Upload folder using huggingface_hub

.gitignore

@@ -144,6 +144,9 @@ data/processed/failed_attempts.json
 # dbt build artifacts & local state
 backend/pipeline/dbt_project/target/
 backend/pipeline/dbt_project/.user.yml
+# profiles.yml est GÉNÉRÉ par run_data_quality_tests (chemins absolus locaux) :
+# le tracker garantissait un working tree sale après chaque run.
+backend/pipeline/dbt_project/profiles.yml
 
 # Uploaded media (generated at runtime, not source)
 backend/api/media/
@@ -151,3 +154,8 @@ backend/api/media/
 # Frontend test coverage reports
 frontend/coverage/
 coverage/
+# Backend coverage report (pytest --cov)
+coverage.xml
+
+# Catalogue offline généré au runtime (SQLite), pas une source
+backend/api/animetix/static/animetix/data/

TODO.md

@@ -6,44 +6,17 @@
 
 ## 🔴 Critiques
 
-- [x] **Prod — secrets réels embarqués dans l'image Docker** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-05, détail archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
-  - ✅ Le `.env` racine ne part plus dans l'image : `.env` exclu de [.gcloudignore](.gcloudignore) (vérifié via `gcloud meta list-files-for-upload` — seul `.env.example` reste), [.dockerignore](.dockerignore) **racine** créé (`.env` + `**/.env` — celui que Docker lit vraiment), config morte `deploy/.dockerignore` supprimée. Le `read_env` de [settings.py:14-16](backend/api/animetix_project/settings.py#L14-L16) devient inoffensif (fichier absent de l'image, ignoré silencieusement).
-  - ✅ Second canal de fuite fermé : [hf_deploy.py](scripts/deploy/huggingface/hf_deploy.py) exclut `.env`/`**/.env` **inconditionnellement** (indépendamment de l'ignore fourni par l'appelant) ; vérifié via l'API Hub que le Space n'a jamais contenu de `.env` réel.
-- [ ] **Prod — secrets manquants sur `animetix-web` + hygiène post-fuite** _(découvert lors de la remédiation `.env` du 2026-07-05 — la fuite elle-même est close et vérifiée, archivée dans [docs/HISTORY.md](docs/HISTORY.md))_
-  - ⏳ **Monter les secrets sur le service web** (action manuelle — bloquée en session par permission) : l'image prod, CI-buildée et donc sans `.env`, tourne **sans** `NEO4J_URI/USER/PASSWORD` (lues par [neo4j_client.py:17-19](backend/pipeline/neo4j_client.py#L17-L19) — features graphe/Oracle dégradent en silence) ni `HUGGINGFACE_API_KEY` ([qwen3_vl_adapter.py:34](backend/adapters/inference/qwen3_vl_adapter.py#L34)) ; `HF_SPACES` y est un littéral au lieu d'un secretKeyRef. Les secrets existent déjà en SM (montés sur les 8 jobs). Exécuter :
-    ```
-    gcloud run services update animetix-web --region europe-west9 --project animetix \
-      --remove-env-vars=HF_SPACES \
-      --update-secrets=HF_SPACES=HF_SPACES:latest,HUGGINGFACE_API_KEY=HF_TOKEN:latest,NEO4J_URI=NEO4J_URI:latest,NEO4J_USER=NEO4J_USER:latest,NEO4J_PASSWORD=NEO4J_PASSWORD:latest
-    ```
-    (Sans risque : nouvelle révision, même image, rollback instantané. [ci.yml](.github/workflows/ci.yml) déploie avec `--update-env-vars` → ne wipe rien.)
-  - ⏳ **Hygiène historique** : purger les anciens tags de `animetix-repo/web` buildés localement avant l'exclusion (peuvent contenir le `.env`) ; révoquer `TRIPO_API_KEY` et `MAPBOX_TOKEN` (valeurs réelles dans le `.env` local, consommées nulle part dans le code).
-- [x] **Sécu — SQL généré par LLM exécuté en base (auto-flaggé HIGH-RISK)** _(audit dette 2026-07-05 ; **clos** le 2026-07-05 par suppression, archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
-  - Code mort de bout en bout (zéro appelant de production, flag off, prod sur Neon) → feature supprimée plutôt que durcie : port + 3 adapters, `sql_guard.py` + fuzzing + script d'audit, settings `ALLOYDB_NL_*`, dépendance `sqlglot`. Spec : [docs/plans/2026-07-05-remove-text-to-sql-design.md](docs/plans/2026-07-05-remove-text-to-sql-design.md).
-- [ ] **Prod — WebSockets cassés (500 sur chaque handshake)** _(audit dette 2026-07-05 ; **corrigé en code** le 2026-07-05, reste le deploy)_
-  - ✅ **Cause racine confirmée par les logs Cloud Run** (repro live, trace `b03e26f1…`) : `ModuleNotFoundError: No module named 'channels_redis'` — le backend Redis était sélectionné dès que `REDIS_URL` existe (prod), mais **le paquet n'a jamais été dans requirements** ; en local, pas de `REDIS_URL` → fallback InMemory → invisible. Les hypothèses TLS et WSGI étaient toutes deux secondaires.
-  - ✅ **Fix committé** : `channels-redis==4.3.0` ajouté (lock régénéré sans dérive) ; [channels_config.py](backend/api/animetix_project/channels_config.py) extrait la construction du layer — **fail-fast** `ImproperlyConfigured` si `REDIS_URL` manque en prod (l'InMemory par-process casse le fan-out avec 2 workers), et miroir du `ssl_cert_reqs=None` de CACHES pour `rediss://`. Tests de régression : [test_channel_layers.py](tests/backend/test_channel_layers.py) (dont `import_string` sur le backend configuré — le test qui aurait attrapé le bug).
-  - ⏳ **Reste** : rebuild + deploy prod (manuel : `gh workflow run ci.yml -f deploy_to_prod=true` après push), puis vérifier le handshake : `curl -si -H "Connection: Upgrade" -H "Upgrade: websocket" -H "Sec-WebSocket-Version: 13" -H "Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==" https://animetix-web-zhwkba45ta-od.a.run.app/ws/undercover/testroom/` → attendu `101 Switching Protocols` (aujourd'hui : 500).
+_Aucun item ouvert._
 
 ## 🟠 Élevés
 
-- [x] **Backend — triple espace de noms d'import du même package** _(audit dette 2026-07-05 ; **clos** le 2026-07-05, archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
-  - Racine nue unifiée partout (~31 fichiers réécrits, chaînes `@patch`/settings comprises) ; hacks supprimés (sync contextvars de middleware.py, `SrcPipelineMapper` du conftest) ; tripwire 3 couches : garde levante [backend/\_\_init\_\_.py](backend/__init__.py), ruff TID251, [test_import_hygiene.py](tests/test_import_hygiene.py). Spec : [docs/plans/2026-07-05-unify-import-namespace-design.md](docs/plans/2026-07-05-unify-import-namespace-design.md).
-- [x] **Sécu/coûts — endpoints IA/GPU en `AllowAny` + throttling incohérent** _(audit dette 2026-07-05 ; **clos** le 2026-07-05, archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
-  - Inventaire : 3 des 4 vues labs citées étaient CPU (restent publiques). 4 vrais trous fermés : S2S Live WS (auth+Bx forfaitaire+cap 10 min ; token via `Sec-WebSocket-Protocol`, pas l'URL), carte-monde (cache partagé public 24 h), VideoRAG (auth+Bx 6), fallback modération LLM (réservé aux authentifiés). Throttling à deux vitesses : burst/minute global (anon 30/min, user 120/min) + scope `gpu` (30/h) réhabilité + `cpu_game` (60/min) sur tous les jeux CPU (fin des `throttle_classes=[]`). Gates login front sur Video/VisualNexus/S2S. Spec : [docs/plans/2026-07-05-secure-ai-endpoints-design.md](docs/plans/2026-07-05-secure-ai-endpoints-design.md).
-- [ ] **Backend — N+1 quasi garantis sur les endpoints listes** _(audit dette 2026-07-05)_
-  - 8 `select_related`/`prefetch_related` dans tout le backend pour un [models.py](backend/api/animetix/models.py) de 895 lignes plein de FK. Les endpoints listes/social/leaderboard ([social.py](backend/api/animetix/api/social.py), [core.py](backend/api/animetix/api/core.py)) sérialisent des objets liés sur Postgres distant (Neon) — latence qui scale avec le volume.
-- [ ] **CI — workflow HF cassé (mauvais chemin de script)** _(audit dette 2026-07-05)_
-  - [deploy_to_hf.yml:44](.github/workflows/deploy_to_hf.yml#L44) appelle `scripts/deploy/hf_deploy.py` qui n'existe pas (réel : `scripts/deploy/huggingface/hf_deploy.py`) → le job échoue à chaque déclenchement. Fixer le chemin, ou supprimer le déploiement HF si Cloud Run est la vraie prod.
-- [x] **Build — dépendances de dev embarquées dans l'image prod** _(audit dette 2026-07-05 — corrigé 2026-07-08)_
-  - ~~[requirements.in:30-39](requirements.in#L30-L39) mélange pytest/pytest-playwright/playwright/watchdog/coloredlogs dans le lock de prod (playwright tire tout un stack navigateur). Scinder en `requirements.in` + `requirements-dev.in`.~~ Fait : 9 pkgs dev sortis du lock prod vers `requirements-dev.{in,txt}` (layered `-c requirements.txt`) ; les 3 images Docker maigrissent sans changement ; 3 jobs CI pytest installent le lock dev. Commits 22a12a30 / 6d045714 / 8294c9c8.
-- [x] **Frontend — tokens de design CSS cassés (triplets RGB à virgules)** _(audit dette 2026-07-05 — corrigé 2026-07-05)_
-  - 23 tokens de [index.css](frontend/src/index.css) convertis en triplets espace-séparés (`37 99 235`). Vérifié en navigateur : `bg-brand-primary` → `rgb(37, 99, 235)`, `bg-anime-accent/20` → `rgba(253, 185, 19, 0.2)`. Les seuls autres consommateurs (`rgb(var(--color-bg))` body) acceptent les deux formats.
+- [ ] **Sécu — révoquer les clés mortes du `.env` local** _(reliquat de l'hygiène post-fuite `.env`, close le 2026-07-09 — secrets montés sur `animetix-web` + 33 images pré-exclusion purgées, archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
+  - ⏳ Révoquer `TRIPO_API_KEY` et `MAPBOX_TOKEN` depuis leurs dashboards respectifs (Tripo3D / Mapbox — action manuelle externe) : valeurs réelles dans le `.env` local, consommées nulle part dans le code. Risque résiduel faible depuis la purge des anciennes images.
 
