feat: cascade deletes, student notes, import popups, module reorganization

- Cascade delete on all entities (student, module, UE, user, role, promotion)
- Fix Response body reuse bug (factory functions instead of constants)
- Student note viewing via CAS uid (strip non-digit prefix)
- Fix middleware page visibility for students in LOCAL mode
- Import result popup component (shared across all import pages)
- Fix student import to use numEtud from Excel
- Bulk student selection with promo change and delete
- Move UE/UE-Module API and pages from notes to admin module
- Move promotions page from students to admin module
- Multi-year maquette import with per-year promo selection
- Inline promo creation in maquette import
- Static Excel templates (students, notes, maquette)
- Fix XLSX export using blob download instead of writeFile
- Allow students to read modules list (GET /modules)

routes/(apps)/notes/api/ajustements/[numEtud]/[idUE].ts

@@ -4,12 +4,13 @@ import { ajustements } from "$root/databases/schema.ts";
 import { AuthenticatedState } from "$root/defaults/interfaces.ts";
 import { and, eq } from "npm:drizzle-orm@0.45.2";
 
-const NOT_FOUND = new Response(
-  JSON.stringify({ error: "Ajustement introuvable" }),
-  { status: 404, headers: { "content-type": "application/json" } },
-);
+const NOT_FOUND = () =>
+  new Response(
+    JSON.stringify({ error: "Ajustement introuvable" }),
+    { status: 404, headers: { "content-type": "application/json" } },
+  );
 
-const FORBIDDEN = new Response(null, { status: 403 });
+const FORBIDDEN = () => new Response(null, { status: 403 });
 
 export const handler: Handlers<null, AuthenticatedState> = {
   // #50 GET /ajustements/{numEtud}/{idUE}
@@ -18,7 +19,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
     context: FreshContext<AuthenticatedState>,
   ): Promise<Response> {
     if (context.state.session.eduPersonPrimaryAffiliation !== "employee") {
-      return FORBIDDEN;
+      return FORBIDDEN();
     }
 
     const numEtud = Number(context.params.numEtud);
@@ -34,7 +35,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
       .where(and(eq(ajustements.numEtud, numEtud), eq(ajustements.idUE, idUE)))
       .then((rows) => rows[0] ?? null);
 
-    if (!ajustement) return NOT_FOUND;
+    if (!ajustement) return NOT_FOUND();
 
     return new Response(JSON.stringify(ajustement), {
       headers: { "content-type": "application/json" },
@@ -47,7 +48,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
     context: FreshContext<AuthenticatedState>,
   ): Promise<Response> {
     if (context.state.session.eduPersonPrimaryAffiliation !== "employee") {
-      return FORBIDDEN;
+      return FORBIDDEN();
     }
 
     const numEtud = Number(context.params.numEtud);
@@ -57,7 +58,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
       return new Response("Paramètres invalides", { status: 400 });
     }
 
-    const body: { valeur: number } = await request.json();
+    const body: { valeur: number; malus?: number } = await request.json();
 
     if (body.valeur === undefined) {
       return new Response(JSON.stringify({ error: "Champ requis: valeur" }), {
@@ -66,13 +67,28 @@ export const handler: Handlers<null, AuthenticatedState> = {
       });
     }
 
+    if (
+      body.malus !== undefined &&
+      (!Number.isInteger(body.malus) || body.malus < 0)
+    ) {
+      return new Response(
+        JSON.stringify({ error: "malus doit être un entier >= 0" }),
+        { status: 400, headers: { "content-type": "application/json" } },
+      );
+    }
+
+    const set: { valeur: number; malus?: number } = { valeur: body.valeur };
+    if (body.malus !== undefined) {
+      set.malus = body.malus;
+    }
+
     const [updated] = await db
       .update(ajustements)
-      .set({ valeur: body.valeur })
+      .set(set)
       .where(and(eq(ajustements.numEtud, numEtud), eq(ajustements.idUE, idUE)))
       .returning();
 
-    if (!updated) return NOT_FOUND;
+    if (!updated) return NOT_FOUND();
 
     return new Response(JSON.stringify(updated), {
       headers: { "content-type": "application/json" },
@@ -85,7 +101,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
     context: FreshContext<AuthenticatedState>,
   ): Promise<Response> {
     if (context.state.session.eduPersonPrimaryAffiliation !== "employee") {
-      return FORBIDDEN;
+      return FORBIDDEN();
     }
 
     const numEtud = Number(context.params.numEtud);
@@ -100,7 +116,7 @@ export const handler: Handlers<null, AuthenticatedState> = {
       .where(and(eq(ajustements.numEtud, numEtud), eq(ajustements.idUE, idUE)))
       .returning();
 
-    if (!deleted) return NOT_FOUND;
+    if (!deleted) return NOT_FOUND();
 
     return new Response(null, { status: 204 });
   },