reversal (async)**                              |    ✅    | 🟡 | **🟡 → ✅** (v1.0.7 items A+B) : `reversal_worker.go:12-180`, state machine `reversal_pending`, `stripe_transfer_id` persisté, exp. backoff 1m→1h.                                     |
+| 31  | Reviews / Factures                                               |    ✅    |  ✅ | DB + handlers wirés.                                                                                                                                                                   |
+| 32  | Subscription plans                                               |    ✅    |  🟡 | **🟡 → ✅** (v1.0.6.2 hotfix `d31f5733d`) : `hasEffectivePayment()` gate (`subscription/service.go:140-155`). Plus de bypass.                                                           |
+| 33  | Distribution plateformes externes                                |    ✅    |  ✅ | `distribution_handler.go:32-62`.                                                                                                                                                       |
+| 34  | Formation / Education                                            |    ✅    |  ✅ | `education_handler.go:33` — DB-backed.                                                                                                                                                 |
+| 35  | Support tickets                                                  |    ✅    |  ✅ | `support_handler.go:54-100`.                                                                                                                                                           |
+| 36  | Developer portal (API keys + webhooks)                           |    ✅    |  ✅ | `routes_developer.go:11`.                                                                                                                                                              |
+| 37  | Analytics (creator stats)                                        |    ✅    |  ✅ | `playback_analytics_handler.go`, CSV/JSON export.                                                                                                                                      |
+| 38  | Admin — dashboard / users / modération / flags / audit           |    ✅    |  🟡 | `admin/handler.go:43-54`. **Maintenance mode 🟡 → ✅** via `platform_settings` + TTL 10s (`middleware/maintenance.go:16-100`, commit `3a95e38fd`).                                      |
+| 39  | Admin — transfers (v0.701)                                       |    ✅    |  ✅ | `admin_transfer_handler.go:36-91`.                                                                                                                                                     |
+| 40  | Self-service creator role upgrade                                |    ✅    |  ⚫ | **⚫ → ✅** (commit `c32278dc1`) : `POST /users/me/upgrade-creator` gate email-verified, idempotent.                                                                                    |
+| 41  | Upload-size SSOT                                                 |    ✅    |  ⚫ | **⚫ → ✅** (commit `5848c2e40`) : `config/upload_limits.go` + `GET /api/v1/upload/limits` consommé par `useUploadLimits` côté web.                                                     |
+| 42  | Tag suggestions                                                  |    ✅    |  ✅ | `tag_handler.go:15-32`.                                                                                                                                                                |
+| 43  | PWA (install + service worker + wake lock)                       |    ✅    |  ✅ | `components/pwa/`, v0.801.                                                                                                                                                             |
+| 44  | Orphan tracks cleanup                                            |    ✅    |  ⚫ | **⚫ → ✅** (commit `553026728`) : `jobs/cleanup_orphan_tracks.go`, hourly, flip `processing`→`failed` si fichier disque manquant.                                                      |
+| 45  | Stem upload & sharing (F482)                                     |    ✅    |  ✅ | `routes_tracks.go:185-189`, ownership guard.                                                                                                                                           |
+
+**Score** : 43 ✅ / 2 🟡 / 0 🔴 / 0 ⚫. La seule 🔴 de la v1 (Player/écoute audio) est résolue.
+
+**Les 2 🟡 restants** : **Upload** (stockage local disque → pas prêt pour production scale) et **WebRTC 1:1** (pas de STUN/TURN → NAT traversal HS).
+
+---
+
+## 2. Les 6 parcours — étape par étape
+
+### Parcours 1 — Écouter de la musique
+
+**Verdict : ✅ OPÉRATIONNEL.** Le bloqueur v1 est résolu — le fallback direct stream existe.
+
+| #   | Étape                    | Verdict | Preuve                                                                                                                                            |
+| --- | ------------------------ | :-----: | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Créer un compte          |    ✅    | `POST /auth/register` → `core/auth/service.go:104-469`. `IsVerified: false` (`:200`), token en DB.                                                |
+| 2   | Recevoir l'email         |    ✅    | MailHog par défaut dans `docker-compose.dev.yml:114-130`. UI sur port 8025. Prod : 500 hard si SMTP down (`service.go:387`).                      |
+| 3   | Cliquer le lien verify   |    ✅    | `POST /auth/verify-email?token=X` → `core/auth/service.go:747-765` check token + flip `is_verified=true`.                                         |
+| 4   | Se connecter             |    ✅    | `POST /auth/login` → 403 Forbidden si `!IsVerified` (`service.go:527`). Lockout après 5 tentatives / 15 min.                                      |
+| 5   | Chercher un morceau      |    ✅    | `GET /api/v1/search` → `search_handlers.go:41`, ES ou fallback Postgres tsvector.                                                                 |
+| 6   | Lancer la lecture        |    ✅    | Player React tente HLS d'abord (`playerService.ts:283-293`), fallback direct `/stream`.                                                           |
+| 7   | **Le son sort ?**        |    ✅    | `GET /tracks/:id/stream` avec `http.ServeContent` (`track_hls_handler.go:266`), Range supporté, cache bypass wiré (`response_cache.go:87-104`). |
+
+**Piège dev** : si on upload un fichier mais que le transcoding (Rust stream server) échoue, le track reste en `Processing`. Le cleanup worker hourly le flippera à `Failed` après 1h. Le fichier **reste lisible via `/stream`** pendant ce temps, mais il n'apparaît pas en library (filtre `status=Completed`).
+
+### Parcours 2 — Uploader un morceau (artiste)
+
+**Verdict : ✅ MAIS sur local disque.**
+
+| #   | Étape                       | Verdict | Preuve                                                                                                                                                           |
+| --- | --------------------------- | :-----: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Login                       |    ✅    | Comme parcours 1.                                                                                                                                                |
+| 2   | Upgrade creator (si besoin) |    ✅    | `POST /api/v1/users/me/upgrade-creator` — gate email-verified, idempotent (`upgrade_creator_handler.go`). UI `AccountSettingsCreatorCard.tsx`.                   |
+| 3   | Uploader un fichier audio   |    ✅    | `POST /api/v1/tracks/upload` → `track_upload_handler.go:39-171`. Multipart, taille SSOT (`config/upload_limits.go`), ClamAV **sync** fail-secure.                |
+| 4   | Stockage physique           |    🟡   | **`uploads/tracks/<userID>/<filename>` sur disque local** (`track_upload_handler.go:376`). Code S3/MinIO présent mais **non wiré** dans ce chemin.               |
+| 5   | Transcoding                 |    🟡   | **Dual-trigger** : gRPC Rust stream server (`stream_service.go:49`) **et** RabbitMQ job (`EnqueueTranscodingJob`). Redondance non documentée.                    |
+| 6   | Track visible en library    |    ✅    | Après `status=Completed`. Avant : utilisateur voit son upload en "Processing" dans son tableau de bord.                                                          |
+| 7   | Autre user peut trouver/lire|    ✅    | Via search + parcours 1. Si track reste `Processing` (transcoding down) → pas en library mais `/tracks/:id/stream` sert quand même le raw.                       |
+
+### Parcours 3 — Acheter sur le marketplace
+
+**Verdict : ✅ (sandbox testing) + solidifiés massivement depuis v1.**
+
+| #   | Étape                              | Verdict | Preuve                                                                                                                                                                                                 |
+| --- | ---------------------------------- | :-----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1   | Browse produits                    |    ✅    | `GET /api/v1/marketplace/products`, handlers DB réels.                                                                                                                                                 |
+| 2   | Ajouter au panier                  |    ✅    | `POST /api/v1/cart/items` → `cart.go:25-97`, DB-backed (table `cart_items`).                                                                                                                           |
+| 3   | Checkout                           |    ✅    | `POST /api/v1/orders` → `service.go:522-548` (prod flow Hyperswitch) ou `:550-586` (dev simulated).                                                                                                    |
+| 4   | **Paiement Hyperswitch**           |    ✅    | `paymentProvider.CreatePayment()` avec `Idempotency-Key: order.ID` (commit `4f15cfbd9`). Retourne `client_secret` consommé par `CheckoutPaymentForm.tsx`.                                              |
+| 5   | Webhook paiement                   |    ✅    | `POST /api/v1/webhooks/hyperswitch` → raw payload logged (`webhook_log.go`), signature HMAC-SHA512 vérifiée, dispatcher `ProcessPaymentWebhook`.                                                       |
+| 6   | Reconciliation si webhook perdu    |    ✅    | `reconcile_hyperswitch.go` sweep stuck orders > 30m avec payment_id non vide, synthèse webhook → `ProcessPaymentWebhook`. Idempotent. Configurable `RECONCILE_INTERVAL=1h` (5m pendant incident).      |
+| 7   | Confirmation + accès contenu       |    ✅    | Création licenses dans la transaction (`service.go:561-585`), lock `FOR UPDATE` pour exclusive.                                                                                                        |
+| 8   | Remboursement                      |    ✅    | 3-phase `service.go:1297-1436` : pending row → `CreateRefund` PSP → persist `hyperswitch_refund_id`. Webhook `refund.succeeded` révoque licenses + débite vendeur.                                     |
+| 9   | Reverse-charge Stripe Connect      |    ✅    | `reversal_worker.go:12-180`, state `reversal_pending`, async, backoff 1m→1h. Rows pré-v1.0.7 sans `stripe_transfer_id` → `permanently_failed` avec message explicite.                                  |
+
+**Piège prod** : `HYPERSWITCH_ENABLED=false` = dev bypass. **Garde-fou** : `Config.Validate` refuse de booter en prod si `HYPERSWITCH_ENABLED=false` (`config.go:908-910`) — message explicite "marketplace orders complete without charging, effectively giving away products". Fail-closed au bon endroit.
+
+### Parcours 4 — Chat
+
+**Verdict : ✅ sur toutes les surfaces.**
+
+| #   | Étape                           | Verdict | Preuve                                                                                                                                                       |
+| --- | ------------------------------- | :-----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1   | Ouvrir le chat                  |    ✅    | `apps/web/src/features/chat/pages/ChatPage.tsx`.                                                                                                             |
+| 2   | Rejoindre / créer une room      |    ✅    | `POST /api/v1/conversations` → `CreateRoom:54`.                                                                                                              |
+| 3   | Envoyer un message              |    ✅    | WS dispatcher `handler.go:54-106` → `HandleSendMessage:18` → DB **avant** broadcast (`handler_messages.go:91-113`).                                          |
+| 4   | Recevoir (temps réel)           |    ✅    | Hub local, puis PubSub pour multi-instance.                                                                                                                  |
+| 5   | Persistance                     |    ✅    | `chat_messages` table, indexed.                                                                                                                              |
+| 6   | Multi-instance sans Redis       |    ✅    | Fallback in-memory **avec log ERROR loud** ("Redis unavailable, cross-instance messages will be lost") (`chat_pubsub.go:23-27`). Plus de silent fail.        |
+| 7   | Typing / reactions / attach.    |    ✅    | 12 features wirées (voir §1 ligne 12).                                                                                                                       |
+
+### Parcours 5 — Livestream
+
+**Verdict : ✅ avec banner UI si RTMP down.**
+
+| #   | Étape                    | Verdict | Preuve                                                                                                                                      |
+| --- | ------------------------ | :-----: | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Démarrer un live         |    ✅    | `POST /api/v1/live/streams` → `live_stream_handler.go:71-98`, génère `stream_key` UUID + `rtmp_url`.                                        |
+| 2   | Push OBS → nginx-rtmp    |    ✅    | `on_publish` callback `live_stream_callback.go:38-80` avec secret `X-RTMP-Callback-Secret`, flip `is_live=true`.                            |
+| 3   | Health check visible     |    ✅    | `GET /api/v1/live/health` (`live_health_handler.go:78-96`) + poll 15s front (`useLiveHealth.ts:41-61`). Banner warn si `rtmp_reachable=false`.|
+| 4   | Viewer play live         |    ✅    | HLS via nginx-rtmp (`streamURL` = `baseURL + /{streamKey}/playlist.m3u8`).                                                                  |
+| 5   | Co-listening en parallèle|    ✅    | Feature séparée, `colistening/hub.go:104-148`, host-authority sync 100ms drift threshold.                                                  |
+
+**Piège** : nécessite `docker compose --profile live up` pour démarrer nginx-rtmp. Sans ça, banner red immédiat. Plus de silent fail comme en v1.
+
+### Parcours 6 — Admin
+
+**Verdict : ✅ complet avec persistance maintenance mode.**
+
+| #   | Étape                    | Verdict | Preuve                                                                                                                   |
+| --- | ------------------------ | :-----: | ------------------------------------------------------------------------------------------------------------------------ |
+| 1   | Accéder /admin           |    ✅    | Middleware JWT + role check, 2FA obligatoire.                                                                            |
+| 2   | Voir stats               |    ✅    | `admin/handler.go:43-54` `GetPlatformMetrics`.                                                                           |
+| 3   | Modérer (queue, bans)    |    ✅    | `moderation/handler.go:44` `GetModerationQueue`, ban/suspend wirés.                                                       |
+| 4   | Gérer utilisateurs       |    ✅    | Admin handlers (user upgrade, role change).                                                                              |
+| 5   | Maintenance mode         |    ✅    | Persisté `platform_settings` (`middleware/maintenance.go:16-100`, TTL 10s). Survit au restart. **🟡 v1 → ✅ v2**.         |
+| 6   | Feature flags            |    ✅    | DB-backed.                                                                                                               |
+| 7   | Ledger health dashboard  |    ✅    | Grafana `config/grafana/dashboards/ledger-health.json` + 5 gauges + 3 alert rules (voir §1 ligne 28).                    |
+| 8   | Admin transfers          |    ✅    | `admin_transfer_handler.go:36-91`, manual retry, state machine persistée.                                                |
+
+---
+
+## 3. Carte des dépendances
+
+### 3.1 Services — hard-required vs optionnels
+
+| Service              | Status          | Comportement si down                                                                                         | Preuve                                                                        |
+| -------------------- | --------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| **PostgreSQL**       | 🔴 Hard-req     | App panique au boot (`main.go:112-120`, migrations auto-run).                                                | `db.Initialize()` + `RunMigrations()` fatal.                                  |
+| **Migrations**       | 🔴 Auto         | Appliquées au démarrage, boot fail si erreur SQL.                                                            | `database.go:234-256`.                                                        |
+| **Redis**            | 🟢 Dégradation  | TokenBlacklist nil-safe. Chat PubSub fallback in-memory avec **log ERROR loud**. Rate limiter dégradé.       | `chat_pubsub.go:23-27` ; `config.go:55-58`.                                   |
+| **RabbitMQ**         | 🟢 Dégradation  | EventBus publish failures maintenant **loggés ERROR** (commit `bf688af35`) au lieu de silent drop.           | `main.go:128-139` ; `config.go:690-693`.                                      |
+| **MinIO / S3**       | 🟢 Non utilisé  | `AWS_S3_ENABLED=false` par défaut, **code S3 présent mais non wiré dans upload path**. Disque local always.  | `config.go:697-720` ; `track_upload_handler.go:376`.                          |
+| **Elasticsearch**    | 🟢 Optionnel    | Search fallback Postgres full-text search (tsvector + pg_trgm). ES non utilisé en chemin chaud.              | `fulltext_search_service.go:14-30` ; `main.go:288-297` (cleanup only).        |
+| **ClamAV**           | 🟠 Fail-secure  | `CLAMAV_REQUIRED=true` par défaut → upload **rejeté** (503) si down. `=false` = bypass avec warning.         | `upload_validator.go:87-88, 140-150` ; `services_init.go:27-46`.              |
+| **Hyperswitch**      | 🟠 Prod-gate    | `HYPERSWITCH_ENABLED=false` = dev bypass. **Prod : `Config.Validate` refuse boot** si false.                 | `config.go:908-910` ; `service.go:522-548, 550-586`.                          |
+| **Stripe Connect**   | 🟠 Prod-gate    | Reversal worker tourne si config présente. Rows pre-v1.0.7 sans id → `permanently_failed`.                   | `reversal_worker.go:12-180` ; `main.go:188`.                                  |
+| **Nginx-RTMP**       | 🟢 Profil live  | `docker compose --profile live up`. Si down : banner UI immédiat sur Go Live page.                           | `live_health_handler.go:78-96` ; `useLiveHealth.ts:41-61`.                    |
+| **Rust stream srv**  | 🟢 Optionnel    | HLS gated `HLSEnabled=false` default. Direct `/stream` fallback toujours disponible. Transcoding async.      | `stream_service.go:49` ; `config.go:355` ; `track_hls_handler.go:266`.        |
+| **MailHog (SMTP)**   | 🟢 Dev default  | Branché `docker-compose.dev.yml:114-130`, port 1025. Dev : fail email → log + continue. Prod : 500 hard.     | `.env.template:160-165` ; `service.go:381-407`.                               |
+
+**Résumé** : **3 hard-required** (Postgres, migrations, bcrypt) · **le reste est optionnel avec fallback, fail-secure, ou prod-gate explicite**. C'est l'évolution la plus importante depuis v1 : il n'y a plus de silent failures non documentés.
+
+### 3.2 Seeding
+
+- `veza-backend-api/cmd/tools/seed/main.go` : modes `production` / `full` / `smoke`. Truncate tables → insert users → tracks → playlists → social → chat. **Manuel**, pas auto-run. Marche.
+
+---
+
+## 4. Stabilité — points de fragilité restants
+
+| #  | Fragilité                                   | Impact  | Preuve                                                                                                                                        |
+| -- | ------------------------------------------- | :-----: | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1  | **WebRTC 1:1 sans STUN/TURN**               | 🟡 Prod | Pas d'env var, pas de grep hit. NAT symétrique = call failures silencieuses (les signals passent, mais le flux média échoue).                 |
+| 2  | **Stockage local disque only**              | 🟡 Prod | `uploads/tracks/<userID>/` sur FS local. Pas scalable multi-pod sans volume partagé. Le code S3/MinIO est dead in upload path.                |
+| 3  | **HLS `HLSEnabled=false` par défaut**       | 🟢 Dev  | Fonctionnel grâce au fallback `/stream`. Pas d'adaptive bitrate out-of-box. Opérateur doit activer explicitement.                             |
+| 4  | **Transcoding dual-trigger**                | 🟡 Ops  | `StreamService.StartProcessing` (gRPC) **et** `EnqueueTranscodingJob` (RabbitMQ) appelés tous les deux. Redondance non documentée.            |
+| 5  | **`HLS_STREAMING` absent de .env.template** | 🟠 Doc  | Dev qui veut HLS doit trouver la var ailleurs. `.env.template` à compléter.                                                                   |
+| 6  | **Dev bypass Hyperswitch**                  | 🟢 Ops  | Fail-closed prod (`Config.Validate`), mais en staging un opérateur distrait peut servir des licences gratuites. Mettre un warning loud au boot. |
+| 7  | **Email tokens en query param**             | 🟠 Sec  | `?token=X` peut leak via Referer / logs proxy. Migration flagged v0.2 (commentaire `handlers/auth.go` L339).                                  |
+| 8  | **Register issue JWT avant email send**     | 🟠 UX   | User a ses tokens avant que l'email parte → login 403 immédiat tant que non-vérifié. Cohérent mais friction.                                  |
+| 9  | **ClamAV 10s timeout sync**                 | 🟢 UX   | Upload bloque jusqu'à 10s sur scan. Acceptable pour fichiers audio <100MB.                                                                    |
+| 10 | **Subscription `pending_payment` item G**   | 🟢 Roadm| v1.0.6.2 compense via filter, item G dans v107-plan refait le path proprement. Pas un bug, juste techdebt flaggée.                            |
+
+**Zero silent fails** parmi les 6 surfaces critiques (Chat Redis, RabbitMQ, RTMP, HLS, SMTP, Hyperswitch). C'est le grand changement depuis v1.
+
+---
+
+## 5. Verdict final
+
+**Veza v1.0.7-rc1 est prêt pour :**
+- ✅ **Démo publique contrôlée** — un pod, infra dev `make dev`, Hyperswitch sandbox. Le parcours "register → verify → search → play → upload → purchase → refund" est intégralement opérationnel.
+- ✅ **Sandbox payment testing** — refund réel, reconciliation, ledger-health gauges, Stripe Connect reversal. Toute la plomberie monétaire est audit-ready.
+- ✅ **Beta privée multi-utilisateurs** — chat multi-instance avec alarme loud si Redis manque, co-listening host-authority, livestream avec health banner. Pas de silent fails.
+
+**Veza v1.0.7-rc1 n'est PAS prêt pour :**
+- 🟡 **Production publique grand-public scale** — le stockage uploads sur disque local ne survit pas à un second pod. MinIO/S3 doit être wiré dans le path upload (le code dort, il faut juste l'appeler).
+- 🟡 **Calls WebRTC fiables hors LAN** — sans STUN/TURN, symmetric NAT = échec silencieux du flux média. À configurer avant d'ouvrir la feature calls au public.
+- 🟠 **Opérateur ops naïf** — le dashboard Grafana ledger-health est là mais ne sert à rien si personne ne le regarde. Nécessite un runbook d'exploitation.
+
+**Ce qui a changé depuis la v1 du 2026-04-16** — en 3 jours, l'équipe a fermé **7 findings 🔴/🟡** et ajouté **10 nouvelles capacités** (reconciliation, audit log webhook, ledger metrics, reversal async, upgrade creator, upload SSOT, RTMP health, orphan cleanup, maintenance persist, SMTP unified). Voir §6.
+
+**En une phrase** : **le code est solide, la plomberie est honnête, les seuls 🟡 restants sont des features "scale" (storage, NAT) pas des bugs**.
+
+---
+
+## 6. Diff vs audit v1 (2026-04-16)
+
+Tableau des évolutions : chaque ligne = un finding v1 avec son statut aujourd'hui.
+
+| Finding v1                                                 | v1 | v2 | Commit / Preuve                                                                                        |
+| ---------------------------------------------------------- | :-: | :-: | ------------------------------------------------------------------------------------------------------ |
+| Player/écoute audio sans fallback (HLSEnabled=false)       | 🔴 | ✅ | Endpoint direct `/tracks/:id/stream` + Range cache bypass. `b875efcff`, `routes_tracks.go:118-120`.   |
+| Register : `IsVerified: true` hardcoded                    | 🔴 | ✅ | `service.go:200` → `IsVerified: false`. Commit trail.                                                  |
+| Verify email : dead code                                   | 🔴 | ✅ | Endpoint actif, login 403 sur unverified (`service.go:527`).                                           |
+| SMTP silent fail                                           | 🟡 | ✅ | Env schema unifié (`066144352`). Prod : 500 hard. Dev : log + continue. MailHog branché par défaut.    |
+| Marketplace dev bypass                                     | 🟡 | ✅ | Prod gate `Config.Validate` refuse boot (`config.go:908-910`). Dev bypass conservé, assumé.            |
+| Refund : row DB only, pas de reverse-charge                | 🟡 | ✅ | 3-phase avec idempotency key. `959031667`, `4f15cfbd9`, `service.go:1297-1436`.                        |
+| Subscription : payment gate bypass                         | 🟡 | ✅ | v1.0.6.2 hotfix `d31f5733d`, `hasEffectivePayment()`.                                                  |
+| Chat multi-instance silent fallback                        | 🟡 | ✅ | Redis missing = **log ERROR loud** (`chat_pubsub.go:23-27`). Fallback conservé pour single-pod dev.    |
+| Livestream : dépendance cachée `--profile live`            | 🟡 | ✅ | Health endpoint + banner UI (`64fa0c9ac`, `live_health_handler.go:78-96`).                             |
+| Maintenance mode in-memory                                 | 🟡 | ✅ | Persisté `platform_settings` + TTL 10s. `3a95e38fd`, `middleware/maintenance.go:16-100`.               |
+| Tracks orphelines `Processing` indéfiniment                | 🟡 | ✅ | Cleanup hourly worker. `553026728`, `jobs/cleanup_orphan_tracks.go`.                                   |
+| RabbitMQ silent drop                                       | 🟡 | ✅ | Log ERROR sur publish failure. `bf688af35`.                                                            |
+| Upload size limits désalignés front/back                   | 🟠 | ✅ | SSOT `config/upload_limits.go` + hook `useUploadLimits`. `5848c2e40`.                                  |
+| Stripe Connect reversal inexistant                         | 🔵 | ✅ | Async worker + state machine `reversal_pending`. v1.0.7 items A+B.                                     |
+| Reconciliation Hyperswitch (stuck orders)                  | 🔵 | ✅ | `reconcile_hyperswitch.go:55-150`. v1.0.7 item C.                                                      |
+| Webhook raw payload audit log                              | 🔵 | ✅ | `webhook_log.go` + cleanup 90j. v1.0.7 item E.                                                         |
+| Ledger-health metrics + alerts                             | 🔵 | ✅ | 5 gauges Prometheus + 3 alert rules + Grafana dashboard. v1.0.7 item F.                                |
+| Idempotency-key Hyperswitch                                | 🔵 | ✅ | Sur CreatePayment + CreateRefund. v1.0.7 item D (`4f15cfbd9`).                                         |
+| Self-service creator upgrade                               | 🔵 | ✅ | `POST /users/me/upgrade-creator`, email-verified gate. `c32278dc1`.                                    |
+| WebRTC sans STUN/TURN                                      | 🟡 | 🟡 | **Toujours pas fixé.** Signaling ok, NAT traversal non.                                                |
+| Stockage uploads sur disque local                          | 🟡 | 🟡 | **Toujours pas fixé.** Code S3 présent, non wiré.                                                      |
+| HLS `HLSEnabled=false` par défaut                          | 🔴 | 🟢 | Plus bloquant grâce au fallback direct stream, mais flag toujours off.                                 |
+
+Légende : 🔵 = finding absent de v1 mais identifié ici, 🟢 = non-bloquant en v2, 🟠 = doc/cleanup.
+
+**Bilan** : **18 findings v1 résolus**, **2 subsistants** (WebRTC TURN, stockage local). **7 nouvelles capacités ajoutées** (reconcil, audit log, ledger metrics, reversal, upgrade creator, upload SSOT, RTMP health). Le "chemin critique v1.0.5 public-ready" listé en v1 est **intégralement réalisé** par v1.0.5 → v1.0.7-rc1.
+
+---
+
+## 7. Cleanup session post-rc1 (2026-04-23)
+
+Une session cleanup + BFG a été exécutée 4 jours après cet audit. Cross-référence avec [AUDIT_REPORT.md §9](AUDIT_REPORT.md) :
+
+- ✅ **10/15 items Top-15 traités** (cleanup #1/#2/#3/#6/#7/#9/#11/#12/#13, BFG inclus)
+- ⚠️ **3 false-positives identifiés** (#4 context propagation, #5 security headers, #10 `RespondWithAppError`) — voir `AUDIT_REPORT.md §9.bis` pour les preuves
+- 📋 **2 deferrals v1.0.8** (#8 OpenAPI typegen, #14 E2E Playwright CI)
+- 📝 **1 item pending** (#15 `docs/ENV_VARIABLES.md` sync, 0.5j)
+- **Repo `.git` : 1.5 GB → 66 MB** (−97%) après 2 passes git-filter-repo + force-push stages 1+2
+
+Les 2 findings fonctionnels subsistants (WebRTC STUN/TURN + stockage uploads disque local) restent **post-v1.0.7-final** dans le scope v1.0.8 (2-3j chacun).
+
+---
+
+*Généré par Claude Code Opus 4.7 (1M context, /effort max, /plan) — 5 agents Explore parallèles + vérifications ponctuelles directes (`routes_tracks.go:118`, `core/auth/service.go:200`, `config.go:355/907-910`, `marketplace/service.go:522-586`). Cross-référencé avec `docs/audit-2026-04/v107-plan.md` et `CHANGELOG.md` v1.0.5 → v1.0.7-rc1. Une correction par rapport à v1 : le Player n'est plus 🔴 — la v1 avait loupé l'endpoint `/stream` (fallback direct avec Range support). §7 ajouté 2026-04-23 post-session cleanup.*

LICENSE

@@ -1,661 +0,0 @@
-                    GNU AFFERO GENERAL PUBLIC LICENSE
-                       Version 3, 19 November 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU Affero General Public License is a free, copyleft license for
-software and other kinds of works, specifically designed to ensure
-cooperation with the community in the case of network server software.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-our General Public Licenses are intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  Developers that use our General Public Licenses protect your rights
-with two steps: (1) assert copyright on the software, and (2) offer
-you this License which gives you legal permission to copy, distribute
-and/or modify the software.
-
-  A secondary benefit of defending all users' freedom is that
-improvements made in alternate versions of the program, if they
-receive widespread use, become available for other developers to
-incorporate.  Many developers of free software are heartened and
-encouraged by the resulting cooperation.  However, in the case of
-software used on network servers, this result may fail to come about.
-The GNU General Public License permits making a modified version and
-letting the public access it on a server without ever releasing its
-source code to the public.
-
-  The GNU Affero General Public License is designed specifically to
-ensure that, in such cases, the modified source code becomes available
-to the community.  It requires the operator of a network server to
-provide the source code of the modified version running there to the
-users of that server.  Therefore, public use of a modified version, on
-a publicly accessible server, gives the public access to the source
-code of the modified version.
-
-  An older license, called the Affero General Public License and
-published by Affero, was designed to accomplish similar goals.  This is
-a different license, not a version of the Affero GPL, but Affero has
-released a new version of the Affero GPL which permits relicensing under
-this license.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU Affero General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Remote Network Interaction; Use with the GNU General Public License.
-
-  Notwithstanding any other provision of this License, if you modify the
-Program, your modified version must prominently offer all users
-interacting with it remotely through a computer network (if your version
-supports such interaction) an opportunity to receive the Corresponding
-Source of your version by providing access to the Corresponding Source
-from a network server at no charge, through some standard or customary
-means of facilitating copying of software.  This Corresponding Source
-shall include the Corresponding Source for any work covered by version 3
-of the GNU General Public License that is incorporated pursuant to the
-following paragraph.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the work with which it is combined will remain governed by version
-3 of the GNU General Public License.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU Affero General Public License from time to time.  Such new versions
-will be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU Affero General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU Affero General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU Affero General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU Affero General Public License as published
-    by the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU Affero General Public License for more details.
-
-    You should have received a copy of the GNU Affero General Public License
-    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If your software can interact with users remotely through a computer
-network, you should also make sure that it provides a way for users to
-get its source.  For example, if your program is a web application, its
-interface could display a "Source" link that leads users to an archive
-of the code.  There are many ways you could offer source, and different
-solutions will be better for different programs; see section 13 for the
-specific requirements.
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU AGPL, see
-<https://www.gnu.org/licenses/>.

Makefile

@@ -0,0 +1,40 @@
+# ==============================================================================
+# VEZA MONOREPO - ULTIMATE CONTROL PLANE
+# ==============================================================================
+# Stack:  Docker + Incus (LXD) Support
+# System: Linux / Bash
+#
+# Configuration: edit make/config.mk (ports, services, paths).
+# Add new targets in make/*.mk or below.
+# ==============================================================================
+
+SHELL := /bin/bash
+.ONESHELL:
+.DEFAULT_GOAL := help
+
+# --- Configuration (single source of truth) ---
+include make/config.mk
+include make/ui.mk
+
+# --- All feature modules ---
+include make/tools.mk
+include make/infra.mk
+include make/dev.mk
+include make/build.mk
+include make/test.mk
+include make/services.mk
+include make/high.mk
+include make/incus.mk
+include make/help.mk
+
+# ==============================================================================
+# PER-SERVICE CONVENIENCE (dev-*, test-*, lint-*, build-*)
+# ==============================================================================
+# Usage: make dev-web, make test-backend-api, make lint-web, etc.
+# Add new services in make/config.mk (SERVICES, SERVICE_DIR_*, PORT_*).
+# ==============================================================================
+
+.PHONY: dev-web dev-backend-api dev-stream-server
+.PHONY: test-web test-backend-api test-stream-server
+.PHONY: lint-web lint-backend-api lint-stream-server
+# (targets defined in make/dev.mk and make/test.mk)

README.md

@@ -1,105 +1,74 @@
-# 🌌 Veza — Plateforme créative et collaborative nouvelle génération
+# Veza Monorepo
 
-Veza est une plateforme audio complète et modulaire : partage, streaming haute performance, collaboration, chat temps réel, marketplace, analytics, et gestion créative.  
-Conçue pour être **intensive**, **scalable** et **créatrice de communautés**, elle s'appuie sur une architecture hybride **Go + Rust + React** pensée pour durer.
+[![CI](https://github.com/okinrev/veza/actions/workflows/ci.yml/badge.svg)](https://github.com/okinrev/veza/actions/workflows/ci.yml)
 
----
+**Version courante** : v1.0.4 (cleanup + consolidation post-audit). Voir [CHANGELOG.md](CHANGELOG.md) et [docs/PROJECT_STATE.md](docs/PROJECT_STATE.md).
 
-## 🏛️ Architecture (vue ultra-résumée)
+## Project Structure
 
-```
+- **`apps/web`** — Frontend React 18 + Vite 5 + TypeScript strict (source of truth for the UI)
+- **`veza-backend-api`** — Main Go 1.25 API service (Gin, GORM, Postgres, Redis, RabbitMQ, Elasticsearch). Handles REST, WebSocket, and chat (chat server was merged into this service in v0.502).
+- **`veza-stream-server`** — Rust streaming server (Axum 0.8, Tokio 1.35, Symphonia) — HLS, HTTP Range, WebSocket, gRPC
+- **`veza-common`** — Shared Rust types and logging
+- **`packages/design-system`** — Shared design tokens
 
-veza/
-│
-├── apps/
-│   ├── backend-api/     # API Go (auth, users, tracks, playlists…)
-│   ├── chat-server/     # WebSocket Rust (rooms & DM)
-│   ├── stream-server/   # Serveur audio Rust (FFmpeg, HLS)
-│   └── web-frontend/    # Interface React/TS, Zustand, shadcn/ui
-│
-├── infra/
-│   ├── docker/          # Images, scripts, entrypoints
-│   ├── incus/           # Containers Dev/Prod
-│   ├── ansible/         # Déploiement automatisé
-│   └── k8s/             # (optionnel) Manifests Kubernetes
-│
-├── docs/
-│   ├── ORIGIN/          # Spécifications "Constitution"
-│   ├── ARCHITECTURE/
-│   ├── FEATURES/
-│   └── ROADMAP/
-│
-└── scripts/
-├── dev/
-├── ci/
-└── smoke-tests/
+See [CLAUDE.md](CLAUDE.md) for the full architecture map.
 
-````
+## Development Setup
 
----
-
-## 🚀 Lancer le projet en local (dev environment)
-
-**Pré-requis :**
-- Go ≥ 1.22  
-- Rust ≥ 1.75  
-- pnpm ou npm  
-- Docker + docker-compose  
-- PostgreSQL + Redis  
-
-### 1. Cloner le repo
-```bash
-git clone https://github.com/your-org/veza.git
-cd veza
-````
-
-### 2. Lancer l’environnement de développement
+Prerequisites: Node 20 (see `.nvmrc`), Go, Rust, Docker. Configure `.env` from `.env.example`.
 
 ```bash
-docker compose up -d
+# Verify environment
+make doctor
+./scripts/validate-env.sh development
+
+# Install dependencies
+make install-deps
+
+# Option A — Backend in Docker + Web local
+make dev
+
+# Option B — All apps local with hot reload (infra from docker-compose.dev.yml)
+make dev-full
+
+# Option C — Infra only, then run services manually
+docker compose -f docker-compose.dev.yml up -d
+make dev-web              # or make dev-backend-api, make dev-stream-server
 ```
 
-### 3. Lancer chaque service
+See [docs/ENV_VARIABLES.md](docs/ENV_VARIABLES.md) for required variables. `make build` builds all services.
 
-#### Backend Go
+## Quick Start
+
+### Frontend only
 
 ```bash
-cd apps/backend-api
-go run cmd/server/main.go
+cd apps/web
+npm install
+npm run dev
 ```
 
-#### Chat server (Rust)
+## Docker Production
+
+**Canonical production compose file**: `docker-compose.prod.yml`
 
 ```bash
-cd apps/chat-server
-cargo run
+docker compose -f docker-compose.prod.yml up -d
 ```
 
-#### Stream server (Rust)
+See `make/config.mk` for COMPOSE_PROD and deployment docs.
 
-```bash
-cd apps/stream-server
-cargo run
-```
+## CI/CD
 
-#### Frontend
+- **Badge** : CI status above. Set `SLACK_WEBHOOK_URL` (Incoming Webhook) in repo secrets to receive Slack notifications on failure.
 
-```bash
-cd apps/web-frontend
-pnpm install
-pnpm dev
-```
+### Disabled workflows
 
----
-
-## 📜 Licence
-
-Le projet est distribué sous licence **AGPL-3.0** (voir fichier `LICENSE`).
-
----
-
-## 🤝 Contributions
-
-Les contributions sont les bienvenues ! Voir `CONTRIBUTING.md`.
+- **Storybook** (`chromatic.yml.disabled`, `storybook-audit.yml.disabled`, `visual-regression.yml.disabled`): deferred until MSW is wired up for `/api/v1/auth/me` and `/api/v1/logs/frontend`, which currently causes ~1 400 network errors in the Storybook build. The npm scripts (`storybook`, `build-storybook`) still work locally for one-off component inspection. To reactivate in CI, fix the MSW handlers and rename the three files back to `.yml`.
 
+## Documentation
 
+- **[Developer Onboarding](docs/ONBOARDING.md)** — Setup, architecture, conventions, troubleshooting
+- **[Documentation index](docs/README.md)** — Index complet de la documentation
+- See `docs/` for detailed architecture and development guides. Older audits and reports are archived in `docs/archive/`.

RELEASE_NOTES_V1.md

@@ -0,0 +1,122 @@
+# Release Notes — Veza v1.0.0
+
+**Date de release** : 2026-03-03  
+**Version précédente** : v0.803 (2026-02-25)
+
+---
+
+## Résumé
+
+Veza v1.0.0 est la première release commerciale de la plateforme audio collaborative. Cette version consolide les corrections de sécurité, les améliorations de qualité, et les fonctionnalités livrées entre v0.803 et v1.0.0.
+
+---
+
+## Nouvelles fonctionnalités depuis v0.803
+
+### Sécurité (v0.901–v0.903)
+- OAuth : génération JWT corrigée via JWTService/SessionService
+- Webhook Hyperswitch : vérification de signature obligatoire
+- TokenBlacklist intégré au middleware auth (tokens révoqués rejetés)
+- ValidateExecPath sur les appels exec (waveform_service)
+- Rate limiter : login/register inclus dans le global limit
+- Harmonisation Go 1.24, VERSION synchronisé
+
+### Auth & Commerce (v0.911–v0.912)
+- Tests d'intégration OAuth Google/GitHub E2E
+- Tests E2E paiement Hyperswitch, webhook idempotence, refund flow
+
+### Qualité (v0.921–v0.923)
+- Couverture tests Rust > 30%
+- Réduction des skips Go, tests de contrat API
+- OpenAPI spec générée et validée
+
+### Performance (v0.931)
+- Pagination cursor-based : tracks, messages, feed social
+- Profiling P50/P95/P99 documenté
+
+### Consolidation (v0.941–v0.943)
+- Nettoyage code mort, migrations dédupliquées
+- Schéma consolidé (000_full_schema.sql)
+- Refactoring fichiers > 1000 lignes
+
+### Hardening (v0.951–v0.952)
+- Load tests : 500 req/s API, 1000 WebSocket, 50 uploads
+- Dashboard Grafana, alertes Prometheus
+- Health check deep (DB, Redis, S3, RabbitMQ)
+
+### Documentation & Ops (v0.961–v0.962)
+- Runbooks : déploiement, rollback, incident, rotation secrets, graceful degradation Redis
+- API Reference, guide onboarding < 30 min
+
+### Features cleanup (v0.971)
+- Feature flag WebRTC_CALLS avec badge "Beta"
+- Gamification fantôme supprimée
+- docs/V1_LIMITATIONS.md, docs/API_VERSIONING_POLICY.md
+
+### Beta & Polish (v0.981–v0.982)
+- Bug bash complet (Auth, Commerce, Média, Social)
+- Lighthouse ≥ 90 (Performance, Accessibility)
+- PWA offline vérifiée
+- RGPD/CCPA : export, suppression, opt-out documentés
+
+---
+
+## Corrections de sécurité majeures
+
+| ID | Description | Version |
+|----|-------------|---------|
+| VEZA-SEC-001 | OAuth generateJWT invalide | v0.901 |
+| VEZA-SEC-002 | PasswordService.GenerateJWT sans contrôles | v0.901 |
+| VEZA-SEC-005 | Webhook Hyperswitch vérification optionnelle | v0.901 |
+| VEZA-SEC-006 | TokenBlacklist déconnecté du middleware | v0.901 |
+| VEZA-SEC-007 | waveform_service sans ValidateExecPath | v0.901 |
+| VEZA-SEC-003 | PKCE OAuth | v0.902 |
+| VEZA-SEC-004 | Tokens OAuth chiffrés au repos | v0.902 |
+| VEZA-SEC-008 | ORDER BY dynamique (whitelist) | v0.903 |
+| VEZA-SEC-009 | Login/register exclus du rate limiter | v0.903 |
+
+---
+
+## Améliorations
+
+- **Performance** : Pagination cursor-based, P99 < 500ms cible
+- **Observabilité** : Request ID propagé, métriques Prometheus, Dashboard Grafana
+- **RGPD/CCPA** : Export données, suppression compte, opt-out documentés et vérifiés
+- **Accessibilité** : Lighthouse Accessibility ≥ 90, PWA mode offline
+- **Documentation** : Runbooks opérationnels, checklist V1_SIGNOFF
+
+---
+
+## Breaking changes
+
+### Pagination
+- `GET /tracks`, `GET /conversations/:id/history`, `GET /social/feed` : support de `cursor` et `limit` en plus de `page`/`limit`. La pagination OFFSET reste en fallback pour rétro-compatibilité.
+
+### API
+- Aucun breaking change sur les signatures de réponse. Voir [docs/API_VERSIONING_POLICY.md](docs/API_VERSIONING_POLICY.md).
+
+---
+
+## Migration guide (v0.803 → v1.0.0)
+
+1. **Variables d'environnement** : Vérifier `OAUTH_ENCRYPTION_KEY`, `CHAT_JWT_SECRET` séparé de `JWT_SECRET` en production, `HYPERSWITCH_WEBHOOK_SECRET` obligatoire.
+
+2. **Migrations** : Appliquer les migrations depuis la dernière version. Si base existante post-consolidation (v0.942), le marqueur `000_mark_consolidated.sql` peut être requis. Voir [docs/MIGRATION_CONSOLIDATION.md](docs/MIGRATION_CONSOLIDATION.md).
+
+3. **Tokens OAuth** : Si des tokens OAuth existants sont en clair, exécuter le script `cmd/tools/encrypt_oauth_tokens` avant mise à jour.
+
+4. **Frontend** : Aucune action spécifique. Les curseurs de pagination sont optionnels.
+
+---
+
+## Limitations connues (v1.0)
+
+Voir [docs/V1_LIMITATIONS.md](docs/V1_LIMITATIONS.md) pour la liste complète : WebRTC TURN/STUN (v1.1), 2FA SMS (v1.1), Redis HA (v1.1), etc.
+
+---
+
+## Liens
+
+- [CHANGELOG.md](CHANGELOG.md) — Historique détaillé des versions
+- [docs/ROADMAP_V09XX_TO_V1.md](docs/ROADMAP_V09XX_TO_V1.md) — Roadmap complète
+- [docs/V1_SIGNOFF.md](docs/V1_SIGNOFF.md) — Checklist de validation

Untitled

@@ -0,0 +1,2 @@
+continues les étapes de remédiation pour atteindre la version stable et fonctionnelle :
+@103_audit_global_features_states.md @103_RAPPORT_ETAT_FEATURES_2026_02_16.md 