 ## 🟡 Moyens
 
-- [ ] **Backend — fichiers-dieux dans la couche API** _(audit dette 2026-07-05)_
-  - 25 fichiers > 500 lignes ; pires côté runtime : [labs.py](backend/api/animetix/api/labs.py) (1262 lignes, ~25 vues) et [core.py](backend/api/animetix/api/core.py) (1216 lignes — auth, recherche, config et jeu dans le même fichier). Découper par domaine.
+- [ ] **Backend — `Profile.rank` n'existe pas (consommé par ConfigView + ProfileSerializer)** _(découvert lors du découpage API du 2026-07-10 — à confirmer)_
+  - `ConfigView` lit `request.user.profile.rank` ([core/config.py](backend/api/animetix/api/core/config.py)) et `ProfileSerializer` déclare `rank = ReadOnlyField()`, mais le modèle `Profile` ne définit aucun attribut `rank` — [test_core_coverage.py](tests/api/test_core_coverage.py) le patche même (`create=True`) avec le commentaire « which the Profile model does not define ». Vérifier le comportement réel en prod (500 probable sur `/config/` authentifié ?) et soit définir la propriété (dérivée de `ranked_points` ?), soit retirer le champ.
 - [ ] **Backend — service locator au lieu d'injection** _(audit dette 2026-07-05)_
   - 169 appels directs `container.x.y()` dans les vues + monkey-patch `ProviderDelegate` ([containers/\_\_init\_\_.py:40-54](backend/api/animetix/containers/__init__.py#L40-L54)) pour contourner le wiring de `dependency_injector`. Couplage global difficile à tester ; lié au bug DI contourné dans [tests/api/games/conftest.py](tests/api/games/conftest.py).
 - [ ] **Backend — exceptions avalées à grande échelle** _(audit dette 2026-07-05)_
@@ -52,95 +25,19 @@
   - [brain_api.py](backend/adapters/inference/brain_api.py) n'est importé nulle part (le container câble `brain_api_adapter`). À supprimer — son nom quasi identique au module actif est un piège.
 - [ ] **Backend — signaux dispersés + write amplification** _(audit dette 2026-07-05)_
   - Signaux dans [models.py:549-557](backend/api/animetix/models.py#L549-L557) ET [signals.py](backend/api/animetix/signals.py) ; `save_user_profile` ré-écrit le profil à **chaque** save de User et lève `RelatedObjectDoesNotExist` si le profil manque (users bulk/legacy). Consolider et garder.
-- [ ] **Backend — squash des migrations** _(audit dette 2026-07-05)_
-  - 48 migrations sur une seule app, avec churn (QuizWhoRoom créé en 0044, supprimé en 0046). Squash = setup DB de test/CI plus rapide.
-- [x] **Frontend — composants-dieux (14 pages de 400-560 lignes)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Refactorisé les trois pages principales : `ForgePage.tsx`, `SynapticLabPage.tsx` et `UndercoverRoom.tsx`. Extrait la logique de state et d'intégration réseau/socket dans des hooks réutilisables (`useForge.ts`, `useSynapticLab.ts`, `useUndercoverRoom.ts`) et découpé les interfaces complexes en sous-composants présentationnels modulaires sous `components/forge/`, `components/labs/` et `components/games/`. Tous les tests unitaires et le typage TypeScript passent à 100%.
-- [x] **Frontend — deux implémentations WebSocket divergentes (+ 2 bugs)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Corrigé le bug d'ordre d'assignation dans `useSocket.ts` : le toast « Connexion rétablie ! » s'affiche désormais correctement lors d'une reconnexion réussie.
-  - ✅ Standardisé la reconnexion de `notificationStore.ts` pour s'aligner sur `useSocket` : ajout d'un cap de 5 tentatives max, backoff exponentiel, détection et non-reconnexion lors d'un close volontaire (ex. déconnexion/logout avec code `1000`), toasts d'information, et nettoyage du timeout lors de `disconnect()`. Tous les tests unitaires et le typage TypeScript passent.
-- [x] **Frontend — i18n incohérent (~500 chaînes FR en dur)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-06)_
-  - ✅ Tous les ~150 fichiers restants (labs, social, admin, media, search, dev) ont été externalisés avec `t('clé', 'défaut FR')`. Les fragments de traduction ont été générés et fusionnés via le script `merge_translation_fragments.py`. Les incohérences de clés préexistantes (`games.akinetix` vs `labs.akinetix` et `labs.ai_debate_arena.protocol_text`) ont été résolues et vérifiées par `compare_translations.py` (succès 100% de concordance des clés). Les 611 tests unitaires vitest et le type checking passent sans erreur.
-- [x] **Tests — le conftest des jeux est une mine (bug `dependency_injector`)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-06)_
-  - ✅ Corrigé à la racine dans `dependency_injector.wiring` en adaptant `_is_marker` et les vérifications de types (`Provide`, `Provider`, `Closing`) pour utiliser du duck-typing et des comparaisons de noms de classes. Cela résout la collision d'importation multiple sous couverture de tests. Le test skippé dans [test_archetypist_coverage.py](tests/api/games/test_archetypist_coverage.py) a été restauré et corrigé, et tout le suite de tests passe au vert.
-- [x] **Tests — les e2e Playwright ne tournent nulle part** _(audit dette 2026-07-05)_
-  - `npm run test:e2e` filtre `--grep @e2e` mais **aucune spec n'a ce tag** → 0 test sélectionné. En CI seule `a11y.spec.ts` tourne ([ci.yml:289](.github/workflows/ci.yml#L289)) ; `akinetix.spec.ts`, `vrt.spec.ts`, `forge-ui.spec.ts` ne s'exécutent jamais. Idem projet vitest `storybook` (jamais en CI).
-- [x] **Tests — asymétrie de couverture + angles morts** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Écrit 25 tests unitaires ciblant les angles morts (`pipeline/movies`, `pipeline/games`, `pipeline/actors`, `adapters/infrastructure`), atteignant une couverture ciblée de 78.83% (au-dessus du seuil de 75%).
-  - ✅ Configuré Ollama et rendu les tests d'intégration bloquants en CI.
-- [x] **Tests — 77 mutations brutes de `sys.modules` dans 16 fichiers** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Sécurisé le nettoyage inter-tests via un snapshot/restore complet de `sys.modules` dans `conftest.py`.
-  - ✅ Remplacé les assignations `os.environ` au niveau module dans les fichiers de test de `brain_api` par `setdefault` pour éviter le couplage temporel.
-  - ✅ Remplacé les vrais `asyncio.sleep` (50ms) par un simple `yield` (`asyncio.sleep(0)`) dans `test_cove_parallel.py`.
-  - ✅ Supprimé le partage d'objets mocks globaux dans `test_s2s_inference.py` (instanciés à chaque test).
-- [x] **CI — dérive pre-commit ↔ CI + audit sécu frontend factice** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Configuré `.pre-commit-config.yaml` pour exécuter `mypy` (avec `--no-site-packages` pour correspondre à la CI et éviter les conflits locaux) et `pytest` avec une barrière de couverture de 75%.
-  - ✅ Créé des scripts de contrôle `run_in_venv.py` et `run_cmd.py` pour exécuter les hooks dans le venv et les sous-répertoires correspondants de manière multiplateforme.
-  - ✅ Ajouté des hooks frontend unifiés (`lint-staged` au commit, `vitest` au push).
-  - ✅ Corrigé le type checker `mypy` (0 erreurs sur 515 fichiers).
-  - ✅ Corrigé le job `frontend-security` pour lancer un vrai `npm audit --audit-level=high` et résolu 12 vulnérabilités de sécurité via `npm audit fix`.
-- [x] **Infra — `animetix.xyz` absent des défauts `ALLOWED_HOSTS`/CORS** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Ajouté le domaine custom `animetix.xyz` et ses sous-domaines (`.animetix.xyz`) aux valeurs par défaut d' `ALLOWED_HOSTS` en production.
-  - ✅ Ajouté `https://animetix.xyz` et `https://www.animetix.xyz` aux valeurs par défaut de `CSRF_TRUSTED_ORIGINS` (en production) et configuré `CORS_ALLOWED_ORIGINS` de manière dynamique à partir des variables d'environnement avec ces domaines par défaut.
-- [x] **Infra — logique de déploiement dupliquée, pas d'IaC** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Créé une source déclarative unique [deployments.yaml](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/deploy/deployments.yaml) qui centralise tous les paramètres de déploiement (GCP Services, Cloud Run GPU, 8 Jobs planifiés, Load Balancer / CDN, Cloud Armor, Cloudflare Worker et Hugging Face Space).
-  - ✅ Fusionné les 3 fichiers de build dans le fichier [cloudbuild.yaml](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/cloudbuild.yaml) à la racine de manière à supporter le build sélectif ou global via des substitutions (`_BUILD_TARGET`).
-  - ✅ Refactorisé les scripts de déploiement Python (`deploy_brain.py`, `deploy_jobs.py`, `deploy_budget.py`, `deploy_cdn.py`, `deploy_security.py`) pour éliminer les paramètres codés en dur et lire directement depuis `deployments.yaml`.
-  - ✅ Aligné `.gcloudignore` sur `.dockerignore` via la directive `#!include:.dockerignore` pour garantir un contexte de build unique et canonique.
-- [x] **Scripts — sprawl (~55 scripts, one-offs exploratoires)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Éliminé la prolifération de scripts exploratoires orphelins (supprimé le répertoire `scripts/test/` contenant 7 scripts hors pytest).
-  - ✅ Promu et migré tous les scripts utilitaires de base de données (Qdrant vector counts, migration checks, SQLite catalog checking et Neo4j reconciliation) vers des Django management commands standards sous `backend/api/animetix/management/commands/` (`check_db_status`, `reconcile_db` et `generate_offline_db`).
-  - ✅ Optimisé la commande `reconcile_db` en effectuant un chargement en bloc (`values_list` avec `item_id__in`) pour éviter les boucles de requêtes N+1 et en validant la connectivité Neo4j une seule fois pour éviter d'inonder les logs.
-  - ✅ Éliminé les emojis et caractères non-ASCII des commandes de base de données pour empêcher les erreurs d'encodage de console (`UnicodeEncodeError`) sous Windows.
-- [ ] **Backend — noms de modèles hardcodés + mismatch de version** _(revue archi 2026-06-22 ; en partie fait)_
-  - ✅ Phase 1 : registre sécu [model_registry.py](backend/core/utils/model_registry.py) (SHA + trust). ✅ Phase 2a : unification Gemini en 3 rôles canoniques via [gemini_models.py](backend/core/utils/gemini_models.py) (`gemini-3.5-flash`/`live-2.5-native-audio`/`embedding-2`) + garde-fou anti-littéral. ✅ Révisions d'embeddings résolues depuis le registre central (`EMBEDDING_VERSIONS`, manifest abandonné).
+- [ ] **Backend — squash des migrations : purge des originales** _(audit dette 2026-07-05 ; squash livrée le 2026-07-08, archivée dans [docs/HISTORY.md](docs/HISTORY.md))_
+  - ⏳ La squash `0001_squashed_0049` existe (commit `68fec496`). Reste : une fois la squash enregistrée comme appliquée partout (prod Neon comprise), supprimer les 49 migrations d'origine et retirer l'attribut `replaces` (procédure Django standard).
+- [ ] **Backend — noms de modèles hardcodés + mismatch de version** _(revue archi 2026-06-22 ; Phases 1/2a livrées, archivées dans [docs/HISTORY.md](docs/HISTORY.md))_
   - ⏳ **Reste (Phase 2b)** : registre d'**IDs logiques locaux** (`llama3`, `Qwen2.5-1.5B` vs `Qwen3.5-4B`, `DRAFT_MODEL_ID`, `VibeThinker-3B`, `FLUX`) + fusion résiduelle [pipeline/models_registry.py](backend/pipeline/models_registry.py).
 
 ## 🟢 Faibles
 
-- [x] **Git — `dev/null/` versionné (hooks Git-LFS committés)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Supprimé définitivement le chemin littéral `dev/null/` et les 4 hooks LFS (`post-checkout`, `post-commit`, `post-merge`, `pre-push`) qui y avaient été committés par accident lors d'une redirection de commande Windows (commit `3df26086`).
-- [x] **Git — ~30 Mo de PNG en blobs bruts (64 fichiers, hors LFS)** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Configuré le suivi automatique des fichiers `*.png` par Git LFS dans [.gitattributes](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/.gitattributes).
-  - ✅ Converti et renormalisé en place les 64 images PNG existantes (dont les gros arrière-plans et mock-ups comme `background.png`) en pointeurs Git LFS via la commande sécurisée `git add --renormalize .` sans altérer l'historique des commits.
-- [x] **Docs — deux TODO contradictoires + docs périmées** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Supprimé le fichier de suivi en double et obsolète [docs/TODO.md](docs/TODO.md) pour conserver le fichier `TODO.md` à la racine comme seule et unique source de vérité.
-  - ✅ Corrigé le chemin d'accès vers `setup_e2e.py` dans [README.md](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/README.md) en le faisant pointer vers `scripts/verify/setup_e2e.py`.
-  - ✅ Nettoyé [docs/ARCHITECTURE.md](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/docs/ARCHITECTURE.md) en remplaçant la référence à Celery par les Cloud Run Jobs actifs.
-  - ✅ Mis à jour [docs/FULL_GUIDE.md](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/docs/FULL_GUIDE.md) et [docs/ROADMAP.md](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/docs/ROADMAP.md) pour documenter et marquer comme terminés les développements clés de juillet 2026 (la détection de drift d'embeddings/d'archétypes, les diagnostics de transparence XAI et la sécurité des budgets de facturation).
-- [x] **Nettoyage — résidus de working tree et de refactor** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Ajouté `/src/` au fichier [.gitignore](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/.gitignore) pour s'assurer que si des outils recréent un dossier `src/` vide à la racine du projet, cela ne vienne pas polluer les statuts Git.
-  - ✅ Vérifié que les fichiers résiduels temporaires (`error_latent.html` et `brainstorming_status.txt`) sont déjà correctement configurés dans `.gitignore`.
-- [x] **Divers cosmétique/hygiène** _(audit dette 2026-07-05 ; **clos et vérifié** le 2026-07-07)_
-  - ✅ Supprimé et désindexé de Git les fichiers binaires de traduction `.mo` compilés (`backend/api/locale/*/LC_MESSAGES/django.mo`) et configuré leur exclusion permanente via le modèle `*.mo` dans [.gitignore](file:///c:/Users/bahma/PycharmProjects/Projet solo/Double_scenario_Project/.gitignore).
-  - ✅ Corrigé le fichier légal [NOTICE](file:///c:/Users/bahma/PycharmProjects/Projet solo/Double_scenario_Project/NOTICE) pour remplacer les mentions de « Double Scenario Project » par la marque officielle « Animetix ».
-  - ✅ Converti le fichier Windows-only `sync-api.bat` en un script Python cross-platform moderne [scripts/sync_api.py](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/scripts/sync_api.py) qui détecte automatiquement l'interpréteur virtuel et execute spectacular + openapi-typescript de manière native sur tous les OS.
-  - ✅ Supprimé la variable de configuration redondante `WSGI_APPLICATION` dans [settings.py](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/backend/api/animetix_project/settings.py) puisque le serveur est ASGI-only (évite les erreurs d'incompréhension au déploiement).
-  - ✅ Désindexé de Git le fichier d'environnement sensible de production [frontend/.env.production](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/frontend/.env.production) et ajouté sa règle d'exclusion dans `.gitignore`.
-  - ✅ Consolidé l'injection du jeton d'authentification Firebase et les en-têtes XML HTTP Request de [api.ts](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/frontend/src/api.ts#L342-L371) (`downloadDataset`) en adaptant [apiClient.ts](file:///c:/Users/bahma/PycharmProjects/Projet%20solo/Double_scenario_Project/frontend/src/utils/apiClient.ts) pour qu'il prenne en charge le type de retour binaire `responseType: 'blob'`.
-  - ✅ Résolu les erreurs de compilation TypeScript induites par la génération du schéma sur les composants d'audit XAI en liant proprement le décorateur `@extend_schema` aux serializers correspondants dans l'API Django.
 - [ ] **Settings — défauts d'infra codés en dur** _(audit dette 2026-07-05)_
   - `DEBUG=True` par défaut hors-prod ([settings.py:104](backend/api/animetix_project/settings.py#L104)) : toute la sécurité repose sur `DJANGO_ENV=production` ; URLs hf.space et emails de service accounts en littéraux ([settings.py:331,391,395,581,595,620](backend/api/animetix_project/settings.py#L331)) ; `print()` au démarrage ([settings.py:375,510](backend/api/animetix_project/settings.py#L375)) au lieu du logger ; `ssl_cert_reqs: None` sur le cache `rediss://` ([settings.py:361](backend/api/animetix_project/settings.py#L361)) désactive la vérif de cert.
-- [ ] **Backend — duplication entre adapters d'inférence** _(revue archi 2026-06-22 ; en partie fait)_
-  - ✅ `health_check` *reachability* des adapters API (`brain_api` HTTP-ping, `google_genai` client-init, `unified`/ollama) factorisé dans [ReachabilityHealthCheckMixin](backend/adapters/inference/reachability_health_mixin.py) (builder de statut standardisé + sonde HTTP générique pilotée par un `requester` injecté → chaque adapter garde son client HTTP et ses cibles de patch).
-  - ✅ `health_check` *readiness* factorisé dans [LazyLocalModelAdapter](backend/adapters/inference/lazy_local_model_adapter.py) (tous les adapters à modèle local migrés) ; motif `_load_model()` multi-sous-modèles factorisé dans [LazyLoadMixin](backend/adapters/inference/lazy_load_mixin.py) (`ImageGenMixin`/`AudioMixin`).
+- [ ] **Backend — duplication entre adapters d'inférence** _(revue archi 2026-06-22 ; mixins de factorisation livrés, archivés dans [docs/HISTORY.md](docs/HISTORY.md))_
   - ⏳ **Reste (résiduel, hors scope)** : `RerankMixin` et `LocalTextAdapter.get_text_embedding` (chargements inline aux sémantiques d'erreur différentes) ; `LocalGuardrailAdapter` (aucun modèle).
-- [x] **Backend — validation des env vars d'inférence** _(revue archi 2026-06-22 ; fait)_
-  - ✅ `BrainAPIAdapter` échoue tôt (`raise ConfigurationError` si `BRAIN_API_URL` manquant) ([brain_api_adapter.py](backend/adapters/inference/brain_api_adapter.py)).
-  - ✅ Garde-fou de cohérence (coherence-only) pour `unified` (`LLM_API_BASE` malformé) et `google_genai` (`GEMINI_API_KEY` blanc) dans leurs `__init__`, + validation groupée à erreurs agrégées au démarrage du container via `validate_inference_config()` ([inference_config.py](backend/core/utils/inference_config.py), câblée dans [inference.py](backend/api/animetix/containers/inference.py)).
-  - ✅ `BrainAPIAdapter` routé sur `check_brain_config` ([brain_api_adapter.py](backend/adapters/inference/brain_api_adapter.py)) : message unifié (`"BRAIN_API_URL is not configured"`) + check d'URL malformée côté adapter. En-tête d'erreur agrégée passé tout en anglais (`"Invalid inference configuration:"`) et filtre `is not None` dans `validate_inference_config()`.
-- [x] **Backend — adapters synchrones (pas de parallélisation des streams)** _(revue archi 2026-06-22 ; fait)_
-  - ✅ `astream_generate` natif (I/O non bloquante) pour `UnifiedInferenceAdapter` (httpx.AsyncClient/SSE), `GoogleGenAIAdapter` (`client.aio`) et orchestration async dans `FallbackInferenceAdapter` ; les modèles locaux restent sur le pont thread par défaut de `InferencePort`. Plusieurs streams peuvent désormais être parallélisés via `asyncio.gather` sans bloquer la boucle. (Caveat documenté : le cache de diagnostics `_last_completion` de `UnifiedInferenceAdapter` est best-effort sous streams concurrents sur le Singleton.)
-- [ ] **Backend — exposer le streaming async aux endpoints HTTP** _(suite du streaming async natif)_
-  - ✅ Chemin service async réutilisable : `LLMService.aask_oracle_stream` + `AniminatorDomainService.aask_oracle_stream` consomment `engine.astream_generate` (Neo4j off-loop via `asyncio.to_thread`). ✅ Bug latent corrigé : `AniminatorStreamView` lit `token.text` (les chunks sont des `InferenceResponse`) — l'endpoint SSE Oracle re-fonctionne.
-  - ✅ `AniminatorStreamView` réécrite en vue Django async native (hors DRF) consommant `aask_oracle_stream` : libère le thread worker pendant le stream (meilleure tenue sous streams concurrents). Rate-limit via `is_ratelimited()` + `sync_to_async` ; session/ORM via `sync_to_async`.
-  - ✅ `EmojiStreamView` & `ParadoxStreamView` réécrites en vues Django async natives via un helper SSE partagé `api/sse.py` (`check_rate_limit` + `sse_stream_response`) ; `AniminatorStreamView` refactorée pour réutiliser `check_rate_limit`. Chemins service async : `LLMService.astream_generate`, `EmojiDomainService.agenerate_emojis_stream`, `ParadoxDomainService.agenerate_logic_stream`.
-  - ✅ `ToTStreamView` réécrite en vue Django async native ; `solve_with_tree_of_thoughts_stream` sync remplacé par `asolve_with_tree_of_thoughts_stream` qui **parallélise chaque niveau via `asyncio.gather`** (premier vrai usage du gather — gain réel sur moteurs distants). Helpers async `_agen_thought` / `_aevaluate_thought_node`.
-  - ✅ AgenticRAG SP1 (fondation) : pipeline async de bout en bout — `StateProcessor.aprocess` (défaut pont-thread sur `process`, pose `ctx.next_state`), `RAGOrchestrator.arun_workflow`, `AgenticRAGService.aplan_and_solve_stream` (I/O via `to_thread`), `AgenticRAGStreamView` vue Django async (`auser`/`sync_to_async` billing). **Les 5 vues SSE sont désormais async natives.** Le sync (`process`/`run_workflow`/`plan_and_solve_stream`) reste (le pont `aprocess` en dépend).
-  - ✅ AgenticRAG SP2 : `aprocess` natifs sur les **2 processors streaming** (boucle de tokens longue) — `FallbackRagProcessor.aprocess` (`hybrid_search` via `to_thread`, streaming natif `inference_engine.astream_generate`) et `SynthesizeProcessor.aprocess` (`measure_confidence` via `to_thread`, streaming via nouvelle `ResponseSynthesizer.asynthesize_stream` → `llm_service.astream_generate`). Parsing `<thought>` byte-for-byte identique au sync. La boucle d'événements est libérée pendant la génération LLM (plus de thread executor mobilisé sur toute la durée du stream).
-  - ✅ Nettoyage SSE : `Cache-Control: no-cache` posé sur `AniminatorStreamView` (la seule vue qui construit son `StreamingHttpResponse` directement) → les 5 vues SSE sont harmonisées. **4 vues stream sync mortes** retirées de `animetix.views.api` (`emoji_decode_stream`, `paradox_stream`, `agentic_rag_stream`, `animinator_stream` — miroirs non routés des vues SSE async) + leurs tests + re-exports `views/__init__.py` ; `get_task_status` et `sync_offline_data` (routé) conservés.
+- [ ] **Backend — exposer le streaming async aux endpoints HTTP** _(suite du streaming async natif — les 5 vues SSE sont désormais async natives, détail archivé dans [docs/HISTORY.md](docs/HISTORY.md))_
   - ⏳ **Reste** : les **8 processors one-shot** (Plan/Research/Judge/Acquire/Speculate/VlmRerank/GraphExplore/SagaLookup) restent sur le pont-thread par défaut (appels bloquants ponctuels → bénéfice marginal d'un `aprocess` natif, YAGNI) ; suppression du sync (`process`/`run_workflow`/`plan_and_solve_stream`) différée tant que les 8 dépendent du pont + voie WSGI.
-  - ✅ Bug `.text` éradiqué dans tous les consommateurs de streaming : `emoji_service`, `paradox_service`, `fallback_rag_processor`, `synthesize_processor` lisent désormais `token.text` (+ annotation de `synthesize_stream` corrigée). Tests de régression feeding `InferenceResponse` ajoutés.
 - [ ] **Couverture backend — orchestrateur `finetuning_dataset`**
   - `run_generate_instruction_dataset` (433 lignes, 14 %). À traiter au cas par cas, sans gonfler la couverture.
 - [ ] **Frontend — `fetch()` brut : reliquat optionnel**

