feat: fix registration 500, add forgot-password flow, frontend validation

- Fix MissingGreenlet: sync_engine now uses psycopg2 instead of asyncpg
- Fix bcrypt/passlib compat: pin bcrypt<4.1 in requirements
- Fix legacy password_hash NOT NULL: alter column to nullable in migration
- Add frontend password validation (uppercase + lowercase + digit)
- Add forgot-password and reset-password backend endpoints
- Add forgot-password and reset-password frontend pages
- Add email_service.py (SMTP via admin settings)
- Add reset_token/reset_token_expires columns to User model
- Migrate legacy JSON-only users to DB on password reset request
- Mount data/ volume in docker-compose.local.yml for persistence
- Add production deployment config (Dockerfile, nginx, deploy.sh)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/app/admin/settings/page.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useState, useEffect } from "react";
-import { Settings, Save, Loader2, CheckCircle, XCircle, RefreshCw, FlaskConical, KeyRound } from "lucide-react";
+import { Settings, Save, Loader2, CheckCircle, XCircle, RefreshCw, FlaskConical, KeyRound, Mail } from "lucide-react";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -10,6 +10,7 @@ import { Switch } from "@/components/ui/switch";
 import { Badge } from "@/components/ui/badge";
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
 import { useNotification } from "@/components/ui/notification";
+import { ModelCombobox, ModelOption } from "@/components/ui/model-combobox";
 import { useTranslationStore } from "@/lib/store";
 import { API_BASE } from "@/lib/config";
 
@@ -22,6 +23,16 @@ interface ProviderConfig {
   max_retries?: number;
 }
 
+interface SmtpConfig {
+  enabled: boolean;
+  host?: string;
+  port: number;
+  username?: string;
+  password?: string;
+  from_email?: string;
+  use_tls: boolean;
+}
+
 interface SettingsConfig {
   google: ProviderConfig;
   google_cloud: ProviderConfig;
@@ -31,6 +42,7 @@ interface SettingsConfig {
   openrouter: ProviderConfig;
   openrouter_premium: ProviderConfig;
   zai: ProviderConfig;
+  smtp: SmtpConfig;
   fallback_chain: string;
   fallback_chain_classic: string;
   fallback_chain_llm: string;
@@ -44,6 +56,7 @@ interface EnvInfo {
   zai: boolean;
   ollama: boolean;
   google_cloud: boolean;
+  smtp: boolean;
 }
 
 interface OllamaModel {
@@ -61,6 +74,7 @@ const defaultConfig: SettingsConfig = {
   openrouter: { enabled: false, api_key: "", model: "deepseek/deepseek-chat" },
   openrouter_premium: { enabled: false, api_key: "", model: "openai/gpt-4o-mini" },
   zai: { enabled: false, api_key: "", base_url: "https://api.x.ai/v1", model: "grok-2-1212" },
+  smtp: { enabled: false, host: "", port: 587, username: "", password: "", from_email: "", use_tls: true },
   fallback_chain: "google,deepl,openai,ollama,openrouter,openrouter_premium,zai",
   fallback_chain_classic: "google,deepl",
   fallback_chain_llm: "ollama,openai,openrouter,zai",
@@ -74,6 +88,7 @@ const defaultEnvInfo: EnvInfo = {
   zai: false,
   ollama: false,
   google_cloud: false,
+  smtp: false,
 };
 
 export default function AdminSettingsPage() {
@@ -85,6 +100,13 @@ export default function AdminSettingsPage() {
   const [testMessages, setTestMessages] = useState<Record<string, string>>({});
   const [ollamaModels, setOllamaModels] = useState<OllamaModel[]>([]);
   const [isLoadingModels, setIsLoadingModels] = useState(false);
+  const [openaiModels, setOpenaiModels] = useState<ModelOption[]>([]);
+  const [openrouterModels, setOpenrouterModels] = useState<ModelOption[]>([]);
+  const [zaiModels, setZaiModels] = useState<ModelOption[]>([]);
+  const [loadingModelsProvider, setLoadingModelsProvider] = useState<string | null>(null);
+  const [isSendingTestEmail, setIsSendingTestEmail] = useState(false);
+  const [testEmailResult, setTestEmailResult] = useState<"idle" | "ok" | "error">("idle");
+  const [testEmailMessage, setTestEmailMessage] = useState<string>("");
   const { success, error, info } = useNotification();
 