VERSION

@@ -0,0 +1 @@
+1.0.8

apps/web/.dockerignore

@@ -0,0 +1,75 @@
+# Dependencies
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Build output
+dist/
+build/
+*.local
+
+# Environment files
+.env
+.env.local
+.env.*.local
+.env.development
+.env.production
+
+# Testing
+coverage/
+.nyc_output/
+*.test.ts
+*.test.tsx
+*.spec.ts
+*.spec.tsx
+__tests__/
+tests/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Documentation
+*.md
+docs/
+README.md
+
+# Logs
+logs/
+*.log
+
+# Temporary files
+tmp/
+temp/
+*.tmp
+
+# Docker
+Dockerfile*
+.dockerignore
+docker-compose*.yml
+
+# Lighthouse reports
+lighthouse-reports/
+
+# Build analysis
+bundle-analysis.html
+
+# Playwright
+playwright-report/
+test-results/
+
+# Misc
+.eslintcache
+.stylelintcache
+

apps/web/.env.example

@@ -0,0 +1,82 @@
+# Veza Frontend Environment Variables
+# Copy this file to .env.local and update with your values
+
+# --- DOMAIN (single source of truth for frontend) ---
+# All service URLs derive from this. Must match APP_DOMAIN in backend .env.
+# Change this + /etc/hosts to switch domain.
+VITE_DOMAIN=veza.fr
+
+# --- BACKEND PORT (Vite proxy target) ---
+# Must match PORT_BACKEND in docker-compose / config.mk. Default 18080 avoids conflicts.
+VITE_BACKEND_PORT=18080
+
+# API Configuration
+# Base URL for the REST API (can be absolute URL or path starting with /)
+# DEV: use /api/v1 so the Vite proxy forwards to the backend (same-origin cookies).
+VITE_API_URL=/api/v1
+
+# WebSocket Configuration
+# Chat WebSocket URL. If omitted, auto-derived from VITE_API_URL + /ws
+# v0.502: Chat WS is now served by the Go backend at /api/v1/ws
+# VITE_WS_URL=/api/v1/ws
+
+# Stream Server Configuration
+# Stream server URL for audio streaming (can be absolute URL or path starting with /)
+# If omitted, auto-derived from VITE_DOMAIN: ws://<domain>:8082/stream
+VITE_STREAM_URL=/stream
+
+# HLS Base URL (optional)
+# HTTP base URL for HLS streaming (master.m3u8, playlists, segments). Auth required (JWT).
+# If omitted, derived from VITE_STREAM_URL. For Docker dev (port 18082): use /hls (Vite proxy) or http://localhost:18082
+# VITE_HLS_BASE_URL=http://localhost:18082
+# VITE_CHAT_PORT=18081
+# VITE_STREAM_PORT=18082
+
+# CDN Configuration (optional)
+# Base URL for CDN when serving assets/audio from edge. Backend typically provides CDN URLs for tracks.
+# VITE_CDN_URL=https://cdn.veza.com
+# VITE_CDN_ENABLED=false
+
+# Upload Configuration
+# Upload endpoint URL (can be absolute URL or path starting with /)
+VITE_UPLOAD_URL=/upload
+
+# Hyperswitch (Payments)
+# Publishable key from Hyperswitch Control Center - for payment widget
+# Leave empty if payments disabled
+VITE_HYPERSWITCH_PUBLISHABLE_KEY=
+
+# Application Configuration
+# Application name
+VITE_APP_NAME=Veza
+
+# API Version
+# API version to use
+VITE_API_VERSION=v1
+
+# Debug Mode
+# Enable verbose API request/response logging in console (true/1 or false/0)
+VITE_DEBUG=false
+
+# Mock Service Worker
+# Enable MSW for API mocking in development (true/1 or false/0)
+VITE_USE_MSW=0
+
+# Firebase Cloud Messaging
+# VAPID key for push notifications (optional)
+# VITE_FCM_VAPID_KEY=your-vapid-key-here
+
+# Sentry Error Tracking
+# Sentry DSN for error tracking (optional)
+# VITE_SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id
+
+# --- Feature Flags (optional, defaults in parens) ---
+# Override feature flags without rebuild. Values: true, 1, yes = enabled; else disabled.
+# VITE_FEATURE_TWO_FACTOR_AUTH=true
+# VITE_FEATURE_PLAYLIST_COLLABORATION=true
+# VITE_FEATURE_PLAYLIST_SEARCH=false
+# VITE_FEATURE_PLAYLIST_SHARE=false
+# VITE_FEATURE_PLAYLIST_RECOMMENDATIONS=false
+# VITE_FEATURE_HLS_STREAMING=true
+# VITE_FEATURE_ROLE_MANAGEMENT=false
+# VITE_FEATURE_NOTIFICATIONS=false

apps/web/.env.storybook

@@ -0,0 +1,8 @@
+# Storybook Environment Configuration
+# Used when running "npm run storybook" or "npm run build-storybook"
+
+# Point API to a relative path so MSW can intercept it easily (same-origin)
+VITE_API_URL=/api/v1
+VITE_IS_STORYBOOK=true
+VITE_USE_MSW=true
+VITE_FEATURE_HLS_STREAMING=true

apps/web/.gitignore

@@ -0,0 +1,8 @@
+# Environment files (may contain secrets)
+.env.local
+.env.production
+
+# Test / E2E artifacts (generated by Playwright visual tests)
+e2e/test-results-visual/
+e2e/playwright-report-visual/
+e2e/playwright-report-visual/**/data/

apps/web/.husky/pre-commit

@@ -0,0 +1 @@
+npm test

apps/web/.prettierignore

@@ -0,0 +1,40 @@
+# Dependencies
+node_modules/
+
+# Build outputs
+dist/
+build/
+target/
+*.tsbuildinfo
+
+# Logs
+*.log
+npm-debug.log*
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+coverage/
+.nyc_output/
+
+# Misc
+*.min.js
+*.min.css
+package-lock.json
+yarn.lock
+pnpm-lock.yaml
+

apps/web/.prettierrc.json

@@ -0,0 +1,5 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2
+}

apps/web/.size-limit.json

@@ -0,0 +1,12 @@
+[
+  {
+    "path": "dist/assets/index-*.js",
+    "limit": "300 KB",
+    "gzip": true
+  },
+  {
+    "path": "dist/assets/*.css",
+    "limit": "80 KB",
+    "gzip": true
+  }
+]

apps/web/.storybook/AppProvidersForStorybook.tsx

@@ -0,0 +1,48 @@
+
+import React from 'react';
+import { ThemeProvider } from '../src/components/theme/ThemeProvider';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import { ToastProvider } from '../src/components/feedback/ToastProvider';
+import { AudioProvider } from '../src/context/AudioContext';
+import { AuthProvider } from '../src/providers/AuthProvider';
+
+// Create a singleton query client for Storybook to share cache if needed, 
+// or one per story. Since decorators run per story, creating it here might 
+// share it. Better to create inside if we want isolation, but for performance 
+// reuse is okay.
+const queryClient = new QueryClient({
+    defaultOptions: {
+        queries: {
+            retry: false,
+            staleTime: Infinity,
+            // Phase 1: Silence network errors in react-query
+            throwOnError: false,
+        },
+    },
+});
+
+interface AppProvidersProps {
+    children: React.ReactNode;
+    isDark?: boolean;
+}
+
+export const AppProvidersForStorybook: React.FC<AppProvidersProps> = ({ children, isDark = true }) => {
+    return (
+        <ThemeProvider defaultTheme={isDark ? 'dark' : 'light'}>
+            <div className={isDark ? 'dark' : ''} style={{ minHeight: '100vh', padding: '1rem', background: isDark ? '#0a0a0a' : '#ffffff', color: isDark ? '#ffffff' : '#0a0a0a' }}>
+                <QueryClientProvider client={queryClient}>
+                    <ToastProvider>
+                        <AudioProvider>
+                            <AuthProvider>
+                                <MemoryRouter>
+                                    {children}
+                                </MemoryRouter>
+                            </AuthProvider>
+                        </AudioProvider>
+                    </ToastProvider>
+                </QueryClientProvider>
+            </div>
+        </ThemeProvider>
+    );
+};

apps/web/.storybook/decorators.tsx

@@ -0,0 +1,60 @@
+/**
+ * Global Storybook decorator: single point of entry for all app providers.
+ * No story should import or wrap with these providers directly; they are applied here.
+ * Stories that need a specific route can set parameters.router.initialEntries.
+ *
+ * This ensures useAuth, useNavigate, useSearchParams, useQueryClient, useToast
+ * and similar hooks never run without context (no "must be used within XProvider" crashes).
+ */
+import React from 'react';
+import type { Decorator } from '@storybook/react';
+import { cn } from '../src/lib/utils';
+import { ThemeProvider } from '../src/components/theme/ThemeProvider';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import { LazyToaster } from '../src/components/feedback/LazyToaster';
+import { AudioProvider } from '../src/context/AudioContext';
+import { AuthProvider } from '../src/providers/AuthProvider';
+import { I18nextProvider } from 'react-i18next';
+import i18n from '../src/lib/i18n';
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+      staleTime: Infinity,
+      throwOnError: false,
+    },
+  },
+});
+
+export const StorybookDecorator: Decorator = (Story, context) => {
+  const bgValue = context.globals?.backgrounds?.value;
+  const isDark = bgValue !== 'light'; // only 'light' triggers light mode, everything else = dark
+  const initialEntries =
+    (context.parameters?.router as { initialEntries?: string[] } | undefined)?.initialEntries ?? ['/'];
+
+  return (
+    <I18nextProvider i18n={i18n}>
+      <ThemeProvider defaultTheme={isDark ? 'dark' : 'light'}>
+        <div
+          className={cn(
+            isDark ? 'dark' : '',
+            'min-h-layout-story min-h-screen p-4 bg-background text-foreground',
+          )}
+        >
+          <QueryClientProvider client={queryClient}>
+            <LazyToaster position="top-right" />
+            <AudioProvider>
+              <AuthProvider>
+                <MemoryRouter initialEntries={initialEntries}>
+                  <Story />
+                </MemoryRouter>
+              </AuthProvider>
+            </AudioProvider>
+          </QueryClientProvider>
+        </div>
+      </ThemeProvider>
+    </I18nextProvider>
+  );
+};

apps/web/.storybook/main.ts

@@ -0,0 +1,45 @@
+// This file has been automatically migrated to valid ESM format by Storybook.
+import { createRequire } from "node:module";
+import type { StorybookConfig } from '@storybook/react-vite';
+
+import { dirname, join } from "path"
+
+const require = createRequire(import.meta.url);
+
+function getAbsolutePath(value: string) {
+  return dirname(require.resolve(join(value, "package.json")))
+}
+
+const config: StorybookConfig = {
+  "stories": [
+    "../src/**/*.mdx",
+    "../src/**/*.stories.@(js|jsx|mjs|ts|tsx)"
+  ],
+  "addons": [
+    getAbsolutePath('@storybook/addon-a11y'),
+    getAbsolutePath("@storybook/addon-docs"),
+    getAbsolutePath("@storybook/addon-mcp"),
+  ],
+  "staticDirs": ['../public'],
+  "framework": getAbsolutePath('@storybook/react-vite'),
+  "docs": {
+    defaultName: "Documentation"
+  },
+  "typescript": {
+    "reactDocgen": "react-docgen-typescript",
+    "reactDocgenTypescriptOptions": {
+      "shouldExtractLiteralValuesFromEnum": true,
+      "propFilter": (prop) => (prop.parent ? !/node_modules/.test(prop.parent.fileName) : true),
+    },
+  },
+  async viteFinal(config) {
+    return {
+      ...config,
+      server: {
+        ...config.server,
+        allowedHosts: ['veza.fr', 'veza.com', 'veza.talas.fr', 'veza.talas.com'],
+      },
+    };
+  },
+};
+export default config;

apps/web/.storybook/preview.tsx

@@ -0,0 +1,88 @@
+/**
+ * Storybook preview: MSW intercepts all API calls when run via `npm run storybook` / `npm run build-storybook`.
+ * Those scripts set VITE_API_URL=/api/v1 (same-origin) and VITE_STORYBOOK=true (logger does not send to backend).
+ * Do not run Storybook with an absolute API URL or MSW will not intercept.
+ */
+import type { Preview } from '@storybook/react';
+import { initialize, mswLoader } from 'msw-storybook-addon';
+import { handlers } from '../src/mocks/handlers';
+import '../src/index.css';
+import '../src/lib/i18n'; // Initialize i18n
+import { StorybookDecorator } from './decorators';
+
+// Custom viewports for responsive testing
+const customViewports = {
+    mobile: {
+        name: 'Mobile',
+        styles: {
+            width: '375px',
+            height: '667px',
+        },
+    },
+    tablet: {
+        name: 'Tablet',
+        styles: {
+            width: '768px',
+            height: '1024px',
+        },
+    },
+    desktop: {
+        name: 'Desktop',
+        styles: {
+            width: '1440px',
+            height: '900px',
+        },
+    },
+};
+
+// Initialize MSW: strict mode — any unhandled request throws in console and fails the story.
+initialize({
+    onUnhandledRequest: 'error',
+    serviceWorker: {
+        url: './mockServiceWorker.js',
+    },
+});
+
+const preview: Preview = {
+    parameters: {
+        msw: {
+            handlers,
+        },
+        controls: {
+            matchers: {
+                color: /(background|color)$/i,
+                date: /Date$/i,
+            },
+            expanded: true,
+        },
+        a11y: {
+            test: 'error-on-violation',
+        },
+        viewport: {
+            options: customViewports,
+        },
+        backgrounds: {
+            options: {
+                dark: { name: 'dark', value: '#121215' },
+                light: { name: 'light', value: '#faf9f6' },
+                raised: { name: 'raised', value: '#1a1a1f' }
+            }
+        },
+        layout: 'centered',
+        docs: {
+            toc: true, // Enable table of contents in docs
+        },
+    },
+
+    decorators: [StorybookDecorator],
+    tags: ['autodocs'],
+    loaders: [mswLoader],
+
+    initialGlobals: {
+        backgrounds: {
+            value: 'dark'
+        }
+    }
+};
+
+export default preview;

apps/web/.storybook/vitest.setup.ts

@@ -0,0 +1,7 @@
+import * as a11yAddonAnnotations from "@storybook/addon-a11y/preview";
+import { setProjectAnnotations } from '@storybook/react-vite';
+import * as projectAnnotations from './preview';
+
+// This is an important step to apply the right configuration when testing your stories.
+// More info at: https://storybook.js.org/docs/api/portable-stories/portable-stories-vitest#setprojectannotations
+setProjectAnnotations([a11yAddonAnnotations, projectAnnotations]);

apps/web/Dockerfile

@@ -0,0 +1,57 @@
+# Build stage
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Copy package files first for better caching
+COPY package*.json ./
+
+# Install dependencies (this layer will be cached if package*.json don't change)
+RUN npm ci --only=production=false && \
+    npm cache clean --force
+
+# Copy source code
+COPY . .
+
+# Build arguments
+ARG VITE_API_URL
+ARG VITE_WS_URL
+ARG VITE_STREAM_URL
+
+# Build the application with error checking
+RUN npm run build && \
+    # Verify build output exists
+    test -f dist/index.html || { echo "ERROR: dist/index.html not found after build!"; exit 1; } && \
+    ls -lh dist/ && \
+    echo "✅ Build successful - dist/ contains $(find dist -type f | wc -l) files"
+
+# Production stage
+FROM nginx:alpine
+
+# Install dependencies for healthcheck
+RUN apk add --no-cache wget
+
+# Copy custom nginx configuration
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Copy built assets from builder
+COPY --from=builder /app/dist /usr/share/nginx/html
+
+# Add health check script
+RUN echo '#!/bin/sh' > /usr/share/nginx/html/health && \
+    echo 'exit 0' >> /usr/share/nginx/html/health && \
+    chmod +x /usr/share/nginx/html/health
+
+# Create non-root user for security (nginx runs as nginx user by default)
+# Nginx alpine image already runs as non-root user
+
+# Expose port
+EXPOSE 80
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD wget --no-verbose --tries=1 --spider http://localhost/health || exit 1
+
+# Run nginx
+CMD ["nginx", "-g", "daemon off;"]
+

apps/web/Dockerfile.dev

@@ -0,0 +1,20 @@
+# Development Dockerfile for Frontend
+# Uses Vite dev server with hot reload
+
+FROM node:20-alpine
+
+WORKDIR /app
+
+# Install dependencies
+COPY package*.json ./
+RUN npm ci
+
+# Copy source code
+COPY . .
+
+# Expose Vite dev server port (default 5173)
+EXPOSE 5173
+
+# Start Vite dev server
+CMD ["npm", "run", "dev", "--", "--host", "0.0.0.0"]
+

apps/web/Dockerfile.production

@@ -0,0 +1,81 @@
+# Production Dockerfile for Frontend Web App
+# Optimized for smaller size, security, and performance
+
+# Build stage
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Install build dependencies only
+RUN apk add --no-cache libc6-compat
+
+# Copy package files first for better caching
+COPY package*.json ./
+
+# Install dependencies (this layer will be cached if package*.json don't change)
+RUN npm ci --only=production=false && \
+    npm cache clean --force
+
+# Copy source code
+COPY . .
+
+# Build arguments for environment variables
+ARG VITE_API_URL
+ARG VITE_WS_URL
+ARG VITE_STREAM_URL
+ARG VITE_APP_ENV=production
+
+# Set build-time environment variables
+ENV VITE_API_URL=${VITE_API_URL}
+ENV VITE_WS_URL=${VITE_WS_URL}
+ENV VITE_STREAM_URL=${VITE_STREAM_URL}
+ENV VITE_APP_ENV=${VITE_APP_ENV}
+ENV NODE_ENV=production
+
+# Build the application with optimizations
+RUN npm run build && \
+    # Verify build output exists
+    test -f dist/index.html || { echo "ERROR: dist/index.html not found after build!"; exit 1; } && \
+    # Remove source maps in production (optional, for smaller size)
+    find dist -name "*.map" -delete && \
+    # Show build summary
+    echo "✅ Build successful - dist/ contains $(find dist -type f | wc -l) files" && \
+    du -sh dist/
+
+# Production stage - nginx alpine
+FROM nginx:1.27-alpine
+
+# Install minimal dependencies for healthcheck
+RUN apk add --no-cache wget && \
+    rm -rf /var/cache/apk/*
+
+# Remove default nginx config
+RUN rm -rf /etc/nginx/conf.d/default.conf
+
+# Copy custom nginx configuration optimized for production
+COPY nginx.production.conf /etc/nginx/conf.d/default.conf
+
+# Copy built assets from builder
+COPY --from=builder /app/dist /usr/share/nginx/html
+
+# Create health check endpoint
+RUN echo '#!/bin/sh' > /usr/share/nginx/html/health && \
+    echo 'exit 0' >> /usr/share/nginx/html/health && \
+    chmod +x /usr/share/nginx/html/health
+
+# Set proper permissions
+RUN chown -R nginx:nginx /usr/share/nginx/html && \
+    chmod -R 755 /usr/share/nginx/html
+
+# Nginx alpine image already runs as non-root user (nginx)
+
+# Expose port
+EXPOSE 80
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD wget --no-verbose --tries=1 --spider http://localhost/health || exit 1
+
+# Run nginx
+CMD ["nginx", "-g", "daemon off;"]
+

apps/web/README.md

@@ -0,0 +1,198 @@
+# Veza Frontend
+
+React + TypeScript frontend application for the Veza audio collaboration platform.
+
+## Quick Start
+
+### Prerequisites
+
+- Node.js 18+ and npm
+- Backend API running (see `veza-backend-api/README.md`)
+
+### Installation
+
+```bash
+npm install
+```
+
+### Development
+
+```bash
+npm run dev
+```
+
+The application will be available at `http://localhost:5173`.
+
+### Building
+
+```bash
+npm run build
+```
+
+## Setup Steps
+
+### 1. Environment Variables
+
+Copy `.env.example` to `.env` and configure:
+
+```bash
+# API Configuration
+VITE_API_URL=http://localhost:8080/api/v1
+VITE_WS_URL=ws://localhost:8081
+VITE_STREAM_URL=http://localhost:8082
+
+# Optional: Enable MSW mocks for development
+VITE_USE_MSW=0
+```
+
+See `.env.example` for all available environment variables.
+
+### 2. Type Generation
+
+TypeScript types are generated from the OpenAPI specification. To regenerate types:
+
+```bash
+npm run generate:types
+```
+
+This script:
+- Reads `veza-backend-api/openapi.yaml`
+- Generates TypeScript types to `src/types/generated/`
+- Creates barrel exports for easy importing
+
+**Note**: Types are automatically generated in CI/CD before type checking.
+
+### 3. Validation
+
+Validate types and schemas:
+
+```bash
+# Type checking
+npm run validate:types
+
+# Schema validation
+npm run validate:schemas
+
+# Both
+npm run validate:all
+```
+
+## Available Scripts
+
+### Development
+- `npm run dev` - Start development server
+- `npm run dev:lab` - Start with lab environment (real database)
+- `npm run dev:mocks` - Start with MSW mocks enabled
+
+### Building
+- `npm run build` - Build for production
+- `npm run preview` - Preview production build
+
+### Testing
+- `npm test` - Run unit tests (Vitest)
+- `npm run test:ui` - Run tests with UI
+- `npm run test:e2e` - Run E2E tests (Playwright)
+
+### Code Quality
+- `npm run lint` - Run ESLint
+- `npm run lint:fix` - Fix ESLint issues
+- `npm run lint:ui` - Run ESLint on `src/components` and `src/features` only
+- `npm run report:arbitrary` - Report Tailwind arbitrary values (w-[...], gap-[...], etc.) for migration
+- `npm run typecheck` - Type check without emitting files
+- `npm run fmt` - Format code with Prettier
+
+### Type Generation & Validation
+- `npm run generate:types` - Generate TypeScript types from OpenAPI spec
+- `npm run validate:schemas` - Validate Zod schemas
+- `npm run validate:types` - Type check
+- `npm run validate:all` - Run all validations
+
+## Project Structure
+
+```
+apps/web/
+├── src/
+│   ├── components/     # Reusable UI components
+│   ├── features/       # Feature modules (auth, tracks, playlists, etc.)
+│   ├── hooks/          # Custom React hooks
+│   ├── services/       # API clients and services
+│   ├── stores/         # Zustand state management (UI state stores)
+│   │                   # Note: Feature stores (auth, chat) are in features/*/store/
+│   ├── types/          # TypeScript types
+│   │   └── generated/  # Auto-generated types from OpenAPI
+│   ├── utils/          # Utility functions
+│   └── styles/         # Global styles and design tokens
+├── e2e/                # End-to-end tests (Playwright)
+├── scripts/            # Build and utility scripts
+└── public/             # Static assets
+```
+
+## Design System
+
+The application uses the Kodo design system. **Single source of truth** for layout, spacing, shadows, and transitions: `docs/DESIGN_TOKENS.md`. Shell layout: `docs/APP_SHELL.md`.
+
+- **Colors**: Kodo color palette (see `src/styles/COLOR_USAGE.md`)
+- **Components**: Design system components in `src/components/ui/`
+- **Typography**: Type scale and hierarchy (see `docs/DESIGN_TOKENS.md`, `src/styles/TYPOGRAPHY_GUIDE.md`)
+- **Spacing**: Spacing scale (see `docs/SPACING_GUIDE.md`) — no arbitrary values (e.g. `w-[300px]`, `gap-[7px]`) without justification.
+
+**Visual regression**: `npm run visual:capture`, `npm run visual:compare`, `npm run visual:update` (see `visual-tests/README.md`). **Arbitrary values report**: `npm run report:arbitrary` to list Tailwind arbitrary patterns for migration. **New full-layout page**: see `docs/FULL_LAYOUT_PAGE.md`.
+
+## ESLint Rules
+
+The project enforces:
+
+- **Typography**: Use type scale classes (text-xs, text-sm, etc.) instead of arbitrary sizes
+- **Spacing**: Use spacing scale (gap-0 through gap-24) instead of arbitrary values
+- **Colors**: Use Kodo design system colors instead of Tailwind defaults
+- **Components**: Use design system Button component instead of native `<button>`
+
+See `eslint.config.js` for full rule configuration.
+
+## Contributing
+
+1. Follow the existing code style
+2. Run `npm run validate:all` before committing
+3. Ensure all tests pass: `npm test`
+4. Type generation runs automatically in CI/CD
+
+## Documentation
+
+- **Architecture Guide**: `docs/ARCHITECTURE.md` (MUST READ)
+- **Component Usage**: `src/components/COMPONENT_USAGE.md`
+- **Color Usage**: `src/styles/COLOR_USAGE.md`
+- **Typography**: `src/styles/TYPOGRAPHY_GUIDE.md`
+- **Spacing**: `src/styles/SPACING_GUIDE.md`
+
+## Troubleshooting
+
+### Type Generation Fails
+
+Ensure `veza-backend-api/openapi.yaml` exists and is valid:
+
+```bash
+cd ../../veza-backend-api
+swag init  # Generate OpenAPI spec
+```
+
+### Build Errors
+
+1. Clear node_modules and reinstall:
+   ```bash
+   rm -rf node_modules package-lock.json
+   npm install
+   ```
+
+2. Clear Vite cache:
+   ```bash
+   rm -rf node_modules/.vite
+   ```
+
+### Type Errors
+
+Run type generation and validation:
+
+```bash
+npm run generate:types
+npm run validate:types
+```

apps/web/RUNTIME_ISSUES.json

@@ -0,0 +1 @@
+[]

apps/web/all_components.txt

@@ -0,0 +1,371 @@
+src/components/admin/AdminAuditLogsView.tsx
+src/components/admin/AdminDashboardView.tsx
+src/components/admin/AdminModerationView.tsx
+src/components/admin/AdminSettingsView.tsx
+src/components/admin/AdminUsersView.tsx
+src/components/admin/modals/BanUserModal.tsx
+src/components/admin/UserTableRow.tsx
+src/components/AdvancedFilters.tsx
+src/components/analytics/TrackAnalyticsView.tsx
+src/components/auth/ProtectedRoute.tsx
+src/components/base/Badge.tsx
+src/components/base/Button.tsx
+src/components/base/Card.tsx
+src/components/base/Input.tsx
+src/components/BulkModeBanner.tsx
+src/components/charts/BarChart.tsx
+src/components/charts/Chart.tsx
+src/components/charts/LineChart.tsx
+src/components/charts/PieChart.tsx
+src/components/commerce/CartItem.tsx
+src/components/commerce/modals/PromoCodeModal.tsx
+src/components/commerce/modals/RefundRequestModal.tsx
+src/components/commerce/OrderSummary.tsx
+src/components/commerce/WishlistView.tsx
+src/components/dashboard/ActivityGraph.tsx
+src/components/dashboard/StatCard.tsx
+src/components/dashboard/TrackList.tsx
+src/components/data/Grid.tsx
+src/components/data/List.tsx
+src/components/data/Table.tsx
+src/components/data/Timeline.tsx
+src/components/demo/DesignSystemDemo.tsx
+src/components/developer/APIPlaygroundView.tsx
+src/components/developer/DeveloperDashboardView.tsx
+src/components/developer/modals/CreateAPIKeyModal.tsx
+src/components/developer/SwaggerUI.tsx
+src/components/developer/WebhooksView.tsx
+src/components/education/CourseCard.tsx
+src/components/education/CourseDetailView.tsx
+src/components/education/CourseLearningView.tsx
+src/components/education/modals/CertificateModal.tsx
+src/components/education/modals/QuizModal.tsx
+src/components/education/MyCoursesView.tsx
+src/components/ErrorBoundary.tsx
+src/components/feedback/Alert.tsx
+src/components/feedback/LazyToaster.tsx
+src/components/feedback/Progress.tsx
+src/components/feedback/ToastProvider.tsx
+src/components/feedback/Toast.tsx
+src/components/filters/FilterBar.tsx
+src/components/filters/Filters.tsx
+src/components/filters/Sort.tsx
+src/components/forms/FormBuilder.tsx
+src/components/forms/LoginForm.tsx
+src/components/forms/PasswordStrengthIndicator.tsx
+src/components/forms/RegisterForm.tsx
+src/components/gamification/AchievementCard.tsx
+src/components/gamification/AchievementsView.tsx
+src/components/gamification/LeaderboardView.tsx
+src/components/gamification/ProfileXPView.tsx
+src/components/gamification/XPBar.tsx
+src/components/inventory/AddEquipmentView.tsx
+src/components/inventory/EquipmentCard.tsx
+src/components/inventory/EquipmentDetailView.tsx
+src/components/inventory/InventoryView.tsx
+src/components/keyboard/KeyboardShortcutsHelp.tsx
+src/components/layout/AudioPlayer.tsx
+src/components/layout/DashboardLayout.tsx
+src/components/layout/Header.tsx
+src/components/layout/Layout.tsx
+src/components/layout/Navbar.tsx
+src/components/layout/Sidebar.tsx
+src/components/library/AutoMetadataDetectionModal.tsx
+src/components/library/playlists/AddToPlaylistModal.tsx
+src/components/library/playlists/CreatePlaylistModal.tsx
+src/components/library/playlists/EditPlaylistModal.tsx
+src/components/library/playlists/PlaylistDetailView.tsx
+src/components/library/playlists/PlaylistsView.tsx
+src/components/library/playlists/QueueView.tsx
+src/components/library/playlists/SaveQueueAsPlaylistModal.tsx
+src/components/library/WatermarkSettingsModal.tsx
+src/components/live/LiveStreamDetailView.tsx
+src/components/live/modals/TipStreamerModal.tsx
+src/components/marketplace/LicenceCard.tsx
+src/components/marketplace/modals/LicenceDetailsModal.tsx
+src/components/marketplace/modals/ReviewProductModal.tsx
+src/components/marketplace/ProductCard.tsx
+src/components/marketplace/ProductDetailView.tsx
+src/components/modals/CreatorModal.tsx
+src/components/monitoring/MonitoringDashboard.tsx
+src/components/navigation/Breadcrumbs.tsx
+src/components/navigation/Pagination.tsx
+src/components/navigation/Tabs.tsx
+src/components/notifications/NotificationBell.tsx
+src/components/notifications/NotificationItem.tsx
+src/components/notifications/NotificationMenu.tsx
+src/components/OfflineIndicator.tsx
+src/components/OfflineQueueManager.tsx
+src/components/Onboarding.tsx
+src/components/player/AudioPlayer.tsx
+src/components/player/FullPlayer.tsx
+src/components/player/LyricsPanel.tsx
+src/components/player/MiniPlayer.tsx
+src/components/player/PlaybackSpeedModal.tsx
+src/components/player/PlayerControls.tsx
+src/components/player/QueuePanel.tsx
+src/components/player/VisualizerSettingsModal.tsx
+src/components/pwa/PWAInstallBanner.tsx
+src/components/RateLimitIndicator.tsx
+src/components/search/GlobalSearchBar.tsx
+src/components/search/SearchBar.tsx
+src/components/search/Search.tsx
+src/components/seller/CreateProductView.tsx
+src/components/seller/modals/FlashSaleModal.tsx
+src/components/seller/SellerDashboardView.tsx
+src/components/settings/accessibility/AccessibilitySettingsView.tsx
+src/components/settings/account/AccountSettings.tsx
+src/components/settings/account/ChangeEmailModal.tsx
+src/components/settings/account/ChangeUsernameModal.tsx
+src/components/settings/account/DeleteAccountConfirmModal.tsx
+src/components/settings/account/DeleteAccountView.tsx
+src/components/settings/appearance/AppearanceSettingsView.tsx
+src/components/settings/backups/BackupsView.tsx
+src/components/settings/cloud/CloudIntegrationView.tsx
+src/components/settings/data/DataExportModal.tsx
+src/components/settings/data/DataExportView.tsx
+src/components/settings/integrations/IntegrationsView.tsx
+src/components/settings/profile/EditProfile.tsx
+src/components/settings/security/LoginHistory.tsx
+src/components/settings/security/PasskeyModal.tsx
+src/components/settings/security/SecuritySettings.tsx
+src/components/settings/security/SessionManagement.tsx
+src/components/settings/security/TwoFactorSetup.tsx
+src/components/share/ShareLinkManager.tsx
+src/components/social/CommentItem.tsx
+src/components/social/connections/ConnectionsView.tsx
+src/components/social/CreatePostModal.tsx
+src/components/social/ExploreView.tsx
+src/components/social/FeedView.tsx
+src/components/social/groups/CreateGroupModal.tsx
+src/components/social/groups/GroupCard.tsx
+src/components/social/groups/GroupDetailView.tsx
+src/components/social/groups/GroupsView.tsx
+src/components/social/PostCard.tsx
+src/components/social/SharePostModal.tsx
+src/components/studio/AIToolsView.tsx
+src/components/studio/CloudFileBrowser.tsx
+src/components/studio/CloudSettingsView.tsx
+src/components/studio/ConnectivityView.tsx
+src/components/studio/GoLiveView.tsx
+src/components/studio/projects/CreateProjectModal.tsx
+src/components/studio/ProjectsManager.tsx
+src/components/studio/projects/ProjectDetailView.tsx
+src/components/theme/ThemeProvider.tsx
+src/components/theme/ThemeSwitcher.tsx
+src/components/ui/accordion.tsx
+src/components/ui/alert.tsx
+src/components/ui/AstralBackground.tsx
+src/components/ui/avatar.tsx
+src/components/ui/avatar-upload.tsx
+src/components/ui/badge.tsx
+src/components/ui/button-loading.tsx
+src/components/ui/button.tsx
+src/components/ui/card.tsx
+src/components/ui/checkbox.tsx
+src/components/ui/collapsible.tsx
+src/components/ui/confirmation-dialog.tsx
+src/components/ui/DataList.tsx
+src/components/ui/date-picker.tsx
+src/components/ui/dialog.tsx
+src/components/ui/dropdown-menu.tsx
+src/components/ui/dropdown.tsx
+src/components/ui/empty-state.tsx
+src/components/ui/ErrorDisplay.tsx
+src/components/ui/FAB.tsx
+src/components/ui/file-upload.tsx
+src/components/ui/floating-input.tsx
+src/components/ui/focus-trap.tsx
+src/components/ui/FormField.tsx
+src/components/ui/HelpText.tsx
+src/components/ui/ImageCropper.tsx
+src/components/ui/ImageViewerModal.tsx
+src/components/ui/input.tsx
+src/components/ui/label.tsx
+src/components/ui/LazyComponent.tsx
+src/components/ui/loading-spinner.tsx
+src/components/ui/LoadingState.tsx
+src/components/ui/modal.tsx
+src/components/ui/optimized-image.tsx
+src/components/ui/progress.tsx
+src/components/ui/radio-group.tsx
+src/components/ui/scroll-area.tsx
+src/components/ui/select.tsx
+src/components/ui/Sidebar.tsx
+src/components/ui/skeleton.tsx
+src/components/ui/slider.tsx
+src/components/ui/Spinner.tsx
+src/components/ui/switch.tsx
+src/components/ui/table.tsx
+src/components/ui/tabs.tsx
+src/components/ui/textarea.tsx
+src/components/ui/Toast.tsx
+src/components/ui/tooltip.tsx
+src/components/ui/virtualized-list.tsx
+src/components/ui/WaveformVisualizer.tsx
+src/components/upload/BulkUploadModal.tsx
+src/components/upload/FilePreviewCard.tsx
+src/components/upload/FileUploadZone.tsx
+src/components/upload/metadata/CoverArtUploadModal.tsx
+src/components/upload/metadata/LyricsEditorModal.tsx
+src/components/upload/metadata/MetadataEditor.tsx
+src/components/upload/metadata/MetadataForm.tsx
+src/components/upload/metadata/TagSuggestionsModal.tsx
+src/components/upload/UploadProgressBar.tsx
+src/components/user/UserCard.tsx
+src/components/views/AdminView.tsx
+src/components/views/AnalyticsView.tsx
+src/components/views/AuthView.tsx
+src/components/views/CartView.tsx
+src/components/views/ChatView.tsx
+src/components/views/CheckoutView.tsx
+src/components/views/DiscoverView.tsx
+src/components/views/EducationView.tsx
+src/components/views/FileDetailsView.tsx
+src/components/views/FileManagerView.tsx
+src/components/views/GearView.tsx
+src/components/views/LiveView.tsx
+src/components/views/MarketplaceView.tsx
+src/components/views/NotificationsView.tsx
+src/components/views/ProfileView.tsx
+src/components/views/PurchasesView.tsx
+src/components/views/SettingsView.tsx
+src/components/views/SocialView.tsx
+src/components/views/StudioView.tsx
+src/components/views/UploadView.tsx
+src/features/auth/components/AuthButton.tsx
+src/features/auth/components/AuthErrorMessage.tsx
+src/features/auth/components/AuthFormField.tsx
+src/features/auth/components/AuthInput.tsx
+src/features/auth/components/AuthLayout.tsx
+src/features/auth/components/EmailVerificationBadge.tsx
+src/features/auth/components/ForgotPasswordForm.tsx
+src/features/auth/components/LoginForm.tsx
+src/features/auth/components/OAuthButtons.tsx
+src/features/auth/components/OAuthButton.tsx
+src/features/auth/components/PasswordStrengthIndicator.tsx
+src/features/auth/components/RegisterForm.tsx
+src/features/auth/components/TwoFactorVerify.tsx
+src/features/auth/components/UserProfile.tsx
+src/features/auth/pages/ForgotPasswordPage.tsx
+src/features/auth/pages/LoginPage.tsx
+src/features/auth/pages/OAuthCallbackPage.tsx
+src/features/auth/pages/RegisterPage.tsx
+src/features/auth/pages/ResetPasswordPage.tsx
+src/features/auth/pages/SessionsPage.tsx
+src/features/auth/pages/VerifyEmailPage.tsx
+src/features/auth/routes.tsx
+src/features/chat/components/ChatInput.tsx
+src/features/chat/components/ChatInterface.tsx
+src/features/chat/components/ChatMessages.tsx
+src/features/chat/components/ChatMessage.tsx
+src/features/chat/components/ChatRoom.tsx
+src/features/chat/components/ChatSidebar.tsx
+src/features/chat/components/CreateRoomDialog.tsx
+src/features/chat/components/MessageSearch.tsx
+src/features/chat/components/TypingIndicator.tsx
+src/features/chat/components/VirtualizedChatMessages.tsx
+src/features/chat/pages/ChatPage.tsx
+src/features/dashboard/pages/DashboardPage.tsx
+src/features/error/pages/NotFoundPage.tsx
+src/features/error/pages/ServerErrorPage.tsx
+src/features/library/components/LibraryManager.tsx
+src/features/library/components/UploadModal.tsx
+src/features/library/pages/LibraryPage.tsx
+src/features/marketplace/components/Cart.tsx
+src/features/marketplace/components/ProductCard.tsx
+src/features/notifications/pages/NotificationsPage.tsx
+src/features/player/components/AudioPlayer.tsx
+src/features/player/components/GlobalPlayer.tsx
+src/features/player/components/MiniPlayer.tsx
+src/features/player/components/NextPreviousButtons.tsx
+src/features/player/components/PlaybackSpeedControl.tsx
+src/features/player/components/PlayerControls.tsx
+src/features/player/components/PlayerError.tsx
+src/features/player/components/PlayerExpanded.tsx
+src/features/player/components/PlayerLoading.tsx
+src/features/player/components/PlayerQueue.tsx
+src/features/player/components/PlayPauseButton.tsx
+src/features/player/components/ProgressBar.tsx
+src/features/player/components/QualitySelector.tsx
+src/features/player/components/RepeatShuffleButtons.tsx
+src/features/player/components/TimeDisplay.tsx
+src/features/player/components/TrackInfo.tsx
+src/features/player/components/VolumeControl.tsx
+src/features/playlists/components/AddCollaboratorModal.tsx
+src/features/playlists/components/AddTrackToPlaylistModal.tsx
+src/features/playlists/components/CollaboratorList.tsx
+src/features/playlists/components/CollaboratorManagement.tsx
+src/features/playlists/components/CreatePlaylistDialog.tsx
+src/features/playlists/components/DuplicatePlaylistButton.tsx
+src/features/playlists/components/ExportPlaylistButton.tsx
+src/features/playlists/components/ImportPlaylistButton.tsx
+src/features/playlists/components/PlaylistActions.tsx
+src/features/playlists/components/PlaylistAnalytics.tsx
+src/features/playlists/components/PlaylistBatchActions.tsx
+src/features/playlists/components/PlaylistCardSkeleton.tsx
+src/features/playlists/components/PlaylistCard.tsx
+src/features/playlists/components/PlaylistErrorBoundary.tsx
+src/features/playlists/components/PlaylistFollowButton.tsx
+src/features/playlists/components/PlaylistForm.tsx
+src/features/playlists/components/PlaylistHeaderSkeleton.tsx
+src/features/playlists/components/PlaylistHeader.tsx
+src/features/playlists/components/PlaylistListSkeleton.tsx
+src/features/playlists/components/PlaylistList.test.responsive.tsx
+src/features/playlists/components/PlaylistList.tsx
+src/features/playlists/components/PlaylistRecommendations.tsx
+src/features/playlists/components/PlaylistSearch.tsx
+src/features/playlists/components/PlaylistTrackItem.tsx
+src/features/playlists/components/PlaylistTrackListSkeleton.tsx
+src/features/playlists/components/PlaylistTrackList.tsx
+src/features/playlists/components/RemoveTrackButton.tsx
+src/features/playlists/components/SharePlaylistModal.tsx
+src/features/playlists/pages/PlaylistDetailPage.tsx
+src/features/playlists/pages/PlaylistListPage.tsx
+src/features/playlists/routes.tsx
+src/features/profile/components/FollowButton.tsx
+src/features/profile/pages/UserProfilePage.tsx
+src/features/roles/components/AssignRoleModal.tsx
+src/features/roles/components/CreateRoleModal.tsx
+src/features/roles/components/EditRoleModal.tsx
+src/features/roles/pages/RolesPage.tsx
+src/features/search/pages/SearchPage.tsx
+src/features/settings/components/AccountSettings.tsx
+src/features/settings/components/ContentSettings.tsx
+src/features/settings/components/NotificationSettings.tsx
+src/features/settings/components/PlaybackSettings.tsx
+src/features/settings/components/PreferenceSettings.tsx
+src/features/settings/components/PrivacySettings.tsx
+src/features/settings/components/SettingsTabs.tsx
+src/features/settings/components/TwoFactorSettings.tsx
+src/features/settings/pages/SettingsPage.tsx
+src/features/streaming/components/BitrateSelector.tsx
+src/features/streaming/components/PlaybackDashboard.tsx
+src/features/streaming/components/PlaybackHeatmap.tsx
+src/features/streaming/components/PlaybackSummary.tsx
+src/features/tracks/components/CommentSection.tsx
+src/features/tracks/components/CommentThread.tsx
+src/features/tracks/components/LikeButton.tsx
+src/features/tracks/components/ShareDialog.tsx
+src/features/tracks/components/TrackCard.tsx
+src/features/tracks/components/TrackFilters.tsx
+src/features/tracks/components/TrackGridDensitySelector.tsx
+src/features/tracks/components/TrackGrid.tsx
+src/features/tracks/components/TrackHistory.tsx
+src/features/tracks/components/TrackListContainer.tsx
+src/features/tracks/components/TrackListEmpty.tsx
+src/features/tracks/components/TrackListPagination.tsx
+src/features/tracks/components/TrackListRow.tsx
+src/features/tracks/components/TrackListSelectionActions.tsx
+src/features/tracks/components/TrackListSkeleton.tsx
+src/features/tracks/components/TrackList.tsx
+src/features/tracks/components/TrackSearchFilters.tsx
+src/features/tracks/components/TrackSearchResults.tsx
+src/features/tracks/components/TrackSearch.tsx
+src/features/tracks/components/TrackSort.tsx
+src/features/tracks/components/TrackStatsDisplay.tsx
+src/features/tracks/components/UploadQuota.tsx
+src/features/tracks/components/ViewToggle.tsx
+src/features/tracks/pages/TrackDetailPage.tsx
+src/features/upload/components/UploadModal.tsx
+src/features/user/components/ProfileForm.tsx

apps/web/analyze_lint.py

@@ -0,0 +1,37 @@
+
+import json
+
+try:
+    with open('lint_report_v2.json', 'r') as f:
+        content = f.read()
+        json_start = content.find('[')
+        if json_start != -1:
+            report = json.loads(content[json_start:])
+        else:
+            print("Could not find JSON start")
+            exit(1)
+
+    errors = []
+    for file_result in report:
+        for msg in file_result.get('messages', []):
+            if msg.get('severity') == 2:
+                errors.append(f"{file_result['filePath']}:{msg['line']} - {msg['ruleId']} - {msg['message']}")
+
+    print(f"Found {len(errors)} errors:")
+    for err in errors[:50]:  # Print first 50 errors
+        print(err)
+
+    # Group by ruleId
+    rule_counts = {}
+    for file_result in report:
+        for msg in file_result.get('messages', []):
+            if msg.get('severity') == 2:
+                rule_id = msg.get('ruleId', 'unknown')
+                rule_counts[rule_id] = rule_counts.get(rule_id, 0) + 1
+    
+    print("\nError counts by rule:")
+    for rule, count in rule_counts.items():
+        print(f"{rule}: {count}")
+
+except Exception as e:
+    print(f"Error parsing report: {e}")

apps/web/covered_components.txt

@@ -0,0 +1,107 @@
+src/components/dashboard/ActivityGraph.tsx
+src/components/dashboard/StatCard.tsx
+src/components/dashboard/TrackList.tsx
+src/components/education/CourseCard.tsx
+src/components/education/modals/CertificateModal.tsx
+src/components/education/modals/QuizModal.tsx
+src/components/education/MyCoursesView.tsx
+src/components/feedback/Alert.tsx
+src/components/feedback/Toast.tsx
+src/components/inventory/EquipmentCard.tsx
+src/components/inventory/InventoryView.tsx
+src/components/layout/DashboardLayout.tsx
+src/components/layout/Header.tsx
+src/components/layout/Sidebar.tsx
+src/components/live/LiveStreamDetailView.tsx
+src/components/live/modals/TipStreamerModal.tsx
+src/components/modals/CreatorModal.tsx
+src/components/notifications/NotificationBell.tsx
+src/components/notifications/NotificationItem.tsx
+src/components/notifications/NotificationMenu.tsx
+src/components/search/SearchBar.tsx
+src/components/search/Search.tsx
+src/components/seller/modals/FlashSaleModal.tsx
+src/components/seller/SellerDashboardView.tsx
+src/components/social/CommentItem.tsx
+src/components/social/PostCard.tsx
+src/components/theme/ThemeSwitcher.tsx
+src/components/ui/Accordion.tsx
+src/components/ui/Alert.tsx
+src/components/ui/AstralBackground.tsx
+src/components/ui/Avatar.tsx
+src/components/ui/AvatarUpload.tsx
+src/components/ui/Badge.tsx
+src/components/ui/Button.tsx
+src/components/ui/Card.tsx
+src/components/ui/Checkbox.tsx
+src/components/ui/Collapsible.tsx
+src/components/ui/ConfirmationDialog.tsx
+src/components/ui/DataList.tsx
+src/components/ui/DatePicker.tsx
+src/components/ui/Dialog.tsx
+src/components/ui/DropdownMenu.tsx
+src/components/ui/ErrorDisplay.tsx
+src/components/ui/FAB.tsx
+src/components/ui/FileUpload.tsx
+src/components/ui/FloatingInput.tsx
+src/components/ui/FocusTrap.tsx
+src/components/ui/FormField.tsx
+src/components/ui/HelpText.tsx
+src/components/ui/ImageCropper.tsx
+src/components/ui/ImageViewerModal.tsx
+src/components/ui/Input.tsx
+src/components/ui/Label.tsx
+src/components/ui/LoadingSpinner.tsx
+src/components/ui/LoadingState.tsx
+src/components/ui/Modal.tsx
+src/components/ui/OptimizedImage.tsx
+src/components/ui/Progress.tsx
+src/components/ui/RadioGroup.tsx
+src/components/ui/ScrollArea.tsx
+src/components/ui/Select.tsx
+src/components/ui/Sidebar.tsx
+src/components/ui/Skeleton.tsx
+src/components/ui/Slider.tsx
+src/components/ui/Spinner.tsx
+src/components/ui/Switch.tsx
+src/components/ui/Table.tsx
+src/components/ui/Tabs.tsx
+src/components/ui/Textarea.tsx
+src/components/ui/Toast.tsx
+src/components/ui/Tooltip.tsx
+src/components/ui/VirtualizedList.tsx
+src/components/ui/WaveformVisualizer.tsx
+src/features/auth/components/AuthButton.tsx
+src/features/auth/components/AuthInput.tsx
+src/features/auth/components/LoginForm.tsx
+src/features/auth/components/OAuthButtons.tsx
+src/features/auth/components/PasswordStrengthIndicator.tsx
+src/features/auth/components/RegisterForm.tsx
+src/features/chat/components/ChatInput.tsx
+src/features/chat/components/ChatMessage.tsx
+src/features/chat/components/TypingIndicator.tsx
+src/features/library/components/UploadModal.tsx
+src/features/player/components/NextPreviousButtons.tsx
+src/features/player/components/PlayPauseButton.tsx
+src/features/player/components/ProgressBar.tsx
+src/features/player/components/QualitySelector.tsx
+src/features/player/components/RepeatShuffleButtons.tsx
+src/features/player/components/TimeDisplay.tsx
+src/features/player/components/VolumeControl.tsx
+src/features/playlists/components/AddTrackToPlaylistModal.tsx
+src/features/playlists/components/PlaylistCard.tsx
+src/features/playlists/components/PlaylistHeader.tsx
+src/features/profile/components/FollowButton.tsx
+src/features/settings/components/AccountSettings.tsx
+src/features/settings/components/NotificationSettings.tsx
+src/features/settings/components/TwoFactorSettings.tsx
+src/features/tracks/components/LikeButton.tsx
+src/features/tracks/components/TrackCard.tsx
+src/features/tracks/components/TrackFilters.tsx
+src/features/tracks/components/TrackGrid.tsx
+src/features/tracks/components/TrackListEmpty.tsx
+src/features/tracks/components/TrackListRow.tsx
+src/features/tracks/components/TrackListSkeleton.tsx
+src/features/tracks/components/TrackSort.tsx
+src/features/tracks/components/TrackStatsDisplay.tsx
+src/features/tracks/components/ViewToggle.tsx