backend/api/animetix/admin.py

@@ -11,9 +11,24 @@ from animetix.models import (
     BossParticipation,
     GlobalBoss,
     GoldDatasetEntry,
+    SiteConfiguration,
 )
 
 
+@admin.register(SiteConfiguration)
+class SiteConfigurationAdmin(admin.ModelAdmin):
+    """Réglages globaux (mode maintenance). Singleton : ni ajout ni suppression."""
+
+    list_display = ("__str__", "maintenance_mode", "maintenance_until", "updated_at")
+
+    def has_add_permission(self, request):
+        # Une seule ligne : on la crée à la volée au premier accès.
+        return not SiteConfiguration.objects.exists()
+
+    def has_delete_permission(self, request, obj=None):
+        return False
+
+
 @admin.register(GlobalBoss)
 class GlobalBossAdmin(admin.ModelAdmin):
     """Pilotage manuel des raids World Boss (le spawn hebdo est automatique)."""

backend/api/animetix/api/core/__init__.py

@@ -0,0 +1,12 @@
+"""Core API views, split by domain.
+
+Star re-exports preserve the public surface of the former monolithic
+``core.py`` (``api_views`` star-imports this package, and URLs resolve the
+view classes through it). Tests patch the domain submodules directly.
+"""
+
+from .accounts import *  # noqa: F401, F403
+from .config import *  # noqa: F401, F403
+from .manga import *  # noqa: F401, F403
+from .media import *  # noqa: F401, F403
+from .suwayomi import *  # noqa: F401, F403

backend/api/animetix/api/core/accounts.py

@@ -0,0 +1,113 @@
+"""Session-auth endpoints (login/logout/register/me) and game-session state."""
+
+from animetix_project.logging_config import get_logger
+from django.contrib.auth import authenticate, login, logout  # noqa: E402
+from django.contrib.auth.models import User
+from django.utils.decorators import method_decorator
+from django.views.decorators.csrf import ensure_csrf_cookie
+from django_ratelimit.decorators import ratelimit  # noqa: E402
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from animetix.api.dependencies import get_session_service  # noqa: E402
+
+from ...serializers import ProfileSerializer
+
+logger = get_logger("animetix.api")
+
+
+class GameSessionView(APIView):
+    """Endpoint pour gérer l'état du jeu via API."""
+
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
+
+    def get(self, request):
+        # Récupère l'état actuel de la session via le service de session
+        session = get_session_service(request)
+        return Response(
+            {
+                "media_type": session.get("media_type"),
+                "is_ranked": session.get("is_ranked"),
+                "is_daily": session.get("is_daily"),
+                "game_over": session.get("game_over"),
+                "guess_count": len(session.get("guesses", [])),
+            }
+        )
+
+
+@method_decorator(ensure_csrf_cookie, name="dispatch")
+@method_decorator(
+    ratelimit(key="ip", rate="5/m", method="POST", block=True), name="dispatch"
+)
+class LoginView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def post(self, request):
+        username = request.data.get("username")
+        password = request.data.get("password")
+        user = authenticate(request, username=username, password=password)
+        if user is not None:
+            login(request, user)
+            return Response({"success": True})
+        return Response(
+            {"success": False, "error": "Invalid credentials"},
+            status=status.HTTP_401_UNAUTHORIZED,
+        )
+
+
+class LogoutView(APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        logout(request)
+        return Response({"success": True})
+
+
+@method_decorator(ensure_csrf_cookie, name="dispatch")
+@method_decorator(
+    ratelimit(key="ip", rate="5/m", method="POST", block=True), name="dispatch"
+)
+class RegisterView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def post(self, request):
+        username = request.data.get("username")
+        email = request.data.get("email")
+        password = request.data.get("password")
+
+        if not username or not password or not email:
+            return Response(
+                {"success": False, "error": "Missing fields"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        if User.objects.filter(username=username).exists():
+            return Response(
+                {"success": False, "error": "Username already exists"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            user = User.objects.create_user(
+                username=username, email=email, password=password
+            )
+            login(request, user)
+            return Response({"success": True})
+        except Exception as e:
+            return Response(
+                {"success": False, "error": str(e)}, status=status.HTTP_400_BAD_REQUEST
+            )
+
+
+@method_decorator(ensure_csrf_cookie, name="dispatch")
+class CurrentUserView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        if request.user.is_authenticated:
+            serializer = ProfileSerializer(request.user.profile)
+            return Response(serializer.data)
+        return Response(
+            {"detail": "Not authenticated"}, status=status.HTTP_401_UNAUTHORIZED
+        )

backend/api/animetix/api/core/config.py

@@ -0,0 +1,210 @@
+"""Public app config (incl. maintenance mode) and the transparency report."""
+
+from animetix_project.logging_config import get_logger
+from django.utils.decorators import method_decorator
+from django.views.decorators.csrf import ensure_csrf_cookie
+from rest_framework import permissions
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...containers import get_container
+
+logger = get_logger("animetix.api")
+
+# Version publiée du modèle « Champion » (libellé déclaré : aucun registre de
+# version n'est persisté en base — c'est la seule source configurable).
+AI_MODEL_VERSION = "Animetix-Champion-v2.4"
+
+# Les taux (hallucination, conformité, fiabilité) sont calculés sur une fenêtre
+# glissante et masqués sous un seuil d'échantillon : sur trop peu d'évaluations,
+# un pourcentage donne une fausse impression de précision.
+TRANSPARENCY_WINDOW_DAYS = 30
+MIN_EVAL_SAMPLE = 20
+
+
+@method_decorator(ensure_csrf_cookie, name="dispatch")
+class ConfigView(APIView):
+    """Configuration publique de l'app (type frontend ``AppConfig``).
+
+    Porte aussi le mode maintenance : le frontend polle cet endpoint pendant
+    la maintenance pour détecter la sortie, d'où l'absence de throttle (le
+    day-cap anonyme couperait le poll) et son exemption dans
+    ``MaintenanceModeMiddleware``.
+    """
+
+    permission_classes = [permissions.AllowAny]
+    throttle_classes = []
+
+    def get(self, request):
+        from ...models import SiteConfiguration  # noqa: E402
+
+        site = SiteConfiguration.get_solo()
+        data = {
+            "version": AI_MODEL_VERSION,
+            "theme": "auto",
+            "language": "fr",
+            "maintenance_mode": site.maintenance_mode,
+            "maintenance_message": site.maintenance_message,
+            "maintenance_until": (
+                site.maintenance_until.isoformat() if site.maintenance_until else None
+            ),
+            "user": {
+                "is_authenticated": request.user.is_authenticated,
+                "username": (
+                    request.user.username if request.user.is_authenticated else None
+                ),
+                "rank": getattr(request.user, "profile", None)
+                and request.user.profile.rank
+                or None,
+            },
+            "features": {
+                "EXPERIMENTAL_MODES": True,
+            },
+        }
+        return Response(data)
+
+
+class CustomConfigDataView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        if not request.user.is_authenticated:
+            return Response({"status": "guest", "visual_theme": "default"})
+        return Response({"status": "stub"})
+
+
+class TransparencyDataView(APIView):
+    """
+    Vue de transparence communautaire — alimentée par des données réelles.
+
+    Chaque section est calculée à partir des tables/services existants et
+    encapsulée dans un try/except : l'endpoint étant public, il ne doit jamais
+    renvoyer 500. Les champs sans source réelle sont renvoyés à ``None`` (le
+    front applique alors ses propres valeurs de repli).
+    """
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        from datetime import timedelta  # noqa: E402
+
+        from django.db.models import Avg  # noqa: E402
+        from django.db.models.functions import TruncMonth  # noqa: E402
+        from django.utils import timezone  # noqa: E402
+
+        from ...models import (  # noqa: E402
+            AIFeedback,
+            AIREvalResult,
+            AISafetyEvent,
+            VectorRecord,
+        )
+
+        container = get_container()
+        cutoff = timezone.now() - timedelta(days=TRANSPARENCY_WINDOW_DAYS)
+
+        # 1. Feedbacks communautaires (réel, cumulés).
+        total_feedbacks = AIFeedback.objects.count()
+        community_satisfaction = 0.0
+        if total_feedbacks:
+            positive = AIFeedback.objects.filter(is_positive=True).count()
+            community_satisfaction = round(positive / total_feedbacks, 2)
+
+        # 2. Base de connaissances vectorielle (réel).
+        knowledge_nodes = VectorRecord.objects.count()
+
+        # 3. Évaluations RAG sur la fenêtre récente. Sous MIN_EVAL_SAMPLE, on
+        # renvoie None : un taux sur 3 évals n'a aucune valeur informative.
+        recent_evals = AIREvalResult.objects.filter(created_at__gte=cutoff)
+        recent_total = recent_evals.count()
+        enough_evals = recent_total >= MIN_EVAL_SAMPLE
+
+        hallucination_rate = None
+        model_reliability = None
+        if enough_evals:
+            recent_halluc = recent_evals.filter(hallucination_detected=True).count()
+            hallucination_rate = round(recent_halluc / recent_total, 4)
+            model_reliability = round(100 * (1 - hallucination_rate), 2)
+
+        # Timeline mensuelle de la précision (réel) — le front masque le graphe
+        # tant qu'il n'y a pas au moins deux points.
+        timeline = [
+            {"date": row["m"].strftime("%Y-%m"), "accuracy": round(row["a"], 4)}
+            for row in (
+                AIREvalResult.objects.annotate(m=TruncMonth("created_at"))
+                .values("m")
+                .annotate(a=Avg("faithfulness"))
+                .order_by("m")
+            )
+            if row["m"] is not None and row["a"] is not None
+        ]
+
+        # 4. Conformité sécurité sur la même fenêtre (blocages Guardrail /
+        # interactions évaluées), masquée sous le même seuil.
+        safety_compliance = None
+        if enough_evals:
+            try:
+                recent_blocked = AISafetyEvent.objects.filter(
+                    created_at__gte=cutoff, action__in=["block", "rewrite"]
+                ).count()
+                safety_compliance = round(
+                    max(0.0, 1 - recent_blocked / recent_total), 4
+                )
+            except Exception:
+                logger.warning("Transparency: safety stats unavailable", exc_info=True)
+
+        # 5. Score éthique composite à partir des seuls signaux fiables du moment.
+        ethics_parts = []
+        if hallucination_rate is not None:
+            ethics_parts.append(1 - hallucination_rate)
+        if community_satisfaction:
+            ethics_parts.append(community_satisfaction)
+        if safety_compliance is not None:
+            ethics_parts.append(safety_compliance)
+        ethics_score = (
+            round(100 * sum(ethics_parts) / len(ethics_parts), 1)
+            if ethics_parts
+            else None
+        )
+
+        # 6. Benchmarks SOTA (source curée canonique de l'app).
+        try:
+            sota_benchmarks = (
+                container.core.sota_benchmark_service().get_all_benchmarks()
+            )
+        except Exception:
+            sota_benchmarks = []
+            logger.warning("Transparency: SOTA benchmarks unavailable", exc_info=True)
+
+        # 7. Dérive des embeddings (réel — test KS ; "unknown" sans baseline).
+        try:
+            embedding_drift = container.core.drift_service().get_drift_report()
+        except Exception:
+            embedding_drift = {}
+            logger.warning("Transparency: drift report unavailable", exc_info=True)
+
+        # Dernière activité d'évaluation (réel), sinon None.
+        last_eval = AIREvalResult.objects.order_by("-created_at").first()
+        last_training = last_eval.created_at.date().isoformat() if last_eval else None
+
+        return Response(
+            {
+                "status": "synchronized",
+                "global_metrics": {
+                    "total_feedbacks": total_feedbacks,
+                    "community_satisfaction": community_satisfaction,
+                    "knowledge_nodes": knowledge_nodes,
+                    "model_version": AI_MODEL_VERSION,
+                    "last_training": last_training,
+                    "uptime": model_reliability,
+                },
+                "model_uptime": model_reliability,
+                "evolution_timeline": timeline,
+                "sota_benchmarks": sota_benchmarks,
+                "embedding_drift": embedding_drift,
+                "ethics_score": ethics_score,
+                "ethics_audit": {
+                    "safety_compliance": safety_compliance,
+                    "hallucination_rate": hallucination_rate,
+                },
+            }
+        )

