fix(securite): lock down the two unauthenticated emergency endpoints

- POST /api/emergency-admin-reset accepted a fallback secret hardcoded in
  the repository, letting anyone who read the source reset the production
  admin account to admin/admin (EMERGENCY_SECRET is not set in the shipped
  docker-compose, so the fallback was live). The route now returns 404
  unless EMERGENCY_SECRET is explicitly configured, and invalid attempts
  are logged.
- POST /api/admin/emergency-migration ran database migrations with no
  authentication at all; it now requires an authenticated admin.

A sweep of the remaining API surface found no other unauthenticated
mutation or read routes beyond /api/health. .env.example documents
EMERGENCY_SECRET and ENCRYPTION_KEY.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHdE9nEh8zHhQNGpCgrtYe

server/routes.ts

@@ -5558,8 +5558,14 @@ RÉSUMÉ DU SCAN
   });
 
   // Emergency migration route for SAV priority column
-  app.post('/api/admin/emergency-migration', async (req, res) => {
+  // SÉCURITÉ : réservée aux administrateurs authentifiés (était accessible sans login)
+  app.post('/api/admin/emergency-migration', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUser(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Insufficient permissions" });
+      }
+
       console.log('🚨 EMERGENCY: Forcing SAV migration execution...');
 
       // Import migration function