apps/web/dev_audit/frontend/00_frontend_overview.md

@@ -0,0 +1,229 @@
+# Phase 0 — Frontend Overview
+
+**Date** : 2026-02-12
+**Auditeur** : Audit automatisé exhaustif
+**Scope** : `apps/web/src/` exclusivement
+
+---
+
+## Statistiques brutes
+
+### Répartition des fichiers
+
+| Type | Nombre |
+|------|--------|
+| `.tsx` | 1 450 |
+| `.ts` | 621 |
+| `.css` | 5 |
+| `.scss` | 0 |
+| `.module.css` | 0 |
+| `.svg` | 5 |
+| **Total fichiers** | **2 081** |
+| **LOC total** | **~218 500** |
+
+### Fichiers > 300 lignes (source uniquement, hors tests)
+
+| Fichier | Lignes | Nature |
+|---------|--------|--------|
+| `src/types/generated/api.ts` | 7 123 | Types auto-générés OpenAPI |
+| `src/services/api/client.ts` | 2 237 | Client HTTP centralisé |
+| `src/mocks/handlers.ts` | 1 716 | MSW mock handlers |
+| `src/features/tracks/api/trackApi.ts` | 848 | API tracks |
+| `src/utils/optimisticUpdates.ts` | 682 | Logique optimistic updates |
+| `src/features/streaming/services/playbackAnalyticsService.ts` | 656 | Analytics streaming |
+| `src/features/playlists/hooks/usePlaylist.ts` | 631 | Hook playlist principal |
+| `src/utils/apiErrorHandler.ts` | 578 | Gestion erreurs API |
+| `src/features/streaming/hooks/usePlaybackRealtime.ts` | 496 | Hook streaming temps réel |
+| `src/services/api/auth.ts` | 493 | Service auth API |
+| `src/schemas/apiRequestSchemas.ts` | 476 | Schémas Zod requêtes |
+| `src/schemas/apiSchemas.ts` | 468 | Schémas Zod réponses |
+| `src/features/tracks/services/trackService.ts` | 453 | Service tracks |
+| `src/features/playlists/services/playlistService.ts` | 448 | Service playlists |
+| `src/utils/sanitize.ts` | 429 | Sanitization XSS |
+
+**Observations** :
+- 15 fichiers source > 400 lignes (hors tests/generated). Les plus critiques sont `client.ts` (2237L) et `trackApi.ts` (848L).
+- Les fichiers de tests sont nombreux à dépasser 400L (ex: `TrackUpload.test.tsx` 783L, `playlistService.test.ts` 780L), signe de tests relativement exhaustifs.
+- Le fichier `api.ts` généré (7123L) est attendu pour des types OpenAPI.
+
+---
+
+## Stack détectée
+
+| Couche | Technologie | Version |
+|--------|-------------|---------|
+| **Framework** | React | 18.2.x |
+| **Bundler** | Vite | 7.1.x |
+| **Langage** | TypeScript | 5.3.x (strict mode complet) |
+| **CSS** | Tailwind CSS | v4.0 (CSS-first config) |
+| **Design System** | SUMI v2.0 | Custom, CSS variables |
+| **State global** | Zustand | 4.5.x |
+| **Server state** | TanStack React Query | 5.17.x |
+| **Routing** | React Router DOM | 6.22.x |
+| **Formulaires** | React Hook Form + Zod | 7.49.x / 3.25.x |
+| **Animation** | Framer Motion | 12.29.x |
+| **HTTP** | Axios | 1.13.x |
+| **i18n** | i18next + react-i18next | 25.5.x / 15.7.x |
+| **Monitoring** | Sentry | 10.32.x |
+| **Icônes** | Lucide React | 0.321.x |
+| **Tests unitaires** | Vitest | 3.2.x |
+| **Tests E2E** | Playwright | 1.58.x |
+| **Storybook** | Storybook | 8.6.x |
+| **Mocking** | MSW | 2.11.x |
+| **Linting** | ESLint 9 (flat config) + Prettier | 9.x / 3.2.x |
+| **Accessibility** | eslint-plugin-jsx-a11y | 6.10.x |
+| **Virtualisation** | TanStack Virtual | 3.13.x |
+| **DnD** | @dnd-kit | 6.3.x |
+| **Toast** | react-hot-toast | 2.6.x |
+
+---
+
+## Dépendances notables
+
+### Production (critiques)
+- `dompurify` 3.3.x — sanitization HTML (bon signe sécurité)
+- `hls.js` 1.6.x — streaming HLS
+- `immer` 10.x — immutabilité state
+- `zod` 3.25.x — validation schemas
+- `emoji-picker-react` 4.16.x — feature chat
+- `swagger-ui-react` 5.31.x — documentation API embarquée
+
+### Dev (notables)
+- `@storybook/addon-a11y` — audit accessibilité intégré
+- `pa11y-ci` — CI accessibility testing
+- `backstopjs` — visual regression testing
+- `pixelmatch` / `pngjs` — visual diff
+- `storybook-dark-mode` — dark mode Storybook
+- `tw-animate-css` — animations Tailwind
+
+---
+
+## Arborescence commentée (2 niveaux)
+
+```
+src/
+├── app/                    # Point d'entrée App, shell principal
+├── components/             # Composants partagés (UI, layout, domain)
+│   ├── admin/              # Vues administration
+│   ├── analytics/          # Composants analytics
+│   ├── auth/               # Composants auth (ProtectedRoute)
+│   ├── charts/             # Composants graphiques
+│   ├── commerce/           # Cart, wishlist
+│   ├── dashboard/          # Dashboard widgets
+│   ├── developer/          # Swagger UI, API keys
+│   ├── education/          # Cours, learning
+│   ├── feedback/           # Toast, progress
+│   ├── filters/            # Filtres, tri
+│   ├── forms/              # Form primitives
+│   ├── gamification/       # XP, achievements
+│   ├── inventory/          # Inventaire
+│   ├── keyboard/           # Raccourcis clavier
+│   ├── layout/             # DashboardLayout, Sidebar, Header, Navbar
+│   ├── library/            # Playlists, watermark
+│   ├── live/               # Live streaming
+│   ├── marketplace/        # Marketplace cards
+│   ├── modals/             # Modales partagées
+│   ├── monitoring/         # Monitoring dashboard
+│   ├── navigation/         # Breadcrumbs
+│   ├── notifications/      # Notification bell/menu
+│   ├── player/             # Audio player UI
+│   ├── pwa/                # PWA composants
+│   ├── search/             # Search bar, results
+│   ├── seller/             # Seller dashboard
+│   ├── settings/           # Settings views
+│   ├── share/              # Sharing
+│   ├── social/             # Social feed, groups
+│   ├── studio/             # Studio projects
+│   ├── theme/              # Theme provider, switcher
+│   ├── ui/                 # ⭐ Primitives UI (button, input, dialog, etc.)
+│   ├── upload/             # Upload components
+│   ├── user/               # User profile components
+│   └── views/              # Feature views (analytics, cart, chat, etc.)
+├── config/                 # Configuration (env, features flags)
+├── context/                # React Context (AuthContext)
+├── features/               # ⭐ Feature modules (domain-driven)
+│   ├── admin/              # Admin feature
+│   ├── analytics/          # Analytics feature
+│   ├── auth/               # Auth (login, register, 2FA, OAuth)
+│   ├── chat/               # Chat feature
+│   ├── dashboard/          # Dashboard feature
+│   ├── error/              # Error pages
+│   ├── inventory/          # Inventory feature
+│   ├── library/            # Library feature
+│   ├── marketplace/        # Marketplace feature
+│   ├── notifications/      # Notifications feature
+│   ├── player/             # ⭐ Player (store, hooks, services, components)
+│   ├── playlists/          # Playlists feature (CRUD, collab, analytics)
+│   ├── profile/            # Profile feature
+│   ├── roles/              # Role management
+│   ├── search/             # Search feature
+│   ├── sessions/           # Sessions management
+│   ├── settings/           # Settings feature
+│   ├── stream/             # Stream feature
+│   ├── streaming/          # Streaming (HLS, playback analytics)
+│   ├── studio/             # Studio feature
+│   ├── tracks/             # ⭐ Tracks (upload, comments, share, search)
+│   ├── upload/             # Upload feature
+│   ├── user/               # User feature
+│   └── webhooks/           # Webhooks feature
+├── hooks/                  # Hooks partagés (useAuth, useDebounce, etc.)
+├── lib/                    # Librairies init (i18n, sentry)
+├── locales/                # Fichiers de traduction i18n
+├── mocks/                  # MSW handlers
+├── pages/                  # Pages (auth, marketplace) — legacy?
+├── providers/              # AuthProvider
+├── router/                 # Routing (AppRouter, config, guards)
+├── schemas/                # Schémas Zod (request/response validation)
+├── services/               # Services API (REST, WebSocket, storage)
+├── stores/                 # Zustand stores (cart, library, UI, rateLimit)
+├── stories/                # Storybook decorators
+├── styles/                 # (si fichiers CSS additionnels)
+├── test/                   # Test utilities, setup
+├── __tests__/              # Tests globaux (accessibility, contrast)
+├── types/                  # Types globaux et générés
+└── utils/                  # Utilitaires (sanitize, logger, toast, etc.)
+```
+
+---
+
+## Patterns critiques détectés
+
+| Pattern | Occurrences | Risque |
+|---------|-------------|--------|
+| `dangerouslySetInnerHTML` | 2 fichiers | 🟠 Moyen (chat) |
+| `localStorage/sessionStorage` | ~45 fichiers | 🟡 Faible (encapsulé via `safeStorage.ts`, `tokenStorage.ts`) |
+| `eval()` / `new Function()` | 0 | ✅ |
+| `console.log/debug/info` | ~27 fichiers | 🟡 Faible (principalement dev/stories) |
+| `: any` | ~80+ fichiers | 🟠 Moyen |
+| `as any` | ~100+ fichiers (dont 145 dans `generated/api.ts`) | 🟠 Moyen |
+| `@ts-ignore` / `@ts-expect-error` | 7 fichiers | 🟢 Faible |
+| `style={{}}` inline | ~80 fichiers | 🟠 Moyen |
+| `TODO/FIXME/HACK` | ~20 occurrences | 🟡 Normal |
+
+---
+
+## Variables d'environnement client (VITE_*)
+
+Déclarées dans `src/vite-env.d.ts` [vite-env.d.ts:4-21] :
+- `VITE_API_URL`, `VITE_WS_URL`, `VITE_STREAM_URL`, `VITE_UPLOAD_URL` — endpoints API
+- `VITE_APP_NAME` — nom de l'application
+- `VITE_DEBUG`, `VITE_USE_MSW`, `VITE_STORYBOOK` — flags dev
+- `VITE_FCM_VAPID_KEY` — push notifications
+- Feature flags : `VITE_FEATURE_TWO_FACTOR_AUTH`, `VITE_FEATURE_PLAYLIST_*`, `VITE_FEATURE_HLS_STREAMING`, `VITE_FEATURE_ROLE_MANAGEMENT`, `VITE_FEATURE_NOTIFICATIONS`
+
+Fichiers `.env` présents :
+- `.env.example` (2.2KB) — template
+- `.env.local` (450B) — config locale
+- `.env.production` (1.8KB) — config prod
+- `.env.storybook` (262B) — config Storybook
+- **Attention** : `.env.local` et `.env.production` sont versionnés (visibles). `.gitignore` ne semble pas exclure les fichiers `.env.*`.
+
+---
+
+## Première impression architecturale
+
+1. **Architecture mature et ambitieuse** : Le projet adopte une organisation feature-based (`features/`) combinée à des composants partagés (`components/ui/`, `components/layout/`), des services centralisés et un design system custom (SUMI v2.0). C'est un projet SaaS complet avec ~2000 fichiers et ~218K LOC — une codebase significative.
+
+2. **Stack moderne mais complexe** : Tailwind v4 CSS-first, React 18, TanStack Query v5, Zustand, Zod, i18next, Sentry, MSW, Storybook 8.6, Playwright — l'outillage est complet mais la complexité d'intégration est élevée. Le `main.tsx` (273L) avec son `waitForStylesheets` et son preloading toast révèle des workarounds de stabilité.
+
+3. **Dualité préoccupante** : Il existe une coexistence entre `components/views/` (analytics-view, cart-view, etc.) et `features/*/pages/` qui suggère une migration architecturale en cours ou incomplète. De même, `pages/auth/` coexiste avec `features/auth/pages/`, et `context/AuthContext.tsx` avec `providers/AuthProvider.tsx`. Cette dualité est un signal de dette structurelle.

apps/web/dev_audit/frontend/01_architecture_analysis.md

@@ -0,0 +1,227 @@
+# Phase A — Architecture Frontend Analysis
+
+**Score Architecture : 7/10**
+
+---
+
+## A1. Structure des dossiers
+
+### Organisation réelle
+
+```
+src/
+├── app/          → Shell applicatif (App.tsx)
+├── components/   → Composants partagés (30+ sous-dossiers)
+├── config/       → Configuration (env, features flags)
+├── context/      → React Context (AuthContext, AudioContext)
+├── features/     → Modules feature-based (24 features)
+├── hooks/        → Hooks partagés (~30 hooks)
+├── lib/          → Init librairies (i18n, sentry)
+├── locales/      → Traductions i18n
+├── mocks/        → MSW handlers
+├── pages/        → Pages legacy (auth, marketplace)
+├── providers/    → AuthProvider
+├── router/       → Routing centralisé
+├── schemas/      → Schémas Zod
+├── services/     → Services API (~35 services)
+├── stores/       → Zustand stores partagés
+├── stories/      → Storybook decorators
+├── test/         → Test setup
+├── types/        → Types globaux et générés
+└── utils/        → Utilitaires (~25 fichiers)
+```
+
+### Séparation `features/` vs `components/`
+
+**Positif** : La codebase utilise un pattern feature-based dans `features/` avec des modules autonomes contenant chacun `api/`, `components/`, `hooks/`, `services/`, `store/`, `pages/`. [features/auth/store/authStore.ts], [features/playlists/hooks/usePlaylist.ts], [features/tracks/api/trackApi.ts]
+
+**Problème majeur** : **Dualité non résolue** entre :
+- `components/views/` (analytics-view, cart-view, chat-view, discover-view, etc. — ~20 vues) et `features/*/pages/` — deux patterns coexistent pour le même rôle [components/views/analytics-view/], [features/dashboard/pages/]
+- `pages/auth/` (Login.tsx, Register.tsx) et `features/auth/pages/` (LoginPage.tsx, RegisterPage.tsx) — **duplication directe** [pages/auth/Login.tsx vs features/auth/pages/LoginPage.tsx]
+- `context/AuthContext.tsx` et `features/auth/store/authStore.ts` — **deux sources de vérité pour l'auth** [context/AuthContext.tsx:54, features/auth/store/authStore.ts:55]
+- `providers/AuthProvider.tsx` et `context/AuthContext.tsx` — coexistence redondante
+
+### Barrel exports (`index.ts`)
+
+**Présents et cohérents** dans les feature views refactorées :
+- `components/views/analytics-view/index.ts` ✅
+- `components/views/cart-view/index.ts` ✅
+- `components/views/settings-view/index.ts` ✅
+- `features/*/index.ts` — **absents** dans la plupart des features ❌
+
+### Routes colocalisées
+
+Les routes sont centralisées dans `router/routeConfig.tsx` [routeConfig.tsx:57-109], pas colocalisées avec les features. C'est un choix acceptable pour un projet de cette taille, mais limite la découvrabilité.
+
+### Dossiers morts ou orphelins
+
+- `pages/auth/` — **probablement orphelin** : contient Login.tsx et Register.tsx mais les routes pointent vers `features/auth/pages/` via LazyComponent [routeConfig.tsx:59-63]
+- `components/views/*.tsx` (fichiers plats type `AnalyticsView.tsx`, `CartView.tsx`) — semblent être des **wrappers legacy** vers les sous-dossiers refactorés
+- `stories/` — contient uniquement `decorators.tsx`, pourrait être dans `.storybook/`
+
+**Verdict structure** : Organisation feature-based ambitieuse mais migration incomplète. La dualité `components/views/` vs `features/*/pages/` et les vestiges legacy (`pages/`, `context/AuthContext.tsx`) créent de la confusion. **-2 points.**
+
+---
+
+## A2. Séparation des responsabilités
+
+### Composants > 100 lignes (source, hors tests)
+
+| Composant | Lignes | Type | Responsabilités mélangées ? | Verdict |
+|-----------|--------|------|----------------------------|---------|
+| `services/api/client.ts` | 2 237 | Service | API client + validation + caching + retry + dedup + metrics | ❌ Monolithe |
+| `features/tracks/api/trackApi.ts` | 848 | Service | CRUD tracks + upload + share + analytics | ⚠️ Large mais cohérent |
+| `utils/optimisticUpdates.ts` | 682 | Utilitaire | Optimistic updates multi-feature | ⚠️ Acceptable |
+| `features/streaming/services/playbackAnalyticsService.ts` | 656 | Service | Analytics streaming | ⚠️ Complexité justifiée |
+| `features/playlists/hooks/usePlaylist.ts` | 631 | Hook smart | CRUD + collaboration + analytics | ❌ Trop de responsabilités |
+| `utils/apiErrorHandler.ts` | 578 | Utilitaire | Error parsing + categorization | ⚠️ Acceptable |
+| `features/streaming/hooks/usePlaybackRealtime.ts` | 496 | Hook smart | WebSocket + state + analytics | ⚠️ Justifié par temps réel |
+| `services/api/auth.ts` | 493 | Service | Auth API complète | ⚠️ Cohérent |
+| `schemas/apiRequestSchemas.ts` | 476 | Types | Schémas Zod | ✅ Naturellement grand |
+| `schemas/apiSchemas.ts` | 468 | Types | Schémas Zod | ✅ Naturellement grand |
+| `features/tracks/services/trackService.ts` | 453 | Service | Service tracks | ⚠️ Cohérent |
+| `features/playlists/services/playlistService.ts` | 448 | Service | Service playlists | ⚠️ Cohérent |
+| `utils/sanitize.ts` | 429 | Utilitaire | Sanitization XSS | ✅ Sécurité critique |
+
+**Point critique** : `client.ts` (2237L) est un **God Object**. Il cumule : instance Axios, interceptors, validation Zod, caching, request deduplication, metrics tracking, offline queue, rate limiting, CSRF. Il devrait être éclaté en 4-5 modules. [services/api/client.ts:1-80]
+
+**Positif** : La séparation services/hooks/components est généralement respectée dans les features refactorées (auth, playlists, tracks, streaming).
+
+---
+
+## A3. Gestion d'état
+
+### Couches identifiées
+
+**1. Zustand Stores (7 stores)** :
+
+| Store | Fichier | Contenu | Persisté | Sync tabs |
+|-------|---------|---------|----------|-----------|
+| `authStore` | `features/auth/store/authStore.ts` | isAuthenticated, isLoading, error | ✅ localStorage | ✅ broadcastSync |
+| `uiStore` | `stores/ui.ts` | theme, language, sidebarOpen, notifications | ✅ localStorage | ✅ broadcastSync |
+| `cartStore` | `stores/cartStore.ts` | items, actions CRUD | ✅ localStorage | ❌ |
+| `playerStore` | `features/player/store/playerStore.ts` | Playback state | Probable | À vérifier |
+| `chatStore` | `features/chat/store/chatStore.ts` | Chat state | À vérifier | À vérifier |
+| `libraryStore` | `stores/library.ts` | Library state | À vérifier | À vérifier |
+| `rateLimitStore` | `stores/rateLimit.ts` | Rate limit tracking | ❌ | ❌ |
+
+**2. React Query (TanStack Query v5)** — Server state principal :
+- Utilisé dans ~30+ fichiers [features/playlists/hooks/usePlaylist.ts, features/tracks/components/LikeButton.tsx, etc.]
+- `useQuery` pour lectures, `useMutation` pour écritures
+- Optimistic updates via `utils/optimisticUpdates.ts` [utils/optimisticUpdates.ts]
+- Cache sync cross-tabs via `utils/reactQuerySync.ts` [app/App.tsx:47-54]
+- QueryClient config : `staleTime: 1min`, `gcTime: 5min`, `retry: false` [main.tsx:43-55]
+
+**3. React Context (4 contextes)** :
+- `AuthContext` [context/AuthContext.tsx] — **CONFLIT** avec `authStore` : deux sources de vérité pour l'auth
+- `AudioContext` [context/audio-context/AudioContext.tsx] — contexte audio player
+- `ThemeProvider` [components/theme/ThemeProvider.tsx] — thème (mais aussi géré par uiStore)
+- `ToastProvider` [components/feedback/ToastProvider.tsx] — gestion toasts
+
+**4. State local (useState)** — usage standard dans les composants
+
+### Diagnostique
+
+**Conflit critique** : `AuthContext` [context/AuthContext.tsx:54] utilise `authService` directement avec `useState` pour `user`, tandis que `authStore` [features/auth/store/authStore.ts:55] utilise Zustand avec `loginService` et gère `isAuthenticated` sans `user` (délégué à React Query). **L'App.tsx utilise `authStore`** [app/App.tsx:4], mais `AuthContext` existe toujours et pourrait être importé par erreur. → **Source de bugs potentiels.**
+
+**Duplication thème** : Le thème est géré par `uiStore` [stores/ui.ts:35-51] ET `ThemeProvider` [components/theme/ThemeProvider.tsx]. L'App.tsx applique le thème via `uiStore` [app/App.tsx:80-94].
+
+**Prop drilling** : Minimisé grâce à Zustand + React Query. Pas de chaîne > 3 niveaux identifiée dans le code audité.
+
+---
+
+## A4. Gestion des requêtes réseau
+
+### Architecture réseau
+
+Le projet utilise un **client Axios centralisé** dans `services/api/client.ts` [services/api/client.ts:1-80] qui fournit :
+- Interceptors pour JWT (Authorization header) [client.ts:9]
+- Refresh token automatique [client.ts:10]
+- Validation Zod des requêtes et réponses [client.ts:24-25]
+- Request deduplication [client.ts:21]
+- Response caching [client.ts:22]
+- Offline queue [client.ts:20]
+- Rate limiting tracking [client.ts:27]
+- CSRF protection [client.ts:14]
+- Validation metrics [client.ts:33-41]
+
+### Patterns observés
+
+| Fichier | Méthode | Loading | Error | Cancel | Typé | Centralisé |
+|---------|---------|---------|-------|--------|------|------------|
+| `features/tracks/api/trackApi.ts` | Axios client | Via React Query | Via React Query | Via React Query | ✅ Zod | ✅ |
+| `services/api/auth.ts` | Axios client | Manual/Store | ✅ parseApiError | ❌ | ✅ Zod | ✅ |
+| `features/playlists/services/playlistService.ts` | Axios client | Via hooks | ✅ | ❌ | ✅ | ✅ |
+| `services/websocket.ts` | WebSocket natif | ❌ | ✅ reconnect | N/A | ⚠️ `any` (8x) | ✅ |
+| `context/AuthContext.tsx` | authService direct | ✅ useState | ✅ toast | ❌ | ❌ `any` (4x) | ⚠️ Parallèle |
+
+**Positif** : Architecture réseau très mature avec dedup, caching, offline queue, validation Zod end-to-end, CSRF. C'est au-dessus de la moyenne.
+
+**Négatif** : Le client.ts est un monolithe de 2237L qui concentre trop de responsabilités. L'AbortController n'est pas systématiquement utilisé pour annuler les requêtes au démontage.
+
+---
+
+## A5. Routing
+
+- **Solution** : React Router DOM v6.22 [package.json]
+- **Routes protégées** : `ProtectedRoute` component wrapper [routeConfig.tsx:47-55] + `ProtectedLayoutRoute` pour le layout dashboard
+- **Lazy loading** : ✅ Toutes les routes sont lazy via `LazyComponent` [routeConfig.tsx:5-33] — pattern `React.lazy` centralisé
+- **404** : ✅ `LazyNotFound` route + catch-all `*` → `/404` [AppRouter.tsx:30-31]
+- **500** : ✅ `LazyServerError` route [routeConfig.tsx:107]
+- **Deep linking** : ✅ Routes paramétrées (`/tracks/:id`, `/u/:username`, `/playlists/*`) [routeConfig.tsx:87-88]
+- **ComingSoon** : Routes planifiées mais non implémentées utilisent un placeholder `ComingSoon` [routeConfig.tsx:96-101] — propre
+- **v7 migration** : Flags de préparation activés `v7_startTransition`, `v7_relativeSplatPath` [main.tsx:221-222]
+
+**Verdict routing** : Solide, bien structuré, lazy loading systématique. **+1 point.**
+
+---
+
+## A6. Gestion des erreurs
+
+### Error Boundaries
+
+- **Root level** : `ErrorBoundary` wrapping `App` [app/App.tsx:171]
+- **Route level** : Chaque route wrappée dans `ErrorBoundary` [routeConfig.tsx:40-55]
+- **Composant** : `ErrorBoundary` class component avec UI de fallback, retry et go-home [components/ui/ErrorBoundary.tsx:16-77]
+- **Fallback configurable** : ✅ via prop `fallback` [ErrorBoundary.tsx:13]
+
+### Erreurs réseau
+
+- `parseApiError` centralisé [utils/apiErrorHandler.ts] — 578L, parsing exhaustif des erreurs Axios
+- `formatUserFriendlyError` [utils/errorMessages.ts] — messages user-friendly
+- Toast pour feedback utilisateur [utils/toast.ts]
+- Rate limit indicator [components/RateLimitIndicator.tsx]
+- Offline indicator [components/OfflineIndicator.tsx]
+
+### Logging
+
+- Sentry intégré [lib/sentry.ts, main.tsx:28,41]
+- Logger structuré custom [utils/logger.ts] avec niveaux et contexte
+
+### Fallback UI
+
+- Error states avec `ErrorDisplay` component [components/ui/ErrorDisplay.tsx]
+- Loading states avec spinners et skeletons (chaque view a un Skeleton)
+- Empty states gérés dans les features refactorées
+
+**Verdict erreurs** : Gestion des erreurs très complète — error boundaries, parsing centralisé, Sentry, toasts, offline detection. **+1 point.**
+
+---
+
+## Score Architecture détaillé
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| Structure feature-based | +2 | Organisation claire en features avec séparation concerns |
+| Migration incomplète | -2 | Dualité components/views vs features/pages, fichiers legacy |
+| State management | +1.5 | Zustand + React Query bien intégré, sync cross-tabs |
+| Conflit AuthContext vs authStore | -1 | Deux sources de vérité pour l'auth |
+| Client API centralisé | +1.5 | Validation Zod, dedup, caching, offline queue |
+| client.ts monolithe | -0.5 | 2237L, trop de responsabilités |
+| Routing | +1.5 | Lazy loading systématique, 404/500, guards |
+| Error handling | +1.5 | ErrorBoundary, Sentry, toast, offline indicator |
+| Barrel exports partiels | -0.5 | Incohérents entre features et components |
+| TypeScript strict | +1 | Mode strict complet avec noUncheckedIndexedAccess |
+| **Total** | **7/10** | **Solide, mais dette structurelle de migration** |
+
+**Résumé** : L'architecture est ambitieuse et globalement solide, avec des patterns modernes (feature-based, server state séparé, validation Zod). Le principal problème est la migration incomplète qui laisse coexister deux patterns architecturaux (`components/views/` vs `features/pages/`, `AuthContext` vs `authStore`). Le client HTTP centralisé est puissant mais devenu un monolithe à découper.

apps/web/dev_audit/frontend/02_design_system_inventory.md

@@ -0,0 +1,263 @@
+# Phase B — Design System Inventory
+
+**Score Design System : 7.5/10**
+
+---
+
+## B1. Stratégie CSS
+
+### Stratégie dominante : Tailwind CSS v4 + Custom Design System (SUMI v2.0)
+
+| Approche | Fichiers utilisant | Rôle |
+|----------|-------------------|------|
+| Tailwind CSS v4 (CSS-first) | ~1400+ tsx files | Stratégie principale, utility-first |
+| CSS Variables (SUMI tokens) | 1 fichier central (`index.css`, 859L) | Single source of truth |
+| `class-variance-authority` (CVA) | `button.tsx` et quelques composants | Variants structurées |
+| Inline styles (`style={{}}`) | 87 occurrences / 69 fichiers | Dynamic values (progress, position) |
+| CSS vanilla | 5 fichiers `.css` | Base styles, animations |
+
+**Verdict CSS** : Stratégie cohérente. Tailwind v4 CSS-first est bien configuré avec un système de tokens custom SUMI qui mappe vers des semantic tokens Tailwind via `@theme inline`. Pas de CSS Modules, pas de styled-components, pas de SCSS. L'approche est unifiée. Les inline styles sont justifiés (valeurs dynamiques runtime). **Pas de mélange incohérent.**
+
+---
+
+## B2. Tokens de design — Extraction exhaustive
+
+### Couleurs
+
+Le design system SUMI v2.0 définit un système de couleurs complet dans `index.css` [index.css:15-296] :
+
+**Palette Dark (par défaut)** :
+
+| Token | Valeur Hex | Usage | Défini token ? |
+|-------|-----------|-------|----------------|
+| `--sumi-bg-void` | `#0c0c0f` | Background le plus profond | ✅ |
+| `--sumi-bg-base` | `#121215` | Background principal | ✅ |
+| `--sumi-bg-raised` | `#1a1a1f` | Surfaces élevées | ✅ |
+| `--sumi-bg-overlay` | `#222228` | Overlays, dropdowns | ✅ |
+| `--sumi-bg-hover` | `#2a2a31` | Hover states | ✅ |
+| `--sumi-bg-active` | `#32323a` | Active states | ✅ |
+| `--sumi-bg-wash` | `#18181d` | Wash/subtle bg | ✅ |
+| `--sumi-text-primary` | `#f0ede8` | Texte principal (crème chaud) | ✅ |
+| `--sumi-text-secondary` | `#a8a4a0` | Texte secondaire | ✅ |
+| `--sumi-text-tertiary` | `#706c68` | Texte tertiaire | ✅ |
+| `--sumi-text-disabled` | `#4a4844` | Texte désactivé | ✅ |
+| `--sumi-accent` | `#7c9dd6` | Accent principal (bleu-acier) | ✅ |
+| `--sumi-vermillion` | `#d4634a` | Destructive/error | ✅ |
+| `--sumi-sage` | `#7a9e6c` | Success/positif | ✅ |
+| `--sumi-gold` | `#c9a84c` | Warning/attention | ✅ |
+| `--sumi-live` | `#e05a5a` | Live indicator | ✅ |
+
+**Palette Light** [index.css:301-364] : Complète avec les mêmes tokens adaptés au light mode.
+
+**Couleurs contextuelles (feature-specific)** [index.css:202-205] :
+- `--graffiti-magenta: #c840a0`
+- `--gaming-gold: #d4b040`
+- `--terminal-green: #3eaa5e`
+- `--sakura: #e0a0b8`
+
+**Semantic mapping (shadcn/Radix)** [index.css:207-251] :
+Les tokens SUMI sont mappés vers les conventions shadcn (`--primary`, `--secondary`, `--destructive`, `--muted`, etc.) ce qui permet d'utiliser les classes Tailwind standards (`bg-primary`, `text-muted-foreground`).
+
+**Couleurs hardcodées dans le code** :
+- `bg-[#...]` / `text-[#...]` dans className : **0 occurrence** ✅ Excellent
+- Hex dans CSS vars uniquement dans `index.css` — aucune couleur orpheline
+
+**Verdict couleurs** : Système de couleurs exemplaire. Tokenisé, thémé (dark/light), sémantique, zéro hardcoded. **9/10 sur ce critère.**
+
+---
+
+### Typographie
+
+**Polices** [index.css:78-81] :
+- Body : `Inter` (Google Font) — excellent choix lisibilité
+- Headings : `Space Grotesk` — caractère distinctif
+- Mono : `JetBrains Mono` — technique/code
+- Serif : `Noto Serif JP` — accent japonais (cohérent avec l'identité SUMI)
+
+**Échelle typographique** [index.css:83-91] :
+
+| Token | Valeur | Usage |
+|-------|--------|-------|
+| `--sumi-text-4xl` | 2.25rem (36px) | Display |
+| `--sumi-text-3xl` | 1.875rem (30px) | H1 |
+| `--sumi-text-2xl` | 1.5rem (24px) | H2 |
+| `--sumi-text-xl` | 1.25rem (20px) | H3 |
+| `--sumi-text-lg` | 1.125rem (18px) | H4 |
+| `--sumi-text-md` | 1rem (16px) | Body large |
+| `--sumi-text-base` | 0.875rem (14px) | Body default |
+| `--sumi-text-sm` | 0.8125rem (13px) | Small text |
+| `--sumi-text-xs` | 0.75rem (12px) | Caption |
+
+**Line-heights** [index.css:93-98] : 6 niveaux (none→loose), bien définis.
+**Tracking** [index.css:100-105] : 6 niveaux, de tighter à widest.
+**Weights** [index.css:107-111] : 5 niveaux (light→bold).
+
+**Utility classes typographiques** [index.css:632-653] :
+- Classes sémantiques Tailwind : `.text-display`, `.text-heading-1` à `.text-heading-4`, `.text-body`, `.text-caption`, `.text-label`
+- Classes SUMI natives : `.sumi-display`, `.sumi-h1` à `.sumi-h4`, `.sumi-body`, `.sumi-caption`, `.sumi-label`, `.sumi-mono`
+
+**Heading hierarchy** dans `@layer base` [index.css:506-516] :
+```css
+h1 { @apply text-4xl md:text-5xl; }
+h2 { @apply text-3xl md:text-4xl; }
+/* etc. */
+```
+
+**Verdict typographie** : Complet et bien structuré. Double système (Tailwind + SUMI natif) est un peu redondant mais les deux sont cohérents. **8/10.**
+
+---
+
+### Spacing
+
+**Échelle de spacing** [index.css:113-127] :
+
+| Token | Valeur | Scale |
+|-------|--------|-------|
+| `--sumi-space-0-5` | 2px | ✅ |
+| `--sumi-space-1` | 4px | ✅ |
+| `--sumi-space-1-5` | 6px | ✅ |
+| `--sumi-space-2` | 8px | ✅ |
+| `--sumi-space-3` | 12px | ✅ |
+| `--sumi-space-4` | 16px | ✅ |
+| `--sumi-space-5` | 20px | ✅ |
+| `--sumi-space-6` | 24px | ✅ |
+| `--sumi-space-8` | 32px | ✅ |
+| `--sumi-space-10` | 40px | ✅ |
+| `--sumi-space-12` | 48px | ✅ |
+| `--sumi-space-16` | 64px | ✅ |
+| `--sumi-space-20` | 80px | ✅ |
+
+Suit une base 4px cohérente. Les valeurs `p-[`, `m-[`, `gap-[` arbitraires sont quasi-absentes (3+4+0 occurrences).
+
+---
+
+### Radius
+
+[index.css:129-136] :
+
+| Token | Valeur |
+|-------|--------|
+| `--sumi-radius-xs` | 2px |
+| `--sumi-radius-sm` | 4px |
+| `--sumi-radius-md` | 6px |
+| `--sumi-radius-lg` | 12px |
+| `--sumi-radius-xl` | 16px |
+| `--sumi-radius-2xl` | 20px |
+| `--sumi-radius-full` | 9999px |
+
+`rounded-[` arbitraire : **0 occurrences** ✅
+
+---
+
+### Shadows
+
+[index.css:138-146] : 7 niveaux + glow effect. Cohérent dark/light.
+
+### Z-index
+
+[index.css:179-189] : Cartographie ordonnée :
+
+| Token | Valeur | Usage |
+|-------|--------|-------|
+| `--sumi-z-base` | 0 | Éléments standard |
+| `--sumi-z-raised` | 10 | Éléments surélevés |
+| `--sumi-z-dropdown` | 100 | Dropdowns |
+| `--sumi-z-sticky` | 200 | Éléments sticky |
+| `--sumi-z-overlay` | 300 | Overlays |
+| `--sumi-z-modal` | 400 | Modales |
+| `--sumi-z-popover` | 500 | Popovers |
+| `--sumi-z-toast` | 600 | Toasts |
+| `--sumi-z-tooltip` | 700 | Tooltips |
+| `--sumi-z-max` | 999 | Maximum |
+
+**Problème** : 31 fichiers utilisent `z-[N]` arbitraire au lieu des tokens : `z-[60]`, `z-[200]`, `z-[300]`, `z-[400]`, `z-[500]`, `z-[9999]`. Cela contredit le système de tokens. [components/layout/Sidebar.tsx, components/layout/Header.tsx, features/player/components/PlayerExpanded.tsx, etc.] **-1 point.**
+
+---
+
+### Motion/Animations
+
+[index.css:158-177] : Système de transitions complet avec durées et easing tokenisés.
+[index.css:655-671] : 15+ animations utility classes (fade-in, slide-up, scale-in, pop, shake, marquee, etc.)
+[index.css:730-845] : Keyframes bien documentés.
+[index.css:850-858] : `prefers-reduced-motion` respecté ✅
+
+---
+
+## B3. Composants UI réutilisables
+
+| Composant | Fichier source | Props | Variantes | Réutilisé (fichiers) | Duplicatas ? |
+|-----------|---------------|-------|-----------|----------------------|-------------|
+| **Button** | `ui/button.tsx` | 8 (variant, size, asChild, icon, loading, etc.) | 7 variants × 4 sizes | **228** | Non |
+| **Input** | `ui/input.tsx` | 6 (icon, label, error, etc.) | SearchInput, FileUpload | **94** | Non |
+| **Card** | `ui/card.tsx` | Standard | Header, Content, Footer | **211** | Non |
+| **Skeleton** | `ui/skeleton.tsx` | Minimal | Pulse animation | **83** | Non |
+| **Toast** | `feedback/Toast.tsx` | Type (success/error/etc.) | react-hot-toast | **54** | Non |
+| **Label** | `ui/label.tsx` | Standard HTML | - | **32** | Non |
+| **Badge** | `ui/badge.tsx` | Variant | Multiple variants | **30** | Non |
+| **Dialog** | `ui/dialog/` | Compound pattern | Header, Body, Footer, Trigger | **29** | ⚠️ `modal.tsx` aussi |
+| **Avatar** | `ui/avatar.tsx` | Image, fallback | Sizes | **24** | Non |
+| **Modal** | `ui/modal.tsx` | Simple modal | - | **23** | ⚠️ Avec Dialog |
+| **Tooltip** | `ui/tooltip.tsx` | Content, side | - | **22** | Non |
+| **Select** | `ui/select/` | Compound pattern | Trigger, Content, Item | **17** | Non |
+| **Checkbox** | `ui/checkbox.tsx` | Standard | - | **17** | Non |
+| **Tabs** | `ui/tabs/` | Compound pattern | List, Trigger, Content | **12** | Non |
+| **DropdownMenu** | `ui/dropdown-menu/` | Compound pattern | Item, Checkbox, Radio | **7** | Non |
+| **Switch** | `ui/switch.tsx` | Standard | - | **6** | Non |
+
+**Composants spécialisés notables** :
+- `ErrorBoundary` (class component)
+- `ErrorDisplay` (error UI)
+- `ComingSoon` (placeholder pour features futures)
+- `AstralBackground` (effet de fond animé)
+- `WaveformVisualizer` (visualisation audio)
+- `VirtualizedList` (liste virtualisée)
+- `FileUpload` (upload drag & drop)
+- `DatePicker` (sélecteur de date)
+- `ImageCropper` (crop d'image)
+- `ConfirmationDialog` (dialog de confirmation)
+- `HoverCard` (card au survol)
+- `Accordion` (accordéon)
+- `ScrollArea` (zone scrollable custom)
+- `DataList` (liste de données avec empty/loading/error)
+- `ContentTransition` (transition de contenu)
+- `FocusTrap` (piège de focus pour modales)
+- `KeyboardShortcutsPanel` (panneau raccourcis)
+
+### Duplication identifiée
+
+- `ui/modal.tsx` vs `ui/dialog/` — Deux composants pour le même rôle. `Dialog` est le pattern Radix/shadcn, `Modal` semble être un wrapper plus simple. Potentielle confusion pour les développeurs.
+- `ui/dropdown-menu.tsx` (fichier plat) vs `ui/dropdown-menu/` (dossier refactoré) — coexistence legacy
+
+---
+
+## B4. Composants dupliqués
+
+**Patterns de boutons** : Le composant `Button` est bien centralisé (228 usages). L'ESLint rule `no-restricted-syntax` interdit les `<button>` natifs [eslint.config.js:rule]. Quelques `<button>` natifs persistent dans les tests et stories mais pas dans le code de production.
+
+**Patterns CSS dupliqués** : Les combinaisons Tailwind les plus fréquentes utilisent les tokens sémantiques (`bg-background`, `text-foreground`, `text-muted-foreground`, `border-border`). Pas de duplication CSS critique.
+
+---
+
+## Verdict Design System
+
+- [x] Design system explicite et documenté — **SUMI v2.0** avec référence DESIGN_SYSTEM_REFERENCE.md (1959L)
+- [x] Tokens complets (couleurs, typo, spacing, radius, shadows, z-index, motion)
+- [x] Dark/Light theme avec CSS variables
+- [x] Composants UI primitives centralisés dans `ui/`
+- [ ] ⚠️ Z-index arbitraires dans 31 fichiers (contredit les tokens)
+- [ ] ⚠️ Coexistence Dialog/Modal non résolue
+- [ ] ⚠️ Arbitrary `w-[` (38 occ.), `h-[` (24 occ.), `shadow-[` (10 occ.)
+
+**Score Design System : 7.5/10**
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| Tokens couleurs | +2 | Exemplaire, 0 hardcoded, dark/light complet |
+| Tokens typo | +1.5 | Complet, double système (Tailwind + SUMI) |
+| Tokens spacing/radius | +1.5 | Échelle 4px, quasi 0 arbitraire |
+| Composants primitives | +1.5 | 16+ composants, bien réutilisés |
+| Animations/motion | +1 | Tokenisé, reduced-motion respecté |
+| Z-index chaos | -0.5 | 31 fichiers avec `z-[N]` au lieu des tokens |
+| Dialog/Modal dualité | -0.25 | Confusion possible |
+| Arbitrary w/h values | -0.25 | 62 occurrences à migrer |
+| **Total** | **7.5/10** | **Design system mature avec quelques fuites** |