backend/api/animetix/api/core/manga.py

@@ -0,0 +1,462 @@
+"""Manga chapters, favorites and third-party tracker sync (AniList/MAL)."""
+
+import base64
+
+from animetix_project.logging_config import get_logger
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...containers import get_container
+from ...serializers import MangaChapterSerializer
+
+logger = get_logger("animetix.api")
+
+
+class MangaChapterListView(APIView):
+    """Liste des chapitres d'un manga."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request, media_id):
+        container = get_container()
+        manga_service = container.core.manga_service()
+        chapters = manga_service.get_chapters(media_id)
+        serializer = MangaChapterSerializer(chapters, many=True)
+        return Response(serializer.data)
+
+
+class MangaChapterDetailView(APIView):
+    """Détails d'un chapitre (incluant les pages)."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request, media_id, chapter_number):
+        container = get_container()
+        manga_service = container.core.manga_service()
+        chapter = manga_service.get_chapter_details(media_id, float(chapter_number))
+
+        if chapter:
+            serializer = MangaChapterSerializer(chapter)
+            return Response(serializer.data)
+        return Response(
+            {"error": "Chapter not found"}, status=status.HTTP_404_NOT_FOUND
+        )
+
+
+class FavoriteMangaToggleView(APIView):
+    """Permet de s'abonner / désabonner (favoris) à un manga."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request, media_id):
+        from ...models import FavoriteManga, MediaItem
+
+        # 1. Récupération ou auto-import du manga
+        try:
+            manga = MediaItem.objects.get(external_id=media_id, media_type="Manga")
+        except MediaItem.DoesNotExist:
+            source_id = request.data.get("source_id")
+            suwayomi_manga_id = request.data.get("suwayomi_manga_id")
+
+            if not source_id or not suwayomi_manga_id:
+                return Response(
+                    {
+                        "error": "Manga non trouvé et source_id/suwayomi_manga_id manquants pour l'import automatique."
+                    },
+                    status=400,
+                )
+
+            # Import automatique depuis Suwayomi
+            container = get_container()
+            suwayomi_adapter = container.persistence.suwayomi_adapter()
+            if not suwayomi_adapter:
+                return Response(
+                    {"error": "Intégration Suwayomi non configurée."}, status=500
+                )
+
+            manga_details = suwayomi_adapter.get_manga_details(suwayomi_manga_id)
+            if not manga_details:
+                return Response(
+                    {"error": "Impossible de charger les détails du manga."}, status=404
+                )
+
+            thumbnail_url = manga_details.get("thumbnailUrl")
+            image_url = None
+            if thumbnail_url:
+                encoded_thumb = base64.b64encode(thumbnail_url.encode("utf-8")).decode(
+                    "utf-8"
+                )
+                image_url = (
+                    f"/api/v1/media/Manga/suwayomi-image/?page_url={encoded_thumb}"
+                )
+
+            manga = MediaItem.objects.create(
+                external_id=media_id,
+                media_type="Manga",
+                title=manga_details.get("title", "Unknown Title"),
+                description=manga_details.get("description", ""),
+                synopsis_en=manga_details.get("description", ""),
+                image_url=image_url,
+                metadata={
+                    "source_id": source_id,
+                    "suwayomi_id": suwayomi_manga_id,
+                    "author": manga_details.get("author", ""),
+                    "artist": manga_details.get("artist", ""),
+                    "status": manga_details.get("status", ""),
+                },
+            )
+
+            # Synchronisation initiale des chapitres
+            manga_service = container.core.manga_service()
+            manga_service.get_chapters(media_id)
+
+        # 2. Toggle or set status
+        status_payload = request.data.get("status")
+        if status_payload:
+            if status_payload not in ["reading", "completed", "plan_to_read"]:
+                return Response({"error": "Invalid status"}, status=400)
+            favorite, created = FavoriteManga.objects.get_or_create(
+                user=request.user, manga=manga
+            )
+            favorite.status = status_payload
+            favorite.save()
+            is_favorite = True
+        else:
+            favorite, created = FavoriteManga.objects.get_or_create(
+                user=request.user, manga=manga
+            )
+            if not created:
+                favorite.delete()
+                is_favorite = False
+            else:
+                is_favorite = True
+
+        status_val = favorite.status if is_favorite else None
+        return Response(
+            {"success": True, "is_favorite": is_favorite, "status": status_val}
+        )
+
+    def get(self, request, media_id):
+        from ...models import FavoriteManga
+
+        try:
+            fav = FavoriteManga.objects.get(
+                user=request.user, manga__external_id=media_id
+            )
+            return Response({"is_favorite": True, "status": fav.status})
+        except FavoriteManga.DoesNotExist:
+            return Response({"is_favorite": False, "status": None})
+
+
+class FavoriteMangaListView(APIView):
+    """Liste tous les mangas favoris de l'utilisateur."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get(self, request):
+        from django.db.models import Count, IntegerField, OuterRef, Subquery
+        from django.db.models.functions import Coalesce
+
+        from ...models import FavoriteManga, MangaChapter
+        from ...serializers import FavoriteMangaSerializer
+
+        # Use a correlated subquery to avoid N+1 query per FavoriteManga in the list
+        unread_chapters_subquery = (
+            MangaChapter.objects.filter(
+                manga=OuterRef("manga"), number__gt=OuterRef("last_read_chapter")
+            )
+            .values("manga")
+            .annotate(count=Count("id"))
+            .values("count")
+        )
+
+        favorites = (
+            FavoriteManga.objects.filter(user=request.user)
+            .select_related("manga")
+            .annotate(
+                unread_chapters_count_annotated=Coalesce(
+                    Subquery(unread_chapters_subquery, output_field=IntegerField()), 0
+                )
+            )
+        )
+        serializer = FavoriteMangaSerializer(favorites, many=True)
+        return Response(serializer.data)
+
+
+class TrackerConnectionListView(APIView):
+    """Lists all active tracker connections of the current user."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get(self, request):
+        from ...models import TrackerConnection
+        from ...serializers import TrackerConnectionSerializer
+
+        connections = TrackerConnection.objects.filter(user=request.user)
+        serializer = TrackerConnectionSerializer(connections, many=True)
+        return Response(serializer.data)
+
+
+class TrackerConnectionLinkView(APIView):
+    """Links or updates a tracker connection."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        from ...models import TrackerConnection
+
+        tracker = request.data.get("tracker")
+        username = request.data.get("username")
+        token = request.data.get("token")
+
+        if not tracker or not username or not token:
+            return Response(
+                {"error": "tracker, username and token are required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        if tracker not in ["myanimelist", "anilist"]:
+            return Response(
+                {"error": "invalid tracker type"}, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        connection, created = TrackerConnection.objects.update_or_create(
+            user=request.user,
+            tracker=tracker,
+            defaults={"username": username, "token": token},
+        )
+
+        return Response({"success": True, "created": created})
+
+
+class TrackerConnectionUnlinkView(APIView):
+    """Unlinks a tracker connection."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        from ...models import TrackerConnection
+
+        tracker = request.data.get("tracker")
+
+        if not tracker:
+            return Response(
+                {"error": "tracker parameter is required"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        deleted_count, _ = TrackerConnection.objects.filter(
+            user=request.user, tracker=tracker
+        ).delete()
+
+        return Response({"success": True, "deleted": deleted_count > 0})
+
+
+class MangaChapterSyncView(APIView):
+    """Synchronizes manga progress to linked third-party trackers (AniList, MyAnimeList)."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request, media_id, chapter_number):
+        import httpx
+
+        from ...models import FavoriteManga, MangaChapter, MediaItem, TrackerConnection
+
+        # 1. Fetch the manga
+        try:
+            manga = MediaItem.objects.get(external_id=media_id, media_type="Manga")
+        except MediaItem.DoesNotExist:
+            return Response(
+                {"error": "Manga not found"}, status=status.HTTP_404_NOT_FOUND
+            )
+
+        # Parse chapter number
+        try:
+            progress = int(float(chapter_number))
+            progress_float = float(chapter_number)
+        except (ValueError, TypeError):
+            return Response(
+                {"error": "Invalid chapter number format"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # 1.5 Update or create FavoriteManga record and handle auto-transitions
+        favorite, created = FavoriteManga.objects.get_or_create(
+            user=request.user, manga=manga
+        )
+        favorite.last_read_chapter = max(favorite.last_read_chapter, progress_float)
+
+        # Check if there are any chapters with a number strictly greater than progress_float
+        has_future_chapters = MangaChapter.objects.filter(
+            manga=manga, number__gt=progress_float
+        ).exists()
+
+        if not has_future_chapters:
+            favorite.status = "completed"
+        elif favorite.status == "plan_to_read":
+            favorite.status = "reading"
+
+        favorite.save()
+
+        # 2. Get active connections
+        connections = TrackerConnection.objects.filter(user=request.user)
+        if not connections.exists():
+            return Response({"success": True, "message": "No trackers connected."})
+
+        results = {}
+
+        # 4. Loop over active connections and sync
+        for conn in connections:
+            if conn.tracker == "anilist":
+                # Resolve AniList ID
+                anilist_id = None
+                # Check if external_id itself is a pure digit (which means it represents AniList ID)
+                if media_id.isdigit():
+                    anilist_id = int(media_id)
+                elif manga.metadata and "id" in manga.metadata:
+                    try:
+                        anilist_id = int(manga.metadata["id"])
+                    except (ValueError, TypeError):
+                        pass
+
+                # If not resolved yet, let's search AniList GraphQL API by title
+                if not anilist_id:
+                    try:
+                        search_url = "https://graphql.anilist.co"
+                        search_query = """
+                        query ($search: String) {
+                          Media (search: $search, type: MANGA) {
+                            id
+                          }
+                        }
+                        """
+                        with httpx.Client(timeout=5.0) as client:
+                            res = client.post(
+                                search_url,
+                                json={
+                                    "query": search_query,
+                                    "variables": {"search": manga.title},
+                                },
+                            )
+                            if res.status_code == 200:
+                                search_data = res.json()
+                                if search_data.get("data", {}).get("Media"):
+                                    anilist_id = search_data["data"]["Media"]["id"]
+                    except Exception as e:
+                        logger.error(
+                            f"Failed to resolve AniList ID by title search: {e}"
+                        )
+
+                if not anilist_id:
+                    results["anilist"] = {
+                        "success": False,
+                        "error": "Could not resolve AniList ID",
+                    }
+                    continue
+
+                # Perform mutation request to AniList
+                try:
+                    mutation = """
+                    mutation ($mediaId: Int, $progress: Int) {
+                      SaveMediaListEntry (mediaId: $mediaId, progress: $progress, status: CURRENT) {
+                        id
+                        progress
+                      }
+                    }
+                    """
+                    url = "https://graphql.anilist.co"
+                    headers = {
+                        "Authorization": f"Bearer {conn.token}",
+                        "Content-Type": "application/json",
+                    }
+                    if conn.token == "mock-token" or conn.token == "test-token":
+                        # Simulate success for tests/CI
+                        results["anilist"] = {"success": True, "simulated": True}
+                    else:
+                        with httpx.Client(timeout=5.0) as client:
+                            res = client.post(
+                                url,
+                                json={
+                                    "query": mutation,
+                                    "variables": {
+                                        "mediaId": anilist_id,
+                                        "progress": progress,
+                                    },
+                                },
+                                headers=headers,
+                            )
+                            if res.status_code == 200:
+                                results["anilist"] = {"success": True}
+                            else:
+                                results["anilist"] = {
+                                    "success": False,
+                                    "error": f"AniList API error: {res.text}",
+                                }
+                except Exception as e:
+                    results["anilist"] = {"success": False, "error": str(e)}
+
+            elif conn.tracker == "myanimelist":
+                # Resolve MAL ID
+                mal_id = None
+                if manga.metadata and "idMal" in manga.metadata:
+                    mal_id = manga.metadata["idMal"]
+                elif manga.metadata and "mal_id" in manga.metadata:
+                    mal_id = manga.metadata["mal_id"]
+
+                # Fallback: search MAL
+                if not mal_id:
+                    try:
+                        # Use Jikan API for searching since it doesn't require authentication
+                        jikan_url = (
+                            f"https://api.jikan.moe/v4/manga?q={manga.title}&limit=1"
+                        )
+                        with httpx.Client(timeout=5.0) as client:
+                            res = client.get(jikan_url)
+                            if res.status_code == 200:
+                                search_data = res.json()
+                                if (
+                                    search_data.get("data")
+                                    and len(search_data["data"]) > 0
+                                ):
+                                    mal_id = search_data["data"][0]["mal_id"]
+                    except Exception as e:
+                        logger.error(f"Failed to resolve MAL ID via Jikan: {e}")
+
+                if not mal_id:
+                    results["myanimelist"] = {
+                        "success": False,
+                        "error": "Could not resolve MyAnimeList ID",
+                    }
+                    continue
+
+                # Perform update request to MAL
+                try:
+                    url = (
+                        f"https://api.myanimelist.net/v2/manga/{mal_id}/my_list_status"
+                    )
+                    headers = {
+                        "Authorization": f"Bearer {conn.token}",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                    }
+                    data = {
+                        "num_chapters_read": progress,
+                        "status": "reading",
+                    }
+                    if conn.token == "mock-token" or conn.token == "test-token":
+                        # Simulate success for tests/CI
+                        results["myanimelist"] = {"success": True, "simulated": True}
+                    else:
+                        with httpx.Client(timeout=5.0) as client:
+                            res = client.patch(url, data=data, headers=headers)
+                            if res.status_code == 200:
+                                results["myanimelist"] = {"success": True}
+                            else:
+                                results["myanimelist"] = {
+                                    "success": False,
+                                    "error": f"MAL API error: {res.text}",
+                                }
+                except Exception as e:
+                    results["myanimelist"] = {"success": False, "error": str(e)}
+
+        return Response({"success": True, "results": results})

