merge: squash develop into master

Intègre en un seul commit les évolutions récentes de develop vers master, incluant la modale admin/gestionnaire, les protections super admin, les ajustements API associés et la mise à jour documentaire des tickets/spec.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/lib/services/user_service.dart

@@ -75,6 +75,41 @@ class UserService {
     return AppUser.fromJson(data);
   }
 
+  static Future<AppUser> createAdministrateur({
+    required String nom,
+    required String prenom,
+    required String email,
+    required String password,
+    required String telephone,
+  }) async {
+    final response = await http.post(
+      Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/admin'),
+      headers: await _headers(),
+      body: jsonEncode(<String, dynamic>{
+        'nom': nom,
+        'prenom': prenom,
+        'email': email,
+        'password': password,
+        'telephone': telephone,
+      }),
+    );
+
+    if (response.statusCode != 200 && response.statusCode != 201) {
+      final decoded = jsonDecode(response.body);
+      if (decoded is Map<String, dynamic>) {
+        final message = decoded['message'];
+        if (message is List && message.isNotEmpty) {
+          throw Exception(message.join(' - '));
+        }
+        throw Exception(_toStr(message) ?? 'Erreur création administrateur');
+      }
+      throw Exception('Erreur création administrateur');
+    }
+
+    final data = jsonDecode(response.body) as Map<String, dynamic>;
+    return AppUser.fromJson(data);
+  }
+
   // Récupérer la liste des parents
   static Future<List<ParentModel>> getParents() async {
     final response = await http.get(
@@ -132,6 +167,82 @@ class UserService {
     return [];
   }
 
+  static Future<AppUser> createAdmin({
+    required String nom,
+    required String prenom,
+    required String email,
+    required String password,
+    required String telephone,
+  }) async {
+    final response = await http.post(
+      Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/admin'),
+      headers: await _headers(),
+      body: jsonEncode(<String, dynamic>{
+        'nom': nom,
+        'prenom': prenom,
+        'email': email,
+        'password': password,
+        'telephone': telephone,
+      }),
+    );
+
+    if (response.statusCode != 200 && response.statusCode != 201) {
+      final decoded = jsonDecode(response.body);
+      if (decoded is Map<String, dynamic>) {
+        final message = decoded['message'];
+        if (message is List && message.isNotEmpty) {
+          throw Exception(message.join(' - '));
+        }
+        throw Exception(_toStr(message) ?? 'Erreur création administrateur');
+      }
+      throw Exception('Erreur création administrateur');
+    }
+
+    final data = jsonDecode(response.body) as Map<String, dynamic>;
+    return AppUser.fromJson(data);
+  }
+
+  static Future<AppUser> updateAdmin({
+    required String adminId,
+    required String nom,
+    required String prenom,
+    required String email,
+    required String telephone,
+    String? password,
+  }) async {
+    final body = <String, dynamic>{
+      'nom': nom,
+      'prenom': prenom,
+      'email': email,
+      'telephone': telephone,
+    };
+
+    if (password != null && password.trim().isNotEmpty) {
+      body['password'] = password.trim();
+    }
+
+    final response = await http.patch(
+      Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/$adminId'),
+      headers: await _headers(),
+      body: jsonEncode(body),
+    );
+
+    if (response.statusCode != 200) {
+      final decoded = jsonDecode(response.body);
+      if (decoded is Map<String, dynamic>) {
+        final message = decoded['message'];
+        if (message is List && message.isNotEmpty) {
+          throw Exception(message.join(' - '));
+        }
+        throw Exception(_toStr(message) ?? 'Erreur modification administrateur');
+      }
+      throw Exception('Erreur modification administrateur');
+    }
+
+    final data = jsonDecode(response.body) as Map<String, dynamic>;
+    return AppUser.fromJson(data);
+  }
+
   static Future<void> updateGestionnaireRelais({
     required String gestionnaireId,
     required String? relaisId,
@@ -156,7 +267,7 @@ class UserService {
     required String nom,
     required String prenom,
     required String email,
-    required String telephone,
+    String? telephone,
     required String? relaisId,
     String? password,
   }) async {
@@ -164,10 +275,13 @@ class UserService {
       'nom': nom,
       'prenom': prenom,
       'email': email,
-      'telephone': telephone,
       'relaisId': relaisId,
     };
 
+    if (telephone != null && telephone.trim().isNotEmpty) {
+      body['telephone'] = telephone.trim();
+    }
+
     if (password != null && password.trim().isNotEmpty) {
       body['password'] = password.trim();
     }
@@ -194,6 +308,50 @@ class UserService {
     return AppUser.fromJson(data);
   }
 
+  static Future<AppUser> updateAdministrateur({
+    required String adminId,
+    required String nom,
+    required String prenom,
+    required String email,
+    String? telephone,
+    String? password,
+  }) async {
+    final body = <String, dynamic>{
+      'nom': nom,
+      'prenom': prenom,
+      'email': email,
+    };
+
+    if (telephone != null && telephone.trim().isNotEmpty) {
+      body['telephone'] = telephone.trim();
+    }
+
+    if (password != null && password.trim().isNotEmpty) {
+      body['password'] = password.trim();
+    }
+
+    final response = await http.patch(
+      Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/$adminId'),
+      headers: await _headers(),
+      body: jsonEncode(body),
+    );
+
+    if (response.statusCode != 200) {
+      final decoded = jsonDecode(response.body);
+      if (decoded is Map<String, dynamic>) {
+        final message = decoded['message'];
+        if (message is List && message.isNotEmpty) {
+          throw Exception(message.join(' - '));
+        }
+        throw Exception(_toStr(message) ?? 'Erreur modification administrateur');
+      }
+      throw Exception('Erreur modification administrateur');
+    }
+
+    final data = jsonDecode(response.body) as Map<String, dynamic>;
+    return AppUser.fromJson(data);
+  }
+
   static Future<void> deleteUser(String userId) async {
     final response = await http.delete(
       Uri.parse('${ApiConfig.baseUrl}${ApiConfig.users}/$userId'),