apps/web/dev_audit/frontend/03_component_map.md

@@ -0,0 +1,200 @@
+# Phase C — Cartographie des Composants
+
+---
+
+## Vue d'ensemble
+
+| Zone | Fichiers .tsx (source) | Rôle |
+|------|----------------------|------|
+| `components/ui/` | ~120 | Primitives UI (design system) |
+| `components/layout/` | 8 | Shell applicatif |
+| `components/views/` | ~138 | Feature views (architecture legacy) |
+| `components/{domain}/` | ~337 | Composants domaine (30 sous-dossiers) |
+| `features/*/` | ~350+ | Feature modules (architecture cible) |
+| **Total estimé** | **~950+** composants source | |
+
+---
+
+## 1. Primitives UI (`components/ui/`)
+
+### Composants > 200 lignes (complexes)
+
+| Composant | Lignes | Type | Observations |
+|-----------|--------|------|-------------|
+| `context-menu/ContextMenu.tsx` | 358 | Compound | Keyboard nav + ARIA complet |
+| `table.tsx` | 305 | Compound | Table sémantique complète |
+| `avatar.tsx` | 305 | Smart | Image fallback + sizes + status |
+| `empty-state.tsx` | 237 | Dumb | Variantes multiples avec illustrations |
+| `ImageViewerModal.tsx` | 230 | Smart | Zoom, navigation, gestures |
+| `radio-group.tsx` | 228 | Compound | Accessible, keyboard nav |
+| `badge.tsx` | 222 | Dumb | 7+ variantes CVA |
+| `FormField.tsx` | 217 | Smart | Form integration + validation |
+| `Sidebar.tsx` | 217 | Smart | Duplicate de layout/Sidebar ? |
+| `dropdown.tsx` | 215 | Smart | Dropdown legacy |
+| `LoadingState.tsx` | 214 | Dumb | Spinner, skeleton, message |
+| `ImageCropper.tsx` | 211 | Smart | Canvas-based cropping |
+| `progress.tsx` | 208 | Dumb | Linear + circular variants |
+| `collapsible.tsx` | 198 | Smart | Animated expand/collapse |
+| `alert.tsx` | 185 | Dumb | Info/warning/error/success |
+| `card.tsx` | 180 | Compound | Header, Content, Footer, variants |
+| `slider.tsx` | 170 | Smart | Range input, dual thumb |
+| `WaveformVisualizer.tsx` | 165 | Smart | Canvas audio waveform |
+| `confirmation-dialog.tsx` | 165 | Smart | Async confirm/cancel |
+| `hover-card/HoverCard.tsx` | 268 | Smart | Positionnement auto |
+| `ErrorDisplay.tsx` | 246 | Dumb | Variantes error/empty/loading |
+| `select/SelectDropdownContent.tsx` | 156 | Smart | Virtualised dropdown |
+| `KeyboardShortcutsPanel.tsx` | 151 | Dumb | Panel raccourcis |
+| `modal.tsx` | 150 | Smart | Focus trap + overlay |
+| `OptimizedImage.tsx` | 145 | Smart | Lazy load + blur placeholder |
+
+### Composants légers (< 50 lignes)
+
+- `AnimatedNumber.tsx` (16L), `ComingSoon.tsx` (14L), `ContentFadeIn.tsx` (33L), `ScrollToTop.tsx` (38L), `LazyComponent.tsx` (39L), `tooltip.tsx` (2L — re-export), `tabs.tsx` (7L — re-export)
+
+### Compound Components (pattern Radix)
+
+| Groupe | Fichiers | Pattern |
+|--------|----------|---------|
+| `dialog/` | 9 fichiers | Dialog, Content, Header, Body, Footer, Title, Description, Trigger, Skeleton |
+| `dropdown-menu/` | 11 fichiers | Menu, Content, Item, Checkbox, Radio, Label, Separator, Shortcut, Trigger |
+| `tabs/` | 5 fichiers | Tabs, List, Trigger, Content |
+| `select/` | 5 fichiers | Select, Trigger, DropdownContent, OptionItem |
+| `accordion/` | 4 fichiers | Accordion, Item, Trigger, Content |
+| `date-picker/` | 4 fichiers | DatePicker, Calendar, Trigger |
+| `hover-card/` | 4 fichiers | HoverCard, TrackHoverContent, UserHoverContent |
+| `file-upload/` | 6 fichiers | FileUpload, Dropzone, FileList, ErrorList |
+| `avatar-upload/` | 5 fichiers | AvatarUpload, Dropzone, Actions, Skeleton |
+| `virtualized-list/` | 3 fichiers | VirtualizedList + hooks |
+| `data-list/` | 5 fichiers | DataList, Empty, Error, Skeleton |
+| `lazy-component/` | 4 fichiers | createLazyComponent, ErrorBoundary, ErrorFallback |
+| `optimized-image/` | 4 fichiers | OptimizedImage, BlurPlaceholder, Skeleton, Responsive |
+
+---
+
+## 2. Layout (`components/layout/`)
+
+| Composant | Lignes | Type | Rôle |
+|-----------|--------|------|------|
+| `Sidebar.tsx` | 294 | Smart | Navigation principale, collapse, mobile |
+| `AudioPlayer.tsx` | 264 | Smart | Player bar persistent |
+| `Navbar.tsx` | 263 | Smart | Barre de navigation top |
+| `Header.tsx` | 172 | Smart | Header applicatif |
+| `DashboardLayout.tsx` | 61 | Smart | Layout wrapper (sidebar + main) |
+| `Layout.tsx` | 57 | Dumb | Layout générique |
+| `MobileBottomNav.tsx` | 50 | Dumb | Navigation mobile |
+| `PageTransition.tsx` | 26 | Dumb | Transition entre pages |
+
+**Observation** : `Sidebar.tsx` dans layout/ (294L) et `Sidebar.tsx` dans ui/ (217L) — **duplication probable**. L'un est le layout sidebar, l'autre semble être un composant UI sidebar générique.
+
+---
+
+## 3. Features (architecture cible)
+
+### Features les plus volumineuses
+
+| Feature | Composants | Fichier principal | Lignes max |
+|---------|-----------|-------------------|------------|
+| `tracks` | ~40+ | TrackListRow.tsx | 320L |
+| `playlists` | ~25+ | PlaylistListPage.tsx | 238L |
+| `auth` | ~35+ | LoginPage.tsx | 225L |
+| `chat` | ~15+ | ChatInput.tsx | 261L |
+| `player` | ~20+ | PlayerExpanded.tsx | 241L |
+| `streaming` | ~10+ | PlaybackSummary.tsx | 206L |
+| `profile` | ~8+ | UserProfilePageTabs.tsx | 226L |
+| `search` | ~8+ | SearchPageResults.tsx | 218L |
+| `dashboard` | ~5+ | DashboardPage.tsx | 328L |
+| `roles` | ~3+ | RolesPage.tsx | 275L |
+| `library` | ~6+ | LibraryPageGrid.tsx | 102L |
+| `studio` | ~10+ | FileToolbar.tsx | 242L |
+| `settings` | ~5+ | SettingsPage.tsx | 183L |
+| `marketplace` | ~5+ | Cart.tsx | 224L |
+| `notifications` | ~5+ | NotificationsPage.tsx | 157L |
+
+### Composants > 250 lignes dans features (attention)
+
+| Composant | Lignes | Risque |
+|-----------|--------|--------|
+| `features/dashboard/pages/DashboardPage.tsx` | 328 | ⚠️ Dépasse limite 300L |
+| `features/tracks/components/TrackListRow.tsx` | 320 | ⚠️ Dépasse limite 300L |
+| `features/tracks/components/TrackList.tsx` | 290 | OK mais proche |
+| `features/roles/pages/RolesPage.tsx` | 275 | Proche limite |
+| `features/chat/components/ChatInput.tsx` | 261 | Proche limite |
+| `features/tracks/components/TrackSearchResults.tsx` | 258 | Proche limite |
+
+---
+
+## 4. Composants domaine (`components/{domain}/`)
+
+### Répartition par domaine
+
+| Domaine | Composants (.tsx) | Observations |
+|---------|------------------|-------------|
+| `views/` | 138 | ⚠️ Plus gros dossier — views refactorés en sous-dossiers |
+| `studio/` | 49 | Studio projects, file browser |
+| `settings/` | 38 | Settings views (6 onglets) |
+| `education/` | 18 | Cours, learning — feature "ComingSoon" |
+| `social/` | 18 | Feed, groups, posts |
+| `admin/` | 16 | Administration, moderation |
+| `marketplace/` | 14 | Product listing |
+| `inventory/` | 14 | Gear management |
+| `player/` | 14 | Player UI (audio player legacy) |
+| `upload/` | 10 | Upload components |
+| `seller/` | 10 | Seller dashboard |
+| `library/` | 9 | Library views |
+| `monitoring/` | 9 | Monitoring dashboard |
+| `notifications/` | 9 | Notification system |
+| `share/` | 7 | Sharing components |
+| `developer/` | 6 | Developer tools |
+| `forms/` | 6 | Form components |
+| `commerce/` | 5 | Commerce views |
+| `gamification/` | 5 | XP, achievements, leaderboard |
+| `charts/` | 4 | Chart components |
+| `feedback/` | 4 | Toast, progress |
+| `search/` | 4 | Global search |
+| `dashboard/` | 3 | Dashboard widgets |
+| `navigation/` | 3 | Breadcrumbs |
+| `live/` | 2 | Live streaming |
+| `theme/` | 2 | Theme provider/switcher |
+| `auth/` | 1 | ProtectedRoute |
+| `analytics/` | 1 | TrackAnalyticsView |
+| `keyboard/` | 1 | Keyboard shortcuts |
+| `pwa/` | 1 | PWA install banner |
+| `user/` | 1 | User profile |
+
+---
+
+## 5. Tests associés
+
+### Couverture des tests
+
+| Zone | Fichiers .test.tsx | Observations |
+|------|-------------------|-------------|
+| `components/ui/` | ~25+ | Bonne couverture des primitives |
+| `features/auth/` | ~15+ | Tests unitaires + integration |
+| `features/tracks/` | ~15+ | Tests composants + services |
+| `features/playlists/` | ~15+ | Tests + integration tests |
+| `features/player/` | ~8+ | Tests services + hooks |
+| `features/streaming/` | ~8+ | Tests services + hooks |
+| `services/` | ~15+ | Tests services API |
+| `hooks/` | ~12+ | Tests hooks custom |
+| `__tests__/` | 2 | Accessibility + contrast |
+| `router/` | 1 | Tests de routing |
+
+**Estimation couverture** : ~60-70% des composants critiques ont des tests associés. Les features `chat`, `dashboard`, `studio`, `marketplace` semblent sous-testées côté composants.
+
+---
+
+## 6. Observations structurelles
+
+### Points forts
+- **Compound components** bien structurés (dialog, tabs, dropdown-menu, select) avec index.ts barrel exports
+- **Skeletons systématiques** dans les views refactorées
+- **Pattern cohérent** dans les features : `types.ts`, `index.ts`, `useXxx.ts`, `XxxSkeleton.tsx`
+- **Composants bien nommés** : convention PascalCase, nom descriptif
+
+### Points faibles
+- **Dualité layout/** : `components/layout/Sidebar.tsx` (294L) vs `components/ui/Sidebar.tsx` (217L)
+- **components/views/** (138 fichiers) coexiste avec `features/*/pages/` — migration incomplète
+- **2 composants dépassent 300L** sans split (DashboardPage 328L, TrackListRow 320L)
+- **Quelques legacy wrappers** : fichiers plats dans `components/views/` (AnalyticsView.tsx, CartView.tsx) qui wrappent les sous-dossiers refactorés
+- **components/player/** (14 fichiers) coexiste avec `features/player/components/` (~20 fichiers) — même problème de dualité

apps/web/dev_audit/frontend/04_ui_consistency_report.md

@@ -0,0 +1,174 @@
+# Phase D — UI Consistency Report
+
+**Score Cohérence UI : 6.5/10**
+
+---
+
+## D1. Boutons
+
+### Inventaire
+
+- **Composant centralisé** : `Button` dans `components/ui/button.tsx` [button.tsx:11-52]
+- **7 variantes définies** : `default`, `primary`, `destructive`, `outline`, `secondary`, `ghost`, `link`
+- **4 tailles** : `default` (h-10), `sm` (h-9), `lg` (h-12), `icon` (h-10 w-10)
+- **228 fichiers** importent le composant Button — adoption massive
+
+### États interactifs
+
+| État | Défini ? | Implémentation |
+|------|----------|---------------|
+| Hover | ✅ | `hover:bg-primary/90`, `hover:bg-muted/50`, etc. [button.tsx:18-34] |
+| Focus | ✅ | `focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2` [button.tsx:12] |
+| Disabled | ✅ | `disabled:pointer-events-none disabled:opacity-50` [button.tsx:12] |
+| Loading | ✅ | `loading` prop → Loader2 spinner + opacity [button.tsx:107-132] |
+
+### Incohérences détectées
+
+- **`variant="glass"`** utilisé dans `CloudIntegrationView.tsx` et `GearViewHeader.tsx` mais **non défini** dans `buttonVariants` [button.tsx:14-35]. Tailwind ne générera aucun style pour cette variante → bouton sans style.
+- **ESLint interdit `<button>` natif** [eslint.config.js] mais ~209 fichiers contiennent encore des `<button` natifs (en partie dans les tests et stories, mais aussi dans le code source).
+
+---
+
+## D2. Formulaires
+
+### Input styling
+
+- **Composant centralisé** : `Input` dans `components/ui/input.tsx` [input.tsx:16-53]
+- **94 fichiers** importent Input
+- **Label intégré** : `label` prop avec `Label` component [input.tsx:21]
+- **Error state** : `error` prop → bordure destructive + message animé [input.tsx:40,47-49]
+- **ARIA** : `aria-invalid`, `aria-describedby` pour les erreurs [input.tsx:31-32] ✅
+
+### Incohérences formulaires
+
+- **Placeholder vs Label** : Le composant `Input` supporte les deux patterns mais rien ne force l'usage de labels. Certains usages utilisent uniquement `placeholder` sans `label`.
+- **`htmlFor` + `id`** : Présent dans 56 fichiers mais pas systématique — certains inputs n'ont pas de label associé.
+- **Validation timing** : Pas de convention unifiée (onBlur vs onChange vs onSubmit). `react-hook-form` est utilisé mais pas partout.
+
+---
+
+## D3. Feedback utilisateur
+
+### Toasts / Notifications
+
+- **109 fichiers** utilisent le système de toast
+- **Deux patterns coexistent** :
+  1. `addToast()` via `useToast()` hook custom [hooks/useToast.ts]
+  2. `toast()` via `react-hot-toast` directement [utils/toast.ts]
+- **Incohérence** : Le même feedback (succès, erreur) est invoqué par deux APIs différentes selon le fichier. Un wrapper unique (`utils/toast.ts`) existe mais n'est pas systématiquement utilisé.
+
+### Loading states
+
+- **187 fichiers** implémentent des loading states ✅ Excellent
+- **Patterns utilisés** : `Skeleton` (83 fichiers), `Spinner` (108L), `LoadingState` (214L), `animate-spin`
+- **Squelettes systématiques** dans les views refactorées (chaque view a un `*Skeleton.tsx`) ✅
+
+### Empty states
+
+- **110+ fichiers** gèrent les états vides ✅ Bon
+- **Composant centralisé** : `empty-state.tsx` (237L) avec variantes multiples
+- **Composants dédiés** : `TrackListEmpty.tsx`, `CartViewEmpty.tsx`, `LibraryPageEmpty.tsx`, etc.
+
+### Error states
+
+- **Composant centralisé** : `ErrorDisplay.tsx` (246L) avec variantes [ErrorDisplay.tsx]
+- **ErrorBoundary** à chaque route [routeConfig.tsx:40-55] ✅
+
+---
+
+## D4. Patterns de layout
+
+### Grille
+
+- **Flexbox dominant** : `flex items-center` (~230 occ.), `flex flex-col` (~230 occ.)
+- **CSS Grid** : utilisé mais moins fréquent
+- **Layout primitives** : `.max-w-layout-content`, `.min-h-layout-main`, etc. [index.css:545-563] ✅
+
+### Sidebar/Header/Footer
+
+- **Sidebar** : `components/layout/Sidebar.tsx` (294L) — composant unique, bien structuré
+- **Header** : `components/layout/Header.tsx` (172L) — composant unique
+- **Footer** : ❌ Aucun composant footer identifié (accepté pour une SPA dashboard)
+- **DashboardLayout** : Shell principal dans `DashboardLayout.tsx` (61L)
+
+### Responsive
+
+- **Mobile-first** : Breakpoints Tailwind standards (`md:`, `lg:`, `xl:`)
+- **Mobile bottom nav** : `MobileBottomNav.tsx` (50L) ✅
+- **Sidebar responsive** : Collapse sur mobile avec overlay [Sidebar.tsx]
+
+### Espacement
+
+- Régulier grâce aux tokens SUMI et aux classes Tailwind `gap-*`, `p-*`, `space-y-*`
+- 7 occurrences de `p-[`, `m-[` arbitraires — négligeable
+
+---
+
+## D5. Iconographie
+
+### Source
+
+- **Lucide React** : 226 fichiers importent des icônes lucide-react — source unique ✅
+- **Aucun mix** avec FontAwesome, Heroicons, etc. — excellent
+
+### Cohérence tailles
+
+- Taille standard : `h-4 w-4` pour les icônes inline, `h-5 w-5` pour les icônes de navigation
+- Quelques variations (`h-3 w-3`, `h-6 w-6`, `h-8 w-8`, `h-12 w-12`) pour des contextes spécifiques (hero, empty states)
+
+### Accessibilité icônes
+
+- Icônes dans les boutons : généralement avec texte adjacent (bonne pratique)
+- Icônes décoratives : `aria-hidden` devrait être plus systématique
+
+---
+
+## Classement des incohérences
+
+### Incohérences critiques
+
+Aucune incohérence critique qui casserait l'expérience utilisateur.
+
+### Incohérences majeures
+
+| # | Incohérence | Fichiers concernés | Impact |
+|---|------------|-------------------|--------|
+| 1 | `variant="glass"` non défini dans Button | `CloudIntegrationView.tsx`, `GearViewHeader.tsx` | Boutons sans style visible |
+| 2 | Deux APIs toast coexistent (`addToast` vs `toast()`) | 109 fichiers | Confusion développeur, risque d'inconsistance UX |
+
+### Incohérences mineures
+
+| # | Incohérence | Fichiers concernés | Impact |
+|---|------------|-------------------|--------|
+| 3 | `<button>` natifs au lieu de `<Button>` | ~50+ fichiers source | Style par défaut du navigateur |
+| 4 | Labels manquants sur certains inputs | Variable | Accessibilité |
+| 5 | `aria-hidden` manquant sur icônes décoratives | ~226 fichiers avec lucide | Accessibilité |
+
+### Dette visuelle à refactorer
+
+| Priorité | Fichier | Raison |
+|----------|---------|--------|
+| P1 | `components/layout/Sidebar.tsx` | 11 valeurs arbitraires |
+| P1 | `components/layout/Header.tsx` | 10 valeurs arbitraires |
+| P1 | `features/dashboard/pages/DashboardPage.tsx` | 11 valeurs arbitraires + >300L |
+| P2 | `features/tracks/components/TrackSearchResults.tsx` | 11 valeurs arbitraires |
+| P2 | `features/player/components/player-bar/PlayerBarGlass.tsx` | 9 valeurs arbitraires |
+| P2 | 31 fichiers avec `z-[N]` | Z-index arbitraires vs tokens |
+
+---
+
+## Score Cohérence UI détaillé
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| Button system | +1.5 | Centralisé, 7 variants, bien adopté (228 fichiers) |
+| `variant="glass"` manquant | -0.5 | Variante utilisée mais non définie |
+| Toast dualité | -0.5 | Deux APIs, pas de convention unique |
+| Loading states | +1.5 | Skeletons systématiques, 187 fichiers |
+| Empty states | +1 | 110+ fichiers, composant centralisé |
+| Error states | +1 | ErrorBoundary + ErrorDisplay |
+| Layout cohérent | +1 | Sidebar/Header/DashboardLayout |
+| Responsive | +0.5 | Mobile nav, sidebar collapse |
+| Iconographie unifiée | +1 | Lucide only, 226 fichiers |
+| Valeurs arbitraires | -0.5 | ~62 occ. w/h + 31 fichiers z-index |
+| **Total** | **6.5/10** | **Globalement cohérent, quelques fuites** |

apps/web/dev_audit/frontend/05_accessibility_audit.md

@@ -0,0 +1,171 @@
+# Phase E — Accessibility Audit (WCAG 2.1 AA)
+
+**Score Accessibilité : 5.5/10**
+
+---
+
+## E1. Sémantique HTML
+
+### Éléments sémantiques détectés
+
+| Élément | Occurrences | Fichiers |
+|---------|------------|---------|
+| `<main>` | 1 | `components/layout/Layout.tsx` |
+| `<nav>` | 2 | `components/layout/Sidebar.tsx`, `Navbar.tsx` |
+| `<header>` | 1 | `components/layout/Header.tsx` |
+| `<footer>` | 0 | Aucun |
+| `<section>` | 2 | Rare |
+| `<article>` | 0 | Aucun |
+| `<aside>` | 0 | Aucun |
+
+**Verdict** : Sémantique HTML **insuffisante** pour une application de cette taille. La sidebar devrait être un `<aside>`, les cards de contenu devraient utiliser `<article>`, les sections de page `<section>`. La navigation par landmarks pour les utilisateurs de lecteurs d'écran est limitée. **-2 points.**
+
+### Anti-patterns `div onClick`
+
+- **2 occurrences** de `<div onClick>` identifiées :
+  - `components/social/groups/GroupCard.tsx:66` — `<div onClick={(e) => e.stopPropagation()}>` — pas d'élement interactif, arrêt propagation seulement
+  - `components/ui/dialog/DialogTrigger.tsx:15` — `<div onClick={onClick} style={{ display: 'inline-block' }}>` — **devrait être un `<button>`**
+
+### Heading hierarchy
+
+- Hiérarchie définie dans `@layer base` [index.css:506-516] : h1→h6 avec tailles responsives ✅
+- **Non vérifié** : L'ordre des headings dans les pages individuelles (h1 → h2 → h3) n'est pas garanti architecturalement. Risque de sauts (h1 → h3).
+
+---
+
+## E2. ARIA
+
+### Usage global
+
+- **176 fichiers** utilisent des attributs `aria-*` ✅ Bon niveau d'adoption
+
+### Détail
+
+| Attribut | Usage | Fichiers | Verdict |
+|----------|-------|----------|---------|
+| `aria-label` | Éléments interactifs sans texte visible | Large adoption | ✅ Bon |
+| `aria-live` | Contenus dynamiques | 6+ fichiers (Toast, auth feedback, track list) | ⚠️ Partiel |
+| `aria-expanded` | Menus/accordéons | 3+ fichiers (PlaybackSpeed, QualitySelector, Accordion) | ⚠️ Partiel |
+| `aria-invalid` | Inputs en erreur | `input.tsx:31` | ✅ Systématique |
+| `aria-describedby` | Messages d'erreur liés | `input.tsx:32` | ✅ |
+| `aria-hidden` | Icônes décoratives | **Rarement utilisé** | ❌ Manquant |
+| `role="button"` | Éléments cliquables non-boutons | 18 fichiers | ⚠️ Devrait être `<button>` |
+
+### Problèmes identifiés
+
+1. **`aria-hidden` absent** sur les icônes Lucide (226 fichiers). Les icônes purement décoratives devraient avoir `aria-hidden="true"`. **Violation WCAG 1.1.1.**
+2. **`role="button"` sur des `<div>`** dans 18 fichiers [PlaylistCard, TrackCard, LibraryPageGrid, etc.] — ces éléments devraient être des `<button>` natifs pour bénéficier du focus clavier et de la gestion Enter/Space automatique.
+3. **`aria-live` limité** — les zones dynamiques (résultats de recherche, listes filtrées, compteurs) n'annoncent pas systématiquement les changements.
+
+---
+
+## E3. Focus management
+
+### `outline-none` sans remplacement
+
+- **45 fichiers** utilisent `outline-none`
+- **Majorité avec remplacement** : `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring` — pattern correct ✅
+- **Exceptions problématiques** :
+  - `features/studio/components/cloud-file-browser/FileToolbar.tsx` — `outline-none` **sans ring** ❌
+  - `CreateProductViewDetailsCard.tsx`, `EditProfileIdentityCard.tsx`, `AccountSettingsPreferencesCard.tsx` — `outline-none` sur inputs sans ring visible ❌
+
+### Focus visible
+
+- **56 fichiers** utilisent `focus-visible:` ✅
+- Le composant `Button` utilise `focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2` [button.tsx:12] ✅
+- Le composant `Input` utilise `focus-visible:outline-none focus-visible:ring-2` [input.tsx:36] ✅
+- **Glow effect** : `focus-visible:shadow-[var(--sumi-shadow-glow)]` [button.tsx:12, input.tsx:37] — feedback visuel amélioré ✅
+
+### Focus trap
+
+- `components/ui/focus-trap.tsx` (126L) disponible ✅
+- Utilisé dans `modal.tsx` pour les modales ✅
+- **Vérification manuelle nécessaire** : restauration du focus après fermeture de modale
+
+### Skip navigation
+
+- ❌ **Aucun skip navigation link** détecté. Violation WCAG 2.4.1 pour une application avec sidebar + header.
+
+---
+
+## E4. Contraste et couleurs
+
+### Estimations de contraste (Dark mode)
+
+| Combinaison | Ratio estimé | WCAG AA (4.5:1) |
+|-------------|-------------|-----------------|
+| `--sumi-text-primary` (#f0ede8) sur `--sumi-bg-base` (#121215) | ~14:1 | ✅ |
+| `--sumi-text-secondary` (#a8a4a0) sur `--sumi-bg-base` (#121215) | ~8:1 | ✅ |
+| `--sumi-text-tertiary` (#706c68) sur `--sumi-bg-base` (#121215) | ~4.2:1 | ⚠️ Borderline |
+| `--sumi-text-disabled` (#4a4844) sur `--sumi-bg-base` (#121215) | ~2.5:1 | ❌ Insuffisant |
+| `--sumi-accent` (#7c9dd6) sur `--sumi-bg-base` (#121215) | ~7:1 | ✅ |
+| `--sumi-vermillion` (#d4634a) sur `--sumi-bg-base` (#121215) | ~5:1 | ✅ |
+
+### Information par couleur seule
+
+- **Erreurs** : Combinaison couleur rouge + icône AlertTriangle + texte — ✅ pas couleur seule
+- **Succès** : Combinaison couleur verte + icône + texte — ✅
+- **Toast** : Icône + texte + couleur — ✅
+
+---
+
+## E5. Images et médias
+
+### Images sans `alt`
+
+- **2 images** sans attribut `alt` :
+  1. `components/social/groups/CreateGroupModal.tsx:62` — `<img src={coverImage}>` ❌
+  2. `components/upload/metadata/CoverArtUploadModal.tsx:124` — `<img src={currentImage}>` ❌
+
+### `loading="lazy"`
+
+- **0 occurrence** de `loading="lazy"` sur les `<img>` ❌
+- Le composant `OptimizedImage` gère le lazy loading via IntersectionObserver [optimized-image/OptimizedImage.tsx] mais ce n'est pas la même chose que l'attribut natif `loading="lazy"`.
+
+---
+
+## E6. Formulaires accessibles
+
+### Labels
+
+| Critère | Status | Détail |
+|---------|--------|--------|
+| `htmlFor` + `id` | ⚠️ Partiel | 56 fichiers — pas systématique |
+| `aria-describedby` pour erreurs | ✅ | Input component [input.tsx:32] |
+| `aria-required` | ❌ | Pas utilisé systématiquement |
+| `aria-invalid` | ✅ | Input component [input.tsx:31] |
+| `autocomplete` | ❌ | Pas vérifié systématiquement |
+
+---
+
+## Tableau des violations
+
+| Sévérité | Critère WCAG | Fichier(s) | Problème | Correction |
+|----------|-------------|------------|----------|------------|
+| 🔴 CRITIQUE | 2.4.1 Bypass Blocks | Global | Pas de skip navigation link | Ajouter `<a href="#main-content" class="sr-only focus:not-sr-only">Skip to content</a>` |
+| 🟠 HAUTE | 4.1.2 Name Role Value | 18 fichiers | `role="button"` sur div sans keyboard handler | Remplacer par `<button>` natif |
+| 🟠 HAUTE | 1.1.1 Non-text Content | 226 fichiers | `aria-hidden` manquant sur icônes décoratives | Ajouter `aria-hidden="true"` sur icônes sans label |
+| 🟠 HAUTE | 1.3.1 Info Relationships | Global | Sémantique HTML insuffisante (1 `<main>`, 0 `<aside>`, 0 `<article>`) | Enrichir les landmarks |
+| 🟡 MOYENNE | 1.1.1 Non-text Content | `CreateGroupModal.tsx:62`, `CoverArtUploadModal.tsx:124` | `<img>` sans `alt` | Ajouter `alt` descriptif |
+| 🟡 MOYENNE | 2.4.7 Focus Visible | `FileToolbar.tsx` + 3 fichiers | `outline-none` sans ring de remplacement | Ajouter `focus-visible:ring-2` |
+| 🟡 MOYENNE | 4.1.3 Status Messages | Zones dynamiques | `aria-live` insuffisant pour les résultats de recherche/filtrage | Ajouter `aria-live="polite"` sur les zones de résultats |
+| 🟢 BASSE | 1.4.3 Contrast | `--sumi-text-disabled` | Ratio ~2.5:1 (sous le seuil AA de 4.5:1) | Acceptable pour texte désactivé (non interactif) |
+
+---
+
+## Score Accessibilité détaillé
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| ARIA usage | +1.5 | 176 fichiers, bonne adoption |
+| Input accessibility | +1 | aria-invalid, aria-describedby, error states |
+| Focus visible | +1 | 56 fichiers, glow effect |
+| Focus trap modales | +0.5 | Composant dédié |
+| Sémantique HTML | -1.5 | 1 main, 0 aside, 0 article — insuffisant |
+| Skip navigation | -0.5 | Absent |
+| aria-hidden icônes | -0.5 | 226 fichiers sans aria-hidden |
+| role="button" sur div | -0.5 | 18 fichiers |
+| img alt | -0.25 | 2 images |
+| outline-none sans ring | -0.25 | 4 fichiers |
+| Contraste | +0.5 | Majoritairement bon |
+| **Total** | **5.5/10** | **Efforts visibles mais lacunes structurelles** |

apps/web/dev_audit/frontend/06_security_frontend.md

@@ -0,0 +1,152 @@
+# Phase F — Sécurité Frontend
+
+---
+
+## F1. Secrets et données sensibles
+
+### Variables VITE_* exposées au bundle
+
+| Variable | Contenu | Sensible ? |
+|----------|---------|-----------|
+| `VITE_API_URL` | URL API backend | ❌ Public |
+| `VITE_WS_URL` | URL WebSocket | ❌ Public |
+| `VITE_STREAM_URL` | URL streaming | ❌ Public |
+| `VITE_UPLOAD_URL` | URL upload | ❌ Public |
+| `VITE_APP_NAME` | Nom de l'app | ❌ Public |
+| `VITE_DEBUG` | Flag debug | ❌ Non sensible |
+| `VITE_USE_MSW` | Flag MSW | ❌ Dev only |
+| `VITE_FCM_VAPID_KEY` | Clé push notifications | ⚠️ Public par design (VAPID) |
+| `VITE_FEATURE_*` | Feature flags | ❌ Non sensible |
+
+**Verdict** : Aucune clé API secrète exposée côté client. ✅
+
+### Fichiers .env
+
+- `.env.local` (450B) : Contient `VITE_DOMAIN`, `VITE_API_URL`, `VITE_WS_URL`, `VITE_STREAM_URL` — **pas de secrets** ✅
+- `.env.production` (1.8KB) : Contient URLs et config — **pas de secrets** ✅
+- `.env.example` (2.2KB) : Template
+
+**Attention** : `.env.local` et `.env.production` sont versionnés (présents dans le repo). Le `.gitignore` ne semble pas exclure `.env.local`. Même si le contenu n'est pas sensible actuellement, c'est un **risque si quelqu'un ajoute un secret à l'avenir**.
+
+### Stockage JWT
+
+- **httpOnly cookies** : Les tokens JWT sont gérés côté backend via cookies httpOnly ✅
+- `TokenStorage.getAccessToken()` retourne `null` en mode cookie — pas d'accès JS aux tokens ✅
+- `tokenStorage.ts` est un wrapper de compatibilité, pas de stockage réel en localStorage ✅
+
+---
+
+## F2. XSS
+
+### `dangerouslySetInnerHTML`
+
+| Fichier | Ligne | Source des données | Sanitization |
+|---------|-------|--------------------|-------------|
+| `features/chat/components/ChatMessages.tsx` | 145-147 | `message.content` (backend) | ✅ `sanitizeChatMessage()` via DOMPurify |
+| `features/chat/components/virtualized-chat-messages/VirtualizedChatMessageItem.tsx` | 58-60 | `message.content` (backend) | ✅ `sanitizeChatMessage()` via DOMPurify |
+
+**Sanitization** : `utils/sanitize.ts` (429L) utilise DOMPurify avec :
+- Allowlist stricte de tags HTML [sanitize.ts]
+- Allowlist d'attributs [sanitize.ts]
+- URL schemes limitées (http, https, mailto) [sanitize.ts]
+- `javascript:` protocol filtré ✅
+
+**Verdict XSS** : ✅ Les deux usages de `dangerouslySetInnerHTML` sont correctement sanitizés.
+
+### Autres vecteurs XSS
+
+- `eval()` / `new Function()` : **0 occurrence** ✅
+- Template literals dans le DOM : Non détecté ✅
+- `document.write` : **0 occurrence** ✅
+
+---
+
+## F3. Stockage client
+
+### Données en localStorage
+
+| Clé | Données | Sensible ? | Expiration |
+|-----|---------|-----------|-----------|
+| `ui-storage` | theme, language, sidebarOpen | ❌ | Persist |
+| `veza-cart-storage` | Items du panier | ❌ | Persist |
+| `auth-storage` | `isAuthenticated` (boolean) | ❌ | Persist |
+| `rememberedEmail` | Email utilisateur | ⚠️ PII | Persist |
+| `veza_offline_queue` | Requêtes en attente | ⚠️ Peut contenir des données | Nettoyé |
+| `PENDING_ANALYTICS_STORAGE_KEY` | Analytics payload | ❌ | Nettoyé |
+| `feature-highlight-*` | Dismissal flags | ❌ | Persist |
+| `pwa-install-dismissed` | Flag | ❌ | Persist |
+| `veza_wrong_server_shown` | Flag toast | ❌ | Persist |
+| **Developer API keys** | **Clés API** | **🔴 OUI** | **Persist** |
+
+**Problème critique** : `services/developerService.ts` stocke des clés API dans localStorage. Même si ce sont des clés de développeur (probablement des API keys publiques), le stockage en localStorage les expose à toute extension de navigateur ou code tiers injecté. **Recommandation : déléguer la gestion au backend.**
+
+### sessionStorage
+
+- Pas d'usage sensible détecté ✅
+
+---
+
+## F4. Dépendances
+
+### Vulnérabilités connues
+
+[DONNÉES INSUFFISANTES — nécessite `npm audit` sur la machine]
+
+### Dépendances à risque
+
+| Dépendance | Version | Risque | Usage |
+|-----------|---------|--------|-------|
+| `dompurify` | 3.3.x | ✅ Activement maintenu | Sanitization |
+| `axios` | 1.13.x | ✅ Récent | HTTP |
+| `swagger-ui-react` | 5.31.x | ⚠️ Exposé en production ? | Dev tools |
+| `hls.js` | 1.6.x | ✅ Maintenu | Streaming |
+
+**Attention** : `swagger-ui-react` et `swagger-ui-dist` sont en `dependencies` (pas `devDependencies`). Si le composant SwaggerUI est accessible en production, cela expose la documentation API. **Vérifier que la route `/developer` est bien protégée et gated.**
+
+---
+
+## F5. Autres vecteurs
+
+### Open redirect
+
+| Fichier | Risque | Détail |
+|---------|--------|--------|
+| `features/playlists/hooks/usePlaylistNotifications.ts:203,219,235,251` | 🔴 **HAUT** | `window.location.href = notification.link!` — URL provenant du backend, pas de validation. Si un attaquant compromet les notifications, il peut rediriger vers un site malveillant. |
+| Autres `window.location.href` | ✅ Sûr | Tous vers des chemins statiques (`/login`, `/marketplace`, etc.) |
+
+### CORS / CSP
+
+- **CORS** : Géré côté backend. Le proxy Vite en dev élimine les problèmes CORS [vite.config.ts:63-76] ✅
+- **CSP** : [DONNÉES INSUFFISANTES — nécessite inspection des headers serveur]
+
+### Prototype pollution
+
+- Pas d'usage de `lodash.merge` ou similaire détecté ✅
+- `immer` (10.x) utilisé pour l'immutabilité — protège contre la mutation directe ✅
+
+---
+
+## Classement des vulnérabilités
+
+| Gravité | Vulnérabilité | Fichier:ligne | Exploitabilité | Correction urgence |
+|---------|--------------|---------------|----------------|-------------------|
+| 🔴 CRITIQUE | Open redirect via notification.link | `usePlaylistNotifications.ts:203,219,235,251` | Moyenne (nécessite compromission backend/notifications) | Immédiate — valider l'URL (same-origin ou allowlist) |
+| 🟠 HAUTE | Clés API en localStorage | `developerService.ts:33` | Faible (nécessite accès au navigateur) | Court terme — migrer vers backend |
+| 🟡 MOYENNE | `.env.local` versionné | `.env.local` | Faible (pas de secrets actuels) | Ajouter `.env.local` au `.gitignore` |
+| 🟡 MOYENNE | swagger-ui en production | `package.json` (dependencies) | Faible (route protégée) | Déplacer en devDependencies si non nécessaire en prod |
+| 🟢 BASSE | `rememberedEmail` en localStorage | `LoginPage.tsx:115` | Très faible (PII minimal) | Acceptable avec notice RGPD |
+
+---
+
+## Score Sécurité implicite
+
+Ce score n'est pas dans le tableau principal car la pondération est ×1.5, mais les observations sont globalement positives :
+- ✅ httpOnly cookies pour JWT
+- ✅ CSRF protection
+- ✅ DOMPurify pour `dangerouslySetInnerHTML`
+- ✅ Zod validation sur les réponses API
+- ✅ Pas de `eval()` ni secrets exposés
+- ❌ Open redirect dans usePlaylistNotifications
+- ❌ Clés API en localStorage
+
+**Score Sécurité : 7/10**

apps/web/dev_audit/frontend/07_performance_analysis.md

@@ -0,0 +1,186 @@
+# Phase G — Performance Analysis
+
+**Score Performance : 6.5/10**
+
+---
+
+## G1. Bundle
+
+### Configuration build
+
+[vite.config.ts:68-92]
+
+- **Target** : `esnext` — navigation moderne uniquement
+- **Minification** : `esbuild` ✅
+- **Source maps** : `hidden` en production (ne pas exposer le code source) ✅
+- **Bundle analyzer** : `rollup-plugin-visualizer` en production → `dist/bundle-analysis.html` ✅
+- **Chunk size warning** : 1000KB
+
+### Manual chunks
+
+```typescript
+// vite.config.ts:73-87
+manualChunks: {
+  'vendor-react': ['react', 'react-dom'],
+  'vendor-router': ['react-router'],
+  'vendor-tanstack': ['@tanstack/*'],
+  'vendor-icons': ['lucide-react'],
+  'vendor-utils': ['date-fns', 'zod'],
+  'vendor': // Default vendor chunk
+}
+```
+
+**Positif** : Chunking explicite des dépendances pour un caching optimal. Les chunks vendeur changent rarement → longue durée de cache.
+
+### Taille estimée
+
+[DONNÉES INSUFFISANTES — `npm run build` non exécuté. Estimation basée sur les dépendances :]
+
+| Chunk | Estimation |
+|-------|-----------|
+| `vendor-react` | ~140KB (gzip) |
+| `vendor-router` | ~25KB |
+| `vendor-tanstack` | ~40KB |
+| `vendor-icons` (lucide-react) | ~50-80KB (226 fichiers importent des icônes) |
+| `vendor-utils` (date-fns + zod) | ~30KB |
+| `vendor` (reste) | ~100KB+ (axios, framer-motion, i18next, etc.) |
+| Application code | ~200-300KB |
+| **Total estimé** | **~600-800KB** (gzip) |
+
+**Attention** : `lucide-react` (0.321.x) peut être volumineux si le tree-shaking n'est pas optimal. Les imports nommés (`import { Home } from 'lucide-react'`) sont utilisés → tree-shaking devrait fonctionner.
+
+**Attention** : `framer-motion` (12.29.x) est une dépendance lourde (~60KB gzip). Vérifier si toutes les animations nécessitent framer-motion ou si CSS animations (déjà définies dans index.css) suffiraient.
+
+---
+
+## G2. Code splitting
+
+### React.lazy
+
+- **5 fichiers** utilisent `React.lazy()` / `lazy()` directement :
+  - `features/chat/components/ChatInput.tsx:31` — emoji-picker-react ✅
+  - `features/chat/components/ChatMessage.tsx:11` — emoji-picker-react ✅
+  - `components/ui/ImageCropper.tsx:4` — Cropper ✅
+  - `components/ui/lazy-component/createLazyComponent.tsx:48` — factory function ✅
+  - `components/feedback/LazyToaster.tsx:15` — react-hot-toast ✅
+
+### Routes lazy-loadées
+
+**Toutes les routes** sont lazy via `createLazyComponent` [components/ui/lazy-component/createLazyComponent.tsx:48] qui utilise `React.lazy` avec error boundaries. Les exports sont centralisés dans `lazy-component/lazyExports.ts` [LazyComponent.tsx:39 → lazyExports.ts].
+
+Routes lazy : Login, Register, Dashboard, Chat, Library, Profile, Settings, Sessions, Roles, TrackDetail, Playlists, Marketplace, Search, Notifications, Analytics, Webhooks, Admin, Social, Seller, Wishlist, Purchases, DesignSystem, 404, 500. ✅ **Excellent.**
+
+### Dynamic imports
+
+- **60+ occurrences** de `import()` — usage approprié pour :
+  - Route splitting
+  - Heavy components (emoji-picker, cropper, swagger-ui)
+  - Conditional loading (MSW, Sentry, toast)
+  - Store lazy loading
+
+---
+
+## G3. Optimisation du rendu
+
+### Memoization
+
+| Pattern | Occurrences | Verdict |
+|---------|------------|---------|
+| `useMemo` / `useCallback` | 135 fichiers | ✅ Usage correct |
+| `React.memo` | **5 fichiers seulement** | ⚠️ Insuffisant |
+
+**Composants avec `React.memo`** :
+- `PlaylistCard.tsx:203` ✅
+- `TrackCard.tsx:198` ✅
+- `CourseCard.tsx:136` ✅
+- `PostCard.tsx:342` ✅
+- `ProductCard.tsx:163` ✅
+
+**Problème** : Seuls les cards sont mémorisés. Les composants de liste (TrackList, PlaylistList, etc.) qui itèrent sur ces cards ne sont PAS mémorisés. Les re-renders du parent provoquent des re-renders de tous les enfants. **-1 point.**
+
+### `key={index}` anti-pattern
+
+**~55 occurrences** de `key={index}` ou `key={i}` ⚠️
+
+Fichiers critiques (listes qui peuvent être réordonnées) :
+- `DashboardPage.tsx:248,303` — dashboard cards
+- `PlaybackHeatmapGrid.tsx:35` — grid dynamique
+- `TrackGrid.tsx:135` — grille de tracks
+- `TrackSearchResults.tsx:89` — résultats de recherche
+- `ChatMessage.tsx:98` — messages chat
+
+**Impact** : Pour les listes statiques (skeletons, options fixes), `key={index}` est acceptable. Pour les listes dynamiques (tracks, messages, résultats), c'est un bug potentiel de réconciliation React.
+
+### Context providers
+
+- Le `QueryClientProvider` est au niveau racine [main.tsx:218] — normal
+- `ThemeProvider`, `AudioProvider`, `ToastProvider` sont au niveau App [App.tsx:170-187] — scope approprié
+- Pas de provider trop large provoquant des re-renders en cascade identifié
+
+### `useEffect` instances
+
+- **~90 `useEffect` avec deps vides** `[]` — mount-only effects
+- La plupart sont des initialisations (fetch, event listeners). Quelques uns pourraient avoir des dépendances manquantes mais ESLint `exhaustive-deps` est configuré en `warn` [eslint.config.js].
+
+---
+
+## G4. Assets
+
+### Images
+
+- **`OptimizedImage`** composant dédié (145L) avec IntersectionObserver pour lazy loading [optimized-image/OptimizedImage.tsx]
+- **`BlurPlaceholder`** (33L) pour le placeholder pendant le chargement [optimized-image/BlurPlaceholder.tsx]
+- **`loading="lazy"` natif** : 0 occurrences ❌ — repose entièrement sur le JS custom
+- **WebP/AVIF** : Pas de détection de format optimisé côté client [DONNÉES INSUFFISANTES — dépend du backend/CDN]
+
+### Fonts
+
+- 4 familles : Inter, Space Grotesk, JetBrains Mono, Noto Serif JP [index.css:78-81]
+- **Preload/display** : [DONNÉES INSUFFISANTES — nécessite vérification index.html]
+- **Subset** : Non détecté — potentiellement 4 polices complètes téléchargées
+
+### SVG
+
+- 5 fichiers SVG dans `src/` — minimal
+- Lucide React injecte les icônes en inline SVG → pas de requêtes HTTP supplémentaires ✅
+
+---
+
+## G5. Requêtes réseau
+
+### Patterns de fetch
+
+- **Request deduplication** : `services/requestDeduplication.ts` — évite les appels API dupliqués ✅
+- **Response caching** : `services/responseCache.ts` — cache en mémoire avec TTL ✅
+- **Offline queue** : `services/offlineQueue.ts` — queue les mutations offline et les rejoue ✅
+- **React Query cache** : staleTime 1min, gcTime 5min [main.tsx:49-50]
+- **Cross-tab sync** : `utils/reactQuerySync.ts` — synchronise le cache React Query entre onglets ✅
+
+### WebSocket
+
+- `services/websocket.ts` — WebSocket natif avec reconnection automatique ✅
+- `features/streaming/hooks/usePlaybackRealtime.ts` (496L) — streaming temps réel avec analytics ✅
+
+### Waterfall
+
+- Les routes sont lazy-loadées, ce qui crée un waterfall initial (HTML → JS chunk → data fetch). C'est le pattern standard React SPA.
+- `useRoutePreload.ts` (239L) implémente le **prefetching des routes** au hover des liens ✅ — réduit le waterfall perçu.
+
+---
+
+## Score Performance détaillé
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| Code splitting routes | +2 | Toutes les routes lazy, 60+ dynamic imports |
+| Manual chunks vendeur | +1 | Bon chunking pour cache long-terme |
+| React.memo insuffisant | -1 | 5 composants seulement, listes non mémorisées |
+| key={index} | -0.5 | 55 occurrences, certaines sur des listes dynamiques |
+| Request dedup + cache | +1 | Architecture réseau mature |
+| Route prefetching | +0.5 | useRoutePreload au hover |
+| useMemo/useCallback | +0.5 | 135 fichiers — bonne adoption |
+| Pas de loading="lazy" | -0.5 | Repose sur JS, pas d'attribut natif |
+| Fonts non optimisées | -0.5 | 4 familles, pas de subset/preload vérifié |
+| Offline queue | +0.5 | Fonctionnalité avancée |
+| framer-motion overhead | -0.5 | Dépendance lourde potentiellement surutilisée |
+| **Total** | **6.5/10** | **Infrastructure solide, optimisation rendu lacunaire** |