backend/api/animetix/api/core/media.py

@@ -0,0 +1,255 @@
+"""Media search, detail and the signed external-image proxy."""
+
+import base64
+import hashlib
+
+from animetix_project.logging_config import get_logger
+from core.constants import ALLOWED_IMAGE_MIMES, MAX_IMAGE_SIZE  # noqa: E402
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS
+from core.domain.services.guardrail_service import GuardrailService
+from core.ports.usage_port import UsagePort
+from core.utils.security import (
+    safe_http_request,
+    validate_file_mime_type,
+    validate_file_size,
+    verify_proxy_signature,
+)
+from dependency_injector.wiring import Provide, inject
+from django.core.cache import cache  # noqa: E402
+from django.http import HttpResponse  # noqa: E402
+from django.utils.decorators import method_decorator
+from django_ratelimit.decorators import ratelimit  # noqa: E402
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from animetix.api.billing import deduct_berrix
+
+from ...containers import Container, get_container
+from ...serializers import MediaItemSerializer
+
+logger = get_logger("animetix.api")
+
+
+@ratelimit(key="ip", rate="30/m", method="GET", block=True)
+def image_proxy_view(request):
+    """
+    Proxy pour les images externes avec cache local.
+    Sécurisé par signature HMAC, Rate Limiting et validation binaire.
+    """
+    encoded_url = request.GET.get("url")
+    signature = request.GET.get("sig")
+
+    if not encoded_url or not signature:
+        return HttpResponse("Missing parameters", status=400)
+
+    try:
+        url = base64.b64decode(encoded_url).decode("utf-8")
+    except Exception as e:
+        logger.error(f"Failed to decode image proxy URL: {e}")
+        return HttpResponse(status=400)
+
+    # 1. Vérification de la signature cryptographique (Prévention Open Proxy)
+    if not verify_proxy_signature(url, signature):
+        logger.warning(f"🚩 Invalid proxy signature detected for URL: {url}")
+        return HttpResponse("Forbidden: Invalid signature", status=403)
+
+    cache_key = (
+        f"img_cache_{hashlib.md5(url.encode(), usedforsecurity=False).hexdigest()}"
+    )
+    cached_data = cache.get(cache_key)
+
+    if cached_data:
+        return HttpResponse(
+            cached_data["content"], content_type=cached_data["content_type"]
+        )
+
+    try:
+        # safe_http_request gère la validation DNS et les sauts de redirection en toute sécurité
+        response = safe_http_request("GET", url, timeout=10)
+
+        if response.status_code == 200:
+            content = response.content
+
+            # 2. Validation de la taille (DoS Protection)
+            if not validate_file_size(len(content), MAX_IMAGE_SIZE):
+                return HttpResponse("Entity Too Large", status=413)
+
+            # 3. Validation du type MIME réel (Magic Number)
+            if not validate_file_mime_type(content, ALLOWED_IMAGE_MIMES):
+                logger.warning(f"🚩 Non-image content detected in proxy for URL: {url}")
+                return HttpResponse("Forbidden: Content type not allowed", status=403)
+
+            content_type = response.headers.get("Content-Type", "image/jpeg")
+            cache.set(
+                cache_key,
+                {"content": content, "content_type": content_type},
+                60 * 60 * 24 * 7,
+            )
+            return HttpResponse(content, content_type=content_type)
+
+    except ValueError as ve:
+        logger.warning(f"Blocked unsafe request in image proxy: {ve}")
+        return HttpResponse("Forbidden: Unsafe request detected", status=403)
+    except Exception as e:
+        logger.error("Image Proxy Error: %s", e, exc_info=True)
+
+    return HttpResponse(status=404)
+
+
+@method_decorator(
+    ratelimit(key="ip", rate="20/m", method="GET", block=True), name="dispatch"
+)
+@method_decorator(
+    ratelimit(key="user", rate="5/m", method="POST", block=True), name="dispatch"
+)
+class MediaSearchView(APIView):
+    """Recherche d'œuvres via SQL ou Multi-Modale (CLIP)."""
+
+    permission_classes = [permissions.AllowAny]
+
+    @inject
+    def __init__(
+        self,
+        guardrail_service: GuardrailService = Provide[Container.core.guardrail_service],
+        usage_port: UsagePort = Provide[Container.infrastructure.usage_port],
+        **kwargs,
+    ):
+        super().__init__(**kwargs)
+        self.guardrail_service = guardrail_service
+        self.usage_port = usage_port
+
+    def get(self, request):
+        media_type = request.query_params.get("media_type")
+        query = request.query_params.get("q", "")
+        limit = min(int(request.query_params.get("limit", 10)), 50)
+
+        if not query and not media_type:
+            return Response([])
+
+        # Input Guardrail (Anti-Jailbreak, Injection)
+        if query:
+            guard_input = self.guardrail_service.validate_input(
+                query, allow_llm=request.user.is_authenticated
+            )
+            if not guard_input.get("is_safe", True):
+                return Response(
+                    {"error": guard_input.get("reason", "Inappropriate search query.")},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+
+        results = (
+            get_container()
+            .core.catalog_service()
+            .search_items(query, media_type, limit)
+        )
+        return Response(self._format_results(results))
+
+    def post(self, request):
+        """Recherche par image (Cross-Modal). Requiert Authentification + Quota."""
+        if not request.user.is_authenticated:
+            return Response(
+                {"error": "Authentication required for image search."},
+                status=status.HTTP_401_UNAUTHORIZED,
+            )
+
+        # Quota Check
+        tier = getattr(request, "user_tier", "free")
+        if not self.usage_port.check_quota(request.user.id, tier):
+            return Response(
+                {"error": "Daily AI quota exceeded."}, status=status.HTTP_403_FORBIDDEN
+            )
+
+        image_file = request.FILES.get("image")
+        request.data.get("media_type", "Anime")
+        limit = min(int(request.data.get("limit", 10)), 20)
+
+        if not image_file:
+            return Response({"error": "No image provided"}, status=400)
+
+        # Berrix deduction for the CLIP cross-modal search (raises 402 if balance
+        # too low). Outside the try below so PaymentRequired isn't swallowed into 500.
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["vision_clip"],
+            "Recherche par image (CLIP)",
+        )
+
+        try:
+            if not validate_file_size(image_file.size, MAX_IMAGE_SIZE):
+                return Response(
+                    {
+                        "error": f"Image is too large (Max: {MAX_IMAGE_SIZE / 1024 / 1024}MB)"
+                    },
+                    status=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+                )
+
+            container = get_container()
+            image_data = b"".join(chunk for chunk in image_file.chunks())
+
+            if not validate_file_mime_type(image_data, ALLOWED_IMAGE_MIMES):
+                return Response(
+                    {
+                        "error": "Invalid image format. Allowed formats: JPEG, PNG, WEBP."
+                    },
+                    status=status.HTTP_415_UNSUPPORTED_MEDIA_TYPE,
+                )
+
+            # Appel au service Cross-Modal
+            results = container.core.cross_modal_search_service.deep_multimodal_search(
+                text_query="", image_data=image_data, limit=limit
+            )
+
+            # Log Usage
+            self.usage_port.log_usage(
+                engine="clip-vit-large-patch14", units=1, user_id=request.user.id
+            )
+
+            return Response(self._format_results(results))
+        except Exception:
+            logger.exception("Error in image search")
+            return Response({"error": "Internal server error"}, status=500)
+
+    def _format_results(self, results):
+        # Utilise le serializer pour formater les résultats
+        serializer = MediaItemSerializer(results, many=True)
+        return serializer.data
+
+
+class MediaDetailView(APIView):
+    """Détails complets d'une œuvre."""
+
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
+
+    def get(self, request, media_type, item_id):
+        from ...models import MediaItem  # noqa: E402
+        from ...serializers import MediaItemSerializer  # noqa: E402
+
+        # 1. Tentative via SQL direct (Source of Truth)
+        try:
+            item_obj = MediaItem.objects.get(media_type=media_type, external_id=item_id)
+            serializer = MediaItemSerializer(item_obj)
+            return Response(serializer.data)
+        except MediaItem.DoesNotExist:
+            logger.debug(
+                f"MediaItem {item_id} ({media_type}) not found in SQL, falling back to Catalog."
+            )
+
+        # 2. Fallback via Catalog Service (si non synchronisé en SQL)
+        container = get_container()
+        data = container.core.catalog_service().load_data(media_type)
+        if data:
+            item = next(
+                (i for i in data.get("db", []) if str(i.get("id")) == str(item_id)),
+                None,
+            )
+            if item:
+                # Enrichissement avec les nœuds du graphe si présents
+                graph_nodes = item.get("graph_nodes", {})
+                item["studios"] = graph_nodes.get("studios", [])
+                item["author"] = graph_nodes.get("author")
+                item["related_items"] = graph_nodes.get("related_items", [])
+
+                return Response(item)
+
+        return Response({"error": "Item not found"}, status=404)

backend/api/animetix/api/core/suwayomi.py

@@ -0,0 +1,264 @@
+"""Suwayomi/Tachidesk (Mihon) integration: proxy, sources, search, import, extensions."""
+
+import base64
+
+from animetix_project.logging_config import get_logger
+from core.utils.security import safe_http_request
+from dependency_injector.wiring import Provide, inject
+from django.http import HttpResponse  # noqa: E402
+from django_ratelimit.decorators import ratelimit  # noqa: E402
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...containers import Container, get_container
+
+logger = get_logger("animetix.api")
+
+
+@ratelimit(key="ip", rate="120/m", method="GET", block=True)
+def suwayomi_image_proxy(request):
+    """
+    Proxy pour les images de Suwayomi/Tachidesk afin de contourner le CORS et l'authentification.
+    """
+    from core.config import settings
+
+    encoded_url = request.GET.get("page_url")
+    if not encoded_url:
+        return HttpResponse("Missing page_url", status=400)
+    try:
+        url = base64.b64decode(encoded_url).decode("utf-8")
+    except Exception as e:
+        logger.error(f"Failed to decode Suwayomi proxy URL: {e}")
+        return HttpResponse("Invalid encoded URL", status=400)
+
+    suwayomi_base = settings.SUWAYOMI_URL.rstrip("/")
+    if not url.startswith("http"):
+        url = f"{suwayomi_base}/{url.lstrip('/')}"
+    else:
+        if not url.startswith(suwayomi_base):
+            logger.warning(
+                f"Blocked unauthorized external URL in Suwayomi proxy: {url}"
+            )
+            return HttpResponse(
+                "Forbidden: URL must point to the configured Suwayomi instance",
+                status=403,
+            )
+
+    headers = {}
+    if settings.SUWAYOMI_PASSWORD:
+        headers["Authorization"] = f"Bearer {settings.SUWAYOMI_PASSWORD}"
+
+    try:
+        response = safe_http_request("GET", url, headers=headers, timeout=15)
+        if response.status_code == 200:
+            content_type = response.headers.get("Content-Type", "image/jpeg")
+            return HttpResponse(response.content, content_type=content_type)
+        else:
+            logger.error(
+                f"Suwayomi proxy failed with status {response.status_code} for URL: {url}"
+            )
+            return HttpResponse(status=response.status_code)
+    except Exception as e:
+        logger.error(f"Error proxying Suwayomi image {url}: {e}", exc_info=True)
+        return HttpResponse(status=500)
+
+
+class SuwayomiSourcesView(APIView):
+    """Liste des sources de mangas installées dans Suwayomi."""
+
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
+
+    @inject
+    def __init__(
+        self, suwayomi_adapter=Provide[Container.persistence.suwayomi_adapter], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.suwayomi_adapter = suwayomi_adapter
+
+    def get(self, request):
+        if not self.suwayomi_adapter:
+            return Response(
+                {"error": "Suwayomi integration not configured"}, status=500
+            )
+        sources = self.suwayomi_adapter.get_sources()
+        return Response(sources)
+
+
+class SuwayomiSearchView(APIView):
+    """Recherche des mangas dans une source spécifique Suwayomi."""
+
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
+
+    @inject
+    def __init__(
+        self, suwayomi_adapter=Provide[Container.persistence.suwayomi_adapter], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.suwayomi_adapter = suwayomi_adapter
+
+    def get(self, request):
+        source_id = request.query_params.get("source_id")
+        query = request.query_params.get("q", "")
+        if not source_id:
+            return Response({"error": "Missing source_id parameter"}, status=400)
+        if not self.suwayomi_adapter:
+            return Response(
+                {"error": "Suwayomi integration not configured"}, status=500
+            )
+        results = self.suwayomi_adapter.search_manga(source_id, query)
+        return Response(results)
+
+
+class SuwayomiImportView(APIView):
+    """Importe un manga depuis Suwayomi dans le catalogue local."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    @inject
+    def __init__(
+        self, suwayomi_adapter=Provide[Container.persistence.suwayomi_adapter], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.suwayomi_adapter = suwayomi_adapter
+
+    def post(self, request):
+        from ...models import MediaItem
+
+        source_id = request.data.get("source_id")
+        suwayomi_manga_id = request.data.get("suwayomi_manga_id")
+
+        if not source_id or not suwayomi_manga_id:
+            return Response(
+                {"error": "Missing source_id or suwayomi_manga_id"}, status=400
+            )
+
+        if not self.suwayomi_adapter:
+            return Response(
+                {"error": "Suwayomi integration not configured"}, status=500
+            )
+
+        manga_details = self.suwayomi_adapter.get_manga_details(suwayomi_manga_id)
+        if not manga_details:
+            return Response(
+                {"error": "Failed to fetch manga details from Suwayomi"}, status=404
+            )
+
+        external_id = f"suwayomi:{source_id}:{suwayomi_manga_id}"
+
+        thumbnail_url = manga_details.get("thumbnailUrl")
+        image_url = None
+        if thumbnail_url:
+            encoded_thumb = base64.b64encode(thumbnail_url.encode("utf-8")).decode(
+                "utf-8"
+            )
+            image_url = f"/api/v1/media/Manga/suwayomi-image/?page_url={encoded_thumb}"
+
+        media_item, created = MediaItem.objects.update_or_create(
+            external_id=external_id,
+            media_type="Manga",
+            defaults={
+                "title": manga_details.get("title", "Unknown Title"),
+                "description": manga_details.get("description", ""),
+                "synopsis_en": manga_details.get("description", ""),
+                "image_url": image_url,
+                "metadata": {
+                    "source_id": source_id,
+                    "suwayomi_id": suwayomi_manga_id,
+                    "author": manga_details.get("author", ""),
+                    "artist": manga_details.get("artist", ""),
+                    "status": manga_details.get("status", ""),
+                },
+            },
+        )
+
+        container = get_container()
+        manga_service = container.core.manga_service()
+        manga_service.get_chapters(external_id)
+
+        return Response(
+            {
+                "success": True,
+                "media_item": {
+                    "id": media_item.id,
+                    "external_id": media_item.external_id,
+                    "title": media_item.title,
+                    "image_url": media_item.image_url,
+                },
+            }
+        )
+
+
+class SuwayomiExtensionsListView(APIView):
+    """Liste des extensions installées et disponibles dans Suwayomi/Mihon.
+
+    Lecture seule sur une page publique (/explore/tachidesk/) : accessible en
+    anonyme comme les sources et la recherche. Les actions (installation /
+    mise à jour) et l'import restent réservés aux utilisateurs authentifiés.
+    """
+
+    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
+
+    @inject
+    def __init__(
+        self, suwayomi_adapter=Provide[Container.persistence.suwayomi_adapter], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.suwayomi_adapter = suwayomi_adapter
+
+    def get(self, request):
+        if not self.suwayomi_adapter:
+            return Response(
+                {"error": "Suwayomi integration not configured"}, status=500
+            )
+        try:
+            extensions = self.suwayomi_adapter.get_extensions()
+            return Response(extensions)
+        except Exception:
+            logger.exception("Failed to fetch Suwayomi extensions")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class SuwayomiExtensionsActionView(APIView):
+    """Effectue une action (installation, désinstallation, mise à jour) sur une extension Suwayomi."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    @inject
+    def __init__(
+        self, suwayomi_adapter=Provide[Container.persistence.suwayomi_adapter], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.suwayomi_adapter = suwayomi_adapter
+
+    def post(self, request):
+        ids = request.data.get("ids")
+        action = request.data.get("action")
+
+        if not ids or not isinstance(ids, list) or not action:
+            return Response(
+                {
+                    "error": "Missing or invalid parameters: 'ids' (list) and 'action' (string)"
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        if action not in ["install", "uninstall", "update"]:
+            return Response(
+                {
+                    "error": "Invalid action. Must be 'install', 'uninstall', or 'update'"
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        if not self.suwayomi_adapter:
+            return Response(
+                {"error": "Suwayomi integration not configured"}, status=500
+            )
+
+        try:
+            results = self.suwayomi_adapter.update_extensions(ids, action)
+            return Response(results)
+        except Exception:
+            logger.exception("Failed to update Suwayomi extensions")
+            return Response({"error": "Internal server error"}, status=500)

backend/api/animetix/api/games/blindtest.py

@@ -24,6 +24,16 @@ def _max_attempts(difficulty: str) -> int:
     return MAX_ATTEMPTS.get(difficulty, MAX_ATTEMPTS["Normal"])
 
 
+def _secret_image(catalog_service, secret: str) -> str | None:
+    """Affiche de l'œuvre secrète, révélée uniquement en fin de manche."""
+    try:
+        data = catalog_service.load_data("Anime") or {}
+        item = data.get("title_to_full_data", {}).get(secret)
+        return str(item["image"]) if item and item.get("image") else None
+    except Exception:  # catalogue indisponible : la révélation reste textuelle
+        return None
+
+
 class BlindtestTitlesView(APIView):
     """Anime titles for the guess autocomplete (same catalog used to validate)."""
 
@@ -47,7 +57,10 @@ class BlindtestGameStateView(APIView):
 
     @inject
     def get(
-        self, request, blind_test_service=Provide[Container.core.blind_test_service]
+        self,
+        request,
+        blind_test_service=Provide[Container.core.blind_test_service],
+        catalog_service=Provide[Container.core.catalog_service],
     ):
         session_service = get_session_service(request)
         port = session_service.port
@@ -74,6 +87,11 @@ class BlindtestGameStateView(APIView):
                 "max_attempts": max_attempts,
                 "attempts_left": max(0, max_attempts - len(state.guesses)),
                 "secret_title": state.secret if state.game_over else None,
+                "secret_image": (
+                    _secret_image(catalog_service, state.secret)
+                    if state.game_over
+                    else None
+                ),
             }
         )
 