   useEffect(() => {
@@ -147,11 +169,19 @@ export default function AdminSettingsPage() {
     setTestResults((prev) => ({ ...prev, [provider]: "testing" }));
     setTestMessages((prev) => ({ ...prev, [provider]: "" }));
     try {
+      // For SMTP, send current form values so unsaved changes are tested
+      const smtpBody = provider === "smtp"
+        ? { body: JSON.stringify(config.smtp) }
+        : {};
       const response = await fetch(
         `${API_BASE}/api/v1/admin/providers/${provider}/test`,
         {
           method: "POST",
-          headers: { Authorization: `Bearer ${getToken()}` },
+          headers: {
+            Authorization: `Bearer ${getToken()}`,
+            ...(provider === "smtp" ? { "Content-Type": "application/json" } : {}),
+          },
+          ...smtpBody,
         }
       );
       const data = await response.json();
@@ -174,10 +204,12 @@ export default function AdminSettingsPage() {
   const fetchOllamaModels = async () => {
     setIsLoadingModels(true);
     try {
-      const response = await fetch(
-        `${API_BASE}/api/v1/admin/providers/ollama/models`,
-        { headers: { Authorization: `Bearer ${getToken()}` } }
-      );
+      const url = config.ollama.base_url
+        ? `${API_BASE}/api/v1/admin/providers/ollama/models?base_url=${encodeURIComponent(config.ollama.base_url)}`
+        : `${API_BASE}/api/v1/admin/providers/ollama/models`;
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${getToken()}` },
+      });
       if (response.ok) {
         const data = await response.json();
         setOllamaModels(data.data || []);
@@ -195,7 +227,32 @@ export default function AdminSettingsPage() {
     }
   };
 
-  type ProviderKey = keyof Omit<SettingsConfig, "fallback_chain" | "fallback_chain_classic" | "fallback_chain_llm">;
+  const fetchModels = async (provider: string) => {
+    setLoadingModelsProvider(provider);
+    try {
+      const response = await fetch(
+        `${API_BASE}/api/v1/admin/providers/${provider}/models`,
+        { headers: { Authorization: `Bearer ${getToken()}` } }
+      );
+      if (response.ok) {
+        const data = await response.json();
+        const models: ModelOption[] = data.data || [];
+        if (provider === "openai") setOpenaiModels(models);
+        else if (provider === "openrouter") setOpenrouterModels(models);
+        else if (provider === "zai") setZaiModels(models);
+        info({ title: `${models.length} modèles ${provider} trouvés` });
+      } else {
+        const body = await response.json().catch(() => ({}));
+        error({ title: `Erreur ${provider}`, description: body.message || `HTTP ${response.status}` });
+      }
+    } catch (e) {
+      error({ title: `Erreur ${provider}`, description: "Impossible de contacter le serveur." });
+    } finally {
+      setLoadingModelsProvider(null);
+    }
+  };
+
+  type ProviderKey = keyof Omit<SettingsConfig, "fallback_chain" | "fallback_chain_classic" | "fallback_chain_llm" | "smtp">;
   const updateProvider = (provider: ProviderKey, updates: Partial<ProviderConfig>) => {
     setConfig((prev) => ({
       ...prev,
@@ -203,6 +260,45 @@ export default function AdminSettingsPage() {
     }));
   };
 
+  const updateSmtp = (updates: Partial<SmtpConfig>) => {
+    setConfig((prev) => ({
+      ...prev,
+      smtp: { ...prev.smtp, ...updates },
+    }));
+  };
+
+  const sendTestEmail = async () => {
+    setIsSendingTestEmail(true);
+    setTestEmailResult("idle");
+    setTestEmailMessage("");
+    try {
+      const response = await fetch(
+        `${API_BASE}/api/v1/admin/providers/smtp/test-send`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${getToken()}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify(config.smtp),
+        }
+      );
+      const data = await response.json();
+      if (data.available) {
+        setTestEmailResult("ok");
+        setTestEmailMessage(data.test_result || "Email envoyé avec succès");
+      } else {
+        setTestEmailResult("error");
+        setTestEmailMessage(data.error || "Échec de l'envoi");
+      }
+    } catch {
+      setTestEmailResult("error");
+      setTestEmailMessage("Erreur réseau");
+    } finally {
+      setIsSendingTestEmail(false);
+    }
+  };
+
   if (isLoading) {
     return (
       <div className="flex items-center justify-center py-12">
@@ -298,15 +394,29 @@ export default function AdminSettingsPage() {
           testMessage={testMessages.openai}
           envKeySet={envInfo.openai}
         >
-          <div className="space-y-2">
-            <Label htmlFor="openai-key">Clé API</Label>
-            <Input
-              id="openai-key"
-              type="password"
-              placeholder={envInfo.openai ? "Clé configurée dans .env (laisser vide pour l'utiliser)" : "sk-..."}
-              value={config.openai.api_key || ""}
-              onChange={(e) => updateProvider("openai", { api_key: e.target.value })}
-            />
+          <div className="grid gap-4 sm:grid-cols-2">
+            <div className="space-y-2">
+              <Label htmlFor="openai-key">Clé API</Label>
+              <Input
+                id="openai-key"
+                type="password"
+                placeholder={envInfo.openai ? "Clé configurée dans .env (laisser vide pour l'utiliser)" : "sk-..."}
+                value={config.openai.api_key || ""}
+                onChange={(e) => updateProvider("openai", { api_key: e.target.value })}
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="openai-model">Modèle</Label>
+              <ModelCombobox
+                value={config.openai.model || ""}
+                onChange={(v) => updateProvider("openai", { model: v })}
+                models={openaiModels}
+                isLoading={loadingModelsProvider === "openai"}
+                onFetchModels={() => fetchModels("openai")}
+                providerLabel="OpenAI"
+                placeholder="gpt-4o"
+              />
+            </div>
           </div>
         </ProviderCard>
 