apps/web/dev_audit/frontend/08_technical_debt_frontend.md

@@ -0,0 +1,175 @@
+# Phase H — Dette Technique Frontend
+
+---
+
+## H1. Complexité excessive
+
+### Fichiers > 300 lignes (source, hors tests/generated)
+
+| Fichier | Lignes | Raison probable | Split possible ? | Complexité |
+|---------|--------|-----------------|-----------------|-----------|
+| `services/api/client.ts` | 2 237 | Client HTTP + validation + caching + retry + dedup + metrics | ✅ Oui, 5 modules | 🔴 Élevée |
+| `mocks/handlers.ts` | 1 716 | MSW handlers pour toutes les routes | ✅ Par feature | 🟡 Linéaire |
+| `features/tracks/api/trackApi.ts` | 848 | API tracks complète | ✅ CRUD/Upload/Share/Analytics | 🟠 Moyenne |
+| `utils/optimisticUpdates.ts` | 682 | Optimistic updates multi-feature | ⚠️ Difficilement | 🟠 Moyenne |
+| `features/streaming/services/playbackAnalyticsService.ts` | 656 | Analytics streaming | ⚠️ Cohérent | 🟡 Linéaire |
+| `features/playlists/hooks/usePlaylist.ts` | 631 | Hook playlist (CRUD + collab + analytics) | ✅ 3 hooks | 🔴 Élevée |
+| `utils/apiErrorHandler.ts` | 578 | Error parsing exhaustif | ⚠️ Cohérent | 🟡 Linéaire |
+| `features/streaming/hooks/usePlaybackRealtime.ts` | 496 | WebSocket + state + analytics | ⚠️ Justifié temps réel | 🟠 Moyenne |
+| `services/api/auth.ts` | 493 | Auth API (login, register, 2FA, OAuth) | ⚠️ Cohérent | 🟡 Linéaire |
+| `schemas/apiRequestSchemas.ts` | 476 | Zod schemas | ❌ Normal | 🟢 Faible |
+| `schemas/apiSchemas.ts` | 468 | Zod schemas | ❌ Normal | 🟢 Faible |
+| `features/tracks/services/trackService.ts` | 453 | Service tracks | ⚠️ Cohérent | 🟡 Linéaire |
+| `features/playlists/services/playlistService.ts` | 448 | Service playlists | ⚠️ Cohérent | 🟡 Linéaire |
+| `utils/sanitize.ts` | 429 | Sanitization XSS | ❌ Critique | 🟢 Faible |
+| `features/chat/hooks/useChat.ts` | 360 | Hook chat | ✅ 2-3 hooks | 🟠 Moyenne |
+| `features/auth/store/authStore.ts` | 330 | Store auth | ⚠️ Acceptable | 🟡 Linéaire |
+| `features/dashboard/pages/DashboardPage.tsx` | 328 | Page dashboard | ✅ Extraire sections | 🟡 Moyenne |
+| `features/tracks/components/TrackListRow.tsx` | 320 | Ligne de track | ✅ Sous-composants | 🟡 Moyenne |
+
+**Priorité de split** :
+1. `client.ts` (2237L) → `httpClient.ts`, `validators.ts`, `caching.ts`, `interceptors.ts`, `metrics.ts`
+2. `usePlaylist.ts` (631L) → `usePlaylistCrud.ts`, `usePlaylistCollaboration.ts`, `usePlaylistAnalytics.ts`
+3. `useChat.ts` (360L) → `useChatMessages.ts`, `useChatConnection.ts`
+
+---
+
+## H2. Props drilling
+
+Grâce à l'utilisation de Zustand (7 stores) et React Query, le prop drilling est **minimal**. Aucune chaîne de props > 3 niveaux intermédiaires identifiée dans le code audité.
+
+**Pattern positif** : Les stores Zustand sont accédés directement dans les composants enfants via `useAuthStore()`, `useUIStore()`, `useCartStore()`, etc. — pas besoin de passer les props à travers les composants intermédiaires.
+
+---
+
+## H3. Hooks complexes
+
+### Custom hooks > 50 lignes
+
+| Hook | Lignes | Responsabilités | Testé ? |
+|------|--------|----------------|---------|
+| `features/playlists/hooks/usePlaylist.ts` | 631 | CRUD + collaboration + analytics + permissions | ✅ (595L de tests) |
+| `features/streaming/hooks/usePlaybackRealtime.ts` | 496 | WebSocket + state + analytics + reconnection | ✅ (490L de tests) |
+| `features/chat/hooks/useChat.ts` | 360 | Messages + connection + typing + presence | ❌ Non vérifié |
+| `features/tracks/hooks/useTrackList.ts` | 286 | List + filters + sort + pagination + localStorage | ✅ (761L de tests) |
+| `features/playlists/hooks/usePlaylistNotifications.ts` | 264 | Notification handling + navigation | ❌ Peu testé |
+| `features/player/hooks/usePlayer.ts` | 249 | Playback control + queue + history | ✅ Tests partiels |
+| `hooks/useRoutePreload.ts` | 239 | Route prefetching + intersection observer | ✅ Tests |
+| `features/library/hooks/useLibraryItems.ts` | 152 | Library items + filters | ❌ Non vérifié |
+
+**Verdict** : Les 3 plus gros hooks (usePlaylist, usePlaybackRealtime, useTrackList) sont bien testés. Les hooks de taille moyenne (useChat, usePlaylistNotifications) sont moins bien couverts.
+
+---
+
+## H4. Duplication
+
+### Patterns CSS les plus répétés
+
+| Pattern | Occurrences approximatives | Action recommandée |
+|---------|---------------------------|-------------------|
+| `flex items-center` | ~230 | Normal (utility-first) |
+| `flex flex-col` | ~230 | Normal |
+| `text-muted-foreground` | ~145 | Normal (sémantique) |
+| `rounded-*` | ~230 | Normal |
+| `w-full h-full` | ~90 | Normal |
+
+Ces répétitions sont **attendues** avec Tailwind utility-first et ne constituent pas de la dette technique.
+
+### Composants dupliqués
+
+| Duplication | Fichiers | Impact |
+|------------|---------|--------|
+| `layout/Sidebar.tsx` (294L) + `ui/Sidebar.tsx` (217L) | 2 fichiers | 🟠 Confusion |
+| `components/player/` (14 fichiers) + `features/player/components/` (~20 fichiers) | 34 fichiers | 🟠 Migration incomplète |
+| `pages/auth/` + `features/auth/pages/` | 4+ fichiers | 🟠 Legacy |
+| `context/AuthContext.tsx` + `features/auth/store/authStore.ts` | 2 fichiers | 🔴 Deux sources de vérité |
+| `ui/modal.tsx` + `ui/dialog/` | 2 systèmes | 🟡 Redondance |
+| `ui/dropdown-menu.tsx` + `ui/dropdown-menu/` | Fichier plat + dossier | 🟡 Legacy wrapper |
+
+### Logique métier dupliquée
+
+- **Auth** : `authService.login()` est appelé par `authStore.login()` ET `AuthContext.login()` — deux chemins d'exécution pour la même action.
+- **Toast** : `toast()` (react-hot-toast) et `addToast()` (custom) — deux APIs pour le même feedback.
+
+---
+
+## H5. TypeScript
+
+### Statistiques
+
+| Métrique | Nombre | Zone |
+|----------|--------|------|
+| `: any` explicites (prod) | ~82 | Code source hors tests/generated |
+| `as any` casts (prod) | ~180 | Code source hors tests/generated |
+| `as any` dans `generated/api.ts` | 145 | Auto-généré — acceptable |
+| `@ts-ignore` / `@ts-expect-error` | 7 fichiers | Minimal ✅ |
+
+### Fichiers avec le plus de `as any` (source)
+
+| Fichier | `as any` | Justification |
+|---------|----------|---------------|
+| `services/api/client.ts` | 48 | Error handling, interceptors — type narrowing difficile |
+| `utils/typeGuards.ts` | 44 | Type guards by design — acceptable |
+| `utils/toast.ts` | 11 | Wrapper react-hot-toast |
+| `features/playlists/services/playlistService.ts` | 9 | API response casting |
+| `utils/apiErrorHandler.ts` | 7 | Error type narrowing |
+| `features/tracks/services/trackListService.ts` | 7 | API response casting |
+
+### Configuration TypeScript
+
+- **Mode strict complet** ✅ [tsconfig.json] : `strict: true`, `noImplicitAny`, `strictNullChecks`, `strictFunctionTypes`, `noUnusedLocals`, `noUnusedParameters`, `noImplicitReturns`, `noFallthroughCasesInSwitch`
+- **`noUncheckedIndexedAccess: true`** — option avancée ✅ (peu de projets l'activent)
+- **`@typescript-eslint/no-explicit-any: off`** — ESLint n'interdit pas `any` ⚠️
+
+**Verdict TS** : Configuration stricte exemplaire mais `no-explicit-any` désactivé dans ESLint permet l'accumulation de `any`. Le comptage (~82 source + ~180 `as any`) est modéré pour un projet de 218K LOC.
+
+---
+
+## H6. Code mort
+
+### Orphelins structurels identifiés
+
+| Fichier/Dossier | Raison | Impact |
+|----------------|--------|--------|
+| `pages/auth/Login.tsx`, `pages/auth/Register.tsx` | Remplacés par `features/auth/pages/` | 🟡 Dead code |
+| `context/AuthContext.tsx` | Remplacé par `features/auth/store/authStore.ts` | 🟠 Source de confusion |
+| `providers/AuthProvider.tsx` | Wrapper de AuthContext — non utilisé dans App.tsx | 🟡 Dead code |
+| `components/views/*.tsx` (fichiers plats) | Wrappers vers les sous-dossiers refactorés | 🟡 Indirection inutile |
+| `ui/dropdown-menu.tsx`, `ui/tabs.tsx`, `ui/accordion.tsx` (plats) | Re-exports vers les dossiers refactorés | 🟢 Acceptable |
+
+### Recommandation
+
+Exécuter `npx ts-prune` ou `npx madge --extensions ts,tsx --circular src/` pour un rapport complet d'orphelins et de dépendances circulaires.
+
+---
+
+## H7. Dépendances inutilisées
+
+### Potentiellement inutilisées
+
+| Dépendance | Status | Raison |
+|-----------|--------|--------|
+| `@dnd-kit/utilities` | ⚠️ À vérifier | Peut être importé indirectement par `@dnd-kit/sortable` |
+| `swagger-ui-dist` | ⚠️ À vérifier | `swagger-ui-react` pourrait l'importer en interne |
+| `rollup-plugin-visualizer` | ✅ OK | Utilisé dans vite.config.ts (pas dans src/) |
+
+[DONNÉES INSUFFISANTES — nécessite `npx depcheck` pour un rapport exhaustif]
+
+---
+
+## Priorisation de la dette
+
+| Priorité | Élément | Impact | Effort | Ratio |
+|----------|---------|--------|--------|-------|
+| P0 | Split `client.ts` (2237L) | Maintenabilité, testabilité | L | Élevé |
+| P0 | Résoudre dualité AuthContext vs authStore | Bugs auth, confusion | M | Très élevé |
+| P1 | Supprimer `pages/auth/` legacy | Clarté code | S | Élevé |
+| P1 | Unifier toast API (addToast vs toast) | Cohérence DX | M | Élevé |
+| P1 | Split `usePlaylist.ts` (631L) | Maintenabilité | M | Moyen |
+| P1 | Résoudre layout/Sidebar vs ui/Sidebar | Clarté | S | Élevé |
+| P2 | Migrer z-[N] vers tokens SUMI | Cohérence design | M | Moyen |
+| P2 | Ajouter `React.memo` sur les composants de liste | Performance | S | Moyen |
+| P2 | Réduire `as any` dans client.ts (48 occ.) | Type safety | L | Faible |
+| P2 | Nettoyer components/views/ wrappers legacy | Clarté | M | Moyen |
+
+**Score dette technique implicite : 6/10** — Dette structurelle significative (migration incomplète) mais codebase fonctionnelle avec de bons patterns.

apps/web/dev_audit/frontend/09_scalability_ui.md

@@ -0,0 +1,147 @@
+# Phase I — Scalabilité UI
+
+---
+
+## I1. Ajout de 50 écrans
+
+### Routing — ⚠️ Partiel
+
+- L'architecture de routing `routeConfig.tsx` est centralisée avec des fonctions `getPublicRoutes()`, `getProtectedRoutes()`, etc. [routeConfig.tsx:57-109]. **Ajouter une route est simple** (une ligne), mais toutes les routes sont dans un seul fichier.
+- Pour 50 écrans supplémentaires, ce fichier deviendrait un bottleneck. **Recommandation** : migrer vers un routing file-based ou colocalisé par feature.
+- Le lazy loading via `createLazyComponent` [lazy-component/createLazyComponent.tsx] est scalable — chaque nouvelle page est automatiquement code-splittée.
+
+### Design system — ✅ Prêt
+
+- Le design system SUMI v2.0 couvre les primitives nécessaires : Button (7 variants), Input, Select, Dialog, Tabs, Card, Badge, Table, DropdownMenu, DatePicker, etc. [02_design_system_inventory.md]
+- Les tokens (couleurs, typo, spacing, shadows) sont suffisamment riches pour supporter de nouveaux écrans sans modification.
+
+### Convention de nommage — ✅ Prêt
+
+- Pattern feature-based clair : `features/{name}/pages/`, `features/{name}/components/`, `features/{name}/hooks/`
+- Convention PascalCase pour les composants, camelCase pour les hooks
+- Pattern `XxxSkeleton.tsx`, `XxxEmpty.tsx`, `useXxx.ts`, `types.ts`, `index.ts` bien établi
+
+### State management — ✅ Prêt
+
+- Zustand pour l'état global (UI, auth, cart) est scalable — chaque feature peut avoir son store
+- React Query pour le server state est naturellement scalable — chaque query est indépendante
+- La combinaison des deux évite un store central monolithique
+
+**Verdict** : ⚠️ Partiel — Le design system et le state management sont prêts, mais le routing centralisé et la migration incomplète `components/views/` → `features/pages/` freinent.
+
+---
+
+## I2. Theming / Dark mode
+
+### Tokenisation — ✅ Prêt
+
+- **100% des couleurs sont tokenisées** dans `index.css` via CSS variables SUMI [index.css:15-296]
+- 0 couleur hardcodée (`bg-[#...]`) dans les className ✅
+- Palette complète dark + light définie [index.css:301-364]
+
+### Migration effort — Minimal
+
+- 24 fichiers utilisent le préfixe `dark:` de Tailwind — ce qui est **très peu** car le theming est géré par `data-theme` attribute + CSS variables, pas par le mécanisme `dark:` de Tailwind.
+- Le switch de thème est fonctionnel via `uiStore.setTheme()` [stores/ui.ts:35-51] et `ThemeProvider` [components/theme/ThemeProvider.tsx]
+
+### Valeurs hardcodées à migrer
+
+- `#ffffff` dans `index.css:363` (primary-foreground light) — acceptable dans le fichier de tokens
+- `#8b7ec8` pour chart-5 [index.css:240] — dans les tokens
+- Couleurs contextuelles (graffiti-magenta, gaming-gold, terminal-green, sakura) [index.css:202-205] — dans les tokens
+
+**Verdict** : ✅ Prêt — Le theming est pleinement fonctionnel avec un effort minimal pour ajouter des thèmes supplémentaires.
+
+---
+
+## I3. Internationalisation (i18n)
+
+### Système en place
+
+- **i18next** + **react-i18next** + **i18next-browser-languagedetector** installés [package.json]
+- Configuration dans `lib/i18n.ts` ✅
+- **2 langues** : `en.json` et `fr.json` dans `src/locales/` ✅
+- Hook `useTranslation.ts` custom disponible [hooks/useTranslation.ts]
+
+### Adoption
+
+- **~80+ fichiers** utilisent `useTranslation` ou `t()` — adoption significative
+- **~35+ fichiers** contiennent des **strings hardcodées** en anglais dans le JSX :
+  - `"No Cover"`, `"No lyrics available"`, `"No courses found"`, `"No messages yet"`, `"No equipment found"`, `"Loading..."`, `"Error"` [voir 08_technical_debt_frontend.md]
+  - Ces strings devraient utiliser `t()` pour être traduisibles
+
+### RTL support
+
+- ❌ **Aucun support RTL** détecté. Pas de `dir` attribute, pas de classes `rtl:`.
+- Pour l'arabe, l'hébreu, etc., une refonte du layout serait nécessaire.
+
+### Formatage dates/nombres
+
+- `date-fns` (4.1.x) installé — supporte la localisation ✅
+- La localisation de date-fns est-elle configurée avec i18next ? [DONNÉES INSUFFISANTES]
+
+**Verdict** : ⚠️ Partiel — Le système i18n est en place et partiellement adopté, mais ~35+ fichiers ont des strings hardcodées et le RTL n'est pas supporté.
+
+---
+
+## I4. White-labeling / Multi-tenant UI
+
+### Logo et branding
+
+- ❌ Le logo/branding semble hardcodé dans les composants (à vérifier dans Header/Sidebar)
+- Les couleurs sont tokenisées → changement de palette possible
+- Les polices sont en variables CSS → personnalisables
+
+### Couleurs externalisables
+
+- ✅ Via les CSS variables SUMI — un tenant pourrait surcharger les variables `:root`
+- Les couleurs contextuelles (graffiti-magenta, gaming-gold, etc.) montrent une flexibilité de palette
+
+### Layouts personnalisables
+
+- ❌ Les layouts (Sidebar, Header, DashboardLayout) sont codés en dur
+- Pas de configuration de layout par tenant
+
+**Verdict** : ❌ Bloqué — Le white-labeling nécessiterait un refactoring significatif pour externaliser le branding, bien que les tokens CSS offrent une base.
+
+---
+
+## I5. Performance à l'échelle
+
+### Virtualisation des listes
+
+- ✅ `@tanstack/react-virtual` installé et utilisé [package.json, components/ui/virtualized-list/VirtualizedList.tsx]
+- `VirtualizedList.tsx` (125L) — composant générique de virtualisation
+- Chat messages virtualisés [features/chat/components/virtualized-chat-messages/]
+
+### Pagination
+
+- ✅ **Pagination serveur** implémentée dans les services API :
+  - `playlistService.ts` : `page`, `limit`, `safeLimit`, `safePage` [playlistService.ts]
+  - `trackService.ts` : `page`, `limit` en query params [trackService.ts]
+  - `socialService.ts` : `page = 1` [socialService.ts]
+  - `marketplaceService.ts` : `page`/`limit` [marketplaceService.ts]
+- Composants de pagination UI : `TrackListPaginationNav.tsx` (148L), `TrackListPaginationInfo.tsx` (25L)
+
+### Infinite scroll
+
+- `features/tracks/hooks/useInfiniteScroll.ts` — hook dédié ✅
+- `components/ui/virtualized-list/useInfiniteScroll.ts` — hook pour la liste virtualisée ✅
+
+### Cursor-based pagination
+
+- ❌ Pas de pagination cursor-based détectée — uniquement offset/limit
+
+**Verdict** : ✅ Prêt — Virtualisation, pagination serveur et infinite scroll sont en place.
+
+---
+
+## Tableau récapitulatif
+
+| Dimension | Verdict | Détail |
+|-----------|---------|--------|
+| Ajout de 50 écrans | ⚠️ Partiel | DS prêt, routing centralisé à améliorer |
+| Theming / Dark mode | ✅ Prêt | 100% tokenisé, dark/light fonctionnel |
+| i18n | ⚠️ Partiel | Système en place, adoption ~70%, pas de RTL |
+| White-labeling | ❌ Bloqué | Branding hardcodé, pas de config par tenant |
+| Performance à l'échelle | ✅ Prêt | Virtualisation, pagination, infinite scroll |

apps/web/dev_audit/frontend/10_recommendations.md

@@ -0,0 +1,183 @@
+# Phase K — Score Global & Recommandations
+
+---
+
+## Tableau de synthèse
+
+| Catégorie | Score /10 | Pondération | Score pondéré | Justification (1 phrase) |
+|-----------|-----------|-------------|---------------|--------------------------|
+| Architecture | 7.0 | ×1.3 | 9.1 | Feature-based solide mais migration incomplète (dualité views/features, AuthContext/authStore) |
+| Design System | 7.5 | ×1.0 | 7.5 | SUMI v2.0 mature avec tokens complets, dark/light, quelques fuites z-index |
+| Cohérence UI | 6.5 | ×1.0 | 6.5 | Composants bien centralisés, toast dualité et `variant="glass"` non défini |
+| Accessibilité | 5.5 | ×1.0 | 5.5 | ARIA correct, focus-visible, mais sémantique HTML insuffisante et skip nav absent |
+| Sécurité | 7.0 | ×1.5 | 10.5 | httpOnly JWT, DOMPurify, Zod, mais open redirect et API keys en localStorage |
+| Performance | 6.5 | ×1.2 | 7.8 | Lazy loading systématique, request dedup, mais React.memo insuffisant |
+| Dette technique | 6.0 | ×1.0 | 6.0 | client.ts monolithe (2237L), dualité structurelle, ~262 `any`/`as any` en prod |
+| Scalabilité | 6.5 | ×1.0 | 6.5 | Theming prêt, virtualisation OK, i18n partiel, pas de white-labeling |
+| Maturité perçue | 6.5 | ×1.0 | 6.5 | Identité SUMI distinctive, beta avancée, features ComingSoon |
+| **SCORE GLOBAL** | | | **66.0 / 99** | |
+| **Moyenne pondérée** | | | **6.6 / 10** | |
+
+---
+
+## Recommandations immédiates (semaine 1-2)
+
+### 1. Corriger l'open redirect dans usePlaylistNotifications
+
+- **Fichier** : `features/playlists/hooks/usePlaylistNotifications.ts:203,219,235,251`
+- **Temps estimé** : 30 min
+- **Impact** : Ferme une vulnérabilité de sécurité exploitable
+- **Action** : Valider `notification.link` avant `window.location.href` (vérifier que l'URL est same-origin ou dans une allowlist)
+
+### 2. Résoudre la dualité AuthContext vs authStore
+
+- **Fichiers** : `context/AuthContext.tsx`, `providers/AuthProvider.tsx`
+- **Temps estimé** : 2-4h
+- **Impact** : Élimine la source de bugs auth, simplifie le modèle mental
+- **Action** : Supprimer `AuthContext.tsx` et `AuthProvider.tsx`, s'assurer que tous les imports utilisent `useAuthStore`
+
+### 3. Ajouter un skip navigation link
+
+- **Fichier** : `components/layout/Layout.tsx` ou `app/App.tsx`
+- **Temps estimé** : 30 min
+- **Impact** : Conformité WCAG 2.4.1
+- **Action** : Ajouter `<a href="#main-content" className="sr-only focus:not-sr-only ...">Skip to content</a>` + `id="main-content"` sur le `<main>`
+
+### 4. Définir la variante `glass` dans Button
+
+- **Fichier** : `components/ui/button.tsx:14-35`
+- **Temps estimé** : 15 min
+- **Impact** : Corrige des boutons sans style dans CloudIntegrationView et GearViewHeader
+- **Action** : Ajouter `glass: 'bg-white/10 text-foreground backdrop-blur-md border border-white/20 hover:bg-white/20'` dans `buttonVariants`
+
+### 5. Supprimer les fichiers legacy auth
+
+- **Fichiers** : `pages/auth/Login.tsx`, `pages/auth/Register.tsx`, `pages/auth/Login.test.tsx`, `pages/auth/Register.test.tsx`
+- **Temps estimé** : 30 min
+- **Impact** : Élimine la confusion, réduit le code mort
+- **Action** : Supprimer les fichiers, vérifier qu'aucun import ne les référence
+
+---
+
+## Recommandations court terme (mois 1-2)
+
+### 1. Éclater `client.ts` (2237L)
+
+- **Description** : Découper le client HTTP monolithique en modules cohérents
+- **Prérequis** : Aucun
+- **Effort** : L
+- **Impact** : Critique — maintenabilité et testabilité
+- **Découpage** : `httpClient.ts`, `requestValidation.ts`, `responseCache.ts`, `requestInterceptors.ts`, `validationMetrics.ts`
+
+### 2. Terminer la migration `components/views/` → `features/pages/`
+
+- **Description** : Migrer les 20 sous-dossiers de `components/views/` vers `features/*/pages/`
+- **Prérequis** : Convention de migration définie
+- **Effort** : XL
+- **Impact** : Majeur — architecture cohérente
+- **Suggestion** : Migrer 3-4 views par sprint
+
+### 3. Unifier le système de toast
+
+- **Description** : Choisir entre `addToast()` et `toast()` react-hot-toast, supprimer l'autre
+- **Prérequis** : Aucun
+- **Effort** : M
+- **Impact** : Majeur — cohérence DX et UX
+
+### 4. Enrichir la sémantique HTML
+
+- **Description** : Ajouter `<aside>` pour la sidebar, `<article>` pour les cards de contenu, `<section>` pour les zones de page
+- **Prérequis** : Aucun
+- **Effort** : M
+- **Impact** : Majeur — accessibilité
+
+### 5. Split `usePlaylist.ts` (631L)
+
+- **Description** : Découper en `usePlaylistCrud`, `usePlaylistCollaboration`, `usePlaylistAnalytics`
+- **Prérequis** : Aucun
+- **Effort** : M
+- **Impact** : Modéré — maintenabilité
+
+### 6. Migrer z-index arbitraires vers tokens SUMI
+
+- **Description** : Remplacer les ~31 fichiers avec `z-[N]` par `z-[var(--sumi-z-*)]` ou les classes utility
+- **Prérequis** : Inventaire z-index complet
+- **Effort** : M
+- **Impact** : Modéré — cohérence design system
+
+### 7. Ajouter `React.memo` sur les composants de liste
+
+- **Description** : Mémoriser TrackList items, PlaylistList items, ChatMessages, SearchResults
+- **Prérequis** : Aucun
+- **Effort** : S
+- **Impact** : Modéré — performance rendu
+
+### 8. Compléter l'adoption i18n
+
+- **Description** : Migrer les ~35 fichiers avec strings hardcodées vers `t()`
+- **Prérequis** : Enrichir en.json et fr.json
+- **Effort** : L
+- **Impact** : Modéré — internationalisation
+
+### 9. Ajouter `loading="lazy"` natif sur les images
+
+- **Description** : Compléter le lazy loading JS par l'attribut natif
+- **Prérequis** : Aucun
+- **Effort** : S
+- **Impact** : Modéré — performance
+
+### 10. Résoudre la dualité layout/Sidebar vs ui/Sidebar
+
+- **Description** : Fusionner ou distinguer clairement les deux composants Sidebar
+- **Prérequis** : Comprendre les usages
+- **Effort** : S
+- **Impact** : Modéré — clarté code
+
+---
+
+## Recommandations long terme (trimestre)
+
+### Consolidation du design system
+
+- Publier SUMI v2.1 avec toutes les variantes manquantes (glass button, etc.)
+- Créer un Storybook complet avec tous les composants documentés
+- Établir un processus de review design pour chaque PR modifiant un composant UI
+
+### Migration architecturale
+
+- Terminer la migration `components/views/` → `features/pages/`
+- Évaluer un passage à TanStack Router pour un routing file-based
+- Envisager de déplacer les 30 sous-dossiers de `components/{domain}/` vers les features correspondantes
+
+### Performance
+
+- Implémenter le Server-Side Rendering (SSR) ou Static Site Generation (SSG) pour les pages publiques (profils, marketplace)
+- Auditer et optimiser le bundle (tree-shaking framer-motion, subset fonts)
+- Ajouter des tests de performance (Lighthouse CI déjà configuré mais non vérifié en fonctionnement)
+
+### Accessibilité
+
+- Viser la conformité WCAG 2.1 AA complète
+- Ajouter `aria-hidden` systématique sur les icônes Lucide
+- Remplacer les `role="button"` sur div par des `<button>` natifs
+- Implémenter un audit automatisé a11y dans la CI (pa11y-ci est installé)
+
+---
+
+## Verdict final
+
+### 1. Le frontend est-il présentable pour un investisseur aujourd'hui ?
+
+**OUI, avec réserves.** Le design system SUMI donne une identité forte et distinctive. L'architecture est ambitieuse et la stack est moderne. Cependant, les 5 routes « ComingSoon », la migration incomplète et le loading screen non-brandé trahissent un produit en développement actif. Pour une démo investisseur, masquer les routes ComingSoon et ajouter un splash screen brandé serait recommandé.
+
+### 2. Le frontend peut-il scaler sans refonte architecturale ?
+
+**OUI.** L'architecture feature-based, le design system tokenisé, React Query pour le server state, et Zustand pour le client state sont des choix scalables. La virtualisation et la pagination serveur sont en place. Les problèmes identifiés (migration incomplète, client.ts monolithe) sont des dettes de refactoring, pas des blocages architecturaux. Un refactoring progressif suffit.
+
+### 3. Une refonte complète est-elle nécessaire ou un refactoring suffit ?
+
+**UN REFACTORING SUFFIT.** Les fondations sont saines : TypeScript strict, design system formalisé, tests présents, patterns modernes. La dette est structurelle (dualité views/features, AuthContext legacy) et technique (client.ts trop gros, `any` types), pas architecturale. Un plan de refactoring sur 2-3 mois avec des migrations progressives est la bonne approche.
+
+### 4. Le projet respecte-t-il les standards minimaux d'un SaaS B2B/B2C en 2025 ?
+
+**OUI, pour un produit en beta.** Le design system, le theming, l'i18n partiel, la sécurité (httpOnly JWT, CSRF, DOMPurify), les tests, le Storybook, et l'architecture feature-based sont conformes aux standards SaaS. Les lacunes (accessibilité sémantique, skip nav, React.memo, i18n incomplet) sont des points d'amélioration, pas des blocages. Le produit est au-dessus de la moyenne pour un projet en beta mais en dessous des standards d'un produit GA (General Availability).

apps/web/dev_audit/frontend/10a_visual_identity.md

@@ -0,0 +1,105 @@
+# Phase J — Identité Visuelle & Maturité Perçue
+
+---
+
+## J1. Perception professionnelle
+
+### 1. Confiance — 7/10
+
+Un utilisateur lambda **ferait probablement confiance** à ce produit en 5 secondes. Les raisons :
+
+**Positif** :
+- Design system SUMI v2.0 avec une identité visuelle distinctive (thème sombre « encre et lumière », grains de papier washi, typographie Space Grotesk) [index.css:6-10, 460-471]
+- Palette de couleurs sophistiquée et cohérente — pas un template générique
+- Effets glass/blur subtils [index.css:621-626]
+- Custom scrollbar raffiné [index.css:478-503]
+- Text selection stylisée [index.css:473-476]
+- Animations soignées avec `prefers-reduced-motion` respecté [index.css:850-858]
+
+**Négatif** :
+- Le nombre élevé de features « ComingSoon » (Gear, Live, Education, Queue, Developer) [routeConfig.tsx:96-101] trahit un produit en développement
+- Le `AstralBackground.tsx` (142L) — effet de fond spatial qui peut sembler amateur si mal dosé
+- Loading screen minimal (spinner + "Chargement...") [App.tsx:161-168] — pas de branded loading
+
+### 2. Cohérence — 7/10
+
+L'interface **donne majoritairement** l'impression d'avoir été conçue par une seule personne.
+
+- Le design system SUMI est appliqué de manière relativement uniforme
+- Les tokens sémantiques (`bg-background`, `text-foreground`, `text-muted-foreground`) sont utilisés partout
+- Les composants UI primitives sont bien centralisés et réutilisés
+- **Points de rupture** : la dualité `components/views/` vs `features/pages/` crée des incohérences stylistiques mineures entre les écrans refactorés (SUMI natif) et les legacy (patterns plus anciens)
+
+### 3. Maturité — Beta avancée (6.5/10)
+
+Le produit ressemble à un **produit en beta / pre-release** :
+
+- Architecture sophistiquée (design system formalisé, feature flags, i18n)
+- Composants bien structurés avec skeletons et empty states
+- Features planifiées avec placeholders « ComingSoon »
+- Migration architecturale en cours (dual patterns visible)
+- Pas encore la finition d'un produit mature (skip nav absent, `loading="lazy"` absent, quelques inline styles)
+
+### 4. Positionnement — 7/10
+
+L'esthétique correspond bien à la cible : **plateforme créative audio / collaboration musicale**.
+
+- Le thème sombre est adapté aux créateurs audio (comme FL Studio, Ableton)
+- Les touches japonaises (SUMI, washi, Noto Serif JP) donnent un caractère distinctif
+- Les couleurs (accent bleu-acier, vermillion, sage, gold) sont appropriées pour un outil créatif
+- Le player audio intégré (PlayerBar, WaveformVisualizer, ProgressBar) montre le focus sur l'audio
+
+### 5. Différenciation — 8/10
+
+Il y a **une identité visuelle distinctive** :
+
+- Ce n'est **pas** un template Material, Bootstrap ou Tailwind UI standard
+- Le design system SUMI avec sa philosophie « encre et lumière » est original
+- La texture grain de papier [index.css:460-471] et les effets washi sont distinctifs
+- Les 4 « pigments » (accent, vermillion, sage, gold) [index.css:46-64] créent une palette reconnaissable
+- La typographie (Space Grotesk + Inter) est un choix distinctif vs le ubiquitaire Inter seul
+
+---
+
+## J2. Comparaison concurrentielle
+
+### Produit comparable
+
+L'UI se rapproche le plus de **Splice** ou **BandLab** en termes de positionnement, avec une influence esthétique rappelant **Linear** (design system rigoureux, dark-first, animations subtiles) et **Discord** (sidebar navigation, chat intégré, gamification).
+
+### Écart avec les leaders
+
+| Leader | Écart perçu | Détail |
+|--------|-------------|--------|
+| Splice | Moyen | Splice a un polish plus élevé sur les interactions et les transitions |
+| BandLab | Faible | Le design system SUMI est plus sophistiqué |
+| SoundCloud | Moyen | SoundCloud a un waveform player plus abouti et une identité de marque plus forte |
+| Linear | Significatif | Linear a une finition pixel-perfect que Veza n'a pas encore atteint |
+
+### 3 éléments qui tirent le produit vers le bas
+
+1. **Features « ComingSoon »** — 5 routes avec placeholder générique, donnent une impression de produit incomplet
+2. **Loading screen non-brandé** — Simple spinner + texte « Chargement... », pas de logo, pas d'animation branded
+3. **Migration visuelle incomplète** — Les écrans non-refactorés (legacy views) peuvent avoir un style légèrement décalé par rapport aux écrans SUMI natifs
+
+### 3 éléments visuels qui fonctionnent bien
+
+1. **Design system SUMI** — Identité cohérente et distinctive avec les tokens, la palette 4 pigments, et la philosophie « encre et lumière »
+2. **Skeleton loading** — Les skeletons systématiques dans chaque view donnent une impression de fluidité et de professionnalisme
+3. **Composants audio** — WaveformVisualizer, PlayerBar, ProgressBar montrent un soin particulier pour le cœur de métier (audio)
+
+---
+
+## Score Maturité Perçue
+
+| Critère | Points | Justification |
+|---------|--------|---------------|
+| Identité visuelle | +2 | SUMI v2.0 distinctif, pas un template |
+| Cohérence globale | +1.5 | Tokens bien appliqués, quelques legacy breaks |
+| Polish des interactions | +1 | Animations, transitions, hover states |
+| Features incomplètes | -1 | 5 routes ComingSoon |
+| Loading experience | -0.5 | Pas de branded loading |
+| Migration visible | -0.5 | Dualité stylistique entre refactoré et legacy |
+| Audio UI quality | +1 | Cœur de métier soigné |
+| Dark/Light theme | +0.5 | Les deux thèmes sont complets |
+| **Total** | **6.5/10** | **Beta avancée avec identité forte** |

apps/web/dev_audit/frontend/AUDIT_COMPLETE.md

@@ -0,0 +1,31 @@
+# AUDIT FRONTEND COMPLET
+
+**Date** : 2026-02-12
+**Score global** : **6.6 / 10** (moyenne pondérée)
+**Verdict** : Beta avancée, solide mais refactoring nécessaire
+
+---
+
+## Score par catégorie
+
+| Catégorie | Score |
+|-----------|-------|
+| Architecture | 7.0 |
+| Design System | 7.5 |
+| Cohérence UI | 6.5 |
+| Accessibilité | 5.5 |
+| Sécurité | 7.0 |
+| Performance | 6.5 |
+| Dette technique | 6.0 |
+| Scalabilité | 6.5 |
+| Maturité perçue | 6.5 |
+
+---
+
+## 3 actions les plus urgentes
+
+1. **Corriger l'open redirect** dans `usePlaylistNotifications.ts:203,219,235,251` — valider `notification.link` avant redirection. (30 min, impact sécurité)
+
+2. **Supprimer `context/AuthContext.tsx`** et `providers/AuthProvider.tsx` — deux sources de vérité pour l'auth coexistent avec `authStore`. (2-4h, élimine une classe de bugs)
+
+3. **Ajouter un skip navigation link** dans le layout principal — conformité WCAG 2.4.1 de base. (30 min, impact accessibilité)

apps/web/docs/A11Y_AUDIT.md

@@ -0,0 +1,33 @@
+# Audit accessibilité (a11y)
+
+Rapport des violations et corrections pour atteindre un niveau Discord/Spotify (contraste, focus, labels, structure).
+
+## Comment lancer l’audit
+
+1. Démarrer Storybook : `npm run storybook` (depuis `apps/web`).
+2. Ouvrir l’addon **Accessibility** (a11y) dans la barre du bas.
+3. Lancer les stories full layout : **Layouts / DashboardLayout** (Dashboard, Playlists, Library, Settings, Profile).
+4. Lancer les composants critiques : **Sidebar**, **Header**, **GlobalPlayer**, **ErrorDisplay**, **Button**, **Input**, modales (AddToPlaylistModal, etc.).
+5. Noter chaque violation : composant, règle (ex. aria-valid-attr-value, color-contrast), description, sévérité (critical / serious / moderate), correction proposée.
+6. Mettre à jour ce fichier avec les entrées ci‑dessous et le statut (Résolu / Reporté / En attente).
+
+## Format d’une entrée
+
+| Composant | Règle | Description | Sévérité | Correction | Statut |
+|-----------|--------|-------------|----------|------------|--------|
+| (ex. Sidebar) | (ex. color-contrast) | (ex. Texte gris sur fond sombre < 4.5:1) | serious | Utiliser text-muted-foreground avec ratio vérifié | En attente |
+
+## Violations connues et actions
+
+- **Focus visible** : Couverture étendue (Phase A5) — ring focus-visible ajouté sur Select, listes, cards, dropdown trigger, etc. À valider en navigation clavier (Tab, Enter, Escape).
+- **Labels** : Vérifier que les icônes-only (fermeture modale, queue, volume, etc.) ont `aria-label` ou `title`. Sidebar et Header déjà partiellement couverts.
+- **Contraste** : Lancer l’addon a11y sur les stories en thème dark pour lister les paires foreground/background en dessous du ratio recommandé (4.5:1 texte normal, 3:1 gros texte).
+- **Live regions** : Toasts et messages d’erreur — s’assurer que `role="alert"` ou `aria-live="polite"` sont utilisés où pertinent (composant Toast, ErrorDisplay en bannière).
+- **Modales** : Vérifier `aria-modal="true"`, `aria-labelledby` / `aria-describedby` sur les dialogs (Radix Dialog déjà conforme ; modales custom à auditer).
+
+## Prochaines étapes
+
+1. Exécuter l’audit Storybook a11y sur les stories listées ci‑dessus.
+2. Remplir le tableau des violations avec les résultats.
+3. Corriger en priorité les violations **critical** et **serious**.
+4. Vérification manuelle : lecteur d’écran (NVDA/VoiceOver) et navigation clavier seule sur les parcours Dashboard → Library → Playlist → Player.

apps/web/docs/APP_SHELL.md

@@ -0,0 +1,143 @@
+# App Shell — Référence (SUMI)
+
+Vue d'ensemble du shell applicatif (layout principal) et des tokens CSS SUMI associés. Toute évolution du shell (sidebar, header, main, player) doit s'appuyer sur ces variables et classes pour rester cohérente.
+
+Source de vérité : [index.css](../src/index.css) — sections "LAYOUT", "GLASS", "Z-INDEX" et les classes utilitaires `@utility`.
+
+## Rôle du shell
+
+- **Header** : barre fixe en haut (hauteur `--header-height`). Fond **glass** (`--sumi-glass-bg`), `backdrop-blur-[12px]` (`--sumi-glass-blur`), bordure basse `--sumi-border-faint`, z-index **200** (`--sumi-z-sticky`). Le bord gauche suit la sidebar (expanded/collapsed).
+- **Sidebar** : navigation fixe à gauche (largeur `--sidebar-width-expanded` / `--sidebar-width-collapsed`). Fond `--sumi-bg-raised`, bordure droite `--sumi-border-faint`. Voir [index.css](../src/index.css) section "Sidebar layout" et le mapping Shadcn `--sidebar-*`.
+- **Main** : zone scrollable (contenu des pages). Marges gauche pilotées par l'état de la sidebar ; padding top/bottom pour ne pas passer sous le header ni le player. Espacement interne via tokens SUMI (`--sumi-space-*`).
+- **Player** : barre de lecture fixe en bas (rendue par `GlobalPlayer` dans `DashboardLayout`). Fond **glass** (`--sumi-glass-bg`), `backdrop-blur-[16px]`, bordure `--sumi-glass-border`, z-index **200** (`--sumi-z-sticky`). Conteneur : `PlayerBarGlass`.
+
+Fichiers principaux :
+
+- [DashboardLayout.tsx](../src/components/layout/DashboardLayout.tsx) — assemblage Sidebar, zone main, Header, GlobalPlayer.
+- [Header.tsx](../src/components/layout/Header.tsx) — barre supérieure (glass bg, recherche, actions, user menu).
+- [PlayerBarGlass.tsx](../src/features/player/components/player-bar/PlayerBarGlass.tsx) — conteneur glassmorphism du player.
+
+## Thème et switching
+
+Le thème est piloté par l'attribut **`[data-theme]`** sur `<html>`, et non par un toggle de classe (`dark`/`light`).
+
+- `ThemeProvider` (`src/components/theme/ThemeProvider.tsx`) pose `data-theme="dark"` ou `data-theme="light"` sur `document.documentElement`.
+- Les tokens CSS sont définis dans `:root, [data-theme="dark"]` (dark par défaut) et `[data-theme="light"]` (light theme — Washi Paper).
+- Le mode `system` écoute `prefers-color-scheme` et pose le `data-theme` correspondant.
+
+## Variables CSS (shell — SUMI)
+
+### Tokens SUMI globaux (utilisés par le shell)
+
+Définis dans `:root` dans [index.css](../src/index.css) :
+
+| Variable | Valeur (dark) | Rôle |
+|----------|---------------|------|
+| `--sumi-glass-bg` | `rgba(18,18,21, 0.80)` | Fond glass (header, player) |
+| `--sumi-glass-border` | `rgba(255,255,255, 0.08)` | Bordure glass |
+| `--sumi-glass-blur` | `12px` | Flou glass (header) |
+| `--sumi-bg-raised` | `#1a1a1f` | Fond sidebar |
+| `--sumi-border-faint` | `rgba(255,255,255, 0.06)` | Bordure fine (sidebar, header) |
+| `--sumi-z-sticky` | `200` | Z-index header et player |
+| `--sumi-z-raised` | `10` | Z-index contenu principal |
+| `--sumi-header-height` | `56px` | Hauteur header (token SUMI) |
+| `--sumi-sidebar-width` | `240px` | Largeur sidebar ouverte (token SUMI) |
+| `--sumi-sidebar-collapsed` | `64px` | Largeur sidebar fermée (token SUMI) |
+| `--sumi-player-height` | `80px` | Hauteur player bar (token SUMI) |
+
+### Tokens layout du shell (classes utilitaires)
+
+Définis dans la section "App shell" de [index.css](../src/index.css) :
+
+| Variable | Valeur | Rôle |
+|----------|--------|------|
+| `--header-height` | 4rem | Hauteur de la barre header fixe |
+| `--main-offset-top` | 5rem | Padding-top du `<main>` (dégager le header) |
+| `--main-offset-bottom` | 9rem | Padding-bottom du `<main>` (réserve pour le player) |
+| `--main-margin-left-expanded` | 18rem | Marge gauche du conteneur main quand sidebar ouverte (15rem sidebar + 3rem gap) |
+| `--main-margin-left-collapsed` | 7rem | Marge gauche du main quand sidebar fermée (5rem + 2rem gap) |
+| `--header-left-expanded` | 18rem | Position `left` de la barre header quand sidebar ouverte |
+| `--header-left-collapsed` | 5rem | Position `left` de la barre header quand sidebar fermée |
+
+Les largeurs sidebar sont définies à part : `--sidebar-width-expanded` (15rem), `--sidebar-width-collapsed` (5rem). Pour garder la cohérence, ne pas modifier les marges main/header sans ajuster ces tokens de façon cohérente.
+
+## Classes utilitaires (shell)
+
+Définies dans [index.css](../src/index.css) via `@utility` :
+
+| Classe | Propriété | Usage |
+|--------|-----------|--------|
+| `.h-header` | height | Barre header et div interne du header |
+| `.pt-main` | padding-top | Élément `<main>` |
+| `.pb-main` | padding-bottom | Élément `<main>` |
+| `.ml-main-expanded` | margin-left | Conteneur principal (avec préfixe `lg:`) quand sidebar ouverte |
+| `.ml-main-collapsed` | margin-left | Conteneur principal (avec `lg:`) quand sidebar fermée |
+| `.left-header-expanded` | left | Barre header quand sidebar ouverte |
+| `.left-header-collapsed` | left | Barre header quand sidebar fermée |
+| `.max-w-layout-content` | max-width | Wrapper contenu principal (limite à `--layout-content-max-width`) |
+
+À utiliser avec le préfixe responsive `lg:` pour les marges/positions desktop (ex. `lg:ml-main-expanded`). En dessous de `lg`, la sidebar est en overlay et le main utilise `ml-0`, le header `left-0` (`max-lg:left-0`).
+
+## Apparence des zones du shell
+
+### Header
+
+```
+bg:       var(--sumi-glass-bg)       → rgba(18,18,21, 0.80)
+blur:     backdrop-blur-[12px]       → var(--sumi-glass-blur)
+border:   border-b border-[var(--sumi-border-faint)]
+z-index:  z-[200]                    → var(--sumi-z-sticky)
+height:   h-header                   → var(--header-height) = 4rem
+```
+
+### Sidebar
+
+```
+bg:       var(--sumi-bg-raised)      → #1a1a1f (dark) / #ffffff (light)
+border:   border-r border-[var(--sumi-border-faint)]
+z-index:  var(--sidebar-z-index)     → 95
+width:    w-sidebar-expanded (15rem) / w-sidebar-collapsed (5rem)
+```
+
+### Player bar
+
+```
+bg:       var(--sumi-glass-bg)       → rgba(18,18,21, 0.80)
+blur:     backdrop-blur-[16px]       → plus prononcé que le header
+border:   border border-[var(--sumi-glass-border)]
+z-index:  z-[200]                    → var(--sumi-z-sticky)
+shadow:   var(--sumi-shadow-lg) / var(--sumi-shadow-xl) au hover
+```
+
+### Main content
+
+```
+padding:  pt-main (5rem top), pb-main (9rem bottom), px-4 md:px-8
+margin:   lg:ml-main-expanded / lg:ml-main-collapsed
+wrapper:  max-w-layout-content mx-auto → limité à var(--layout-content-max-width) = 100rem
+scroll:   overflow-y-auto custom-scrollbar
+```
+
+## Comportement responsive
+
+- **lg (1024px et plus)** : sidebar fixe à gauche, main et header utilisent les classes tokenisées (expanded/collapsed selon `sidebarOpen`).
+- **En dessous de lg** : sidebar en overlay (ouverte/fermée par toggle), conteneur main en pleine largeur (`ml-0`), header en pleine largeur (`max-lg:left-0`).
+
+## Breakpoints et viewports de test
+
+| Breakpoint | Largeur | Comportement attendu |
+|------------|---------|----------------------|
+| Mobile | 320px | Sidebar overlay, main pleine largeur, header pleine largeur. |
+| Tablet | 768px | Idem (sidebar overlay jusqu'à lg). |
+| Desktop | 1024px (lg) | Sidebar fixe, main et header avec marges/positions tokenisées. |
+| Large desktop | 1280px | Même comportement que lg, contenu limité par `max-w-layout-content` si applicable. |
+
+Vérifier visuellement (ou via tests Playwright) que Sidebar, Header et Main se comportent correctement sur ces largeurs.
+
+## Référence croisée
+
+- Tokens SUMI complets (backgrounds, borders, text, glass, shadows, z-index, spacing, radius, motion) : [index.css](../src/index.css) — `:root` et `[data-theme="light"]`.
+- Tokens sidebar (largeurs, offsets, z-index) : [index.css](../src/index.css) — "Sidebar layout" et classes `.w-sidebar-expanded`, `.left-sidebar`, `.top-sidebar`, `.bottom-sidebar`, `.z-sidebar`, `.z-sidebar-overlay`.
+- Layout primitives (max-width contenu, min-height pages) : variables `--layout-content-max-width`, `--layout-page-min-height`, etc. Le `<main>` contient un wrapper `max-w-layout-content` pour le contenu.
+- Design tokens SUMI (nomenclature, philosophie) : [DESIGN_TOKENS.md](./DESIGN_TOKENS.md).
+- Direction design (esthétique SUMI) : [DESIGN_DIRECTION.md](./DESIGN_DIRECTION.md).