@@ -266,6 +284,11 @@ class BlindtestGameGuessView(APIView):
                 "blindtest_song": state.song,
                 "blindtest_artists": state.artists,
                 "secret_title": secret if state.game_over else None,
+                "secret_image": (
+                    str(secret_item.get("image"))
+                    if state.game_over and secret_item and secret_item.get("image")
+                    else None
+                ),
                 "newly_unlocked_achievements": unlocked_achievements,
             }
         )

backend/api/animetix/api/games/vs_battle.py

@@ -21,7 +21,12 @@ logger = logging.getLogger(__name__)
 @permission_classes([AllowAny])
 def list_vs_battles(request):
     """Liste les combats publics récents pour l'Arène."""
-    battles = VsBattle.objects.filter(is_public=True).order_by("-created_at")[:20]
+    battles = (
+        VsBattle.objects.filter(is_public=True)
+        .select_related("creator")
+        .prefetch_related("likes")
+        .order_by("-created_at")[:20]
+    )
     serializer = VsBattleSerializer(battles, many=True)
     return Response(serializer.data)
 

backend/api/animetix/api/labs/__init__.py

@@ -0,0 +1,13 @@
+"""Labs API views, split by domain.
+
+Star re-exports preserve the public surface of the former monolithic
+``labs.py`` (``api_views`` star-imports this package, and URLs resolve the
+view classes through it). Tests patch the domain submodules directly.
+"""
+
+from .audio import *  # noqa: F401, F403
+from .dashboards import *  # noqa: F401, F403
+from .manga import *  # noqa: F401, F403
+from .singularity import *  # noqa: F401, F403
+from .spatial import *  # noqa: F401, F403
+from .video import *  # noqa: F401, F403

backend/api/animetix/api/labs/audio.py

@@ -0,0 +1,270 @@
+"""Audio labs: seiyuu discovery, voice ingestion/cloning, soundscape and S2S."""
+
+from animetix_project.logging_config import get_logger
+
+# Media-upload limits/MIME allow-lists are centralized in core.constants.
+from core.constants import ALLOWED_AUDIO_MIMES  # noqa: E402
+from core.utils.security import validate_file_mime_type, validate_file_size
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...containers import get_container  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS  # noqa: E402
+
+from animetix.api.billing import deduct_berrix  # noqa: E402
+
+
+class AudioLabDataView(APIView):
+    """Metadata for the Audio Lab tools."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        return Response(
+            {
+                "status": "active",
+                "tools": [
+                    {
+                        "id": "soundscape",
+                        "name": "Soundscape Generator",
+                        "description": "Generate immersive ambient soundscapes for your video clips.",
+                        "endpoint": "/api/v1/labs/audio/soundscape/",
+                    },
+                    {
+                        "id": "s2s",
+                        "name": "Voice Interaction (S2S)",
+                        "description": "Direct speech-to-speech interaction with anime personas.",
+                        "endpoint": "/api/v1/labs/audio/s2s/",
+                    },
+                    {
+                        "id": "seiyuu-discovery",
+                        "name": "Seiyuu Discovery",
+                        "description": "Search and explore voice actors (seiyuu) and their iconic character roles.",
+                        "endpoint": "/api/v1/labs/audio/seiyuu/",
+                    },
+                ],
+            }
+        )
+
+
+class SeiyuuDiscoveryView(APIView):
+    """Recherche et exploration des Seiyuu/Doubleurs et de leurs rôles."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        query = request.query_params.get("q", "")
+        language = request.query_params.get("language", "")
+        origin = request.query_params.get("origin", "")
+
+        from django.db.models import Q
+
+        from animetix.models import VoiceProfile
+        from animetix.serializers import VoiceProfileSerializer
+
+        profiles = VoiceProfile.objects.all()
+
+        if query:
+            profiles = profiles.filter(
+                Q(name__icontains=query)
+                | Q(roles__icontains=query)
+                | Q(definition__icontains=query)
+            )
+
+        if language:
+            profiles = profiles.filter(language=language)
+        if origin:
+            profiles = profiles.filter(origin=origin)
+
+        serializer = VoiceProfileSerializer(profiles, many=True)
+        return Response({"query": query, "results": serializer.data})
+
+
+class VoiceProfileIngestView(APIView):
+    """Ingestion dynamique de voix à la volée depuis YouTube."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        name = request.data.get("name")
+        language = request.data.get("language", "japanese")
+        youtube_url_or_query = request.data.get("youtube_url") or request.data.get(
+            "query"
+        )
+        definition = request.data.get("definition", "")
+        roles = request.data.get("roles", "")
+        impact = request.data.get("impact", "Custom")
+
+        if not name or not youtube_url_or_query:
+            return Response(
+                {"error": "Le nom et l'URL/requête YouTube sont obligatoires."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # Déduction des Berrix (30 Bx pour l'ingestion/découpage de voix)
+        try:
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["voice_ingest"],
+                f"Ingestion vocale de {name}",
+            )
+        except Exception as e:
+            return Response(
+                {"error": f"Fonds insuffisants : {str(e)}"},
+                status=status.HTTP_402_PAYMENT_REQUIRED,
+            )
+
+        from animetix.serializers import VoiceProfileSerializer
+
+        ingestion_service = get_container().core.voice_ingestion_service()
+        try:
+            profile = ingestion_service.ingest_voice(
+                name=name,
+                language=language,
+                youtube_url_or_query=youtube_url_or_query,
+                definition=definition,
+                roles=roles,
+                impact=impact,
+            )
+            serializer = VoiceProfileSerializer(profile)
+            return Response(
+                {
+                    "message": "Ingestion réussie !",
+                    "profile": serializer.data,
+                },
+                status=status.HTTP_201_CREATED,
+            )
+        except Exception:
+            logger.exception("Erreur lors de l'ingestion vocale")
+            return Response(
+                {"error": "Erreur lors de l'ingestion"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+
+class SoundscapeGenerationView(APIView):
+    """Génère un soundscape ambiant pour une vidéo."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        video_file = request.FILES.get("video_file") or request.FILES.get("video")
+
+        if not video_file:
+            return Response({"error": "Video file is required."}, status=400)
+
+        # Déduction des Berrix (50 Bx pour génération audio)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["soundscape"],
+            "Génération de Soundscape Immersif",
+        )
+
+        try:
+            video_bytes = video_file.read()
+            service = container.core.soundscape_service()
+            result_url = service.generate_soundscape_for_video(video_bytes)
+            return Response({"status": "success", "audio_url": result_url})
+        except Exception:
+            logger.exception("Error in SoundscapeGenerationView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class SpeechToSpeechLabView(APIView):
+    """Interaction directe voix-à-voix (S2S)."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        audio_file = request.FILES.get("audio_file") or request.FILES.get("audio")
+        persona = request.data.get("persona", "Standard")
+
+        if not audio_file:
+            return Response({"error": "Audio file is required."}, status=400)
+
+        # Déduction des Berrix (10 Bx pour un tour de parole S2S)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["speech_to_speech"],
+            f"Speech-to-Speech: {persona}",
+        )
+
+        try:
+            audio_bytes = audio_file.read()
+            service = container.core.native_speech_llm_service()
+            result = service.process_voice_interaction(audio_bytes, persona=persona)
+
+            if result.get("status") == "success":
+                # Convert audio bytes to base64 for JSON transport
+                import base64  # noqa: E402
+
+                encoded_audio = base64.b64encode(result["audio_data"]).decode("utf-8")
+                return Response({"status": "success", "audio_data": encoded_audio})
+            return Response(result, status=400)
+        except Exception:
+            logger.exception("Error in SpeechToSpeechLabView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class VoiceCloningLabView(APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        target_text = request.data.get("target_text")
+        ref_audio_file = request.FILES.get("reference_audio")
+
+        if not target_text or not ref_audio_file:
+            return Response({"error": "Missing text or audio"}, status=400)
+
+        # Déduction des Berrix (100 Bx pour clonage vocal multi-passes)
+        deduct_berrix(
+            request.user, FEATURE_BX_COSTS["voice_clone"], "Voice Cloning (Audio)"
+        )
+
+        # Validation: Pitch must be an integer
+        try:
+            pitch = int(request.data.get("pitch", 0))
+        except (ValueError, TypeError):
+            return Response(
+                {"error": "Invalid pitch value. Must be an integer."}, status=400
+            )
+
+        # Validation: File size (Max 5MB as per review)
+        MAX_VOICE_AUDIO_SIZE = 5 * 1024 * 1024
+        if not validate_file_size(ref_audio_file.size, MAX_VOICE_AUDIO_SIZE):
+            return Response(
+                {"error": "Reference audio file too large (Max 5MB)."}, status=400
+            )
+
+        container = get_container()
+        service = container.core.voice_cloning_service()
+
+        try:
+            audio_bytes = ref_audio_file.read()
+
+            # Validation: MIME Type
+            if not validate_file_mime_type(audio_bytes, ALLOWED_AUDIO_MIMES):
+                return Response(
+                    {"error": "Invalid file type. Only wav and mp3 are allowed."},
+                    status=400,
+                )
+
+            result_audio = service.clone(
+                reference_audio=audio_bytes, target_text=target_text, pitch=pitch
+            )
+            # Return as base64 for pure SPA handling
+            import base64  # noqa: E402
+
+            encoded = base64.b64encode(result_audio).decode("utf-8")
+            return Response(
+                {"status": "success", "audio_data": f"data:audio/wav;base64,{encoded}"}
+            )
+        except Exception:
+            logger.exception("Voice Cloning Error")
+            return Response({"error": "Internal server error"}, status=500)

backend/api/animetix/api/labs/dashboards.py

@@ -0,0 +1,132 @@
+"""Labs dashboards: daily challenge hub and latent-space explorer data."""
+
+import datetime
+import json
+import os
+
+from animetix_project.logging_config import get_logger
+from django.conf import settings
+from rest_framework import permissions, status, viewsets
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...models import DailyChallenge  # noqa: E402
+from ...serializers import DailyChallengeSerializer  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+
+class DailyChallengeViewSet(viewsets.ReadOnlyModelViewSet):
+    queryset = DailyChallenge.objects.all()
+    serializer_class = DailyChallengeSerializer
+    permission_classes = [permissions.AllowAny]
+
+
+class LatentSpaceDataView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        media = request.query_params.get("media", "anime").lower()
+        type_param = request.query_params.get("type", "thematic").lower()
+        mapping = {
+            ("anime", "thematic"): "latent_space_anime_thematic.json",
+            ("anime", "visual"): "latent_space_anime_visual_vibe.json",
+            ("anime", "scenario"): "latent_space_anime_plot.json",
+            ("manga", "thematic"): "latent_space_manga_thematic.json",
+            ("manga", "visual"): "latent_space_manga_visual_vibe.json",
+            ("manga", "scenario"): "latent_space_manga_plot.json",
+            ("character", "thematic"): "latent_space_character_vibe.json",
+            ("character", "visual"): "latent_space_character_visual_vibe.json",
+        }
+        filename = mapping.get((media, type_param), "latent_space_3d.json")
+        project_root = settings.BASE_DIR.parent.parent
+        file_path = project_root / "data" / "artifacts" / filename
+        if not os.path.exists(file_path):
+            file_path = project_root / "data" / "artifacts" / "latent_space_3d.json"
+            if not os.path.exists(file_path):
+                return Response([], status=status.HTTP_404_NOT_FOUND)
+        try:
+            with open(file_path, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            return Response(data)
+        except Exception:
+            logger.exception("Error loading latent space artifact")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class DailyChallengeDataView(APIView):
+    permission_classes = [permissions.AllowAny]
+
+    # How far back past challenges stay replayable.
+    MAX_BACK_DAYS = 30
+
+    def get(self, request):
+        today = datetime.date.today()
+        day = today
+        raw_date = request.query_params.get("date")
+        if raw_date:
+            try:
+                parsed = datetime.date.fromisoformat(raw_date)
+                if parsed <= today and (today - parsed).days <= self.MAX_BACK_DAYS:
+                    day = parsed
+            except ValueError:
+                pass
+
+        modes = [
+            {
+                "id": "anime",
+                "media_type": "Anime",
+                "brush1": "ANIME",
+                "brush2": "DU JOUR",
+                "description": "Devine la série animée mystère du jour.",
+                "gradient": "from-blue-600 to-indigo-900",
+                "icon": "/static/img/modes/classic.png",
+            },
+            {
+                "id": "manga",
+                "media_type": "Manga",
+                "brush1": "MANGA",
+                "brush2": "DU JOUR",
+                "description": "Devine l'œuvre papier mystère du jour.",
+                "gradient": "from-rose-500 to-red-900",
+                "icon": "/static/img/modes/covertest.png",
+            },
+            {
+                "id": "character",
+                "media_type": "Character",
+                "brush1": "PERSO",
+                "brush2": "DU JOUR",
+                "description": "Devine le personnage mystère du jour.",
+                "gradient": "from-purple-600 to-fuchsia-900",
+                "icon": "/static/img/modes/akinetix.png",
+            },
+        ]
+
+        # Attach this user's saved score per universe for the requested day.
+        results = {}
+        if request.user.is_authenticated:
+            from ...models import DailyResult  # noqa: E402
+
+            for r in DailyResult.objects.filter(user=request.user, date=day):
+                results[r.media_type] = {"score": r.score, "attempts": r.attempts}
+        for m in modes:
+            res = results.get(m["media_type"])
+            m["completed"] = bool(res)
+            m["score"] = res["score"] if res else None
+
+        prev_day = day - datetime.timedelta(days=1)
+        can_prev = (today - prev_day).days <= self.MAX_BACK_DAYS
+        return Response(
+            {
+                "date": day.isoformat(),
+                "is_today": day == today,
+                "prev_date": prev_day.isoformat() if can_prev else None,
+                "next_date": (
+                    None
+                    if day >= today
+                    else (day + datetime.timedelta(days=1)).isoformat()
+                ),
+                "total_score": sum(r["score"] for r in results.values()),
+                "modes": modes,
+            }
+        )

backend/api/animetix/api/labs/manga.py

@@ -0,0 +1,197 @@
+"""Manga labs: cleaning, translation and GCP-orchestrated dubbing."""
+
+import base64
+
+from adapters.inference.workflows_client import GCPWorkflowsClient
+from animetix_project.logging_config import get_logger
+from django.conf import settings
+from django.utils.decorators import method_decorator
+from django_ratelimit.decorators import ratelimit
+from rest_framework import permissions
+from rest_framework.response import Response
+from rest_framework.throttling import ScopedRateThrottle
+from rest_framework.views import APIView
+
+from ...containers import get_container  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS  # noqa: E402
+
+from animetix.api.billing import deduct_berrix  # noqa: E402
+
+
+class MangaLabDataView(APIView):
+    """Metadata for the Manga Lab tools."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        return Response(
+            {
+                "status": "active",
+                "tools": [
+                    {
+                        "id": "clean",
+                        "name": "Manga Cleaner",
+                        "description": "Remove text bubbles from manga pages.",
+                        "endpoint": "/api/v1/labs/manga-lab/clean/",
+                    },
+                    {
+                        "id": "translate",
+                        "name": "Manga Translator",
+                        "description": "Translate manga bubbles to target language.",
+                        "endpoint": "/api/v1/labs/manga-lab/translate/",
+                    },
+                    {
+                        "id": "voice",
+                        "name": "Manga Voice Lab",
+                        "description": "Generate voices for manga characters (Dubbing).",
+                        "endpoint": "/api/v1/labs/manga-voice/",
+                    },
+                ],
+            }
+        )
+
+
+@method_decorator(
+    ratelimit(key="user_or_ip", rate="5/m", method="POST", block=True), name="dispatch"
+)
+class MangaVoiceLabView(APIView):
+    """Traduction de manga + synthèse vocale orchestrée via GCP Workflows."""
+
+    permission_classes = [permissions.IsAuthenticated]
+    throttle_scope = "gpu"
+    throttle_classes = [ScopedRateThrottle]
+
+    def post(self, request):
+        import uuid  # noqa: E402
+
+        from django.core.cache import cache  # noqa: E402
+
+        image = request.data.get("image")
+        reference_audio = request.data.get("reference_audio")
+        target_lang = request.data.get("target_lang", "French")
+
+        if not image or not reference_audio:
+            return Response(
+                {"error": "Missing image or reference_audio in payload"}, status=400
+            )
+
+        # Déduction des Berrix (200 Bx pour orchestration GCP + Audio)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["manga_voice"],
+            "Manga Voice Lab (Doublage IA)",
+        )
+
+        task_id = str(uuid.uuid4())
+        filename = f"manga_voice_{task_id}.wav"
+
+        # Initialisation du cache
+        cache.set(
+            f"task_result:{task_id}",
+            {"ready": False, "status": "pending"},
+            timeout=3600,
+        )
+
+        is_prod = getattr(settings, "IS_PRODUCTION", False)
+        if is_prod:
+            try:
+                client = GCPWorkflowsClient()
+                execution_name = client.trigger_pipeline(
+                    image, reference_audio, target_lang, filename
+                )
+
+                # Cloud Task pour le polling
+                client.enqueue_polling_task(execution_name, task_id)
+                return Response({"task_id": task_id}, status=202)
+            except Exception as e:
+                cache.set(
+                    f"task_result:{task_id}",
+                    {"ready": True, "status": "failed", "error": str(e)},
+                    timeout=3600,
+                )
+                logger.exception("Failed to start workflow")
+                return Response({"error": "Failed to start workflow"}, status=500)
+        else:
+            # Fallback local dev synchrone simulé
+            cache.set(
+                f"task_result:{task_id}",
+                {
+                    "ready": True,
+                    "status": "success",
+                    "result": {
+                        "translated_text": "[Local Dev Fallback] Traduction simulée.",
+                        "audio_url": f"http://localhost:8000/media/mock_{filename}",
+                    },
+                },
+                timeout=3600,
+            )
+            return Response({"task_id": task_id}, status=202)
+
+
+class MangaCleanLabView(APIView):
+    """Nettoie (inpaint) les bulles de texte d'une planche de manga."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        image_file = request.FILES.get("image")
+
+        if not image_file:
+            return Response({"error": "Image file is required."}, status=400)
+
+        # Déduction des Berrix (20 Bx pour inpainting de planche)
+        deduct_berrix(
+            request.user, FEATURE_BX_COSTS["manga_clean"], "Manga Cleaner (Planche)"
+        )
+
+        try:
+            image_bytes = image_file.read()
+            inference_engine = container.inference.inference_engine()
+
+            # Un nettoyage simple équivaut à un inpainting avec une liste de bulles vide.
+            cleaned_bytes = inference_engine.inpaint_text_bubbles(image_bytes, [])
+
+            b64_img = base64.b64encode(cleaned_bytes).decode("utf-8")
+            return Response({"status": "success", "image": b64_img})
+        except Exception:
+            logger.exception("Error in MangaCleanLabView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class MangaTranslateLabView(APIView):
+    """Traduit les bulles de texte d'une planche de manga."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        image_file = request.FILES.get("image")
+        target_lang = request.data.get("target_lang", "French")
+
+        if not image_file:
+            return Response({"error": "Image file is required."}, status=400)
+
+        # Déduction des Berrix (20 Bx pour inpainting + traduction)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["manga_translate"],
+            f"Manga Translator: {target_lang}",
+        )
+
+        try:
+            image_bytes = image_file.read()
+            manga_flow_service = container.core.manga_flow_service()
+
+            translated_bytes = manga_flow_service.translate_manga_page(
+                image_bytes, target_lang
+            )
+
+            b64_img = base64.b64encode(translated_bytes).decode("utf-8")
+            return Response({"status": "success", "image": b64_img})
+        except Exception:
+            logger.exception("Error in MangaTranslateLabView")
+            return Response({"error": "Internal server error"}, status=500)