@@ -409,11 +519,14 @@ export default function AdminSettingsPage() {
             </div>
             <div className="space-y-2">
               <Label htmlFor="openrouter-model">Modèle Essentiel</Label>
-              <Input
-                id="openrouter-model"
-                placeholder="deepseek/deepseek-chat"
+              <ModelCombobox
                 value={config.openrouter.model || ""}
-                onChange={(e) => updateProvider("openrouter", { model: e.target.value })}
+                onChange={(v) => updateProvider("openrouter", { model: v })}
+                models={openrouterModels}
+                isLoading={loadingModelsProvider === "openrouter"}
+                onFetchModels={() => fetchModels("openrouter")}
+                providerLabel="OpenRouter"
+                placeholder="deepseek/deepseek-chat"
               />
               <p className="text-xs text-muted-foreground">Recommandé : <code>deepseek/deepseek-chat</code> (~€0.04/doc)</p>
             </div>
@@ -432,11 +545,14 @@ export default function AdminSettingsPage() {
         >
           <div className="space-y-2">
             <Label htmlFor="openrouter-premium-model">Modèle Premium</Label>
-            <Input
-              id="openrouter-premium-model"
-              placeholder="openai/gpt-4o-mini"
+            <ModelCombobox
               value={config.openrouter_premium.model || ""}
-              onChange={(e) => updateProvider("openrouter_premium", { model: e.target.value })}
+              onChange={(v) => updateProvider("openrouter_premium", { model: v })}
+              models={openrouterModels}
+              isLoading={loadingModelsProvider === "openrouter"}
+              onFetchModels={() => fetchModels("openrouter")}
+              providerLabel="OpenRouter"
+              placeholder="openai/gpt-4o-mini"
             />
             <p className="text-xs text-muted-foreground">
               Recommandé : <code>openai/gpt-4o-mini</code> (~€0.15/doc) ou <code>anthropic/claude-3.5-haiku</code> (~€0.20/doc)
@@ -467,11 +583,14 @@ export default function AdminSettingsPage() {
             </div>
             <div className="space-y-2">
               <Label htmlFor="zai-model">Modèle</Label>
-              <Input
-                id="zai-model"
-                placeholder="grok-2-1212"
+              <ModelCombobox
                 value={config.zai.model || ""}
-                onChange={(e) => updateProvider("zai", { model: e.target.value })}
+                onChange={(v) => updateProvider("zai", { model: v })}
+                models={zaiModels}
+                isLoading={loadingModelsProvider === "zai"}
+                onFetchModels={() => fetchModels("zai")}
+                providerLabel="xAI"
+                placeholder="grok-2-1212"
               />
             </div>
           </div>
@@ -513,6 +632,143 @@ export default function AdminSettingsPage() {
             </div>
           </CardContent>
         </Card>
+
+        <Card className={config.smtp.enabled ? "border-primary/30 overflow-visible" : "overflow-visible"}>
+          <CardHeader className="pb-3">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-3">
+                <div className="w-8 h-8 bg-blue-600/20 rounded-md flex items-center justify-center">
+                  <Mail className="w-4 h-4 text-blue-400" />
+                </div>
+                <CardTitle className="text-base">Email SMTP</CardTitle>
+                <Badge variant={config.smtp.enabled ? "default" : "secondary"} className="text-xs">
+                  {config.smtp.enabled ? "Activé" : "Désactivé"}
+                </Badge>
+                {envInfo.smtp && (
+                  <Badge variant="outline" className="text-xs gap-1 border-green-500/40 text-green-400">
+                    <KeyRound className="size-3" />
+                    Config dans .env
+                  </Badge>
+                )}
+              </div>
+              <div className="flex items-center gap-3">
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={() => testProvider("smtp")}
+                  disabled={testResults.smtp === "testing"}
+                  className="h-8"
+                >
+                  {testResults.smtp === "testing" ? (
+                    <><Loader2 className="size-3 animate-spin mr-1" />Test...</>
+                  ) : testResults.smtp === "ok" ? (
+                    <><CheckCircle className="size-3 text-green-500 mr-1" />OK</>
+                  ) : testResults.smtp === "error" ? (
+                    <><XCircle className="size-3 text-red-500 mr-1" />Erreur</>
+                  ) : (
+                    <><FlaskConical className="size-3 mr-1" />Tester</>
+                  )}
+                </Button>