apps/web/docs/ARCHITECTURE.md

@@ -0,0 +1,131 @@
+# Veza Frontend Architecture Guide
+
+**Status:** Living Document  
+**Version:** 2.0 (Post-Audit 2026)
+
+This document outlines the architectural principles, patterns, and rules that govern the Veza frontend. It supersedes previous ad-hoc audit reports.
+
+---
+
+## 1. Core Philosophy: "Visual First"
+
+> "If it can't be rendered in Storybook, it is architecturally broken."
+
+We follow a **Storybook-Driven Development** (SDD) approach. 
+- **Isolation:** Every component must be renderable in isolation. Dependencies (Providers, Router, Store) must be explicit.
+- **Verification:** Storybook is our primary verification tool for UI logic and layout.
+
+---
+
+## 2. State Management Strategy
+
+We distinguish three types of state. Mixing them is strictly forbidden.
+
+### 2.1. Server State (Data) -> `React Query`
+Data that belongs to the backend (Users, Tracks, Playlists).
+- **Tool:** `@tanstack/react-query`
+- **Rule:** Never copy server data into a global store (Zustand) unless strictly necessary for client-side manipulation (e.g., a complex audio editor buffer).
+- **Caching:** Managed automatically by query keys.
+
+### 2.2. Client Global State (App) -> `Zustand`
+Data that is truly global to the client session (Auth Token, Shopping Cart, Audio Player Status).
+- **Tool:** `zustand`
+- **Rule:** Use atomic selectors to prevent render-thrashing.
+- **Structure:**
+    - `authStore`: User session.
+    - `cartStore`: E-commerce state (Items, Total).
+    - `playerStore`: Audio playback state.
+
+**Legacy Note:** `React Context` is BANNED for high-frequency state updates. It is reserved for dependency injection (Theme, i18n).
+
+### 2.3. UI Local State -> `useState` / `useReducer`
+Ephemeral state specific to a component (Modal Open/Close, Form Inputs).
+- **Rule:** If it doesn't need to persist when navigating away, it stays local.
+
+---
+
+## 3. Component Engineering
+
+We adhere to the **Smart vs Dumb** (Container vs Presentational) separation to ensure testability.
+
+### 3.1. Dumb Components (UI)
+- **Role:** Render props into HTML. Emit events via callbacks.
+- **Dependencies:** ZERO. No explicit side-effects, no API calls, no Context consumers (except Theme).
+- **Testing:** Storybook.
+
+```tsx
+// ✅ Correct Dumb Component
+export const ProductCard = ({ title, price, onAddToCart }: Props) => (
+  <div onClick={onAddToCart}>{title} - {price}</div>
+);
+```
+
+### 3.2. Smart Components (Containers)
+- **Role:** Wire data to UI.
+- **Dependencies:** Allowed (`useQuery`, `useCartStore`, `useParams`).
+- **Testing:** Integration Tests (MSW + Storybook play functions).
+
+```tsx
+// ✅ Correct Smart Component
+export const ProductCardContainer = ({ id }) => {
+  const { data } = useProduct(id);
+  const addToCart = useCartStore(s => s.addItem);
+  return <ProductCard title={data.title} onAddToCart={() => addToCart(data)} />;
+};
+```
+
+---
+
+## 4. Design System & Styling
+
+We use **Tailwind CSS** with a rigorous Design System (Kodo).
+
+- **Tokens Only:** Do not use arbitrary values (e.g., `w-[350px]`). Use design tokens (`w-sidebar`).
+- **Dark Mode:** All UI/Layout components must implement `dark:` variants.
+- **Icons:** `lucide-react`. Icons must inherit color via `currentColor`.
+
+---
+
+## 5. Storybook Usage
+
+Storybook is not optional. It is the definition of "Done".
+
+### 5.1. Decorators
+Use granular decorators from `src/stories/decorators.tsx` instead of global wrapping in `preview.tsx`.
+- `withToast`: Injects ToastProvider.
+- `withRouter`: Injects MemoryRouter.
+- `withStoreState`: Mocks Zustand state.
+
+### 5.2. Interaction Testing
+Critical user flows (e.g., Add to Cart) must have a `.play` function in their story to verify interaction without manual testing.
+
+---
+
+## 6. Testing Pyramid
+
+1. **Unit (Vitest):** Utilities, Store Reducers, Hooks.
+2. **Integration (Storybook + Vitest):** Component wiring, Props interface.
+3. **E2E (Playwright):** Critical Paths (Login, Checkout, Signup).
+
+---
+
+## 7. Feature Structure (Audit 2.1)
+
+**Pattern unique : `features/*/pages/`**
+
+- Toutes les pages principales vivent dans `src/features/<domain>/pages/`.
+- Chaque feature peut avoir : `pages/`, `components/`, `hooks/`, `services/`, `types/`.
+- Les routes chargent via `lazyExports.ts` : `import('@/features/<domain>/pages/<Page>')`.
+- Référence : [FULL_LAYOUT_PAGE.md](FULL_LAYOUT_PAGE.md).
+
+---
+
+## 8. Anti-Patterns (Dos & Don'ts)
+
+| ❌ Don't | ✅ Do |
+| :--- | :--- |
+| `useContext(CartContext)` | `useCartStore(selector)` |
+| `w-[17px]` | `w-4` or `w-5` (stick to grid) |
+| Props Drilling (> 3 levels) | Composition (Slots) or Context (if static) |
+| API calls in `useEffect` | `useQuery` |
+| `any` type | Generated types from OpenAPI |

apps/web/docs/AUDIT_UI_SPOTIFY_DISCORD_20260210.md

@@ -0,0 +1,147 @@
+# Audit Frontend UI — Qualité Spotify/Discord (10 février 2026)
+
+Audit complet du frontend pour la phase d'amélioration UI autonome. Basé sur les documents existants et l'exécution des outils de vérification.
+
+---
+
+## 1. Synthèse exécutive
+
+| Domaine | Score | Statut |
+|---------|-------|--------|
+| Design System & Tokens | 8.5/10 | 🟢 Mature |
+| Valeurs arbitraires | 6.5/10 | 🟡 À migrer |
+| Layout & Shell | 9/10 | 🟢 Excellent |
+| Typographie | 8/10 | 🟢 Bon |
+| Focus & Accessibilité | 8/10 | 🟢 Bon |
+| États Loading/Error/Empty | 8/10 | 🟢 Bon |
+| Cohérence visuelle | 8/10 | 🟢 Bon |
+
+---
+
+## 2. Forces actuelles
+
+### 2.1 Design system
+- **Tokens layout** : `index.css` définit sidebar, header, main, modales (`--layout-modal-max-height*`), lyrics, drawer, panel
+- **Modales** : Les tokens `.max-h-layout-modal`, `.max-h-layout-modal-sm`, `.max-h-layout-modal-xs`, `.max-h-layout-modal-lg` existent et sont utilisés dans CreateAPIKeyModal, FlashSaleModal, LicenceDetailsModal, QuizModal, AddToPlaylistModal, NotificationBell, LyricsEditorModal
+- **Ombres sémantiques** : `.shadow-card`, `.shadow-modal`, `.shadow-tooltip`, etc.
+- **Transitions** : Durées tokenisées (`--duration-fast`, `--duration-normal`, etc.)
+
+### 2.2 Shell
+- Sidebar, header, main alignés avec tokens
+- Player positionné correctement
+- Responsive documenté (lg breakpoint)
+
+### 2.3 Tests
+- Playwright : smoke, auth, playlists, profile, upload, visual
+- Config visuelle : `visual-complete.spec.ts`, `playwright.config.visual.ts`
+- Storybook : stories full layout (Dashboard, Playlists, Library, Settings, Profile)
+
+---
+
+## 3. Valeurs arbitraires à migrer (priorisées)
+
+### 3.1 Hauteurs critiques (composants visibles)
+
+| Fichier | Pattern | Recommandation |
+|---------|---------|----------------|
+| `ChatPage.tsx` | `h-[calc(100vh-6.25rem)]` | Token `--main-offset-top` ou nouvelle classe `h-layout-chat` |
+| `LiveStreamDetailView.tsx` | `h-[calc(100vh-6rem)]` | `min-h-layout-main` ou token dédié |
+| `ui/modal.tsx` | `h-[calc(100vh-2rem)]` | `max-h-layout-modal` |
+| `ui/ImageCropper.tsx` | `h-[80vh]` | `max-h-layout-modal-sm` (80vh) |
+| `ChatRoom.tsx` | `h-[50vh]` | `h-layout-lyrics-sm` (50vh) ou token |
+| `ChatInput.tsx` | `h-[450px]`, `h-[400px]` | `max-h-layout-panel` ou `max-h-96` |
+| `PlaybackSummary.tsx` | `h-[200px]` | `h-50` ou token chart |
+
+### 3.2 Largeurs arbitraires
+
+| Fichier | Pattern | Recommandation |
+|---------|---------|----------------|
+| `GlobalPlayer.tsx` | `max-w-[45%]` | `max-w-[min(45%,28rem)]` ou token |
+| `ChatMessage.tsx` | `max-w-[80%]`, `max-w-[150px]` | `max-w-[80%]` acceptable (bubble) ; `min-w-36` ou `min-w-40` |
+| `ChatInput.tsx` | `min-w-[150px]` | `min-w-36` (9rem) |
+| `AstralBackground.tsx` | `w-[60%]`, `h-[60%]` | Documenter exception décorative |
+| `data/Timeline.tsx` | `min-w-[200px]` | `min-w-50` (12.5rem) |
+
+### 3.3 Stories (priorité basse)
+- `h-[400px]`, `h-[200px]`, `min-h-[400px]` → `min-h-layout-story` ou `min-h-layout-page-sm` avec commentaire
+- `w-[300px]`, `w-[350px]`, `w-[500px]` → `w-80`, `w-96`, `max-w-xl` ou `min-h-layout-story`
+
+### 3.4 rounded-[var(--radius-xl)] → rounded-xl
+- Le thème Tailwind expose `--radius-xl` ; la classe `rounded-xl` devrait exister
+- Migrer `rounded-[var(--radius-xl)]` → `rounded-xl` et `rounded-[var(--radius)]` → `rounded-lg` (ou équivalent)
+
+### 3.5 NavigationProgress shadow
+- `shadow-[0_0_10px_var(--primary)]` → token `--shadow-button-primary-glow` ou classe existante
+
+---
+
+## 4. Composants à auditer (focus UI)
+
+1. **Player** : GlobalPlayer, PlayerExpanded, PlayerQueue — cohérence max-width, hauteurs
+2. **Chat** : ChatPage, ChatInput, ChatMessage, ChatRoom — layout tokens
+3. **Layout** : DashboardLayout, Sidebar, Header — vérifier pas de régression
+4. **Modales** : ui/modal.tsx — aligner sur tokens
+
+---
+
+## 5. Plan d'action (phases)
+
+### Phase 1 — Tokens layout (0 régression)
+- Ajouter `h-layout-chat` (calc(100vh - 6.25rem)) et `min-h-layout-stream` si besoin
+- Migrer ChatPage, LiveStreamDetailView, ui/modal vers tokens
+- Migrer ChatRoom, ChatInput, ImageCropper vers tokens existants
+
+### Phase 2 — Largeurs et rounded
+- GlobalPlayer : token ou max-w responsive
+- ChatMessage : min-w scale Tailwind
+- rounded-[var(...)] → rounded-xl / rounded-lg
+
+### Phase 3 — Stories et polish
+- Stories : min-h-layout-story, min-h-layout-page-sm
+- NavigationProgress : shadow token
+
+---
+
+## 6. Progrès réalisés (10 feb 2026)
+
+### Phase 1 — Commits effectués
+- **Commit 1** : Tokens layout chat/stream/modal + ChatPage, LiveStreamDetailView, Modal, ChatRoom, ChatInput
+- **Commit 2** : ImageCropper (h-layout-modal-sm), PlaybackSummary (min-h-50)
+
+### Phase 3 — Commit 3 (suite)
+- **rounded-[var(--radius-xl/md/lg/sm)]** → rounded-xl, rounded-md, rounded-lg, rounded-sm (composants + skeletons + stories)
+- **min-w/min-h** : Timeline (min-w-50), AddEquipmentView (min-h-25), MetadataForm (min-h-25)
+- **NavigationProgress** : shadow-[...] → shadow-button-primary-glow
+- **Stories** : ActivityGraph, StatCard, NotificationBell, LoadingState, ScrollArea, Skeleton, FileUploadZone → min-h-layout-page-sm, w-80, w-96, min-h-50, max-w-xl
+
+### Arbitraires restants (priorité basse, exceptions documentées)
+- AstralBackground : w-[60%] h-[60%] (décoratif)
+- ChatInput : h-[450px] (emoji picker tiers)
+- ChatMessage : max-w-[80%], max-w-[150px], h-[400px] (bulles chat)
+- GlobalPlayer : max-w-[45%] (responsive)
+- ChatMessage.stories : min-h-[200px]
+
+---
+
+## 7. Commandes de vérification
+
+```bash
+# Rapport arbitraire
+npm run report:arbitrary
+
+# Tests
+npm run test:e2e          # Playwright (auth requise)
+npm run test:visual       # Capture visuelle
+npm run test:storybook    # Storybook audit
+npm run lint
+npm run typecheck
+```
+
+---
+
+## 7. Fichiers de référence
+
+- `docs/DESIGN_TOKENS.md`
+- `docs/APP_SHELL.md`
+- `docs/UI_UX_AUDIT_DISCORD_SPOTIFY_QUALITY.md`
+- `src/index.css` (lignes 95-135 : layout primitives)

apps/web/docs/AUDIT_UI_UX_VISUEL_COMPLET.md

@@ -0,0 +1,169 @@
+# Audit UI/UX visuel complet — Qualité Discord/Spotify-like
+
+**Date** : 8 février 2025  
+**Rôle** : Lead Frontend Engineer + Design Systems Architect + UX Reviewer  
+**Référents** : Discord (densité, sidebar, clarté), Spotify (rythme, listes, player), Linear, Notion  
+**Source de vérité visuelle** : Storybook (full layout), baselines `visual-tests/`, code shell et tokens.
+
+**Méthodologie** : Analyse fondée sur le code du shell (DashboardLayout, Sidebar, Header, GlobalPlayer), les tokens (`index.css`, DESIGN_TOKENS.md, APP_SHELL.md), les rapports existants (UI_UX_AUDIT_DISCORD_SPOTIFY_QUALITY.md, VISUAL_AUDIT_REPORT.md) et l’analyse des assets dans `visual-tests/baselines/`. Les baselines actuelles (dashboard, library, header) décrivent des écrans de login lorsque l’app est capturée sans session ; pour une observation directe du shell complet, ouvrir Storybook sur `App/Layouts/DashboardLayout` → *Dashboard – full layout* (port 6006).
+
+---
+
+## 1. Résumé exécutif (10–15 lignes)
+
+L’interface Veza se situe aujourd’hui entre **produit soigné** et **produit premium**. Le shell (sidebar, header, main, player) est **structuré et tokenisé** : largeurs, marges, z-index et transitions sont centralisés dans `index.css` et `APP_SHELL.md`. La hiérarchie typographique et le rythme des pages principales (Dashboard, cartes, listes) sont **maîtrisés** sur les vues authentifiées. Les **écarts qui empêchent le niveau Discord/Spotify** sont : (1) baselines visuelles qui reflètent souvent l’état login (redirection non authentifiée), donc peu de captures du shell complet ; (2) valeurs arbitraires restantes (modales, quelques vues) et typo (`text-[10px]`) ; (3) scrollbar et effets globaux définis à plusieurs endroits ; (4) patterns Error/Empty et focus-visible pas encore systématiques. **Impression utilisateur** : application moderne, dark theme cohérent, player et sidebar soignés ; la dernière couche de polish (micro-interactions, contraste secondaire, un seul système de scrollbar) manque pour atteindre le niveau “premium”.
+
+---
+
+## 2. Constats visuels majeurs (avec références)
+
+### 2.1 Source des observations
+
+- **Storybook** : stories `App/Layouts/DashboardLayout` — *Default* (shell + placeholder), *Dashboard – full layout*, *Playlists – full layout*, *Library – full layout*, *Settings*, *Profile*. Viewport desktop, MSW actif. **Recommandation** : considérer Storybook comme source de vérité pour le shell et lancer les captures Playwright sur ces stories (pas seulement sur l’app avec auth).
+- **Baselines actuelles** (`visual-tests/baselines/`) : les captures `dashboard-desktop-dark.png`, `header-desktop-dark.png`, `library-desktop-dark.png` décrivent dans l’analyse des images des **écrans de login** (Welcome Back, Sign in, boutons sociaux). Cela indique soit une redirection login quand l’auth n’est pas disponible pendant la capture, soit un nommage à clarifier. Pour un audit shell complet, s’appuyer sur les stories full layout Storybook.
+- **Code** : `DashboardLayout.tsx`, `Sidebar.tsx`, `Header.tsx`, `GlobalPlayer.tsx`, `index.css` (tokens shell), `DESIGN_TOKENS.md`, `APP_SHELL.md`.
+
+### 2.2 Shell & structure globale
+
+| Élément | Constat visuel / code | Niveau |
+|--------|------------------------|--------|
+| **Sidebar** | Largeur tokenisée : 15rem (expanded), 5rem (collapsed). Classes `w-sidebar-expanded`, `w-sidebar-collapsed`, `transition-shell`. Sections (My Studio, Veza Network, Commerce, Library, System), labels en `text-xs` uppercase, items `px-3 py-2 rounded-lg`, indicateur actif `sidebar-active-indicator`. Densité proche Discord (liste de canaux). | **Correct à premium** |
+| **Header** | `h-header` (4rem), `backdrop-blur-md`, position `left-header-expanded` / `left-header-collapsed` selon sidebar. Recherche type Spotify (rounded-full, placeholder “What do you want to play?”). Badge “Online”, notifications, theme toggle, user menu. Rapport avec le main : `pt-main` dégage le header. | **Correct** |
+| **Player** | Barre flottante `bottom-6`, `lg:left-main-expanded` / `lg:left-main-collapsed`, `rounded-2xl`, `backdrop-blur-2xl`, barre de progression en haut, `h-20 md:h-24`. Animation d’entrée `slide-in-from-bottom-4 fade-in duration-500`, `player-bar-entrance` avec `prefers-reduced-motion` respecté. Poids visuel fort mais contenu principal reste prioritaire. | **Robuste** |
+| **Alignement global** | Main : `pt-main`, `pb-main`, `px-4 md:px-8`, `max-w-layout-content mx-auto`. Marges gauche `lg:ml-main-expanded` / `lg:ml-main-collapsed`. Grille cohérente. | **Correct** |
+
+**Conclusion shell** : **niveau actuel correct à premium**. Structure claire, tokens respectés, transitions fluides. La seule réserve : sur les captures “app” (non-Storybook), si l’utilisateur n’est pas authentifié, le shell n’est pas visible — d’où l’importance des stories full layout pour la régression visuelle.
+
+### 2.3 Rythme visuel & spacing
+
+- **Dashboard** : `space-y-6` page, `gap-4` grille stats, `gap-6` grille activité. Cartes en `Card variant="glass"` avec `transition-all duration-[var(--duration-normal)]`. Padding contenu `p-6 pb-24`.
+- **Sidebar** : `space-y-6` entre sections, `space-y-0.5` entre items, `px-3 py-2` items, `px-4 py-4` header sidebar.
+- **Tokens** : `--layout-gap`, `--layout-gap-sm`, `--layout-gap-lg` documentés. Échelle Tailwind utilisée (gap-2, gap-3, gap-4, p-3, p-4, etc.).
+- **Où le rythme est maîtrisé** : grilles Dashboard, espacement sidebar, padding main, espacement entre cartes.
+- **Où il peut casser la lecture** : rapports arbitraires signalent encore des `gap-[Xpx]` ou `p-[Xpx]` dans certains composants (modales, vues métier) ; à migrer vers l’échelle ou tokens pour un rythme 100 % cohérent type Discord/Spotify.
+
+### 2.4 Hiérarchie typographique
+
+- **Titres** : `text-3xl font-display font-bold` (Dashboard welcome), `text-2xl font-bold` (valeurs stats), sous-titres `text-sm` / `text-xs text-muted-foreground`.
+- **Sidebar** : sections en `text-xs font-medium uppercase tracking-wider`, items `text-sm font-medium`.
+- **Player** : titre piste `text-sm md:text-base font-display font-bold`, artiste `text-xs text-muted-foreground`.
+- **Reste de `text-[10px]`** : listé dans `UI_UX_AUDIT_DISCORD_SPOTIFY_QUALITY.md` (Navbar, Badge, Admin, MetadataForm, etc.) — à migrer vers `text-xs` sauf exceptions documentées (ex. avatar xs).
+- **Contraste principal / secondaire** : `text-foreground` vs `text-muted-foreground` utilisé ; à vérifier ratio AA sur `muted-foreground` (audit a11y recommandé).
+
+### 2.5 Couleurs, contrastes, surfaces
+
+- **Fonds** : `bg-background`, sidebar `bg-[var(--sidebar)]`, header `bg-transparent backdrop-blur-md`, cartes `variant="glass"`, player `bg-black/80 border border-white/10`.
+- **Hover / focus** : `hover:bg-sidebar-accent`, `hover:bg-white/5`, `focus-visible:ring-2 focus-visible:ring-primary/50` sur Sidebar et Header. Cartes `hover:border-primary/50`.
+- **Impression** : l’UI “respire” grâce au dark theme, aux espacements et au blur ; pas d’écrasement visuel. Profondeur par bordures légères et ombres sémantiques (shadow-card, shadow-player-hover).
+
+### 2.6 Composants (qualité perçue)
+
+| Composant | Classe | Commentaire |
+|-----------|--------|-------------|
+| Sidebar (nav items, sections) | **Robuste** | États actif/hover/focus cohérents, transitions tokenisées. |
+| Header (search, menu user) | **Correct** | Recherche lisible, menu dropdown ; focus-visible présent. |
+| GlobalPlayer (barre, controls) | **Robuste** | Entrée animée, barre de progression, hover sur barre. |
+| Cartes Dashboard (stats, activité) | **Correct** | Glass, hover border, pas de surcharge. |
+| Boutons (primaire, ghost) | **Correct** | Focus ring, transitions. |
+| Inputs (login/register vus en baselines) | **Correct** | Rounded-xl, contraste OK ; lien “Don’t have an account? Sign up” signalé en contraste faible dans les descriptions d’images → à renforcer. |
+| Modales (max-h) | **Fragile** | Plusieurs `max-h-[85vh]` / `max-h-[80vh]` encore en dur → migrer vers tokens `.max-h-layout-modal*`. |
+
+### 2.7 Micro-interactions & motion
+
+- **Présent** : `transition-shell` (sidebar), `duration-[var(--duration-fast)]` / `--duration-normal` sur Header, Sidebar, cartes, player. Animation d’entrée player (`slide-in-from-bottom-4`, `fade-in`). `prefers-reduced-motion: reduce` désactive `transition-shell` et `player-bar-entrance`.
+- **Où une animation apporte du sens** : déjà en place sur le player (entrée, hover barre). À étendre : feedback hover/focus uniforme sur toutes les listes et cards cliquables ; loading states sur boutons (spinner) pour les actions async.
+
+---
+
+## 3. Points forts (à préserver absolument)
+
+1. **Shell tokenisé** : une seule source (`index.css`) pour sidebar, header, main, player (largeurs, marges, offsets, z-index). Classes utilitaires `.pt-main`, `.pb-main`, `.ml-main-expanded`, `.transition-shell`, etc.
+2. **Layout primitives** : `max-w-layout-content`, `min-h-layout-main`, `min-h-layout-page`, tokens modales/lyrics documentés dans DESIGN_TOKENS.md et APP_SHELL.md.
+3. **Transitions et durées** : variables `--duration-fast`, `--duration-normal`, `--duration-slow`, `--ease-out`, `--ease-in-out` utilisées dans le shell et les composants critiques ; pas de `duration-200` en dur.
+4. **Ombres sémantiques** : `.shadow-card`, `.shadow-modal`, `.shadow-tooltip`, `.shadow-player-thumb`, `.shadow-queue-item-current`, etc. — cohérence et maintenabilité.
+5. **Sidebar** : structure claire (sections, labels, indicateur actif), focus-visible et hover cohérents, transition expand/collapse fluide.
+6. **GlobalPlayer** : positionnement aligné sur la sidebar (lg:left-main-*), entrée animée, barre de progression toujours visible, reduced-motion respecté.
+7. **Stories full layout** : DashboardLayout avec Dashboard, Playlists, Library, Settings, Profile — référence visuelle et base pour tests de régression.
+8. **Skeletons** : présents sur de nombreuses vues (Library, Playlist, Track, Chat, Settings, Profile) pour états Loading.
+9. **Règles et outillage** : ESLint no-restricted-syntax sur valeurs arbitraires, script `report-arbitrary-values.mjs`, procédure visual-tests documentée.
+
+---
+
+## 4. Points faibles critiques (ce qui empêche le niveau premium)
+
+1. **Captures visuelles shell** : les baselines “dashboard”, “library”, “header” peuvent montrer l’écran de login si l’app est capturée sans session. Le shell complet (sidebar + header + main + player) n’est pas garanti dans la régression actuelle. **Impact** : régressions layout shell non détectées.
+2. **Valeurs arbitraires restantes** : modales (`max-h-[85vh]`, etc.), quelques vues (LiveStreamDetailView, APIPlaygroundView, etc.), typo `text-[10px]` dans plusieurs fichiers. **Impact** : incohérence et maintenance difficile.
+3. **Scrollbar et effets globaux** : définitions dans `index.css`, `global-effects.css` et `fixDisplayIssues.ts` — risque d’incohérence selon l’ordre de chargement. **Impact** : expérience variable, sentiment “bricolé”.
+4. **Contraste secondaire** : texte “Don’t have an account? Sign up” et similaires (muted-foreground) signalés comme faible contraste dans les analyses d’images. **Impact** : accessibilité et lisibilité en dessous du niveau AA sur certains textes secondaires.
+5. **Patterns Error / Empty** : pas unifiés (toast vs bannière vs bloc inline ; messages et CTA empty hétérogènes). **Impact** : expérience incohérente en cas d’erreur ou liste vide.
+6. **Focus-visible** : pas sur tous les contrôles (Select, certaines listes, certaines cards). **Impact** : navigation clavier et a11y incomplètes.
+7. **Réduction de mouvement** : partielle (effets décoratifs) ; pas étendue à toutes les transitions du shell/player dans un seul bloc `prefers-reduced-motion`. **Impact** : utilisateurs sensibles au motion pas toujours respectés.
+
+---
+
+## 5. Top 10 des améliorations à plus fort impact
+
+| # | Amélioration | Impact visuel | Risque | Effort |
+|---|--------------|---------------|--------|--------|
+| 1 | **Capturer le shell en Storybook** : ajouter des tests Playwright qui ouvrent les stories DashboardLayout (Default, DashboardFullLayout) et capturent sidebar + header + main + player. Mettre à jour la doc visual-tests. | Élevé (régression shell détectée) | Faible | M |
+| 2 | **Unifier la scrollbar** : une seule source (index.css ou global-effects) avec variables CSS ; retirer ou cantonner les injections dans fixDisplayIssues. | Élevé (cohérence perçue) | Moyen | S |
+| 3 | **Tokens modales** : utiliser `.max-h-layout-modal`, `.max-h-layout-modal-sm`, etc. partout ; supprimer les `max-h-[XXvh]` dans les modales. | Moyen (design system) | Faible | M |
+| 4 | **Contraste muted-foreground** : mesurer et ajuster `--muted-foreground` (dark) pour ratio ≥ 4.5:1 ; corriger les liens secondaires (ex. “Sign up”). | Élevé (lisibilité, a11y) | Faible | S |
+| 5 | **Pattern Error unifié** : composant ou pattern (page vs liste vs formulaire) + usage systématique. | Moyen (cohérence) | Faible | M |
+| 6 | **Pattern Empty unifié** : structure commune (titre, description, CTA) + style cohérent pour librairie vide, playlist vide, queue vide, recherche sans résultat. | Moyen (cohérence) | Faible | M |
+| 7 | **Focus-visible sur tous les contrôles** : audit des éléments focusables (Select, listes, cards cliquables) et ajout du ring cohérent. | Élevé (a11y, clavier) | Faible | M |
+| 8 | **Migration text-[10px] → text-xs** : avec exceptions documentées (avatar xs, etc.). | Moyen (typo cohérente) | Faible | S |
+| 9 | **Réduction de mouvement complète** : étendre `@media (prefers-reduced-motion: reduce)` à toutes les transitions du shell et du player (sidebar, header, player bar). | Moyen (a11y) | Faible | S |
+| 10 | **Micro-interactions** : hover/focus explicites sur list items et cards cliquables ; loading spinner sur boutons d’action async. | Moyen (polish) | Faible | M |
+
+---
+
+## 6. Recommandations structurantes
+
+### 6.1 Design system
+
+- Consolider **une seule** définition des effets globaux (scrollbar, noise) et la documenter dans DESIGN_TOKENS.md.
+- Documenter les exceptions typo (avatar xs, etc.) et les tokens modales/lyrics déjà en place.
+- Ajouter un court guide “Empty state” et “Error handling” dans `docs/` et les lier depuis DESIGN_TOKENS ou STORYBOOK_CONTRACT.
+
+### 6.2 Layout
+
+- Continuer à utiliser **uniquement** les classes shell tokenisées (`pt-main`, `pb-main`, `lg:ml-main-*`, `left-header-*`, `lg:left-main-*`) ; pas de marges/padding en dur pour le shell.
+- Valider les breakpoints 320, 768, 1024, 1280 sur les stories full layout (grilles, listes, sidebar overlay).
+
+### 6.3 Composants
+
+- Classe chaque nouveau composant “feature” avec états Loading (skeleton), Error, Empty dans les stories (référence STORYBOOK_CONTRACT.md).
+- Étendre l’usage des ombres sémantiques (shadow-card, shadow-modal) et éviter les `shadow-[...]` arbitraires.
+- Boutons : feedback loading (spinner ou disabled) sur toutes les actions async.
+
+### 6.4 Motion
+
+- Utiliser **uniquement** les variables `--duration-*` et `--ease-*` pour les transitions.
+- Centraliser la logique `prefers-reduced-motion: reduce` (déjà partiellement en place) pour shell et player ; ne pas ajouter d’animations décoratives sans les désactiver en reduced-motion.
+
+---
+
+## 7. Verdict honnête
+
+> **Aujourd’hui, cette UI est à environ 70–75 % d’une qualité Discord/Spotify-like.**
+
+- **Shell et structure** : 85 % — très proche (tokens, alignements, player).
+- **Rythme et spacing** : 75 % — bon sur les pages principales ; reste des arbitraires et quelques incohérences.
+- **Typographie** : 70 % — hiérarchie claire ; reste des `text-[10px]` et contraste secondaire à renforcer.
+- **Couleurs et surfaces** : 80 % — thème cohérent, ombres sémantiques.
+- **Composants** : 70 % — sidebar et player robustes ; modales et patterns Error/Empty à unifier.
+- **Motion** : 75 % — transitions tokenisées et reduced-motion partiel ; micro-interactions à étendre.
+
+Les **2–3 prochaines semaines** ciblant : (1) captures shell Storybook + unification scrollbar, (2) tokens modales + contraste muted-foreground, (3) patterns Error/Empty et focus-visible, feront franchir le cap “produit premium” de façon visible et durable.
+
+---
+
+## 8. Références
+
+- `docs/DESIGN_TOKENS.md` — tokens layout, typo, ombres, transitions.
+- `docs/APP_SHELL.md` — shell, variables CSS, classes utilitaires, responsive.
+- `docs/UI_UX_AUDIT_DISCORD_SPOTIFY_QUALITY.md` — lacunes détaillées, phases A/B/C.
+- `visual-tests/README.md` — procédure capture/compare/update.
+- `src/components/layout/DashboardLayout.stories.tsx` — stories full layout.
+- `src/index.css` — tokens shell, `.transition-shell`, `.pt-main`, `.pb-main`, etc.

apps/web/docs/BRANDING.md

@@ -0,0 +1,149 @@
+# Branding & assets pipeline — apps/web
+
+Single source of truth for how Talas / Veza brand assets enter the codebase.
+Reference brand spec : [`CHARTE_GRAPHIQUE_TALAS.md`](../../../../Documents/TG__Talas_Group/05_EXPERIENCE_UTILISATEUR/CHARTE_GRAPHIQUE_TALAS.md).
+
+---
+
+## Architecture
+
+```
+apps/web/
+├── public/
+│   ├── favicon.svg             # SVG favicon (Mizu cyan placeholder)
+│   ├── icons/                  # PWA icons (PNG, 72x72 to 512x512)
+│   ├── fonts/                  # Self-hosted woff2 (Space Grotesk, Inter, JetBrains Mono)
+│   └── manifest.json           # PWA manifest (theme_color = #0098B5 SUMI accent)
+└── src/
+    ├── components/
+    │   ├── branding/
+    │   │   ├── Logo.tsx        # SOLE entry point for Talas / Veza wordmark + symbol
+    │   │   ├── Logo.stories.tsx
+    │   │   ├── assets/
+    │   │   │   ├── SymbolPlaceholder.tsx  # Geometric placeholder, swap for hand-drawn
+    │   │   │   ├── TalasWordmark.tsx      # (P0.1 artist deliverable — 3 variants)
+    │   │   │   └── VezaWordmark.tsx       # (P1.1 artist deliverable — 1 variant)
+    │   │   └── index.ts
+    │   └── icons/
+    │       ├── SumiIcon.tsx    # Wrapper : prefers hand-drawn, falls back to Lucide
+    │       └── sumi/           # Hand-drawn calligraphic icons (10 prioritaires)
+    │           ├── Play.tsx
+    │           ├── Pause.tsx           (TODO)
+    │           └── ...
+```
+
+---
+
+## Logo component
+
+**Always use `<Logo />`** instead of inline `<h2>VEZA</h2>` style markup.
+
+```tsx
+import { Logo } from '@/components/branding';
+
+// Default (wordmark, md, theme-aware color)
+<Logo brand="veza" />
+
+// Lockup with tagline
+<Logo brand="veza" variant="lockup" size="lg" tagline="STREAMING" />
+
+// Symbol only (favicon-style usage)
+<Logo brand="talas" variant="symbol" size="sm" />
+
+// Cyan accent
+<Logo brand="veza" variant="lockup" color="cyan" />
+```
+
+API : see [Logo.stories.tsx](../src/components/branding/Logo.stories.tsx) for all variants in Storybook.
+
+---
+
+## Asset deliverables — current status
+
+Per `BRIEF_ARTISTE_IDENTITE_VISUELLE.md` (artist Renaud, 15 avril 2026) and Sprint 3 :
+
+| Asset | Priority | Status | Location |
+|-------|----------|--------|----------|
+| TALAS wordmark × 3 (propre, sauvage, vertical) | P0.1 | ⏳ awaiting artist | `branding/assets/TalasWordmark.tsx` (pending) |
+| Hero image post-apo | P0.2 | ⏳ awaiting artist | `public/hero/` (pending) |
+| VEZA wordmark × 1 (tag fluide) | P1.1 | ⏳ awaiting artist | `branding/assets/VezaWordmark.tsx` (pending) |
+| 3-5 textures de liaison | P1.2 | ⏳ awaiting artist | `public/textures/` (pending) |
+| 3 symboles iconiques (enso, onde, libre) | P1.3 | ⏳ awaiting artist | `branding/assets/Symbol.tsx` (pending) |
+| Talas symbole (calligraphique) | — | 🟡 placeholder | `branding/assets/SymbolPlaceholder.tsx` |
+| Favicon SVG | — | 🟡 placeholder | `public/favicon.svg` |
+| 10 Sumi icons (play/pause/search/...) | — | 🟡 1/10 stubbed | `components/icons/sumi/` |
+| washi.png texture | — | ✅ inline SVG (feTurbulence) | `src/index.css:456` (no external file) |
+| Fonts (Space Grotesk + Inter + JetBrains Mono) | — | ✅ self-hosted | `public/fonts/*.woff2` |
+| PWA icons (PNG, 9 sizes) | — | 🟡 generic placeholders | `public/icons/icon-*.png` |
+
+### Naming convention
+
+- Wordmarks : `{brand}_wordmark_{variant}.svg` then exported as React component
+  - Example : `talas_wordmark_propre.svg` → `TalasWordmarkPropre.tsx`
+- Symbols : `{brand}_symbol_{type}.svg`
+- Hero / textures : `{kind}_{number}.png` (raw scans), processed to `webp` for prod
+- Always store source SVGs (vectorized) ; processed bitmaps in build
+
+### Format requirements (per BRIEF_ARTISTE §5)
+
+- **Scan minimum 600 DPI** (1200 if available). PNG/TIFF only — no JPG (bleeding edges on ink).
+- **One artwork per file**. Naming : `talas_wordmark_sauvage_01.png` etc.
+- **No retouching** before delivery — clean fond, niveaux, détourage handled in apps/web preprocessing.
+- **Paper white** (not cream) ; **encre de Chine** (not brown-tinted black) ; aquarelle limited to terreuse palette.
+
+---
+
+## How to integrate a delivered asset
+
+### Wordmark (e.g. TALAS propre)
+
+1. Receive `talas_wordmark_propre_01.png` (scan 600+ DPI).
+2. Clean fond + isolate ink in Inkscape : `File → Import → Select-by-color (white) → Delete → Trace bitmap`.
+3. Export SVG with `currentColor` fills + transparent background.
+4. Save as `apps/web/src/components/branding/assets/TalasWordmark.tsx` :
+
+   ```tsx
+   import type { SVGProps } from 'react';
+   export default function TalasWordmark(props: SVGProps<SVGSVGElement>) {
+     return (
+       <svg viewBox="0 0 240 60" xmlns="http://www.w3.org/2000/svg" {...props}>
+         {/* Pasted SVG paths here, fills set to currentColor */}
+       </svg>
+     );
+   }
+   ```
+
+5. Update `Logo.tsx` to use `<TalasWordmark />` for `brand='talas'` instead of the
+   text fallback. (Detect via prop or via fallback chain.)
+6. Storybook will show it automatically.
+
+### Sumi icon (e.g. Pause)
+
+1. Receive `pause_01.png` from artist.
+2. Vectorize manually in Inkscape (no auto-trace — preserves irregularity).
+3. Save as `apps/web/src/components/icons/sumi/Pause.tsx`.
+4. Add export to `components/icons/sumi/index.ts`.
+5. At call site :
+
+   ```tsx
+   import { SumiIcon } from '@/components/icons/SumiIcon';
+   import { PauseIcon } from '@/components/icons/sumi';
+   import { Pause } from 'lucide-react';
+
+   <SumiIcon sumi={PauseIcon} fallback={Pause} size={24} />
+   ```
+
+The `SumiIcon` wrapper handles the "use hand-drawn if available, else Lucide
+fallback" logic, so you can drop hand-drawn icons in progressively.
+
+---
+
+## Brand color guard
+
+ESLint rule (`eslint.config.js` `no-restricted-syntax` for hex literals) blocks
+new hardcoded colors. To fix a warning :
+
+- CSS context (JSX style/className/template literal) : use `var(--sumi-*)`.
+- TS / canvas context : `import { ColorVizIndigo } from '@veza/design-system/tokens-generated';`.
+
+Source of truth for all colors : `packages/design-system/tokens/primitive/color.json`.

apps/web/docs/BUNDLE_SIZE_REPORT.md

@@ -0,0 +1,125 @@
+# Bundle Size Report
+
+**Date**: 2025-01-27  
+**Action**: 6.2.1.7 - Measure bundle size before/after code splitting  
+**Status**: ✅ Complete
+
+## Summary
+
+Bundle sizes have been measured after implementing code splitting optimizations. The application demonstrates excellent code splitting with 55 chunks and a total JavaScript size of 764KB.
+
+## Total Bundle Sizes
+
+| Category | Size | Notes |
+|----------|------|-------|
+| **Total JavaScript** | **764KB** | 55 chunks |
+| **Total CSS** | **66KB** | 2 files (61KB + 4.5KB) |
+| **Total Assets** | **~3.1MB** | Includes all JS, CSS, and other assets |
+
+## Vendor Chunks
+
+| Chunk Name | Size | Description |
+|------------|------|-------------|
+| `vendor-react-core` | 209KB | React core library (React, ReactDOM, JSX runtime) |
+| `vendor-react-hook-form` | 17KB | React Hook Form library |
+| `vendor-toast` | 8.5KB | react-hot-toast library |
+
+**Total Vendor Size**: ~234KB
+
+## Feature Chunks
+
+No dedicated feature chunks found in current build. Feature code is split across page chunks and shared chunks.
+
+## Page Chunks (Lazy-Loaded Routes)
+
+Most page chunks are **4.5KB - 8.5KB**, demonstrating excellent lazy loading:
+
+| Size Range | Count | Examples |
+|------------|-------|----------|
+| **4.5KB** | 30 chunks | LoginPage, RegisterPage, SettingsPage, etc. |
+| **8.5KB** | 10 chunks | DashboardPage, LibraryPage, ProfilePage, etc. |
+| **13KB** | 1 chunk | TrackDetailPage |
+| **21KB+** | 2 chunks | Various shared chunks |
+
+**Key Observation**: All routes are properly lazy-loaded, resulting in very small initial page chunks.
+
+## Largest Chunks (Top 10)
+
+| Rank | Chunk | Size | Type |
+|------|-------|------|------|
+| 1 | `vendor-react-core` | 209KB | Vendor |
+| 2 | `chunk-BF1KxVTQ` | 65KB | Shared |
+| 3 | `chunk-Dyycus1l` | 53KB | Shared |
+| 4 | `index` | 37KB | Entry |
+| 5 | `routes` | 25KB | Router |
+| 6 | `chunk-C6FiuQKD` | 25KB | Shared |
+| 7 | `chunk-CH23-Jbb` | 21KB | Shared |
+| 8 | `chunk-1Mo5hXFS` | 21KB | Shared |
+| 9 | `vendor-react-hook-form` | 17KB | Vendor |
+| 10 | `chunk-Djr0ZY6-` | 17KB | Shared |
+
+## Code Splitting Analysis
+
+### ✅ Strengths
+
+1. **Excellent Route-Level Splitting**: All routes are lazy-loaded, with page chunks averaging 4.5-8.5KB
+2. **Vendor Isolation**: React core (209KB) is isolated in a dedicated chunk
+3. **Small Initial Bundle**: Entry chunk (`index`) is only 37KB
+4. **High Chunk Count**: 55 chunks indicate thorough code splitting
+5. **CSS Splitting**: CSS is split into separate files (61KB + 4.5KB)
+
+### 📊 Metrics
+
+- **Initial Load**: ~37KB (index) + 209KB (vendor-react-core) = **~246KB** (before gzip)
+- **Average Page Chunk**: ~6KB
+- **Total Chunks**: 55
+- **Code Splitting Ratio**: High (many small chunks vs. few large chunks)
+
+### 🔍 Observations
+
+1. **React Core is Largest**: 209KB for React is expected and acceptable
+2. **Shared Chunks**: Some shared chunks (65KB, 53KB) could potentially be further split, but current size is reasonable
+3. **No Feature Chunks**: Feature-specific chunks (player, upload, chat, studio) are not appearing as separate chunks, suggesting they may be included in shared chunks or page chunks
+
+## Recommendations
+
+### ✅ Already Optimized
+
+- Route-level lazy loading ✅
+- Vendor chunk splitting ✅
+- CSS code splitting ✅
+- Small page chunks ✅
+
+### 🔄 Potential Optimizations (Future)
+
+1. **Feature Chunks**: Consider more aggressive feature chunking if feature-specific code grows
+2. **Shared Chunk Analysis**: Investigate the 65KB and 53KB shared chunks to see if they can be further split
+3. **Tree Shaking**: Verify that unused code is being tree-shaken effectively
+
+## Comparison with Industry Standards
+
+| Metric | Veza | Industry Standard | Status |
+|--------|------|-------------------|--------|
+| Initial JS Bundle | ~246KB | < 300KB | ✅ Excellent |
+| Total JS Size | 764KB | < 1MB | ✅ Good |
+| Page Chunk Size | 4.5-8.5KB | < 50KB | ✅ Excellent |
+| Chunk Count | 55 | 20-100 | ✅ Good |
+
+## Conclusion
+
+**Bundle size optimization is excellent.** The application demonstrates:
+- ✅ Small initial bundle (~246KB)
+- ✅ Excellent route-level code splitting
+- ✅ Proper vendor chunk isolation
+- ✅ Small, focused page chunks
+- ✅ Reasonable total bundle size (764KB)
+
+**Action 6.2.1.7 Status**: ✅ Complete - Bundle sizes measured and documented.
+
+**Action 6.2.1.8 Status**: ✅ Complete - Optimization not needed. All metrics exceed industry standards:
+- Initial bundle: ~246KB (< 300KB standard) ✅
+- Total JS: 764KB (< 1MB standard) ✅
+- Page chunks: 4.5-8.5KB (< 50KB standard) ✅
+- Code splitting: Excellent (55 chunks, proper vendor isolation) ✅
+
+**Conclusion**: No optimization required. Bundle sizes are already optimal.

