feat: modération IA automatique à la publication

- contentModerationService branché dans /api/notes/publish
- blocked → 403, publication refusée, toast d'explication
- flagged → publié mais admins notifiés pour révision
- safe → publication normale
- PublishDialog gère les 3 cas (succès normal, flagged, blocked)
- i18n FR/EN

memento-note/app/api/notes/publish/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
 import prisma from '@/lib/prisma'
+import { contentModerationService } from '@/lib/ai/services/content-moderation.service'
 
 function generateSlug(title: string): string {
   const base = title
@@ -22,11 +23,44 @@ export async function POST(request: NextRequest) {
 
   const note = await prisma.note.findFirst({
     where: { id: noteId, userId: session.user.id },
-    select: { id: true, title: true, publicSlug: true },
+    select: { id: true, title: true, publicSlug: true, content: true },
   })
   if (!note) return NextResponse.json({ error: 'Not found' }, { status: 404 })
 
   if (action === 'publish') {
+    // --- AI Moderation ---
+    let moderation
+    try {
+      moderation = await contentModerationService.moderate(note.title || '', note.content || '')
+    } catch {
+      moderation = { verdict: 'safe' as const, categories: ['safe'], reason: 'Moderation indisponible' }
+    }
+
+    if (moderation.verdict === 'blocked') {
+      return NextResponse.json({
+        error: 'blocked',
+        reason: moderation.reason,
+        categories: moderation.categories,
+      }, { status: 403 })
+    }
+
+    // flagged → publish but notify admins
+    if (moderation.verdict === 'flagged') {
+      const admins = await prisma.user.findMany({ where: { role: 'ADMIN' }, select: { id: true } })
+      for (const admin of admins) {
+        await prisma.notification.create({
+          data: {
+            userId: admin.id,
+            type: 'content_flagged',
+            title: 'Contenu sensible publié',
+            message: `La note "${note.title}" a été publiée avec un contenu potentiellement sensible: ${moderation.reason}`,
+            actionUrl: '/admin/published',
+            relatedId: note.id,
+          },
+        }).catch(() => {})
+      }
+    }
+
     let slug = note.publicSlug
     if (!slug) {
       slug = generateSlug(note.title || 'note')
@@ -37,7 +71,12 @@ export async function POST(request: NextRequest) {
       where: { id: noteId },
       data: { isPublic: true, publicSlug: slug, publishedAt: new Date() },
     })
-    return NextResponse.json({ success: true, slug })
+
+    return NextResponse.json({
+      success: true,
+      slug,
+      moderation: moderation.verdict === 'flagged' ? 'flagged' : undefined,
+    })
   }
 
   if (action === 'unpublish') {