+                <Switch checked={config.smtp.enabled} onCheckedChange={(enabled) => updateSmtp({ enabled })} />
+              </div>
+            </div>
+            <CardDescription>
+              Configuration du serveur SMTP pour l&apos;envoi d&apos;emails (mot de passe oublié, notifications, etc.)
+            </CardDescription>
+            {testMessages.smtp && (
+              <p className={`text-xs mt-1 ${testResults.smtp === "ok" ? "text-green-400" : "text-red-400"}`}>
+                {testMessages.smtp}
+              </p>
+            )}
+          </CardHeader>
+          <CardContent className="pt-0 space-y-4">
+            <div className="grid gap-4 sm:grid-cols-2">
+              <div className="space-y-2">
+                <Label htmlFor="smtp-host">Hôte SMTP</Label>
+                <Input
+                  id="smtp-host"
+                  placeholder={envInfo.smtp ? "Configuré dans .env" : "smtp.example.com"}
+                  value={config.smtp.host || ""}
+                  onChange={(e) => updateSmtp({ host: e.target.value })}
+                />
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="smtp-port">Port</Label>
+                <Input
+                  id="smtp-port"
+                  type="number"
+                  placeholder="587"
+                  value={config.smtp.port}
+                  onChange={(e) => updateSmtp({ port: parseInt(e.target.value) || 587 })}
+                />
+              </div>
+            </div>
+            <div className="grid gap-4 sm:grid-cols-2">
+              <div className="space-y-2">
+                <Label htmlFor="smtp-username">Nom d&apos;utilisateur</Label>
+                <Input
+                  id="smtp-username"
+                  placeholder={envInfo.smtp ? "Configuré dans .env" : "user@example.com"}
+                  value={config.smtp.username || ""}
+                  onChange={(e) => updateSmtp({ username: e.target.value })}
+                />
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="smtp-password">Mot de passe</Label>
+                <Input
+                  id="smtp-password"
+                  type="password"
+                  placeholder="••••••••"
+                  value={config.smtp.password || ""}
+                  onChange={(e) => updateSmtp({ password: e.target.value })}
+                />
+              </div>
+            </div>
+            <div className="grid gap-4 sm:grid-cols-2">
+              <div className="space-y-2">
+                <Label htmlFor="smtp-from">Adresse d&apos;expédition</Label>
+                <Input
+                  id="smtp-from"
+                  type="email"
+                  placeholder={envInfo.smtp ? "Configuré dans .env" : "noreply@example.com"}
+                  value={config.smtp.from_email || ""}
+                  onChange={(e) => updateSmtp({ from_email: e.target.value })}
+                />
+              </div>
+              <div className="flex items-center gap-3 pt-6">
+                <Switch
+                  checked={config.smtp.use_tls}
+                  onCheckedChange={(checked) => updateSmtp({ use_tls: checked })}
+                />
+                <Label>Utiliser TLS</Label>
+              </div>
+            </div>
+            <div className="flex items-center gap-3 pt-2">
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={sendTestEmail}
+                disabled={isSendingTestEmail || !config.smtp.enabled}
+                className="h-8"
+              >
+                {isSendingTestEmail ? (
+                  <><Loader2 className="size-3 animate-spin mr-1" />Envoi...</>
+                ) : testEmailResult === "ok" ? (
+                  <><CheckCircle className="size-3 text-green-500 mr-1" />Envoyé</>
+                ) : testEmailResult === "error" ? (
+                  <><XCircle className="size-3 text-red-500 mr-1" />Échec</>
+                ) : (
+                  <><Mail className="size-3 mr-1" />Envoyer un email de test</>
+                )}
+              </Button>
+              {testEmailMessage && (
+                <p className={`text-xs ${testEmailResult === "ok" ? "text-green-400" : "text-red-400"}`}>
+                  {testEmailMessage}
+                </p>
+              )}
+            </div>
+          </CardContent>
+        </Card>
       </div>
 
       <div className="flex justify-end">
@@ -558,7 +814,7 @@ function ProviderCard({
   children?: React.ReactNode;
 }) {
   return (
-    <Card className={enabled ? "border-primary/30" : ""}>
+    <Card className={enabled ? "border-primary/30 overflow-visible" : "overflow-visible"}>
       <CardHeader className="pb-3">
         <div className="flex items-center justify-between">
           <div className="flex items-center gap-3">