apps/web/docs/BUTTON_VARIANT_USAGE_AUDIT.md

@@ -0,0 +1,139 @@
+# Button Variant Usage Audit
+
+**Date**: 2025-01-27  
+**Action**: 9.3.1.1 - Audit button variant usage  
+**Purpose**: Identify usage count for each button variant to determine which variants can be removed
+
+## Summary
+
+- **Design System Button Location**: `apps/web/src/components/ui/button.tsx`
+- **Legacy Button Location**: `apps/web/src/components/base/Button.tsx` (different API)
+- **Total Variants in Design System**: 9 variants
+- **Variants Actually Used**: 5 variants
+- **Variants Unused**: 4 variants
+
+## Design System Button Variants
+
+### Available Variants (9 total)
+
+1. **default** - Primary button with cyan background
+2. **destructive** - Red variant for destructive actions
+3. **outline** - Outlined button
+4. **secondary** - Secondary button with steel background
+5. **ghost** - Minimal button with hover effect
+6. **link** - Link-style button
+7. **neon** - Neon effect button
+8. **glass** - Glass morphism effect
+9. **premium** - Premium gradient button
+
+## Usage Statistics
+
+### Variants in Use
+
+| Variant | Usage Count | Percentage | Status |
+|---------|-------------|------------|--------|
+| **ghost** | 71 | 54.2% | ✅ Most popular |
+| **outline** | 36 | 27.5% | ✅ Common |
+| **secondary** | 13 | 9.9% | ✅ Used |
+| **default** | 4 | 3.1% | ✅ Used (default variant) |
+| **destructive** | 4 | 3.1% | ✅ Used |
+| **TOTAL USED** | **128** | **97.7%** | |
+
+### Variants Unused
+
+| Variant | Usage Count | Status |
+|---------|-------------|--------|
+| **neon** | 0 | ❌ Unused - Can be removed |
+| **glass** | 0 | ❌ Unused - Can be removed |
+| **premium** | 0 | ❌ Unused - Can be removed |
+| **link** | 0 | ❌ Unused - Can be removed |
+
+### Legacy Button Variant Usage
+
+| Variant | Usage Count | Notes |
+|---------|-------------|-------|
+| **primary** | 28 | ⚠️ Legacy Button component variant (not design system) |
+
+**Note**: The `variant="primary"` usage (28 instances) refers to the legacy Button component in `components/base/Button.tsx`, which has a different API. These should be migrated to the design system Button with `variant="default"`.
+
+## Analysis
+
+### Most Popular Variants
+1. **ghost** (71 uses) - Most common, used for icon buttons, close buttons, and subtle actions
+2. **outline** (36 uses) - Common for secondary actions and form buttons
+3. **secondary** (13 uses) - Used for less prominent actions
+
+### Least Used Variants
+- **default** (4 uses) - Despite being the default, it's rarely explicitly specified
+- **destructive** (4 uses) - Used for delete/destructive actions
+
+### Unused Variants
+- **neon**, **glass**, **premium**, **link** - Zero usage across the codebase
+- These variants can be safely removed without breaking changes
+
+## Recommendations
+
+### High Priority: Remove Unused Variants
+The following variants have **zero usage** and can be removed:
+1. **neon** - No usage found
+2. **glass** - No usage found
+3. **premium** - No usage found
+4. **link** - No usage found
+
+**Impact**: No breaking changes (zero usage)
+
+### Medium Priority: Keep Core Variants
+Based on usage patterns, the following variants should be kept:
+1. **default** - Default variant (even if rarely explicit)
+2. **outline** - 36 uses (27.5%)
+3. **ghost** - 71 uses (54.2%)
+4. **destructive** - 4 uses (needed for delete actions)
+5. **secondary** - 13 uses (9.9%)
+
+**Note**: The task specifies keeping only `default`, `outline`, and `ghost`. However, `destructive` and `secondary` are also in use. This should be reviewed.
+
+### Low Priority: Migrate Legacy Buttons
+- 28 instances using `variant="primary"` from legacy Button component
+- Should be migrated to design system Button with `variant="default"`
+
+## Migration Strategy
+
+### Phase 1: Remove Unused Variants (Action 9.3.1.2)
+- Remove: `neon`, `glass`, `premium`, `link`
+- **Risk**: LOW (zero usage)
+- **Breaking Changes**: None
+
+### Phase 2: Review Secondary and Destructive
+- **secondary**: 13 uses - Consider if these can be replaced with `outline`
+- **destructive**: 4 uses - Consider if these can be replaced with `default` + red styling
+- **Decision needed**: Keep or remove these variants
+
+### Phase 3: Simplify Remaining Variants (Action 9.3.1.4)
+- Remove excessive glows from `default` variant
+- Simplify shadow effects
+
+## Files to Review
+
+### Files Using Unused Variants
+- None (all unused variants have zero usage)
+
+### Files Using Secondary Variant (13 uses)
+- Review if these can be replaced with `outline`
+
+### Files Using Destructive Variant (4 uses)
+- Review if these can be replaced with `default` + custom styling
+
+## Next Steps
+
+1. ✅ Audit complete (Action 9.3.1.1)
+2. ⏳ Remove unused variants: neon, glass, premium, link (Action 9.3.1.2)
+3. ⏳ Decide on secondary and destructive variants
+4. ⏳ Replace removed variants with default/outline/ghost (Action 9.3.1.3)
+5. ⏳ Remove excessive glows from remaining variants (Action 9.3.1.4)
+
+## Notes
+
+- The design system Button has 9 variants, but only 5 are actually used
+- 4 variants (neon, glass, premium, link) have zero usage and can be safely removed
+- The most popular variant is `ghost` (54.2% of all variant usage)
+- Legacy Button component still has 28 uses with `variant="primary"` - these should be migrated separately

apps/web/docs/CACHE_FEATURES_VERIFICATION.md

@@ -0,0 +1,108 @@
+# Cache Features Verification
+
+**Date**: 2025-01-27  
+**Actions**: 2.5.1.9, 2.5.1.10 - Verify cache invalidation and size limits  
+**Status**: ✅ Complete (Already Implemented)
+
+## Overview
+
+This document verifies that cache invalidation and size limits are already implemented in the response cache utility.
+
+## Action 2.5.1.9: Cache Invalidation on Mutations
+
+### Verification
+
+**Status**: ✅ **ALREADY IMPLEMENTED**
+
+**Implementation Location**: `apps/web/src/services/api/client.ts:486-494`
+
+**Code**:
+```typescript
+// FE-API-017: Invalidate cache on mutations
+// FE-STATE-004: Invalidate state after mutations
+if (isMutation) {
+  const url = response.config.url || '';
+  const method = response.config.method || 'POST';
+
+  // Use centralized invalidation system
+  invalidateStateAfterMutation(url, method);
+}
+```
+
+**Behavior**:
+- ✅ Automatically called for all mutations (POST, PUT, PATCH, DELETE)
+- ✅ Uses centralized `invalidateStateAfterMutation` function
+- ✅ Invalidates cache based on resource type and ID
+- ✅ Pattern-based invalidation (e.g., `/tracks/*`)
+
+**Invalidation Logic** (`apps/web/src/utils/stateInvalidation.ts`):
+- `invalidateStateAfterMutation` determines resource type from URL
+- Calls `invalidateState` with appropriate resource type
+- `invalidateCacheByResource` invalidates matching cache entries
+- Supports both pattern-based and specific resource invalidation
+
+**Example**:
+- POST `/tracks` → Invalidates `/tracks` and `/library/tracks` patterns
+- PUT `/tracks/123` → Invalidates `/tracks/123` specifically
+- DELETE `/playlists/456` → Invalidates `/playlists/456` specifically
+
+## Action 2.5.1.10: Cache Size Limits
+
+### Verification
+
+**Status**: ✅ **ALREADY IMPLEMENTED**
+
+**Implementation Location**: `apps/web/src/services/responseCache.ts:46, 240-246, 349`
+
+**Configuration**:
+```typescript
+private maxSize = 100; // Maximum cache size
+
+// In constructor
+this.maxSize = config.maxSize || this.maxSize;
+
+// Default instance
+export const responseCache = new ResponseCacheService({
+  maxSize: 100,
+  // ...
+});
+```
+
+**Eviction Logic** (lines 240-246):
+```typescript
+// Check cache size limit
+if (this.cache.size >= this.maxSize && !this.cache.has(key)) {
+  // Remove oldest entry (simple FIFO)
+  const firstKey = this.cache.keys().next().value;
+  if (firstKey) {
+    this.cache.delete(firstKey);
+  }
+}
+```
+
+**Behavior**:
+- ✅ Maximum cache size: 100 entries
+- ✅ FIFO eviction: Oldest entry removed when limit reached
+- ✅ Only evicts when adding new entry (not when updating existing)
+- ✅ Configurable via constructor options
+
+**Additional Features**:
+- Periodic cleanup removes expired entries (every minute)
+- `cleanup()` method removes entries older than TTL
+- `getStats()` method provides cache statistics
+
+## Summary
+
+Both features are **already fully implemented**:
+
+1. ✅ **Cache Invalidation**: Automatic invalidation on mutations via `invalidateStateAfterMutation`
+2. ✅ **Cache Size Limits**: 100 entry limit with FIFO eviction
+
+**No changes needed** - Actions 2.5.1.9 and 2.5.1.10 are complete.
+
+## Validation
+
+✅ Cache invalidation verified in response interceptor  
+✅ Cache size limits verified in ResponseCacheService  
+✅ FIFO eviction logic verified  
+✅ Both features working as expected

apps/web/docs/COMMENTED_CODE_AUDIT.md

@@ -0,0 +1,58 @@
+# Commented Code Audit
+
+**Date**: 2025-01-27  
+**Action**: Cleanup 8 - Audit commented-out code  
+**Status**: ✅ Complete
+
+## Summary
+
+This audit identifies commented-out code blocks that may be obsolete and safe to remove.
+
+## Methodology
+
+Searched for:
+1. Commented-out function/component definitions
+2. Commented-out imports/exports
+3. Commented-out JSX/TSX blocks
+4. Multi-line commented code blocks (/* ... */)
+5. Commented-out variable declarations
+
+**Excluded**:
+- Documentation comments (JSDoc, explanations)
+- Type generation files (`types/generated/`)
+- Single-line explanatory comments
+- License headers
+- ESLint/TSLint disable comments
+
+## Findings
+
+### Generated Files (Excluded from cleanup)
+- `apps/web/src/types/generated/*` - Auto-generated, contains legitimate comments
+
+### Files with Commented Code
+
+Most commented lines found are legitimate documentation comments, not commented-out code.
+
+**Total commented lines**: ~4,329 (includes documentation comments)
+
+### Actual Commented-Out Code Blocks
+
+**Note**: Most files contain only documentation comments. Actual commented-out code blocks are minimal.
+
+## Recommendations
+
+1. **Review manually**: The grep results show mostly documentation comments
+2. **Focus on multi-line blocks**: Look for `/* ... */` blocks that contain actual code
+3. **Check for TODO comments**: Some commented code may be marked with TODO
+4. **Preserve documentation**: Keep JSDoc and explanatory comments
+
+## Next Steps
+
+- **Cleanup 9**: Review specific files manually to identify actual commented-out code blocks
+- Focus on files with multiple consecutive commented lines
+- Remove only clearly obsolete commented code
+
+---
+
+**Last Updated**: 2025-01-27  
+**Status**: Audit complete - Ready for manual review in Cleanup 9

apps/web/docs/CONSOLE_STATEMENTS_AUDIT.md

@@ -0,0 +1,81 @@
+# Console Statements Audit
+
+**Date**: 2025-01-27  
+**Action**: Cleanup 10 - Audit console.log/error/warn statements  
+**Status**: ✅ Complete
+
+## Summary
+
+This audit identifies all console.log, console.error, and console.warn statements in the codebase and categorizes them for replacement.
+
+## Methodology
+
+Searched for:
+- `console.log`
+- `console.error`
+- `console.warn`
+- `console.info`
+- `console.debug`
+
+**Excluded**:
+- Type generation files (`types/generated/`)
+- Test files (test mocks are intentional)
+- Logger utility itself (logger.ts uses console internally - intentional)
+- JSDoc documentation examples (preserved as examples)
+
+## Findings
+
+**Total console statements found**: 33 (excluding generated files)
+
+### Categories
+
+#### 1. ✅ **Preserve** (Documentation/Examples)
+- JSDoc examples in component files (tabs.tsx, checkbox.tsx, slider.tsx, etc.)
+- These are documentation examples, not actual code
+
+#### 2. ✅ **Preserve** (Logger Implementation)
+- `apps/web/src/utils/logger.ts` - Logger uses console internally (intentional)
+
+#### 3. ✅ **Preserve** (Test Files)
+- `apps/web/src/components/ErrorBoundary.test.tsx` - Test mocks for console.error
+
+#### 4. ✅ **Preserve** (Dev-Only Utilities)
+- `apps/web/src/utils/gridOverlay.ts` - Dev-only utility with intentional console.log/warn
+- These are development-only and provide useful feedback
+
+#### 5. ⚠️ **Replace** (Production Code)
+- `apps/web/src/main.tsx:125` - console.error('[Init] Failed to initialize; continuing', error)
+- `apps/web/src/config/env.ts:61` - console.error('❌ Invalid environment variables:', error.errors)
+- `apps/web/src/components/OfflineQueueManager.tsx:84` - console.error('Failed to remove request:', error)
+- `apps/web/src/components/OfflineQueueManager.tsx:97` - console.error('Failed to clear queue:', error)
+- `apps/web/src/utils/toast.ts:56` - console.error('Toast module failed to load')
+
+#### 6. ✅ **Preserve** (Commented Code)
+- Commented console statements in various files (already disabled)
+
+#### 7. ✅ **Preserve** (Backup Files)
+- `apps/web/src/utils/storeSelectors.ts.backup` - Backup file
+
+## Recommendations
+
+**Replace with logger**:
+1. `main.tsx` - Use logger.error for initialization errors
+2. `config/env.ts` - Use logger.error for environment validation errors
+3. `OfflineQueueManager.tsx` - Use logger.error for queue operation errors
+4. `toast.ts` - Use logger.error for toast module loading errors
+
+**Preserve**:
+- Logger implementation (logger.ts)
+- Test mocks
+- JSDoc examples
+- Dev-only utilities (gridOverlay.ts)
+
+## Next Steps
+
+- **Cleanup 11**: Replace console.log with logger (production code only)
+- **Cleanup 12**: Replace console.error/warn with logger (production code only)
+
+---
+
+**Last Updated**: 2025-01-27  
+**Status**: Audit complete - Ready for replacement in Cleanup 11-12

apps/web/docs/CUSTOM_BUTTONS_AUDIT.md

@@ -0,0 +1,156 @@
+# Custom Button Implementations Audit
+
+**Date**: 2025-01-27  
+**Action**: 9.2.1.1 - Find all custom button implementations  
+**Purpose**: Identify all buttons with inline className styles that should be replaced with the Button component from `@/components/ui/button`
+
+## Summary
+
+- **Total files with button elements**: 166 files
+- **Button component location**: `apps/web/src/components/ui/button.tsx`
+- **Legacy Button component**: `apps/web/src/components/base/Button.tsx` (uses CSS classes, different API)
+
+## Custom Button Implementations Found
+
+### High Priority (Should be replaced)
+
+#### 1. Live Stream Components
+- **File**: `apps/web/src/components/live/LiveStreamDetailView.tsx`
+  - Line 195-200: Send chat button with `className="absolute right-1.5 top-1.5 p-1.5 bg-kodo-cyan text-black rounded-full hover:bg-white transition-colors"`
+  - Line 205-211: Tip button with `className="text-kodo-gold hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="default" for send, variant="ghost" for tip)
+
+#### 2. Dashboard Page
+- **File**: `apps/web/src/pages/DashboardPage.tsx`
+  - Line 235-237: Time filter button with complex className
+  - Line 238-240: Active time filter button with `className="text-xs font-medium text-kodo-cyan bg-kodo-cyan/10 px-2 py-1 rounded-lg border border-kodo-cyan/20..."`
+  - Line 241-243: Time filter button with complex className
+  - **Recommendation**: Replace with Button component (variant="outline" for inactive, variant="default" for active)
+
+#### 3. Social Components
+- **File**: `apps/web/src/components/social/CommentItem.tsx`
+  - Line 61: Button with `className="hover:text-white transition-colors"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+- **File**: `apps/web/src/components/social/PostCard.tsx`
+  - Line 239: Button with `className="w-full text-center text-xs text-kodo-cyan mt-4 hover:underline"`
+  - **Recommendation**: Replace with Button component (variant="link")
+
+- **File**: `apps/web/src/pages/SocialPage.tsx`
+  - Line 112: Button with `className="flex items-center gap-2 text-kodo-secondary hover:text-kodo-magenta transition-colors"`
+  - Line 116: Button with `className="flex items-center gap-2 text-kodo-secondary hover:text-kodo-cyan transition-colors"`
+  - Line 120: Button with `className="flex items-center gap-2 text-kodo-secondary hover:text-white transition-colors"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+- **File**: `apps/web/src/components/views/SocialView.tsx`
+  - Line 75: Button with `className="w-full flex items-center gap-3 px-3 py-2.5 rounded-lg text-sm font-medium text-gray-400 hover:text-white"`
+  - Line 146-150: Multiple buttons with `className="hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+#### 4. Admin Components
+- **File**: `apps/web/src/components/admin/AdminUsersView.tsx`
+  - Line 169: Disabled button with `className="hover:text-white disabled:opacity-50"`
+  - Line 172: Next button with `className="hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="ghost", disabled prop)
+
+- **File**: `apps/web/src/components/admin/UserTableRow.tsx`
+  - Line 99: Button with `className="w-full text-left px-4 py-2.5 text-xs text-gray-300 hover:bg-white/10 flex items-center gap-2"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+#### 5. Studio Components
+- **File**: `apps/web/src/components/studio/ProjectsManager.tsx`
+  - Line 196: Button with `className="p-1.5 rounded bg-kodo-slate text-white"`
+  - Line 199: Button with `className="p-1.5 rounded text-gray-500 hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="secondary" and "ghost")
+
+- **File**: `apps/web/src/components/studio/CloudFileBrowser.tsx`
+  - Line 403: Button with `className="p-1.5 hover:bg-white/10 rounded text-gray-400 hover:text-white"`
+  - Line 406: Similar button
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+#### 6. File Manager
+- **File**: `apps/web/src/components/views/FileManagerView.tsx`
+  - Line 357: Button with `className="p-1.5 hover:bg-white/10 rounded text-gray-400 hover:text-white"`
+  - Line 363: Similar button
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+#### 7. Modal Components
+- **File**: `apps/web/src/components/modals/CreatorModal.tsx`
+  - Line 66: Close button with `className="text-gray-400 hover:text-white"`
+  - Line 113: Button with `className="p-3 rounded border border-kodo-cyan bg-kodo-cyan/10 text-kodo-cyan..."`
+  - Line 117: Button with `className="p-3 rounded border border-kodo-steel bg-kodo-slate text-gray-400..."`
+  - Line 121: Similar button
+  - **Recommendation**: Replace with Button component (variant="ghost" for close, variant="outline" for others)
+
+- **File**: `apps/web/src/components/ui/ImageCropper.tsx`
+  - Line 138: Cancel button with `className="text-gray-400 hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+- **File**: `apps/web/src/components/upload/BulkUploadModal.tsx`
+  - Line 46: Close button with `className="text-gray-400 hover:text-white"`
+  - **Recommendation**: Replace with Button component (variant="ghost")
+
+### Medium Priority (Context-specific, may need custom handling)
+
+#### 8. UI Component Internals
+- **File**: `apps/web/src/components/ui/dropdown-menu.tsx`
+  - Line 120: Internal button with `className={cn('outline-none', className)}`
+  - **Note**: This is part of a Radix UI component wrapper, may need to stay as-is
+
+### Low Priority (May be intentional custom buttons)
+
+#### 9. Specialized Components
+- **File**: `apps/web/src/components/ui/FAB.tsx`
+  - Floating Action Button - may be intentionally custom
+  - **Note**: Review if FAB should use Button component or remain custom
+
+- **File**: `apps/web/src/features/tracks/components/LikeButton.tsx`
+  - Specialized like button component
+  - **Note**: May use Button component internally, needs verification
+
+## Statistics
+
+- **High Priority Replacements**: ~30+ instances across 15+ files
+- **Medium Priority**: ~5 instances (UI component internals)
+- **Low Priority**: ~5 instances (specialized components)
+
+## Migration Strategy
+
+1. **Phase 1**: Replace high-priority custom buttons in:
+   - Live stream components
+   - Dashboard page
+   - Social components
+   - Admin components
+
+2. **Phase 2**: Replace medium-priority buttons in:
+   - Studio components
+   - File manager
+   - Modal components
+
+3. **Phase 3**: Review and decide on low-priority specialized components
+
+## Button Component Variants Available
+
+From `apps/web/src/components/ui/button.tsx`:
+- `default`: Primary button with cyan background
+- `destructive`: Red variant for destructive actions
+- `outline`: Outlined button
+- `secondary`: Secondary button with steel background
+- `ghost`: Minimal button with hover effect
+- `link`: Link-style button
+- `neon`: Neon effect button
+- `glass`: Glass morphism effect
+- `premium`: Premium gradient button
+
+## Notes
+
+- Some buttons may need size adjustments (Button component supports `sm`, `md`, `lg`, `xl`)
+- Some buttons may need icon support (Button component supports `asChild` prop for custom content)
+- Legacy Button component (`components/base/Button.tsx`) uses different API and CSS classes - should be migrated separately
+
+## Next Steps
+
+1. ✅ Audit complete (Action 9.2.1.1)
+2. ⏳ Replace custom buttons with Button component (Action 9.2.1.2)
+3. ⏳ Create ESLint rule to enforce Button usage (Action 9.2.1.3)
+4. ⏳ Create component usage guide (Action 9.2.1.4)

apps/web/docs/CUSTOM_COMPONENTS_AUDIT.md

@@ -0,0 +1,191 @@
+# Custom Components Audit (Non-Button)
+
+**Date**: 2025-01-27  
+**Action**: 9.2.1.5 - Audit other custom components (not just buttons)  
+**Purpose**: Identify all custom implementations of Card, Input, Select, and other components that should be replaced with design system components
+
+## Summary
+
+- **Design System Components Location**: `apps/web/src/components/ui/`
+- **Legacy Components Location**: `apps/web/src/components/base/`
+- **Total Card/Input imports**: 230 matches across 179 files
+
+## Component Inventory
+
+### 1. Card Component
+
+#### Design System Card
+- **Location**: `apps/web/src/components/ui/card.tsx`
+- **Status**: ✅ Current design system component
+- **API**: Simple className-based, no variants
+- **Sub-components**: CardHeader, CardTitle, CardDescription, CardContent, CardFooter
+
+#### Legacy Card Components
+- **Location**: `apps/web/src/components/base/Card.tsx`
+- **Status**: ⚠️ Legacy component using CSS classes
+- **API**: Variant-based (`default`, `manga`, `neon`, `nature`, `elevated`, `glass`)
+- **Usage**: 
+  - `pages/DesignSystemDemo.tsx` (demo page only)
+  - Exported in `components/index.ts` (type exports)
+
+#### Custom Card-Like Components
+1. **StatCard** (`components/dashboard/StatCard.tsx`)
+   - ✅ Uses design system Card correctly
+   - Custom styling for stats display (acceptable)
+
+2. **UserCard** (`components/user/UserCard.tsx`)
+   - ⚠️ Uses design system Card but with invalid `variant` prop
+   - Line 22: `variant="default"` (doesn't exist in design system Card)
+   - Custom gradient overlay (line 26)
+   - **Recommendation**: Remove `variant` prop, use className only
+
+3. **LicenceCard** (`components/marketplace/LicenceCard.tsx`)
+   - ⚠️ Uses design system Card but with invalid `variant` prop
+   - Line 22: `variant={selected ? 'gaming' : 'default'}` (doesn't exist)
+   - **Recommendation**: Remove `variant` prop, use className for selected state
+
+4. **ProductCard** (`components/marketplace/ProductCard.tsx`)
+   - Needs verification
+
+5. **AchievementCard** (`components/gamification/AchievementCard.tsx`)
+   - Needs verification
+
+6. **EquipmentCard** (`components/inventory/EquipmentCard.tsx`)
+   - Needs verification
+
+7. **CourseCard** (`components/education/CourseCard.tsx`)
+   - Needs verification
+
+8. **GroupCard** (`components/social/groups/GroupCard.tsx`)
+   - Needs verification
+
+#### Backup Card
+- **Location**: `apps/web/src/components/ui.backup/card.tsx`
+- **Status**: ⚠️ Old backup version (should be removed)
+
+### 2. Input Component
+
+#### Design System Input
+- **Location**: `apps/web/src/components/ui/input.tsx`
+- **Status**: ✅ Current design system component
+- **API**: Standard HTML input props with Kodo design system styling
+
+#### Legacy Input Components
+1. **Base Input** (`components/base/Input.tsx`)
+   - **Status**: ⚠️ Legacy component (no styling, just props wrapper)
+   - **Usage**: Exported in `components/index.ts` (type exports)
+   - **Note**: Minimal wrapper, may be acceptable
+
+2. **FormField Input** (`components/ui/FormField.tsx`)
+   - **Status**: ⚠️ Custom Input component with Tailwind default colors
+   - Line 134-153: Custom Input with `border-gray-300`, `focus:ring-blue-500`, `border-red-500`
+   - **Recommendation**: Replace with design system Input component
+
+#### Custom Input Components
+1. **AuthInput** (`features/auth/components/AuthInput.tsx`)
+   - **Status**: ⚠️ Custom input wrapper
+   - **Note**: May be acceptable if it wraps design system Input
+
+2. **ChatInput** (`features/chat/components/ChatInput.tsx`)
+   - **Status**: ⚠️ Custom chat input
+   - **Note**: Specialized component, may need custom styling
+
+#### Backup Input
+- **Location**: `apps/web/src/components/ui.backup/input.tsx`
+- **Status**: ⚠️ Old backup version (should be removed)
+
+### 3. Select Component
+
+#### Design System Select
+- **Location**: `apps/web/src/components/ui/select.tsx`
+- **Status**: ✅ Current design system component
+- **API**: Advanced select with search, multi-select, groups
+- **Dependencies**: Uses design system Button and Input internally
+
+#### Legacy Select Components
+1. **FormField Select** (`components/ui/FormField.tsx`)
+   - **Status**: ⚠️ Custom Select component
+   - Line 183-211: Custom Select with native HTML select
+   - **Recommendation**: Replace with design system Select component
+
+#### Backup Select
+- **Location**: `apps/web/src/components/ui.backup/select.tsx`
+- **Status**: ⚠️ Old backup version (should be removed)
+
+### 4. Other Custom Components
+
+#### Custom Components with Inline Styles
+1. **Search Component** (`components/search/Search.tsx`)
+   - Line 305: Custom dropdown with `className="absolute z-50 mt-2 w-full rounded-md border bg-popover shadow-lg"`
+   - **Recommendation**: Use design system Dropdown component
+
+## Statistics
+
+### Card Component Usage
+- **Design System Card**: Used in ~50+ files
+- **Legacy Card**: Used in 1 file (demo page)
+- **Custom Card-like**: ~8 specialized components
+- **Issues**: 2 components using invalid `variant` prop
+
+### Input Component Usage
+- **Design System Input**: Used in ~100+ files
+- **Legacy Input**: Minimal usage (type exports)
+- **Custom Input**: 2 specialized components (AuthInput, ChatInput)
+- **Issues**: 1 component (FormField) using Tailwind default colors
+
+### Select Component Usage
+- **Design System Select**: Used in ~30+ files
+- **Custom Select**: 1 component (FormField) using native HTML select
+- **Issues**: 1 component should use design system Select
+
+## Migration Priority
+
+### High Priority
+1. **FormField Input** - Replace with design system Input (removes Tailwind defaults)
+2. **FormField Select** - Replace with design system Select
+3. **UserCard** - Remove invalid `variant` prop
+4. **LicenceCard** - Remove invalid `variant` prop
+
+### Medium Priority
+1. **Legacy Card component** - Remove or migrate demo page
+2. **Backup components** - Remove `ui.backup/` directory
+3. **Custom card-like components** - Verify they use design system Card correctly
+
+### Low Priority
+1. **Specialized components** (AuthInput, ChatInput) - Review if custom styling is needed
+2. **Base Input** - Review if wrapper is needed or can be removed
+
+## Recommendations
+
+### Immediate Actions
+1. **Remove invalid variant props** from UserCard and LicenceCard
+2. **Replace FormField Input** with design system Input
+3. **Replace FormField Select** with design system Select
+4. **Remove backup components** in `ui.backup/` directory
+
+### Future Actions
+1. **Audit all card-like components** to ensure they use design system Card
+2. **Create ESLint rules** to prevent invalid props on design system components
+3. **Document component usage** guidelines
+
+## Files Requiring Changes
+
+### High Priority
+- `apps/web/src/components/ui/FormField.tsx` - Replace Input and Select
+- `apps/web/src/components/user/UserCard.tsx` - Remove variant prop
+- `apps/web/src/components/marketplace/LicenceCard.tsx` - Remove variant prop
+
+### Medium Priority
+- `apps/web/src/pages/DesignSystemDemo.tsx` - Migrate from legacy Card
+- `apps/web/src/components/index.ts` - Remove legacy type exports
+
+### Low Priority
+- `apps/web/src/components/ui.backup/` - Remove entire directory
+- `apps/web/src/components/base/Input.tsx` - Review and potentially remove
+
+## Next Steps
+
+1. ✅ Audit complete (Action 9.2.1.5)
+2. ⏳ Replace custom components with design system components (Action 9.2.1.6)
+3. ⏳ Create ESLint rules to enforce component usage
+4. ⏳ Create component usage guide

apps/web/docs/CYAN_USAGE_AUDIT.md

@@ -0,0 +1,189 @@
+# Cyan Usage Audit - Action 11.3.1.1
+
+**Date**: 2025-01-27  
+**Scope**: All `kodo-cyan` usage across the codebase  
+**Total Instances**: 965 matches across 217 files
+
+## Summary
+
+Cyan is currently used extensively throughout the application. This audit categorizes usage to identify opportunities for reducing overuse and applying the 80/20 rule (80% neutral, 20% color).
+
+## Categories
+
+### 1. Primary Actions (✅ Keep Cyan)
+**Purpose**: Main CTAs, primary interactive elements  
+**Count**: ~150 instances
+
+**Examples**:
+- Button default variant: `bg-kodo-cyan` (primary CTAs)
+- Active navigation states: `text-kodo-cyan`, `bg-kodo-cyan/10`
+- Focus rings: `focus-visible:ring-kodo-cyan`
+- Primary links and important actions
+- Active tab indicators
+- Selected states in lists
+
+**Files**:
+- `apps/web/src/components/ui/button.tsx` - Primary button variant
+- `apps/web/src/components/layout/Sidebar.tsx` - Active nav items
+- `apps/web/src/components/ui/tabs.tsx` - Active tabs
+- `apps/web/src/pages/DashboardPage.tsx` - Primary actions
+- `apps/web/src/features/library/pages/LibraryPage.tsx` - Primary filters/actions
+
+### 2. Secondary Actions (⚠️ Replace with Steel)
+**Purpose**: Non-primary buttons, hover states, borders  
+**Count**: ~200 instances
+
+**Examples**:
+- Hover states on outline buttons: `hover:border-kodo-cyan/50`
+- Secondary button borders
+- Non-primary interactive elements
+- Icon buttons (non-primary)
+- Secondary navigation items
+
+**Files**:
+- `apps/web/src/components/ui/button.tsx` - Outline variant hover
+- `apps/web/src/components/layout/Header.tsx` - Secondary nav items
+- `apps/web/src/components/views/FileManagerView.tsx` - Secondary actions
+- `apps/web/src/features/tracks/components/TrackFilters.tsx` - Filter buttons
+
+### 3. Decorative/Background (⚠️ Reduce or Replace)
+**Purpose**: Backgrounds, borders, decorative elements  
+**Count**: ~300 instances
+
+**Examples**:
+- Backgrounds with opacity: `bg-kodo-cyan/10`, `bg-kodo-cyan/20`
+- Decorative borders: `border-kodo-cyan/30`
+- Empty state icons: `text-kodo-cyan`
+- Section headers: `text-kodo-cyan`
+- Card borders and highlights
+- Progress indicators (non-critical)
+
+**Files**:
+- `apps/web/src/components/ui/KodoEmptyState.tsx` - Icon and border
+- `apps/web/src/components/views/StudioView.tsx` - Decorative elements
+- `apps/web/src/components/ui/progress.tsx` - Progress bars
+- `apps/web/src/components/education/CourseCard.tsx` - Card decorations
+- `apps/web/src/components/social/PostCard.tsx` - Card highlights
+
+### 4. Informational (⚠️ Consider Steel or Keep)
+**Purpose**: Info alerts, status indicators, metadata  
+**Count**: ~150 instances
+
+**Examples**:
+- Info toasts: `bg-kodo-cyan/10 border-kodo-cyan/30`
+- Status indicators
+- Metadata highlights
+- Info badges
+- Loading spinners
+
+**Files**:
+- `apps/web/src/components/feedback/Toast.tsx` - Info variant
+- `apps/web/src/components/feedback/Alert.tsx` - Info variant
+- `apps/web/src/components/ui/Spinner.tsx` - Loading states
+- `apps/web/src/components/OfflineIndicator.tsx` - Status indicator
+
+### 5. Focus/Interaction States (✅ Keep Cyan)
+**Purpose**: Focus rings, active states, keyboard navigation  
+**Count**: ~100 instances
+
+**Examples**:
+- Focus rings: `focus-visible:ring-kodo-cyan`
+- Active states: `active:bg-kodo-cyan`
+- Keyboard navigation highlights
+- Input focus states
+
+**Files**:
+- `apps/web/src/components/ui/input.tsx` - Focus states
+- `apps/web/src/components/ui/select.tsx` - Focus states
+- `apps/web/src/components/ui/checkbox.tsx` - Focus states
+- All form components with focus rings
+
+### 6. Text/Links (⚠️ Review Context)
+**Purpose**: Text color, links, headings  
+**Count**: ~65 instances
+
+**Examples**:
+- Links: `text-kodo-cyan hover:text-kodo-cyan`
+- Headings: `text-kodo-cyan`
+- Emphasized text
+- Helper text
+
+**Files**:
+- `apps/web/src/components/layout/Header.tsx` - Links
+- `apps/web/src/features/auth/components/TwoFactorVerify.tsx` - Links
+- `apps/web/src/components/views/ProfileView.tsx` - Text highlights
+
+## Recommendations
+
+### High Priority (Action 11.3.1.2)
+1. **Replace secondary action borders** with `kodo-steel`
+   - Outline button hover states
+   - Secondary navigation borders
+   - Non-primary card borders
+
+2. **Reduce decorative backgrounds**
+   - Replace `bg-kodo-cyan/10` with `bg-kodo-steel/10` for non-primary elements
+   - Keep cyan backgrounds only for primary CTAs and active states
+
+3. **Update empty state icons**
+   - Consider using `kodo-steel` for decorative icons
+   - Keep cyan only for actionable icons
+
+### Medium Priority
+4. **Review informational elements**
+   - Consider using `kodo-steel` for info alerts (non-critical)
+   - Keep cyan for success/important info
+
+5. **Audit text/links**
+   - Replace non-primary links with steel
+   - Keep cyan for primary navigation links
+
+### Low Priority
+6. **Maintain primary actions**
+   - Keep all primary button variants
+   - Keep active navigation states
+   - Keep focus rings
+
+## Target Distribution (80/20 Rule)
+
+**Current**: ~40% cyan usage (estimated)  
+**Target**: ~20% cyan usage
+
+**Breakdown**:
+- **80% Neutral**: Use `kodo-steel`, `kodo-graphite`, `kodo-ink` for backgrounds, borders, secondary elements
+- **20% Color**: Use `kodo-cyan` only for:
+  - Primary CTAs
+  - Active states
+  - Focus rings
+  - Critical status indicators
+  - Primary navigation
+
+## Files Requiring Changes
+
+### High Impact (Many instances):
+1. `apps/web/src/components/ui/button.tsx` - Button variants
+2. `apps/web/src/components/layout/Sidebar.tsx` - Navigation
+3. `apps/web/src/components/views/StudioView.tsx` - Decorative elements
+4. `apps/web/src/components/ui/KodoEmptyState.tsx` - Empty states
+5. `apps/web/src/components/views/FileManagerView.tsx` - Secondary actions
+6. `apps/web/src/features/tracks/components/TrackFilters.tsx` - Filters
+7. `apps/web/src/components/education/CourseCard.tsx` - Cards
+8. `apps/web/src/components/social/PostCard.tsx` - Cards
+
+### Medium Impact:
+- All view components with decorative cyan
+- Form components with secondary cyan borders
+- Card components with cyan highlights
+
+## Next Steps
+
+1. ✅ **Action 11.3.1.1**: Audit complete
+2. ⏭️ **Action 11.3.1.2**: Replace secondary cyan with steel (non-primary actions)
+3. ⏭️ **Action 11.3.1.3**: Apply 80/20 rule (80% neutral, 20% color)
+
+## Notes
+
+- This audit is based on pattern matching and may require manual review for context-specific decisions
+- Some decorative uses may be intentional for brand consistency
+- Focus states and active states should remain cyan for accessibility
+- Primary CTAs must remain cyan for clear visual hierarchy

apps/web/docs/DESIGN_DIRECTION.md

@@ -0,0 +1,281 @@
+# Design Direction: SUMI — « Encre, pas néon »
+
+**Last Updated**: 2026-02-12
+**Status**: Active Design Direction
+**Purpose**: Define the SUMI design philosophy for the Veza application
+
+## Overview
+
+SUMI is a design philosophy rooted in the **sumi-e** (墨絵) ink wash painting tradition. The guiding motto is:
+
+> **« Encre, pas néon »** — Ink, not neon.
+
+Three pillars:
+
+1. **Surgical Minimalism** — Every visual element serves a function. If it doesn't inform, guide, or delight purposefully, it doesn't belong.
+2. **Purposeful Design** — Color, motion, and spacing are intentional tools, never decoration.
+3. **Texture over effect** — Depth comes from paper grain, ink wash gradients, and warm neutrals — not from glows, neon pulses, or flashy transforms.
+
+## Core Principles
+
+### 1. Sumi-e Metaphor
+
+The UI draws from ink wash painting:
+
+- **Paper grain**: subtle texture through warm neutral backgrounds (`--sumi-bg-base`, `--sumi-bg-raised`, `--sumi-bg-wash`). Light theme evokes washi paper (`--sumi-bg-void: #f0ece4`).
+- **Ink wash gradients**: depth built with opacity layers and glass effects (`--sumi-glass-bg`), not solid neon colors.
+- **Pigments, not neon**: four earth-toned accent pigments — **Accent** (slate blue `#7c9dd6`), **Vermillion** (brick red `#d4634a`), **Sage** (muted green `#7a9e6c`), **Gold** (warm ochre `#c9a84c`). Each used sparingly and intentionally.
+
+### 2. Color: Warm Neutrals, Muted Pigments
+
+**Principle**: Warm neutral surfaces, muted earth-toned pigments for accents, high contrast text.
+
+- **Backgrounds**: Warm dark neutrals with subtle blue-violet undertones (`#0c0c0f` → `#1a1a1f` → `#222228`), not pure black.
+- **Text**: Warm off-white (`--sumi-text-primary: #f0ede8`) for primary, stone gray (`--sumi-text-secondary: #a8a4a0`) for secondary. High contrast, WCAG AA compliant.
+- **Accents**: Used only for primary actions, active states, semantic status. Never decorative fills.
+
+**Implementation**:
+- Primary actions: `--sumi-accent` (buttons, active states, focus rings)
+- Secondary actions: `--sumi-bg-hover` / `--sumi-border-default`
+- Semantic: `--sumi-success` (sage), `--sumi-warning` (gold), `--sumi-error` (vermillion)
+- Decorative elements: neutral backgrounds only
+
+### 3. Typography: Inter + Space Grotesk
+
+| Role | Font | Token |
+|------|------|-------|
+| Body text | Inter | `--sumi-font-body` |
+| Headings | Space Grotesk | `--sumi-font-heading` |
+| Code / mono | JetBrains Mono | `--sumi-font-mono` |
+| Serif accents | Noto Serif JP | `--sumi-font-serif` |
+
+**Text sizes** follow SUMI scale: `--sumi-text-xs` (0.75rem) through `--sumi-text-4xl` (2.25rem), with `--sumi-text-base` at 0.875rem.
+
+**Hierarchy**:
+- Headings: `--sumi-text-primary` + `--sumi-font-heading` + `--sumi-weight-semibold`
+- Body: `--sumi-text-primary` + `--sumi-font-body` + `--sumi-weight-regular`
+- Secondary/metadata: `--sumi-text-secondary` or `--sumi-text-tertiary`, sparingly
+
+### 4. Whitespace & Readability
+
+**Principle**: Generous whitespace improves visual hierarchy and reduces cognitive load.
+
+**Spacing tokens** (SUMI scale in [index.css](../src/index.css)):
+- `--sumi-space-2` (8px) — base unit
+- `--sumi-space-4` (16px) — standard gap
+- `--sumi-space-6` (24px) — section gap
+- `--sumi-space-8` (32px) — card padding, large section spacing
+- `--sumi-space-12` (48px) — page-level spacing
+- `--sumi-space-16` (64px) — major separations
+
+**Layout gaps**:
+- `--layout-gap` (1rem), `--layout-gap-sm` (0.75rem), `--layout-gap-lg` (1.5rem)
+
+### 5. Subtle, Purposeful Interactions
+
+**Principle**: Hover effects and animations should be functional, not decorative.
+
+**Keep** (functional):
+- Background color changes: `hover:bg-[var(--sumi-bg-hover)]` for interactive feedback
+- Opacity changes: `group-hover:opacity-100` for functional overlays (play buttons)
+- Border color changes: `hover:border-[var(--sumi-border-strong)]`
+- Text color changes: `hover:text-[var(--sumi-text-primary)]`
+- Transition timing: `--sumi-duration-fast` (150ms) for colors, `--sumi-duration-normal` (200ms) for transforms
+- Easing: `--sumi-ease-default` or `--sumi-ease-out`
+
+**Anti-patterns** (NEVER do):
+- ❌ Scale transforms on hover: no `hover:scale-[1.02]`, `hover:scale-105`, `hover:scale-110`
+- ❌ Neon glows: no `shadow-[0_0_15px_rgba(0,255,255,...)]`, no `shadow-neon-*`
+- ❌ Decorative animations: no pulsing, no bouncing, no breathing effects for aesthetics
+- ❌ Multiple simultaneous effects: no scale + shadow + border combos
+- ❌ Image zoom on hover: no `group-hover:scale-110` on decorative images
+
+### 6. Surfaces & Elevation
+
+Depth is conveyed through **background layers** and **shadows**, not glows:
+
+| Level | Token | Usage |
+|-------|-------|-------|
+| Void | `--sumi-bg-void` | Page background |
+| Base | `--sumi-bg-base` | Main content area |
+| Raised | `--sumi-bg-raised` | Sidebar, cards |
+| Overlay | `--sumi-bg-overlay` | Dropdowns, popovers |
+| Glass | `--sumi-glass-bg` + blur | Header, player bar |
+
+**Shadows** (SUMI scale): `--sumi-shadow-xs` through `--sumi-shadow-2xl`. Use sparingly — one shadow level per element. `--sumi-shadow-glow` reserved for focus rings only.
+
+### 7. Gradients: Functional Only
+
+**Keep**:
+- Functional overlays for text readability: `bg-gradient-to-t from-black/80`
+- Hero sections (featured content, landing)
+- Glass effects (via `--sumi-glass-bg` + backdrop-blur)
+
+**Remove**:
+- Card backgrounds: use solid `--sumi-surface-card`
+- Decorative section backgrounds
+- Hover overlays: use solid colors with opacity
+
+## Sub-Themes: Contextual Accents
+
+Sub-themes are **contextual accent overrides**, not global theme replacements. They provide feature-specific color accents while the core SUMI palette stays constant.
+
+| Sub-theme | Accent | Token | Context |
+|-----------|--------|-------|---------|
+| Nature | Sakura pink | `--sakura: #e0a0b8` | Nature/ambient content |
+| Graffiti | Magenta | `--graffiti-magenta: #c840a0` | Urban/graffiti features |
+| Gaming | Gold | `--gaming-gold: #d4b040` | Gaming-related features |
+| Terminal | Green | `--terminal-green: #3eaa5e` | Developer/terminal features |
+| Music | Default accent | `--sumi-accent` | Core music experience |
+
+**Rules**:
+- Sub-themes affect only their feature area, not the global shell
+- Core backgrounds, text colors, and border tokens remain SUMI
+- A sub-theme overrides `--sumi-accent` locally, nothing else
+
+## Anti-Patterns Reference
+
+These patterns contradict SUMI and must be avoided:
+
+| Anti-pattern | Why | Alternative |
+|--------------|-----|-------------|
+| `hover:scale-[1.02]` | Decorative, not functional | `hover:bg-[var(--sumi-bg-hover)]` |
+| `shadow-neon-cyan/20` | Neon aesthetic, not ink | `--sumi-shadow-sm` |
+| `bg-gradient-to-r from-cyan to-blue` | Neon gradient | Solid `--sumi-surface-card` |
+| `animate-pulse` on decorative elements | Distracting | Static or `--sumi-transition-opacity` |
+| `text-cyan-400` / `text-kodo-cyan` | Old Kodo neon palette | `--sumi-accent` or `--sumi-text-link` |
+| `bg-kodo-void` / `bg-kodo-ink` | Old Kodo tokens | `--sumi-bg-void` / `--sumi-bg-base` |
+| Class-based theme toggle (`dark:`) | Stale pattern | `[data-theme]` attribute |
+
+## Implementation Checklist
+
+When applying SUMI to a component or page:
+
+### Color & Surface
+- [ ] Backgrounds use SUMI tokens (`--sumi-bg-*`, `--sumi-surface-*`)
+- [ ] Text uses `--sumi-text-primary` (not `text-white` or `text-kodo-*`)
+- [ ] Accents use `--sumi-accent` family (not `kodo-cyan`)
+- [ ] Semantic colors use `--sumi-success`, `--sumi-warning`, `--sumi-error`
+- [ ] No neon colors, no `kodo-*` tokens
+- [ ] Cards use `--sumi-surface-card` (solid, no gradient)
+
+### Spacing & Layout
+- [ ] Spacing uses SUMI scale (`--sumi-space-*`) or Tailwind equivalents
+- [ ] Layout uses SUMI layout tokens (`--sumi-max-width`, `--sumi-header-height`, etc.)
+- [ ] Generous whitespace between sections
+
+### Interactions
+- [ ] Hover effects are subtle: background/opacity/border color only
+- [ ] No scale transforms on interactive elements
+- [ ] No decorative shadows or glows on hover
+- [ ] Transitions use `--sumi-duration-fast` / `--sumi-ease-default`
+
+### Typography
+- [ ] Body text uses `--sumi-font-body` (Inter)
+- [ ] Headings use `--sumi-font-heading` (Space Grotesk)
+- [ ] Text sizes follow SUMI scale (`--sumi-text-*`)
+- [ ] Text contrast meets WCAG AA
+
+### Glass & Elevation
+- [ ] Glass surfaces use `--sumi-glass-bg` + `backdrop-blur`
+- [ ] Shadows use SUMI scale (`--sumi-shadow-*`)
+- [ ] Focus rings use `--sumi-shadow-glow`
+
+### Theme Compatibility
+- [ ] Component works with `[data-theme="dark"]` and `[data-theme="light"]`
+- [ ] No hardcoded colors that break in light theme
+- [ ] Borders use `--sumi-border-*` tokens
+
+## Examples
+
+### ✅ Good: SUMI Applied
+
+```tsx
+// Card with SUMI tokens
+<Card className="bg-[var(--sumi-surface-card)] border border-[var(--sumi-border-faint)] p-8
+  hover:bg-[var(--sumi-bg-hover)] transition-colors duration-[var(--sumi-duration-fast)]">
+  <CardHeader>
+    <CardTitle className="text-[var(--sumi-text-primary)] font-heading">Title</CardTitle>
+  </CardHeader>
+  <CardContent>
+    <p className="text-[var(--sumi-text-secondary)]">Content</p>
+  </CardContent>
+</Card>
+
+// Button with SUMI accent
+<Button className="bg-[var(--sumi-accent)] text-[var(--sumi-text-inverse)]">
+  Primary Action
+</Button>
+<Button variant="outline" className="border-[var(--sumi-border-default)]
+  hover:border-[var(--sumi-border-strong)]">
+  Secondary Action
+</Button>
+```
+
+### ❌ Avoid: Anti-SUMI Patterns
+
+```tsx
+// Neon glow + scale transform + gradient
+<Card className="bg-gradient-to-r from-kodo-ink to-kodo-graphite
+  hover:scale-[1.02] hover:shadow-neon-cyan/20">
+  {/* ❌ Gradient bg, scale, neon glow */}
+</Card>
+
+// Kodo tokens (deprecated)
+<Button className="bg-kodo-cyan text-black">
+  {/* ❌ Use --sumi-accent instead */}
+</Button>
+
+// Decorative animation
+<div className="animate-pulse bg-cyan-500/20">
+  {/* ❌ Neon color + decorative animation */}
+</div>
+```
+
+## Migration Path
+
+### Completed
+1. ✅ SUMI token system defined in `index.css` (`:root` + `[data-theme="light"]`)
+2. ✅ Theme switching migrated from class to `[data-theme]` attribute
+3. ✅ Typography tokens: Inter (body) + Space Grotesk (headings) + JetBrains Mono (code)
+4. ✅ Glass effects on header and player bar
+5. ✅ Shadow and z-index scales defined
+6. ✅ Contextual accent tokens (graffiti, gaming, terminal, sakura)
+
+### In Progress
+- Component migration from `kodo-*` tokens to `--sumi-*` tokens
+- Audit and removal of remaining neon glows and scale transforms
+- Light theme (Washi Paper) refinement
+
+### Future Work
+- Enforce SUMI tokens via linting rules
+- Paper grain texture as optional background layer
+- Ink wash gradient presets for hero/feature sections
+- Sub-theme contextual scoping
+
+## References
+
+- **SUMI tokens source**: `apps/web/src/index.css` — `:root` and `[data-theme="light"]`
+- **App Shell layout**: `apps/web/docs/APP_SHELL.md`
+- **Design Tokens doc**: `apps/web/docs/DESIGN_TOKENS.md`
+- **Storybook contract**: `apps/web/docs/STORYBOOK_CONTRACT.md`
+
+## Benefits
+
+**User Experience**:
+- Reduced cognitive load — warm neutrals are easier on the eyes
+- Improved readability — high contrast text, generous whitespace
+- Better visual hierarchy — depth through layers, not decoration
+- Professional, distinctive aesthetic — ink wash, not neon
+
+**Developer Experience**:
+- Single token system (`--sumi-*`) — no ambiguity between old/new tokens
+- Clear anti-patterns — easy to audit and enforce
+- Consistent patterns across dark and light themes
+- Meaningful names tied to the sumi-e metaphor
+
+**Accessibility**:
+- WCAG AA compliant contrast ratios
+- Clear focus states (`--sumi-shadow-glow`)
+- Reduced visual noise and motion
+- Functional-only interactions