backend/api/animetix/api/labs/singularity.py

@@ -0,0 +1,509 @@
+"""Singularity/Ghost labs: evolving-AI experiments, LNN, ToT and diagnostics."""
+
+import datetime
+import random
+import time
+
+import numpy as np
+from animetix_project.logging_config import get_logger
+from dependency_injector.wiring import Provide, inject  # noqa: E402
+from rest_framework import permissions, status
+from rest_framework.response import Response
+from rest_framework.throttling import ScopedRateThrottle
+from rest_framework.views import APIView
+
+from ...containers import Container, get_container  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS  # noqa: E402
+
+from animetix.api.billing import deduct_berrix  # noqa: E402
+
+
+class SingularityLabDataView(APIView):
+    """Interact with fifth generation Evolving AI and Singularity services (SOTA 2035+)."""
+
+    permission_classes = [permissions.IsAuthenticated]
+    throttle_scope = "gpu"
+    throttle_classes = [ScopedRateThrottle]
+
+    def get(self, request):
+        container = get_container()
+        service = container.core.synaptic_plasticity_simulator()
+        drift_service = container.core.archetype_drift_service()
+
+        profile = getattr(request.user, "profile", None)
+        settings = profile.personalization_settings if profile else {}
+        drift_config = drift_service.calculate_drift(request.user.id, settings)
+
+        return Response(
+            {
+                "status": "success",
+                "weights": service.W.tolist(),
+                "concepts": [
+                    "Shonen",
+                    "Seinen",
+                    "Cyberpunk",
+                    "Mecha",
+                    "Fantasy",
+                    "Magic",
+                    "Ghibli",
+                    "Romance",
+                    "Comedy",
+                    "Drama",
+                ],
+                "plasticity_config": {
+                    "tau_plus": service.tau_plus,
+                    "tau_minus": service.tau_minus,
+                    "num_concepts": service.num_concepts,
+                },
+                "personalization_settings": settings,
+                "current_archetype": {
+                    "id": drift_config.archetype_id,
+                    "accent": drift_config.primary_accent,
+                    "aura_type": drift_config.aura_type,
+                    "intensity": drift_config.aura_intensity,
+                    "font_vibe": drift_config.font_vibe,
+                },
+            }
+        )
+
+    def post(self, request):
+        action = request.data.get("action", "")
+        container = get_container()
+
+        if action == "update_config":
+            profile = getattr(request.user, "profile", None)
+            if profile:
+                settings = profile.personalization_settings or {}
+                mode = request.data.get("mode")
+                if mode in ["auto", "manual"]:
+                    settings["mode"] = mode
+                manual_arch = request.data.get("manual_archetype")
+                if manual_arch:
+                    settings["manual_archetype"] = manual_arch
+                intensity = request.data.get("intensity_multiplier")
+                if intensity is not None:
+                    try:
+                        settings["intensity_multiplier"] = float(intensity)
+                    except ValueError:
+                        pass
+                features = request.data.get("features")
+                if isinstance(features, dict):
+                    settings["features"] = {
+                        "aura": bool(features.get("aura", True)),
+                        "font": bool(features.get("font", True)),
+                        "accent": bool(features.get("accent", True)),
+                    }
+                profile.personalization_settings = settings
+                profile.save()
+
+                # Clear cache for middleware
+                from django.core.cache import cache
+
+                cache.delete(f"personalization_drift_user_{request.user.id}")
+
+            service = container.core.synaptic_plasticity_simulator()
+            tau_plus = request.data.get("tau_plus")
+            if tau_plus is not None:
+                try:
+                    service.tau_plus = float(tau_plus)
+                except ValueError:
+                    pass
+            tau_minus = request.data.get("tau_minus")
+            if tau_minus is not None:
+                try:
+                    service.tau_minus = float(tau_minus)
+                except ValueError:
+                    pass
+
+            service.save_checkpoint()
+            return self.get(request)
+
+        if action == "compile":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["singularity_basic"],
+                "Singularity: Compilation de Kernel",
+            )
+            function_name = request.data.get(
+                "function_name", "cosine_similarity"
+            ).strip()
+            allowed_functions = [
+                "cosine_similarity",
+                "euclidean_distance",
+                "vector_norm",
+            ]
+            if function_name not in allowed_functions:
+                return Response(
+                    {"error": f'Function "{function_name}" not allowed.'}, status=400
+                )
+            try:
+                compiler = container.core.self_evolving_compiler()
+                optimized_fn = compiler.analyze_and_optimize(function_name)
+                a = np.array([1.0, 2.0, 3.0])
+                b = np.array([1.0, 2.0, 3.0])
+                test_val = optimized_fn(a, b)
+                return Response(
+                    {
+                        "status": "success",
+                        "message": f"Kernel '{function_name}' compilé dynamiquement !",
+                        "test_output": f"Result: {test_val:.4f}",
+                        "mode": compiler.mode,
+                    }
+                )
+            except Exception:
+                logger.exception("Error in singularity compile action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        elif action == "plasticity":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["singularity_basic"],
+                "Singularity: Plasticité Synaptique",
+            )
+            activations = request.data.get(
+                "activations", [1.0, 1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0]
+            )
+            active_indices = request.data.get("trigger_spikes", [0, 1])
+            learning_rate = float(request.data.get("learning_rate", 0.05))
+            try:
+                service = container.core.synaptic_plasticity_simulator()
+                now = time.time()
+                service.trigger_spikes(active_indices, now)
+                updated_W = service.update_hebbian(
+                    activations, learning_rate=learning_rate
+                )
+
+                # Check for STDP if two specific indices provided
+                stdp_log = []
+                if len(active_indices) >= 2:
+                    pre, post = active_indices[0], active_indices[1]
+                    dW = service.update_stdp(pre, post, learning_rate=learning_rate)
+                    stdp_log.append(f"STDP Update: {pre} -> {post} (dW: {dW:+.4f})")
+
+                return Response(
+                    {
+                        "status": "success",
+                        "message": "Plasticité synaptique synchronisée !",
+                        "weights": updated_W.tolist(),
+                        "weights_mean": float(np.mean(updated_W)),
+                        "stdp_log": stdp_log,
+                    }
+                )
+            except Exception:
+                logger.exception("Error in singularity plasticity action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        elif action == "quantum":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["singularity_basic"],
+                "Singularity: Effondrement Quantique",
+            )
+            theme = request.data.get("theme", "shonen").lower()
+            try:
+                model = container.core.quantum_cognitive_model()
+                prob, outcome = model.measure_preference(theme)
+                return Response(
+                    {
+                        "status": "success",
+                        "theme": theme,
+                        "probability": float(prob),
+                        "outcome": outcome,
+                        "state_vector": [str(x) for x in model.state],
+                        "message": f"Effondrement quantique sur '{theme}' réussi.",
+                    }
+                )
+            except Exception:
+                logger.exception("Error in singularity quantum action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        elif action == "evolve_dynamic":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["singularity_mid"],
+                "Singularity: Évolution LLM Dynamique",
+            )
+            task = request.data.get("task", "dot_product")
+            try:
+                compiler = container.core.self_evolving_compiler()
+                llm = container.agentic.llm_service()
+                # Évolution dynamique réelle via LLM
+                fn = compiler.evolve_with_llm(task, llm_proxy=llm)
+
+                # Test du kernel avec des données bidon
+                a = np.array([1.0, 2.0, 3.0, 4.0])
+                b = np.array([5.0, 6.0, 7.0, 8.0])
+                try:
+                    res = fn(a, b)
+                except Exception:
+                    res = "Kernel compiled but execution failed (check input types)."
+
+                return Response(
+                    {
+                        "status": "success",
+                        "result": str(res),
+                        "kernel_name": fn.__name__,
+                        "message": f"Nouveau kernel '{fn.__name__}' généré par LLM et injecté.",
+                    }
+                )
+            except Exception:
+                logger.exception("Error in singularity evolve_dynamic action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        elif action == "swarm":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["singularity_mid"],
+                "Singularity: Consensus Swarm P2P",
+            )
+            fact = request.data.get("fact")
+            media = request.data.get("media")
+            if not fact or not media:
+                return Response({"error": "fact and media are required"}, status=400)
+
+            try:
+                orchestrator = container.core.swarm_consensus_orchestrator()
+                # On utilise les diagnostics pour exposer Paxos-sémantique
+                diagnostics = orchestrator.get_paxos_diagnostics(
+                    fact=fact, media_title=media
+                )
+                return Response(diagnostics)
+            except Exception:
+                logger.exception("Error in singularity swarm action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        elif action == "synthesize":
+            deduct_berrix(
+                request.user,
+                FEATURE_BX_COSTS["multiverse_synth"],
+                "Singularity: Synthèse Multivers",
+            )
+            universe_name = request.data.get("universe_name", "Unnamed Universe")
+            genre = request.data.get("genre", "Cyberpunk")
+
+            try:
+                synthesizer = container.core.autonomous_domain_synthesizer()
+                universe_data = synthesizer.synthesize_multiverse(
+                    universe_name=universe_name, primary_genre=genre
+                )
+
+                # CRITICAL: Persist for HITL validation
+                persisted = synthesizer.persist_universe_to_graph(universe_data)
+
+                evaluation = synthesizer.evaluate_coherence_and_interest(universe_data)
+
+                return Response(
+                    {
+                        "status": "success",
+                        "universe": universe_data,
+                        "evaluation": evaluation,
+                        "persisted": persisted,
+                        "message": (
+                            f"Univers '{universe_name}' synthétisé et stagé pour validation."
+                            if persisted
+                            else f"Univers '{universe_name}' synthétisé mais rejeté par les filtres de cohérence."
+                        ),
+                    }
+                )
+            except Exception:
+                logger.exception("Error in singularity synthesize action")
+                return Response({"error": "Internal server error"}, status=500)
+
+        return Response({"error": "Action inconnue"}, status=400)
+
+
+class LiquidNeuralNetworkLabView(APIView):
+    """Simulateur neuromorphique de réseaux de neurones liquides (LNN)."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        input_signal = request.data.get("signal", [[0.5, 0.2]])
+        dt = float(request.data.get("dt", 0.05))
+        try:
+            lnn = container.core.liquid_neural_network()
+            state_history = lnn.process_continuous_signal(input_signal, dt=dt)
+            return Response(
+                {
+                    "status": "success",
+                    "state_history": state_history,
+                    "final_state": lnn.state.tolist(),
+                }
+            )
+        except Exception:
+            logger.exception("Error in LiquidNeuralNetworkLabView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class TreeOfThoughtsLabView(APIView):
+    # GPU-backed reasoning (multi-node ToT) → requires login and consumes Berrix.
+    permission_classes = [permissions.IsAuthenticated]
+
+    @inject
+    def __init__(
+        self, tot_service=Provide[Container.core.tree_of_thoughts_service], **kwargs
+    ):
+        super().__init__(**kwargs)
+        self.tot_service = tot_service
+
+    def post(self, request):
+        query = request.data.get("query")
+        if not query:
+            return Response(
+                {"error": "Query required"}, status=status.HTTP_400_BAD_REQUEST
+            )
+        # GPU → consume Berrix (before the try so a 402 isn't swallowed into a 500).
+        deduct_berrix(
+            request.user, FEATURE_BX_COSTS["tree_of_thoughts"], "Tree-of-Thoughts (IA)"
+        )
+        try:
+            result = self.tot_service.solve_with_tree_of_thoughts(query)
+            return Response(result)
+        except Exception:
+            logger.exception("Error in TreeOfThoughtsLabView")
+            return Response(
+                {"error": "Internal server error"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+
+class SingularityCommandCenterView(APIView):
+    """
+    Vue unifiée pour le monitoring et le contrôle des expériences IA avancées.
+    Agrège les données de santé de Quantum, Plasticity, Swarm, LNN, etc.
+    """
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get(self, request):
+        get_container()
+
+        # 1. État des services (Simulation de santé système)
+        services = []
+        try:
+            # Quantum
+            services.append(
+                {
+                    "id": "quantum",
+                    "name": "Quantum Cognitive",
+                    "status": "online",
+                    "load": random.randint(5, 25),  # nosec B311
+                    "metrics": {"coherence": 0.98, "dimension": 4},
+                }
+            )
+
+            # Plasticity
+            services.append(
+                {
+                    "id": "plasticity",
+                    "name": "Synaptic Plasticity",
+                    "status": "online",
+                    "load": random.randint(10, 40),
+                    "metrics": {"learning_rate": 0.05, "synapses": 1024},
+                }
+            )
+
+            # Swarm
+            services.append(
+                {
+                    "id": "swarm",
+                    "name": "P2P Swarm Consensus",
+                    "status": "online",
+                    "load": random.randint(15, 60),
+                    "metrics": {"nodes": 12, "consensus_rate": 0.95},
+                }
+            )
+
+            # LNN
+            services.append(
+                {
+                    "id": "lnn",
+                    "name": "Liquid Neural Network",
+                    "status": "online",
+                    "load": random.randint(20, 80),
+                    "metrics": {"stability": 0.92, "dt": 0.05},
+                }
+            )
+        except Exception as e:
+            logger.error(f"Failed to aggregate health metrics for Ghost Labs: {e}")
+
+        # 2. Événements récents (Simulés pour le dashboard)
+        events = [
+            {
+                "time": (
+                    datetime.datetime.now() - datetime.timedelta(minutes=2)
+                ).isoformat(),
+                "type": "QUANTUM",
+                "msg": "Effondrement de fonction d'onde détecté (Shonen).",
+            },
+            {
+                "time": (
+                    datetime.datetime.now() - datetime.timedelta(minutes=5)
+                ).isoformat(),
+                "type": "PLASTICITY",
+                "msg": "Apprentissage Hebbien complété pour user_77.",
+            },
+            {
+                "time": (
+                    datetime.datetime.now() - datetime.timedelta(minutes=12)
+                ).isoformat(),
+                "type": "SWARM",
+                "msg": "Consensus Paxos-sémantique atteint sur 'One Piece Timeline'.",
+            },
+        ]
+
+        return Response(
+            {
+                "status": "operational",
+                "services": services,
+                "events": events,
+                "system_load": random.randint(30, 50),  # nosec B311
+            }
+        )
+
+
+class NeuralDiagnosticsLabView(APIView):
+    """
+    Expose AI diagnostics for the Neural Diagnostics Dashboard.
+    Uses native logprobs and XAI service.
+    """
+
+    # GPU-backed (LLM generate + logprobs) → requires login and consumes Berrix.
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        prompt = request.data.get("prompt")
+        if not prompt:
+            return Response(
+                {"error": "Prompt is required."}, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        # GPU → consume Berrix (before the try so a 402 isn't swallowed into a 500).
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["neural_diagnostics"],
+            "Neural Diagnostics (IA)",
+        )
+
+        container = get_container()
+        try:
+            inference_engine = container.inference.inference_engine()
+            xai_service = container.core.xai_service()
+
+            # 1. Generate response with logprobs
+            response = inference_engine.generate(prompt, include_logprobs=True)
+
+            # 2. Get rich diagnostics report
+            report = xai_service.get_diagnostics_report(prompt, response)
+
+            return Response(report)
+        except Exception:
+            logger.exception("Neural Diagnostics Error")
+            return Response(
+                {"error": "Internal server error"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )

backend/api/animetix/api/labs/spatial.py

@@ -0,0 +1,99 @@
+"""Spatial-computing labs: image/video to 3D reconstruction."""
+
+from animetix_project.logging_config import get_logger
+from rest_framework import permissions
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from ...containers import get_container  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS  # noqa: E402
+
+from animetix.api.billing import deduct_berrix  # noqa: E402
+
+
+class SpatialLabDataView(APIView):
+    """Métadonnées pour les outils de Calcul Spatial."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        return Response(
+            {
+                "status": "active",
+                "tools": [
+                    {
+                        "id": "generate-3d",
+                        "name": "Image-to-3D",
+                        "description": "Generate a navigable 3D scene from a single image (Gaussian Splatting).",
+                        "endpoint": "/api/v1/labs/spatial/generate-3d/",
+                    },
+                    {
+                        "id": "cinematic",
+                        "name": "Cinematic Reconstruction",
+                        "description": "Reconstruct dynamic volumetric 3D scenes from video clips.",
+                        "endpoint": "/api/v1/labs/spatial/cinematic/",
+                    },
+                ],
+            }
+        )
+
+
+class Generate3DDataView(APIView):
+    """Génère une scène 3D (PLY) à partir d'une image."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        image_file = request.FILES.get("image")
+        title = request.data.get("title", "Poster 3D")
+
+        if not image_file:
+            return Response({"error": "Image file is required."}, status=400)
+
+        # Déduction des Berrix (150 Bx pour reconstruction 3D Gaussian Splatting)
+        deduct_berrix(
+            request.user, FEATURE_BX_COSTS["image_to_3d"], f"Image-to-3D: {title}"
+        )
+
+        try:
+            image_bytes = image_file.read()
+            service = container.core.spatial_computing_service()
+            result = service.reconstruct_3d_scene(image_bytes, title)
+            return Response(result)
+        except Exception:
+            logger.exception("Error in Generate3DDataView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class CinematicReconstructionView(APIView):
+    """Génère une séquence de scènes 3D à partir d'une vidéo."""
+
+    permission_classes = [permissions.IsAuthenticated]
+
+    def post(self, request):
+        container = get_container()
+        video_file = request.FILES.get("video")
+        title = request.data.get("title", "Cinematic 3D")
+
+        if not video_file:
+            return Response({"error": "Video file is required."}, status=400)
+
+        # Déduction des Berrix (500 Bx pour reconstruction volumétrique dynamique)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["cinematic_3d"],
+            f"Cinematic 3D Reconstruction: {title}",
+        )
+
+        try:
+            video_bytes = video_file.read()
+            service = container.core.cinematic_volumetric_reconstruction_service()
+            result = service.reconstruct_dynamic_cinematic_scene(video_bytes, title)
+            return Response(result)
+        except Exception:
+            logger.exception("Error in CinematicReconstructionView")
+            return Response({"error": "Internal server error"}, status=500)

backend/api/animetix/api/labs/video.py

@@ -0,0 +1,143 @@
+"""Video labs: style transfer (FateZero) and Video-RAG indexing/search."""
+
+from animetix_project.logging_config import get_logger
+from rest_framework import permissions
+from rest_framework.response import Response
+from rest_framework.throttling import ScopedRateThrottle
+from rest_framework.views import APIView
+
+from ...containers import get_container  # noqa: E402
+
+logger = get_logger("animetix." + __name__)
+
+from core.domain.services.berrix_economy import FEATURE_BX_COSTS  # noqa: E402
+
+from animetix.api.billing import deduct_berrix  # noqa: E402
+
+
+class VideoFateZeroLabView(APIView):
+    """Transforme une vidéo avec transfert de style SOTA (FateZero)."""
+
+    permission_classes = [permissions.IsAuthenticated]
+    throttle_scope = "gpu"
+    throttle_classes = [ScopedRateThrottle]
+
+    def post(self, request):
+        container = get_container()
+        video_file = request.FILES.get("video")
+        studio_style = request.data.get("studio_style", "Ufotable")
+
+        if not video_file:
+            return Response({"error": "Video file is required."}, status=400)
+
+        # Déduction des Berrix (500 Bx pour transfert de style vidéo - Très lourd)
+        deduct_berrix(
+            request.user,
+            FEATURE_BX_COSTS["style_transfer"],
+            f"FateZero Style Transfer: {studio_style}",
+        )
+
+        try:
+            video_bytes = video_file.read()
+            service = container.core.studio_transform_service()
+
+            result_url = service.transform_video_to_anime_sota(
+                video_bytes, studio_style
+            )
+
+            return Response(
+                {
+                    "status": "success",
+                    "video_url": result_url,
+                    "message": f"Transformation {studio_style} (FateZero) réussie.",
+                }
+            )
+        except Exception:
+            logger.exception("Error in VideoFateZeroLabView")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class VideoRAGIndexView(APIView):
+    """Endpoint pour indexer une vidéo dans le Video-RAG."""
+
+    permission_classes = [permissions.IsAdminUser]
+
+    def post(self, request):
+        video_file = request.FILES.get("video")
+        video_id = request.data.get("video_id")
+
+        if not video_file or not video_id:
+            return Response({"error": "video and video_id are required"}, status=400)
+
+        container = get_container()
+        video_rag = container.agentic.video_rag_service()
+
+        try:
+            video_data = video_file.read()
+            count = video_rag.index_video(video_id, video_data)
+            return Response({"status": "success", "indexed_segments": count})
+        except Exception:
+            logger.exception("VideoRAGIndex Error")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class VideoRAGSearchView(APIView):
+    """Endpoint pour rechercher des moments précis dans les vidéos indexées.
+
+    GPU/RAG : requiert login + consomme des Berrix (règle « GPU = Bx »).
+    """
+
+    permission_classes = [permissions.IsAuthenticated]
+    throttle_scope = "gpu"
+    throttle_classes = [ScopedRateThrottle]
+
+    def get(self, request):
+        query = request.GET.get("q")
+        if not query:
+            return Response({"error": "query q is required"}, status=400)
+
+        container = get_container()
+        usage_port = container.infrastructure.usage_port()
+        tier = getattr(request, "user_tier", "free")
+        if not usage_port.check_quota(request.user.id, tier):
+            return Response({"error": "Daily AI quota exceeded."}, status=403)
+        deduct_berrix(
+            request.user, FEATURE_BX_COSTS["video_rag"], "VideoRAG — recherche vidéo"
+        )
+
+        video_rag = container.agentic.video_rag_service()
+        try:
+            results = video_rag.search_video_segment(query, limit=10)
+            usage_port.log_usage(engine="video-rag", units=1, user_id=request.user.id)
+            return Response({"status": "success", "results": results})
+        except Exception:
+            logger.exception("VideoRAGSearch Error")
+            return Response({"error": "Internal server error"}, status=500)
+
+
+class VideoLabDataView(APIView):
+    """Métadonnées pour les outils du Video Lab."""
+
+    permission_classes = [permissions.AllowAny]
+
+    def get(self, request):
+        return Response(
+            {
+                "status": "active",
+                "tools": [
+                    {
+                        "id": "fatezero",
+                        "name": "FateZero Style Transfer",
+                        "description": "Temporally consistent anime style transfer for real videos.",
+                        "endpoint": "/api/v1/labs/video/fatezero/",
+                        "supported_styles": ["Shaft", "Ufotable", "Kyoto", "Ghibli"],
+                    },
+                    {
+                        "id": "video-rag",
+                        "name": "Video-RAG Search",
+                        "description": "Semantic search for precise moments in anime videos.",
+                        "endpoint": "/api/v1/labs/video/search/",
+                    },
+                ],
+            }
+        )

backend/api/animetix/api/mlops.py

@@ -137,9 +137,11 @@ class AIFeedbackAPIView(APIView):
 
     def get(self, request):
         """Récupère l'historique des feedbacks de l'utilisateur connecté."""
-        feedbacks = AIFeedback.objects.filter(user=request.user).order_by(
-            "-created_at"
-        )[:100]
+        feedbacks = (
+            AIFeedback.objects.filter(user=request.user)
+            .select_related("user")
+            .order_by("-created_at")[:100]
+        )
         serializer = AIFeedbackSerializer(feedbacks, many=True)
         return Response(serializer.data)
 

backend/api/animetix/api/social.py

@@ -534,7 +534,7 @@ class ProfileDetailView(APIView):
         serializer = ProfileSerializer(profile)
         # On ajoute les succès et les fusions récentes
         data = serializer.data
-        data["achievements_count"] = user.user_achievements.count()
+        data["achievements_count"] = user.userachievement_set.count()
         data["collection_count"] = CreativeFusion.objects.filter(creator=user).count()
         data["recent_achievements"] = AchievementSerializer(
             Achievement.objects.filter(userachievement__user=user).order_by(
@@ -542,12 +542,17 @@ class ProfileDetailView(APIView):
             )[:5],
             many=True,
         ).data
+        fusions_qs = (
+            CreativeFusion.objects.filter(creator=user)
+            .select_related("creator")
+            .prefetch_related("likes")
+        )
         data["top_fusions"] = CreativeFusionSerializer(
-            CreativeFusion.objects.filter(creator=user).order_by("-likes")[:4],
+            fusions_qs.order_by("-likes")[:4],
             many=True,
         ).data
         data["recent_fusions"] = CreativeFusionSerializer(
-            CreativeFusion.objects.filter(creator=user).order_by("-created_at")[:5],
+            fusions_qs.order_by("-created_at")[:5],
             many=True,
         ).data
         return Response(data)

backend/api/animetix/apps.py

@@ -34,9 +34,18 @@ class AnimetixConfig(AppConfig):
                 "animetix.api.games.duel",
                 "animetix.api.games.world_boss",
                 "animetix.api.explore",
-                "animetix.api.core",
+                "animetix.api.core.accounts",
+                "animetix.api.core.config",
+                "animetix.api.core.manga",
+                "animetix.api.core.media",
+                "animetix.api.core.suwayomi",
                 "animetix.api.social",
-                "animetix.api.labs",
+                "animetix.api.labs.audio",
+                "animetix.api.labs.dashboards",
+                "animetix.api.labs.manga",
+                "animetix.api.labs.singularity",
+                "animetix.api.labs.spatial",
+                "animetix.api.labs.video",
                 "animetix.api.mlops",
                 "animetix.api.graph",
                 "animetix.api.companion",

backend/api/animetix/middleware.py

@@ -215,3 +215,93 @@ class TracingMiddleware:
                 span.record_exception(e)
                 span.set_status(Status(StatusCode.ERROR, description=str(e)))
                 raise e
+
+
+class MaintenanceModeMiddleware:
+    """Mode maintenance global (flag ``SiteConfiguration.maintenance_mode``).
+
+    Quand le flag est ON, les requêtes ``/api/…`` reçoivent 503
+    ``{"maintenance": true}`` pour que le frontend bascule sur la page dédiée.
+    Exemptions : l'endpoint de config (le poll de sortie doit passer), le
+    monitoring (health checks) et le staff — session admin ou token Firebase.
+    Hors ``/api/`` (SPA, statiques, /admin/), rien n'est bloqué : le gating UX
+    est fait côté frontend.
+    """
+
+    sync_capable = True
+    async_capable = True
+
+    EXEMPT_PREFIXES = (
+        "/api/v1/config/",
+        "/api/monitoring/",
+    )
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.async_mode = iscoroutinefunction(self.get_response)
+
+    # --- Helpers (sync : appelés via sync_to_async en mode ASGI) ---
+
+    def _guarded(self, request) -> bool:
+        path = request.path
+        if not path.startswith("/api/"):
+            return False
+        return not path.startswith(self.EXEMPT_PREFIXES)
+
+    @staticmethod
+    def _maintenance_on() -> bool:
+        from .models import SiteConfiguration
+
+        return SiteConfiguration.get_solo().maintenance_mode
+
+    @staticmethod
+    def _is_staff(request) -> bool:
+        """Session admin, ou token Firebase d'un compte staff.
+
+        L'authentification DRF n'est tentée que sur le chemin bloquant (mode
+        ON + non exempt) : coût nul en fonctionnement normal.
+        """
+        if getattr(request, "user", None) is not None and request.user.is_staff:
+            return True
+        try:
+            from .auth import GoogleIdentityAuthentication
+
+            result = GoogleIdentityAuthentication().authenticate(request)
+            return bool(result and result[0].is_staff)
+        except Exception:
+            return False
+
+    @staticmethod
+    def _blocked_response():
+        from django.http import JsonResponse
+
+        return JsonResponse(
+            {
+                "detail": "Animetix est en maintenance. Réessayez dans quelques instants.",
+                "maintenance": True,
+            },
+            status=503,
+        )
+
+    def _should_block(self, request) -> bool:
+        return (
+            self._guarded(request)
+            and self._maintenance_on()
+            and not self._is_staff(request)
+        )
+
+    # --- Entrées sync / async ---
+
+    def __call__(self, request):
+        if self.async_mode:
+            return self.__acall__(request)
+        if self._should_block(request):
+            return self._blocked_response()
+        return self.get_response(request)
+
+    async def __acall__(self, request):
+        from asgiref.sync import sync_to_async
+
+        if await sync_to_async(self._should_block)(request):
+            return self._blocked_response()
+        return await self.get_response(request)

backend/api/animetix/migrations/0050_siteconfiguration.py

@@ -0,0 +1,55 @@
+# Generated by Django 5.2.14 on 2026-07-09 22:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("animetix", "0001_squashed_0049_remove_profile_stripe_customer_id_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="SiteConfiguration",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "maintenance_mode",
+                    models.BooleanField(
+                        default=False,
+                        help_text="ON : les visiteurs voient la page de maintenance ; le staff navigue normalement.",
+                    ),
+                ),
+                (
+                    "maintenance_message",
+                    models.TextField(
+                        blank=True,
+                        default="",
+                        help_text="Message optionnel affiché sur la page de maintenance.",
+                    ),
+                ),
+                (
+                    "maintenance_until",
+                    models.DateTimeField(
+                        blank=True,
+                        help_text="Heure de retour estimée (informatif, affiché sur la page).",
+                        null=True,
+                    ),
+                ),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                "verbose_name": "Configuration du site",
+                "verbose_name_plural": "Configuration du site",
+            },
+        ),
+    ]

backend/api/animetix/models.py

@@ -886,3 +886,43 @@ class VoiceProfile(models.Model):
                 )
             return self.origin_detail
         return ""
+
+
+# --- SITE CONFIGURATION (singleton) ---
+class SiteConfiguration(models.Model):
+    """Réglages globaux du site, togglables depuis l'admin sans redéploiement.
+
+    Singleton (pk=1) : toujours passer par ``get_solo()``.
+    """
+
+    maintenance_mode = models.BooleanField(
+        default=False,
+        help_text="ON : les visiteurs voient la page de maintenance ; le staff navigue normalement.",
+    )
+    maintenance_message = models.TextField(
+        blank=True,
+        default="",
+        help_text="Message optionnel affiché sur la page de maintenance.",
+    )
+    maintenance_until = models.DateTimeField(
+        null=True,
+        blank=True,
+        help_text="Heure de retour estimée (informatif, affiché sur la page).",
+    )
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = "Configuration du site"
+        verbose_name_plural = "Configuration du site"
+
+    def __str__(self):
+        return "Configuration du site"
+
+    def save(self, *args, **kwargs):
+        self.pk = 1  # Singleton : toute sauvegarde écrase l'unique ligne.
+        super().save(*args, **kwargs)
+
+    @classmethod
+    def get_solo(cls) -> "SiteConfiguration":
+        obj, _ = cls.objects.get_or_create(pk=1)
+        return obj

backend/api/animetix/serializers.py

@@ -384,6 +384,11 @@ class VsBattleSerializer(serializers.ModelSerializer):
     def get_is_liked(self, obj):
         user = self.context["request"].user if "request" in self.context else None
         if user and user.is_authenticated:
+            if (
+                hasattr(obj, "_prefetched_objects_cache")
+                and "likes" in obj._prefetched_objects_cache
+            ):
+                return user in obj.likes.all()
             return obj.likes.filter(id=user.id).exists()
         return False