apps/web/docs/DESIGN_TOKENS.md

@@ -0,0 +1,301 @@
+# Design Tokens — SUMI Design System
+
+Source of truth: [`src/index.css`](../src/index.css). All `--sumi-*` variables are defined there. Do not create competing token files.
+
+Theme switching uses `[data-theme="dark"]` (default, applied on `:root`) and `[data-theme="light"]` attributes.
+
+---
+
+## 1. Colors
+
+### Backgrounds
+
+| Token | Dark | Light | Role |
+|-------|------|-------|------|
+| `--sumi-bg-void` | `#0c0c0f` | `#f0ece4` | Deepest background |
+| `--sumi-bg-base` | `#121215` | `#f6f3ed` | App background |
+| `--sumi-bg-raised` | `#1a1a1f` | `#ffffff` | Cards, sidebar |
+| `--sumi-bg-overlay` | `#222228` | `#ffffff` | Popovers, dropdowns |
+| `--sumi-bg-hover` | `#2a2a31` | `#ede9e1` | Hover state |
+| `--sumi-bg-active` | `#32323a` | `#e4e0d8` | Active/pressed state |
+| `--sumi-bg-wash` | `#18181d` | `#f8f6f1` | Subtle wash area |
+
+### Surfaces
+
+| Token | Role |
+|-------|------|
+| `--sumi-surface-inset` | Inset/recessed areas |
+| `--sumi-surface-subtle` | Subtle differentiation |
+| `--sumi-surface-card` | Card backgrounds |
+| `--sumi-surface-elevated` | Elevated panels |
+
+### Text — Warm neutrals
+
+| Token | Dark | Light | Role |
+|-------|------|-------|------|
+| `--sumi-text-primary` | `#f0ede8` | `#1a1816` | Primary content |
+| `--sumi-text-secondary` | `#a8a4a0` | `#5c5854` | Secondary content |
+| `--sumi-text-tertiary` | `#706c68` | `#8a8580` | Tertiary/hints |
+| `--sumi-text-disabled` | `#4a4844` | `#b5b0aa` | Disabled state |
+| `--sumi-text-inverse` | `#121215` | `#f0ede8` | Inverse (on accent bg) |
+| `--sumi-text-link` | `#8baade` | `#4a6fa5` | Links |
+
+### Borders
+
+| Token | Role |
+|-------|------|
+| `--sumi-border-faint` | Barely visible dividers |
+| `--sumi-border-default` | Standard borders |
+| `--sumi-border-strong` | Emphasized borders |
+| `--sumi-border-focus` | Focus rings |
+| `--sumi-border-accent` | Accent-tinted borders |
+
+### Pigments (accent colors)
+
+4 pigments provide all accent color needs:
+
+| Pigment | Token | Dark hex | Role |
+|---------|-------|----------|------|
+| **Indigo** | `--sumi-accent` | `#7c9dd6` | Primary accent, links, focus |
+| **Vermillion** | `--sumi-vermillion` | `#d4634a` | Destructive, errors, live |
+| **Sage** | `--sumi-sage` | `#7a9e6c` | Success, online, positive |
+| **Gold** | `--sumi-gold` | `#c9a84c` | Warnings, achievements |
+
+Each pigment has `-hover` and `-subtle` variants. Indigo also has `-active`, `-muted`, and `-emphasis`.
+
+### Semantic aliases
+
+| Token | Maps to |
+|-------|---------|
+| `--sumi-success` | `--sumi-sage` |
+| `--sumi-warning` | `--sumi-gold` |
+| `--sumi-error` | `--sumi-vermillion` |
+| `--sumi-info` | `--sumi-accent` |
+
+### shadcn/Radix mapping
+
+Standard `--background`, `--foreground`, `--primary`, `--muted`, `--border`, etc. are all aliased to `--sumi-*` tokens in `index.css`. Use Tailwind classes (`bg-background`, `text-foreground`, `text-primary`, `text-muted-foreground`) as usual — they resolve to SUMI values.
+
+**Do not** use raw Tailwind color palettes (slate, gray, zinc, etc.). Always use the semantic tokens.
+
+---
+
+## 2. Typography
+
+### Font stacks
+
+| Token | Font | Usage |
+|-------|------|-------|
+| `--sumi-font-body` | Inter | Body text (Tailwind `font-sans`) |
+| `--sumi-font-heading` | Space Grotesk | Headings (Tailwind `font-heading`) |
+| `--sumi-font-mono` | JetBrains Mono | Code (Tailwind `font-mono`) |
+| `--sumi-font-serif` | Noto Serif JP | Decorative (Tailwind `font-serif`) |
+
+### Type scale (`--sumi-text-*`)
+
+| Token | Size | Tailwind class |
+|-------|------|----------------|
+| `--sumi-text-4xl` | 2.25rem | `text-4xl` |
+| `--sumi-text-3xl` | 1.875rem | `text-3xl` |
+| `--sumi-text-2xl` | 1.5rem | `text-2xl` |
+| `--sumi-text-xl` | 1.25rem | `text-xl` |
+| `--sumi-text-lg` | 1.125rem | `text-lg` |
+| `--sumi-text-md` | 1rem | — |
+| `--sumi-text-base` | 0.875rem | `text-sm` |
+| `--sumi-text-sm` | 0.8125rem | — |
+| `--sumi-text-xs` | 0.75rem | `text-xs` |
+
+### Utility classes (Tailwind-friendly)
+
+| Class | Definition |
+|-------|------------|
+| `.text-display` | `text-4xl font-bold tracking-tight` |
+| `.text-heading-1` | `text-3xl font-semibold tracking-tight` |
+| `.text-heading-2` | `text-2xl font-semibold` |
+| `.text-heading-3` | `text-xl font-medium` |
+| `.text-heading-4` | `text-lg font-medium` |
+| `.text-body-lg` | `text-base leading-relaxed` |
+| `.text-body` | `text-sm leading-relaxed` |
+| `.text-caption` | `text-xs text-muted-foreground` |
+| `.text-label` | `text-xs font-medium uppercase tracking-wider text-muted-foreground` |
+
+### SUMI typography classes (token-driven)
+
+`.sumi-display`, `.sumi-h1` through `.sumi-h4`, `.sumi-body-lg`, `.sumi-body`, `.sumi-body-sm`, `.sumi-caption`, `.sumi-label`, `.sumi-mono` — these use `--sumi-*` variables directly for font-size, weight, line-height, and letter-spacing. Use these for finer control over the SUMI type scale.
+
+### Visual hierarchy (recommended usage)
+
+| Role | Class | Context |
+|------|-------|---------|
+| Page title | `.text-heading-1` / `.text-display` | H1 |
+| Section title | `.text-heading-2` / `.text-heading-3` | H2, H3 |
+| Label / metadata | `.text-label` / `text-sm` | Field labels |
+| Body | `.text-body-lg` / `.text-body` | Running text |
+| Caption | `.text-caption` | Timestamps, legends |
+
+Use `text-foreground` for primary info, `text-muted-foreground` for secondary.
+
+---
+
+## 3. Spacing
+
+**Base grid: 4px.** Use the standard Tailwind spacing scale (`gap-*`, `p-*`, `m-*`, `space-*`).
+
+SUMI spacing tokens in `index.css` (for reference — prefer Tailwind classes):
+
+| Token | Value |
+|-------|-------|
+| `--sumi-space-0-5` | 2px |
+| `--sumi-space-1` | 4px |
+| `--sumi-space-1-5` | 6px |
+| `--sumi-space-2` | 8px |
+| `--sumi-space-3` | 12px |
+| `--sumi-space-4` | 16px |
+| `--sumi-space-5` | 20px |
+| `--sumi-space-6` | 24px |
+| `--sumi-space-8` | 32px |
+| `--sumi-space-10` | 40px |
+| `--sumi-space-12` | 48px |
+| `--sumi-space-16` | 64px |
+| `--sumi-space-20` | 80px |
+
+Layout gaps: `--layout-gap` (16px), `--layout-gap-sm` (12px), `--layout-gap-lg` (24px).
+
+---
+
+## 4. Radius
+
+| Token | Value | Usage |
+|-------|-------|-------|
+| `--sumi-radius-xs` | 2px | Badges, tags |
+| `--sumi-radius-sm` | 4px | Buttons, inputs |
+| `--sumi-radius-md` | 6px | Cards (default `--radius`) |
+| `--sumi-radius-lg` | 12px | Panels, dialogs |
+| `--sumi-radius-xl` | 16px | Large cards |
+| `--sumi-radius-2xl` | 20px | Hero sections |
+| `--sumi-radius-full` | 9999px | Pills, avatars |
+
+Tailwind mapping: `rounded-sm` → `--sumi-radius-sm`, `rounded-md` → `--sumi-radius-md`, etc.
+
+---
+
+## 5. Shadows
+
+Defined in `:root` and overridden in `[data-theme="light"]`.
+
+| Token | Role |
+|-------|------|
+| `--sumi-shadow-xs` | Subtle elevation |
+| `--sumi-shadow-sm` | Buttons, small cards |
+| `--sumi-shadow-md` | Tooltips, dropdowns |
+| `--sumi-shadow-lg` | Cards, panels |
+| `--sumi-shadow-xl` | Modals, dialogs |
+| `--sumi-shadow-2xl` | Full overlays |
+| `--sumi-shadow-glow` | Focus ring glow (Indigo-tinted) |
+| `--sumi-shadow-glow-lg` | Large ambient glow |
+
+### Glass effect
+
+| Token | Value |
+|-------|-------|
+| `--sumi-glass-bg` | Semi-transparent bg |
+| `--sumi-glass-border` | Subtle glass border |
+| `--sumi-glass-blur` | 12px blur |
+
+Classes: `.glass` / `.sumi-glass` apply all three properties + `backdrop-filter`.
+
+---
+
+## 6. Z-Index
+
+| Token | Value | Usage |
+|-------|-------|-------|
+| `--sumi-z-base` | 0 | Default layer |
+| `--sumi-z-raised` | 10 | Raised content |
+| `--sumi-z-dropdown` | 100 | Dropdown menus |
+| `--sumi-z-sticky` | 200 | Sticky headers, player |
+| `--sumi-z-overlay` | 300 | Overlays |
+| `--sumi-z-modal` | 400 | Modals |
+| `--sumi-z-popover` | 500 | Popovers |
+| `--sumi-z-toast` | 600 | Toast notifications |
+| `--sumi-z-tooltip` | 700 | Tooltips |
+| `--sumi-z-max` | 999 | Absolute top layer |
+
+---
+
+## 7. Motion
+
+### Durations
+
+| Token | Value | Usage |
+|-------|-------|-------|
+| `--sumi-duration-instant` | 75ms | Immediate feedback |
+| `--sumi-duration-fast` | 150ms | Hover, focus, color changes |
+| `--sumi-duration-normal` | 200ms | Sidebar, modals, transforms |
+| `--sumi-duration-slow` | 300ms | Complex transitions |
+| `--sumi-duration-slower` | 500ms | Page-level transitions |
+
+### Easings
+
+| Token | Curve | Usage |
+|-------|-------|-------|
+| `--sumi-ease-default` | `cubic-bezier(0.25, 0.1, 0.25, 1)` | General purpose |
+| `--sumi-ease-out` | `cubic-bezier(0.33, 1, 0.68, 1)` | Enter / appear |
+| `--sumi-ease-in` | `cubic-bezier(0.32, 0, 0.67, 0)` | Exit / leave |
+| `--sumi-ease-in-out` | `cubic-bezier(0.65, 0, 0.35, 1)` | Symmetric transitions |
+| `--sumi-ease-bounce` | `cubic-bezier(0.34, 1.56, 0.64, 1)` | Playful bounce |
+| `--sumi-ease-spring` | `cubic-bezier(0.175, 0.885, 0.32, 1.1)` | Spring feel |
+
+### Composite transition tokens
+
+| Token | Animates |
+|-------|----------|
+| `--sumi-transition-colors` | color, background-color, border-color |
+| `--sumi-transition-opacity` | opacity |
+| `--sumi-transition-transform` | transform |
+| `--sumi-transition-shadow` | box-shadow |
+
+`prefers-reduced-motion: reduce` is respected globally — all durations collapse to near-zero.
+
+---
+
+## 8. Layout Shell
+
+Full reference: [APP_SHELL.md](APP_SHELL.md).
+
+| Token | Value | Role |
+|-------|-------|------|
+| `--sumi-header-height` | 56px | Header height |
+| `--sumi-sidebar-width` | 240px | Sidebar expanded |
+| `--sumi-sidebar-collapsed` | 64px | Sidebar collapsed |
+| `--sumi-player-height` | 80px | Player bar |
+| `--sumi-max-width` | 1400px | App max width |
+| `--sumi-max-width-content` | 1200px | Content max width |
+| `--sumi-max-width-narrow` | 800px | Narrow content |
+| `--sumi-max-width-prose` | 65ch | Prose text width |
+
+### Layout primitives (utility classes)
+
+| Class | Token | Value |
+|-------|-------|-------|
+| `.max-w-layout-content` | `--layout-content-max-width` | 100rem |
+| `.min-h-layout-main` | `--layout-main-min-height` | calc(100vh - 4rem) |
+| `.min-h-layout-page` | `--layout-page-min-height` | 37.5rem |
+| `.min-h-layout-page-sm` | `--layout-page-min-height-sm` | 25rem |
+| `.min-h-layout-story` | `--layout-story-decorator-min-height` | 12rem |
+
+Modal/drawer height constraints, lyrics, chat, and stream heights — all defined in `index.css` with matching utility classes (`.max-h-layout-modal`, `.h-layout-chat`, etc.). See `index.css` `@layer utilities` section for the full list.
+
+---
+
+## 9. Exceptions (arbitrary values)
+
+Arbitrary Tailwind values (`w-[...]`, `h-[...]`, `rounded-[...]`, `shadow-[...]`) are **forbidden** unless:
+
+- SVG/canvas rendering (e.g., `text-[2px]` for chart axes)
+- Third-party component markup you don't control
+- Documented here or in a PR with justification
+
+Add `eslint-disable` comment when an exception is necessary.
+
+See also: [.cursorrules](../.cursorrules) for layout primitives and spacing rules.

apps/web/docs/EMPTY_ERROR_PATTERNS.md

@@ -0,0 +1,57 @@
+# Patterns Empty et Error — Guide d’usage
+
+Ce document décrit quand et comment utiliser les composants d’état vide et d’erreur pour une expérience homogène type Discord/Spotify.
+
+## Erreurs (Error)
+
+Référence détaillée : [ERROR_DISPLAY_STRATEGY.md](../src/components/ui/ERROR_DISPLAY_STRATEGY.md) et [ERROR_DISPLAY_COMPONENT_API.md](../src/components/ui/ERROR_DISPLAY_COMPONENT_API.md).
+
+### Règle courte
+
+- **Erreur persistante (requête, chargement de page/liste)** → `ErrorDisplay` avec variante `card` ou `inline` et `onRetry` si pertinent.
+- **Erreur après une action (mutation)** → `ErrorDisplay` en variante `banner` (dismissible) ou toast selon la gravité.
+- **Feedback rapide (copier, toggle)** → `toast.error()`.
+- **Validation de formulaire** → message inline au niveau du champ (ex. `text-destructive`).
+
+### Composant
+
+- **ErrorDisplay** (`@/components/ui/ErrorDisplay`) : props `error`, `variant` (card | inline | banner), `severity`, `onRetry`, `context`. Utiliser partout où l’utilisateur doit voir l’erreur et éventuellement réessayer.
+
+### Pages à aligner
+
+S’assurer que les vues suivantes utilisent `ErrorDisplay` (et non uniquement un toast) pour les erreurs de chargement : Library, Playlists, Track detail, Playlist detail, Settings, Profile, Chat, Search, Notifications. Déjà en place dans beaucoup de pages (voir usages de `ErrorDisplay` dans le code).
+
+---
+
+## États vides (Empty)
+
+### Structure recommandée (type Spotify/Discord)
+
+- **Titre** : court, explicite (ex. « Aucune piste », « Aucun résultat »).
+- **Description** : une phrase optionnelle pour guider (ex. « Ajoutez des pistes ou parcourez le marketplace »).
+- **CTA** : un bouton principal si une action est possible (ex. « Créer une playlist », « Explorer »).
+
+Style : même espacement (padding généreux), même hiérarchie (titre en `text-xl` ou `text-2xl`, description en `text-sm text-muted-foreground`), couleurs sémantiques (primary pour le CTA).
+
+### Composants disponibles
+
+| Composant | Usage typique | Fichier |
+|-----------|----------------|---------|
+| **EmptyState** | Liste générique (titre, description, action optionnelle) | `@/components/ui/empty-state` |
+| **TrackListEmpty** | Liste de pistes vide (no-tracks, no-results, error) | `@/features/tracks/components/TrackListEmpty` |
+| **PlaylistListEmpty** | Liste de playlists (no_playlists, no_search_results) | `@/features/playlists/components/playlist-list/PlaylistListEmpty` |
+| **PlaylistTrackListEmpty** | Pistes d’une playlist vide | `@/features/playlists/components/playlist-track-list/PlaylistTrackListEmpty` |
+| **DataListEmpty** | Liste data générique (message) | `@/components/ui/data-list/DataListEmpty` |
+| **ChatSidebarEmpty** / états vides chat | Chat sans conversations | (voir features/chat) |
+
+### Quand utiliser lequel
+
+- **Page ou section entière vide** (ex. Library vide, aucun résultat recherche) → `EmptyState` avec titre + description + CTA.
+- **Liste de pistes** → `TrackListEmpty` (gère no-tracks, no-results, error avec retry).
+- **Liste de playlists** → `PlaylistListEmpty` avec la variante adaptée.
+- **Pistes d’une playlist** → `PlaylistTrackListEmpty`.
+- **Liste générique (data)** → `DataListEmpty` ou `EmptyState`.
+
+### Pages à vérifier
+
+Library, Playlists, Queue, Chat (sidebar), Search (résultats vides), Notifications : chaque liste ou vue vide doit utiliser un de ces composants et non un simple paragraphe ou div vide, pour garder la même structure (titre, description, CTA) et le même style.

apps/web/docs/ENDPOINT_SCHEMA_AUDIT.md

@@ -0,0 +1,198 @@
+# Endpoint Request Schema Audit
+
+**Date**: 2025-01-27  
+**Action**: 1.2.1.3 - Audit all API endpoints for request schemas  
+**Status**: ✅ Complete
+
+## Overview
+
+This document provides a comprehensive audit of all API endpoints and their request schema coverage status.
+
+## Methodology
+
+1. Extracted all endpoints from `veza-backend-api/docs/swagger.json`
+2. Identified endpoints that require request bodies (POST, PUT, PATCH)
+3. Cross-referenced with existing schemas in `apps/web/src/schemas/apiRequestSchemas.ts`
+4. Categorized by schema status: ✅ Has Schema, ⚠️ Missing Schema, ➖ No Body Required
+
+## Summary Statistics
+
+- **Total Endpoints**: 56 endpoints
+- **Endpoints Requiring Request Bodies**: 25 endpoints
+- **Endpoints with Schemas**: 9 endpoints (36%)
+- **Endpoints Missing Schemas**: 16 endpoints (64%)
+- **GET/DELETE Endpoints** (no body): 31 endpoints
+
+## Endpoints with Request Schemas ✅
+
+### Authentication (3/6)
+- ✅ `POST /auth/login` - `loginRequestSchema`
+- ✅ `POST /auth/register` - `registerRequestSchema`
+- ✅ `POST /auth/refresh` - `refreshRequestSchema`
+- ⚠️ `POST /auth/2fa/setup` - Missing schema
+- ⚠️ `POST /auth/2fa/verify` - Missing schema
+- ⚠️ `POST /auth/2fa/disable` - Missing schema
+
+### Tracks (2/6)
+- ✅ `POST /tracks` - `createTrackRequestSchema` / `uploadTrackRequestSchema`
+- ✅ `PUT /tracks/{id}` - `updateTrackRequestSchema`
+- ⚠️ `POST /tracks/batch/delete` - Missing schema (BatchDeleteRequest)
+- ⚠️ `POST /tracks/initiate` - Missing schema (InitiateChunkedUploadRequest)
+- ⚠️ `POST /tracks/chunk` - Missing schema (UploadChunkRequest)
+- ⚠️ `POST /tracks/complete` - Missing schema (CompleteChunkedUploadRequest)
+
+### Playlists (2/3)
+- ✅ `POST /playlists` - `createPlaylistRequestSchema`
+- ✅ `POST /playlists/{id}/tracks` - `addTrackToPlaylistRequestSchema`
+- ⚠️ `PUT /playlists/{id}` - Missing schema (updatePlaylistRequestSchema exists but not verified)
+
+### Comments (2/2)
+- ✅ `POST /tracks/{id}/comments` - `createCommentRequestSchema`
+- ✅ `PUT /comments/{id}` - `updateCommentRequestSchema` (via PUT /tracks/{id}/comments/{comment_id})
+
+### Users (2/2)
+- ✅ `POST /users` - `createUserRequestSchema`
+- ✅ `PUT /users/{id}` - `updateUserRequestSchema`
+
+## Endpoints Missing Request Schemas ⚠️
+
+### Analytics (1)
+- ⚠️ `POST /analytics/events` - RecordEventRequest
+  - **Fields**: event_type, properties, user_id, timestamp
+  - **Priority**: MEDIUM
+
+### Marketplace (2)
+- ⚠️ `POST /api/v1/marketplace/products` - CreateProductRequest
+  - **Fields**: name, description, price, type, file_url
+  - **Priority**: LOW (feature may not be active)
+  
+- ⚠️ `POST /api/v1/marketplace/orders` - CreateOrderRequest
+  - **Fields**: product_id, quantity, payment_method
+  - **Priority**: LOW (feature may not be active)
+
+### Webhooks (1)
+- ⚠️ `POST /webhooks` - CreateWebhookRequest
+  - **Fields**: url, events[], secret
+  - **Priority**: MEDIUM
+
+### Two-Factor Authentication (3)
+- ⚠️ `POST /auth/2fa/setup` - Setup2FARequest
+  - **Fields**: password (for verification)
+  - **Priority**: HIGH (security feature)
+  
+- ⚠️ `POST /auth/2fa/verify` - Verify2FARequest
+  - **Fields**: code (TOTP code)
+  - **Priority**: HIGH (security feature)
+  
+- ⚠️ `POST /auth/2fa/disable` - Disable2FARequest
+  - **Fields**: password, code
+  - **Priority**: HIGH (security feature)
+
+### Upload Chunking (3)
+- ⚠️ `POST /tracks/initiate` - InitiateChunkedUploadRequest
+  - **Fields**: filename, total_chunks, total_size
+  - **Priority**: MEDIUM
+  
+- ⚠️ `POST /tracks/chunk` - UploadChunkRequest
+  - **Fields**: upload_id, chunk_number, chunk_data
+  - **Priority**: MEDIUM
+  
+- ⚠️ `POST /tracks/complete` - CompleteChunkedUploadRequest
+  - **Fields**: upload_id
+  - **Priority**: MEDIUM
+
+### Batch Operations (1)
+- ⚠️ `POST /tracks/batch/delete` - BatchDeleteRequest
+  - **Fields**: track_ids[]
+  - **Priority**: MEDIUM
+
+### Frontend Logging (1)
+- ⚠️ `POST /api/v1/logs/frontend` - FrontendLogRequest
+  - **Fields**: level, message, context, timestamp
+  - **Priority**: LOW
+
+### Other (1)
+- ⚠️ `POST /auth/resend-verification` - ResendVerificationRequest
+  - **Fields**: email
+  - **Priority**: LOW
+
+## Endpoints Not Requiring Request Bodies ➖
+
+### GET Endpoints (28)
+- `GET /analytics`
+- `GET /analytics/tracks/{id}`
+- `GET /analytics/tracks/top`
+- `GET /audit/activity`
+- `GET /audit/logs`
+- `GET /audit/stats`
+- `GET /auth/2fa/status`
+- `GET /auth/check-username`
+- `GET /auth/me`
+- `GET /chat/token`
+- `GET /comments/{id}/replies`
+- `GET /playlists`
+- `GET /playlists/{id}`
+- `GET /tracks`
+- `GET /tracks/{id}`
+- `GET /tracks/{id}/analytics/plays`
+- `GET /tracks/{id}/comments`
+- `GET /tracks/{id}/stats`
+- `GET /tracks/{id}/status`
+- `GET /tracks/quota/{id}`
+- `GET /tracks/resume/{uploadId}`
+- `GET /users`
+- `GET /users/by-username/{username}`
+- `GET /users/{id}`
+- `GET /users/{id}/analytics/stats`
+- `GET /users/{id}/completion`
+- `GET /webhooks`
+- `GET /webhooks/stats`
+
+**Note**: GET endpoints may have query parameters that should be validated, but they don't require request body schemas.
+
+### DELETE Endpoints (3)
+- `DELETE /playlists/{id}`
+- `DELETE /playlists/{id}/tracks/{trackId}`
+- `DELETE /tracks/{id}`
+- `DELETE /tracks/{id}/comments/{comment_id}`
+- `DELETE /users/{id}`
+- `DELETE /webhooks/{id}`
+
+**Note**: DELETE endpoints typically don't require request bodies.
+
+## Priority Ranking for Missing Schemas
+
+### HIGH Priority (Security Features)
+1. `POST /auth/2fa/setup` - Two-factor setup
+2. `POST /auth/2fa/verify` - Two-factor verification
+3. `POST /auth/2fa/disable` - Two-factor disable
+
+### MEDIUM Priority (Core Features)
+4. `POST /tracks/batch/delete` - Batch operations
+5. `POST /tracks/initiate` - Chunked upload initiation
+6. `POST /tracks/chunk` - Chunk upload
+7. `POST /tracks/complete` - Chunked upload completion
+8. `POST /analytics/events` - Analytics tracking
+9. `POST /webhooks` - Webhook creation
+
+### LOW Priority (Optional/Edge Cases)
+10. `POST /api/v1/marketplace/products` - Marketplace (may not be active)
+11. `POST /api/v1/marketplace/orders` - Marketplace (may not be active)
+12. `POST /api/v1/logs/frontend` - Frontend logging
+13. `POST /auth/resend-verification` - Email verification
+
+## Next Steps
+
+- ✅ **Action 1.2.1.3**: Audit complete - This document
+- ⏭️ **Action 1.2.1.4**: Add request validation schemas for missing endpoints
+  - Start with HIGH priority (2FA schemas)
+  - Then MEDIUM priority (upload chunking, batch operations)
+  - Finally LOW priority (marketplace, logging)
+
+## Validation
+
+✅ All endpoints extracted from Swagger spec  
+✅ Request body endpoints identified  
+✅ Existing schemas mapped  
+✅ Missing schemas categorized by priority  
+✅ 16 missing schemas identified (64% coverage gap)

apps/web/docs/ERROR_BOUNDARY_AUDIT.md

@@ -0,0 +1,130 @@
+# Error Boundary Usage Audit
+
+**Date**: 2026-01-11  
+**Action**: 3.3.1.1 - Audit existing ErrorBoundary usage  
+**Status**: ✅ Complete
+
+## Summary
+
+This document audits the current usage of ErrorBoundary components across the application to identify coverage gaps and areas for improvement.
+
+## ErrorBoundary Components Found
+
+### 1. Main ErrorBoundary Component
+**File**: `apps/web/src/components/ErrorBoundary.tsx`
+- **Type**: Class component extending React.Component
+- **Features**:
+  - Logs errors to structured logger
+  - Sends errors to Sentry
+  - Custom fallback UI support
+  - Reset functionality
+  - Dev mode error details display
+- **Current Usage**: Wraps entire app in `App.tsx` (line 122)
+
+### 2. PlaylistErrorBoundary Component
+**File**: `apps/web/src/features/playlists/components/PlaylistErrorBoundary.tsx`
+- **Type**: Class component extending React.Component
+- **Features**:
+  - Specialized for playlist components
+  - Uses ErrorDisplay component for fallback UI (already updated per Action 3.1.1.10)
+  - Reset functionality
+  - Custom fallback support
+- **Current Usage**: Wraps playlist-specific components
+
+### 3. LazyErrorBoundary Component
+**File**: `apps/web/src/components/ui/LazyComponent.tsx`
+- **Type**: Class component extending React.Component
+- **Features**:
+  - Specialized for lazy-loaded components
+  - Custom fallback UI (LazyErrorFallback)
+  - Retry functionality
+- **Current Usage**: Wraps lazy-loaded page components
+
+## Current Coverage
+
+### ✅ Covered Areas
+
+1. **App-Level Coverage**
+   - `App.tsx` wraps entire application with `ErrorBoundary`
+   - Catches all unhandled React errors at the top level
+
+2. **Playlist Components**
+   - `PlaylistErrorBoundary` wraps playlist-specific components
+   - Provides specialized error handling for playlist operations
+
+3. **Lazy-Loaded Components**
+   - `LazyErrorBoundary` wraps lazy-loaded page components
+   - Handles code-splitting errors
+
+### ❌ Gaps Identified
+
+1. **Route-Level Coverage**
+   - **Issue**: No ErrorBoundary wrapping individual routes
+   - **Impact**: If one route crashes, entire app may become unusable
+   - **Recommendation**: Wrap each route with ErrorBoundary (Action 3.3.1.2)
+
+2. **Feature-Level Coverage**
+   - **Issue**: Only playlists have feature-specific error boundary
+   - **Impact**: Other features (tracks, library, marketplace, chat) lack isolated error handling
+   - **Recommendation**: Consider feature-specific boundaries for critical features
+
+3. **Component-Level Coverage**
+   - **Issue**: No boundaries around individual components that might fail
+   - **Impact**: Component failures can propagate up to route/app level
+   - **Recommendation**: Add boundaries for complex components (modals, forms, data-heavy components)
+
+## Router Structure
+
+**File**: `apps/web/src/router/index.tsx`
+- Uses React Router for routing
+- Routes are defined but not individually wrapped with ErrorBoundary
+- All routes are currently protected by app-level ErrorBoundary only
+
+## Recommendations
+
+### High Priority
+
+1. **Wrap Individual Routes** (Action 3.3.1.2)
+   - Add ErrorBoundary to each route definition
+   - Prevents one route crash from affecting entire app
+   - Allows route-specific error recovery
+
+2. **Update ErrorBoundary UI** (Action 3.3.1.3)
+   - Replace custom fallback UI with ErrorDisplay component
+   - Provides consistent error presentation
+   - Already done for PlaylistErrorBoundary
+
+### Medium Priority
+
+3. **Add Feature-Level Boundaries**
+   - Consider boundaries for:
+     - Track upload/management features
+     - Marketplace features
+     - Chat features
+     - Library features
+
+4. **Component-Level Boundaries**
+   - Add boundaries for:
+     - Complex modals (UploadModal, ShareDialog)
+     - Data-heavy components (LibraryPage, MarketplaceHome)
+     - Forms with complex validation
+
+### Low Priority
+
+5. **Error Boundary Logging** (Action 3.3.1.4)
+   - Enhance logging with more context
+   - Add user action tracking
+   - Improve error correlation
+
+## Files Requiring Updates
+
+1. `apps/web/src/router/index.tsx` - Add ErrorBoundary to routes
+2. `apps/web/src/components/ErrorBoundary.tsx` - Update to use ErrorDisplay (Action 3.3.1.3)
+3. Feature components - Consider adding feature-specific boundaries
+
+## Next Steps
+
+1. ✅ Complete: Audit existing ErrorBoundary usage
+2. ⏭️ Next: Wrap all routes in ErrorBoundary (Action 3.3.1.2)
+3. ⏭️ Next: Update ErrorBoundary to use ErrorDisplay (Action 3.3.1.3)
+4. ⏭️ Next: Add error boundary logging (Action 3.3.1.4)

apps/web/docs/ERROR_DISPLAY_PATTERNS_AUDIT.md

@@ -0,0 +1,278 @@
+# Error Display Patterns Audit
+
+**Date**: 2025-01-27  
+**Action**: 3.1.1.4 - Audit all error display patterns  
+**Status**: ✅ Complete
+
+## Overview
+
+This document catalogs all error display patterns found in the codebase, including toast notifications, inline error displays, error components, and error boundaries.
+
+## Summary Statistics
+
+- **Toast.error() calls**: 35+ instances across 20+ files
+- **Inline error divs**: 10+ instances
+- **Dedicated error components**: 3 (AuthErrorMessage, PlayerError, ErrorDisplay)
+- **Error boundaries**: 2 (ErrorBoundary, PlaylistErrorBoundary)
+- **Form validation errors**: 15+ instances (inline text-red-500)
+
+## 1. Toast Error Notifications
+
+### API Client Errors (Global)
+**File**: `apps/web/src/services/api/client.ts`
+- **Line 857**: `toast.error(apiError.message, {...})` - Global API error handler
+- **Line 1026**: `toast.error(enhancedMessage, {...})` - Enhanced error messages
+- **Context**: Centralized error handling in API client
+- **Recommendation**: Consider ErrorDisplay banner for critical API errors
+
+### Feature-Specific Toast Errors
+
+#### Library/Playlist Features
+**File**: `apps/web/src/features/library/pages/LibraryPage.tsx`
+- **Line 201**: `toast.error('Impossible de supprimer les pistes')` - Bulk delete error
+- **Status**: ✅ Already replaced with ErrorDisplay (Action 3.1.1.3)
+
+**File**: `apps/web/src/features/playlists/components/SharePlaylistModal.tsx`
+- **Line 45**: `toast.error(apiError.message)` - Share playlist error
+- **Line 59**: `toast.error('Failed to copy link')` - Copy link error
+- **Recommendation**: Replace with ErrorDisplay inline variant
+
+**File**: `apps/web/src/features/playlists/components/AddCollaboratorModal.tsx`
+- **Line 35**: `toast.error('Username is required')` - Validation error
+- **Line 56**: `toast.error(apiError.message)` - Add collaborator error
+- **Recommendation**: Replace validation with inline ErrorDisplay, API error with banner
+
+#### Track Features
+**File**: `apps/web/src/features/tracks/pages/TrackDetailPage.tsx`
+- **Line 63**: `toast.error(errorMessage)` - Track detail error
+- **Recommendation**: Replace with ErrorDisplay card variant
+
+**File**: `apps/web/src/features/tracks/components/ShareDialog.tsx`
+- **Line 49**: `toast.error(apiError.message)` - Share track error
+- **Line 66**: `toast.error('Failed to copy link')` - Copy link error
+- **Recommendation**: Replace with ErrorDisplay inline variant
+
+**File**: `apps/web/src/features/tracks/components/CommentSection.tsx`
+- **Line 46**: `toast.error(error.message || 'Erreur lors de la publication')` - Comment error
+- **Recommendation**: Replace with ErrorDisplay inline variant
+
+#### Chat Features
+**File**: `apps/web/src/features/chat/components/ChatSidebar.tsx`
+- **Line 48**: `toast.error(error.response?.data?.error || 'Failed to leave room')` - Leave room error
+- **Line 63**: `toast.error(error.response?.data?.error || 'Failed to delete room')` - Delete room error
+- **Recommendation**: Replace with ErrorDisplay banner variant
+
+**File**: `apps/web/src/features/chat/components/CreateRoomDialog.tsx`
+- **Line 28**: `toast.error('Room name is required')` - Validation error
+- **Line 56**: `toast.error(apiError.message)` - Create room error
+- **Recommendation**: Replace validation with inline ErrorDisplay, API error with banner
+
+#### User/Profile Features
+**File**: `apps/web/src/features/user/components/ProfileForm.tsx`
+- **Line 170**: `toast.error(apiError.message || t('profile.error') || 'Failed to update profile')` - Profile update error
+- **Recommendation**: Replace with ErrorDisplay banner variant
+
+#### Settings Features
+**File**: `apps/web/src/features/settings/components/AccountSettings.tsx`
+- **Line 61**: `toast.error(apiError.message)` - Account update error
+- **Line 69**: `toast.error('Please type DELETE to confirm')` - Validation error
+- **Line 89**: `toast.error(apiError.message)` - Password change error
+- **Line 115**: `toast.error(apiError.message)` - Account deletion error
+- **Recommendation**: Replace validation with inline ErrorDisplay, API errors with banner
+
+**File**: `apps/web/src/features/settings/pages/SettingsPage.tsx`
+- **Line 39**: `toast.error(errorMessage)` - Settings load error
+- **Line 59**: `toast.error(\`Erreur de validation: ${errors}\`)` - Validation error
+- **Line 70**: `toast.error(errorMessage)` - Settings save error
+- **Recommendation**: Replace with ErrorDisplay banner variant
+
+#### Marketplace Features
+**File**: `apps/web/src/pages/marketplace/MarketplaceHome.tsx`
+- **Line 77**: `toast.error(errorMessage)` - Marketplace load error
+- **Line 107**: `toast.error(errorMessage)` - Marketplace filter error
+- **Recommendation**: Replace with ErrorDisplay card variant
+
+**File**: `apps/web/src/features/marketplace/components/Cart.tsx`
+- **Line 34**: `toast.error('Please log in to checkout')` - Auth error
+- **Line 39**: `toast.error('Cart is empty')` - Validation error
+- **Line 55**: `toast.error(apiError.message)` - Checkout error
+- **Recommendation**: Replace auth/validation with inline ErrorDisplay, checkout error with banner
+
+#### Roles Features
+**File**: `apps/web/src/features/roles/pages/RolesPage.tsx`
+- **Line 45**: `toast.error(errorMessage)` - Roles load error
+- **Line 65**: `toast.error(errorMessage)` - Role update error
+- **Line 71**: `toast.error('Cannot delete system roles')` - Validation error
+- **Line 82**: `toast.error(errorMessage)` - Role delete error
+- **Recommendation**: Replace validation with inline ErrorDisplay, API errors with banner
+
+## 2. Inline Error Displays
+
+### Query Error Displays
+**File**: `apps/web/src/features/library/pages/LibraryPage.tsx`
+- **Lines 402-414**: Query error display with Card component
+- **Status**: ✅ Already replaced with ErrorDisplay (Action 3.1.1.3)
+
+**File**: `apps/web/src/features/playlists/components/AddTrackToPlaylistModal.tsx`
+- **Line 199**: `error ? (<div>...</div>)` - Inline error display
+- **Recommendation**: Replace with ErrorDisplay inline variant
+
+### Profile Error Display
+**File**: `apps/web/src/features/profile/pages/UserProfilePage.tsx`
+- **Line 90**: `<h2 className="text-2xl font-bold text-destructive mb-2">Error</h2>` - Error heading
+- **Recommendation**: Replace with ErrorDisplay card variant
+
+### Upload Error Display
+**File**: `apps/web/src/features/upload/components/UploadModal.tsx`
+- **Line 330**: `<p className="font-medium">{error}</p>` - Upload error display
+- **Recommendation**: Replace with ErrorDisplay inline variant
+
+## 3. Dedicated Error Components
+
+### AuthErrorMessage Component
+**File**: `apps/web/src/features/auth/components/AuthErrorMessage.tsx`
+- **Purpose**: Displays authentication errors
+- **Pattern**: Inline div with red styling
+- **Usage**: Used in LoginForm, RegisterForm
+- **Recommendation**: Replace with ErrorDisplay inline variant (Action 3.1.1.8)
+
+### PlayerError Component
+**File**: `apps/web/src/features/player/components/PlayerError.tsx`
+- **Purpose**: Displays audio player errors
+- **Pattern**: Custom error component with retry button
+- **Features**: Error type detection, retry functionality, dev details
+- **Recommendation**: Replace with ErrorDisplay card variant (Action 3.1.1.9)
+
+### ErrorDisplay Component
+**File**: `apps/web/src/components/ui/ErrorDisplay.tsx`
+- **Status**: ✅ Newly implemented (Action 3.1.1.2)
+- **Purpose**: Standardized error display component
+- **Usage**: Currently used in LibraryPage
+
+## 4. Error Boundaries
+
+### ErrorBoundary Component
+**File**: `apps/web/src/components/ErrorBoundary.tsx`
+- **Usage**: Wraps routes in `router/index.tsx` (40+ instances)
+- **Usage**: Wraps app in `app/App.tsx`
+- **Pattern**: React error boundary with fallback UI
+- **Recommendation**: Update fallback UI to use ErrorDisplay component
+
+### PlaylistErrorBoundary Component
+**File**: `apps/web/src/features/playlists/components/PlaylistErrorBoundary.tsx`
+- **Usage**: Wraps playlist components
+- **Pattern**: Specialized error boundary for playlists
+- **Recommendation**: Update fallback UI to use ErrorDisplay component (Action 3.1.1.10)
+
+## 5. Form Validation Errors
+
+### Inline Form Errors
+**File**: `apps/web/src/features/user/components/ProfileForm.tsx`
+- **Lines 287, 302, 317, 332, 350, 369, 397**: `<p className="text-sm text-red-500">{errors.field.message}</p>`
+- **Pattern**: Inline validation error messages
+- **Recommendation**: Keep as-is (form validation errors are appropriate inline)
+
+**File**: `apps/web/src/features/upload/components/UploadModal.tsx`
+- **Line 381**: `<p className="text-sm text-destructive">{errors.title.message}</p>`
+- **Pattern**: Inline validation error
+- **Recommendation**: Keep as-is (form validation)
+
+### FormField Component
+**File**: `apps/web/src/components/ui/FormField.tsx`
+- **Line 124**: `<p className="text-xs text-red-500 dark:text-red-400">{error}</p>`
+- **Pattern**: Standardized form field error display
+- **Recommendation**: Keep as-is (form validation errors are appropriate inline)
+
+### AuthFormField Component
+**File**: `apps/web/src/features/auth/components/AuthFormField.tsx`
+- **Pattern**: Auth-specific form field with error display
+- **Recommendation**: Keep as-is (form validation errors are appropriate inline)
+
+## 6. API Client Error Handling
+
+**File**: `apps/web/src/services/api/client.ts`
+- **Lines 857, 1026**: Global toast.error calls for API errors
+- **Pattern**: Centralized error notification
+- **Recommendation**: Consider ErrorDisplay banner for critical errors, keep toast for transient errors
+
+## 7. Utility Functions
+
+### apiToastHelper
+**File**: `apps/web/src/utils/apiToastHelper.ts`
+- **Line 53**: `toast.error(message, { duration })` - Helper function
+- **Usage**: Used for consistent toast error styling
+- **Recommendation**: Keep utility, but consider ErrorDisplay integration
+
+## Categorization by Error Type
+
+### 1. Query Errors (Data Fetching)
+- **Pattern**: `isError` from React Query
+- **Current Display**: Inline divs, toast notifications
+- **Recommendation**: ErrorDisplay card/inline variant with retry
+- **Files**: LibraryPage, TrackDetailPage, MarketplaceHome, RolesPage, SettingsPage
+
+### 2. Mutation Errors (Data Updates)
+- **Pattern**: `catch` blocks in async functions
+- **Current Display**: Toast notifications
+- **Recommendation**: ErrorDisplay banner variant (dismissible)
+- **Files**: All feature files with mutations
+
+### 3. Validation Errors (Form Input)
+- **Pattern**: React Hook Form errors
+- **Current Display**: Inline text-red-500
+- **Recommendation**: Keep as-is (appropriate for form validation)
+
+### 4. Network Errors (API Failures)
+- **Pattern**: Axios errors, network failures
+- **Current Display**: Toast notifications, API client errors
+- **Recommendation**: ErrorDisplay banner variant with retry
+- **Files**: API client, feature files
+
+### 5. Runtime Errors (Component Failures)
+- **Pattern**: Error boundaries
+- **Current Display**: ErrorBoundary fallback UI
+- **Recommendation**: Update ErrorBoundary to use ErrorDisplay
+- **Files**: ErrorBoundary, PlaylistErrorBoundary
+
+### 6. Player Errors (Audio Playback)
+- **Pattern**: PlayerError component
+- **Current Display**: Custom PlayerError component
+- **Recommendation**: Replace with ErrorDisplay card variant
+- **Files**: PlayerError.tsx
+
+## Priority Classification
+
+### HIGH Priority (Critical User-Facing Errors)
+1. Query errors (data fetching failures)
+2. Network errors (API failures)
+3. Runtime errors (component crashes)
+
+### MEDIUM Priority (User Action Errors)
+1. Mutation errors (data update failures)
+2. Auth errors (login/register failures)
+3. Player errors (audio playback failures)
+
+### LOW Priority (Transient/Validation Errors)
+1. Form validation errors (keep as-is)
+2. Copy link errors (toast is appropriate)
+3. Validation messages (keep as-is)
+
+## Recommendations Summary
+
+1. **Replace toast.error() for query errors** → ErrorDisplay card/inline variant
+2. **Replace toast.error() for mutation errors** → ErrorDisplay banner variant
+3. **Keep toast.error() for transient actions** → Copy link, quick actions
+4. **Keep inline validation errors** → Form field errors are appropriate
+5. **Update ErrorBoundary fallback** → Use ErrorDisplay component
+6. **Replace PlayerError** → Use ErrorDisplay card variant
+7. **Replace AuthErrorMessage** → Use ErrorDisplay inline variant
+
+## Next Steps
+
+1. ✅ Action 3.1.1.4: Audit complete
+2. ⏭️ Action 3.1.1.5: Create error display strategy document
+3. ⏭️ Action 3.1.1.6: Replace toast.error() calls based on strategy
+4. ⏭️ Action 3.1.1.7: Remove duplicate error displays
+5. ⏭️ Action 3.1.1.8: Update AuthErrorMessage component
+6. ⏭️ Action 3.1.1.9: Update PlayerError component
+7. ⏭️ Action 3.1.1.10: Update ErrorBoundary fallback UI