feat(translation): quality pipeline overhaul + new features (audit 2026-08-29)

Translation quality & format preservation:
- Word: merge adjacent same-format runs into one unit (sentence-level
  coherence like inline-tag handling); translate comments/balloons;
  dedupe textbox collection (was translated twice); RTL no longer
  overrides center/justify alignment; CJK/Arabic font hints (eastAsia/cs)
- PPTX: chart translations now actually reach the output file
  (ChartPart.blob is read-only — rewrite chart XML in the saved ZIP);
  CJK typeface hints (a:ea)
- Excel: sheet renames no longer break references — rewrite cell
  formulas (3D/quoted), defined names, data validations, cond. formats
- PDF: bold/italic honored (hebo/heit/hebi); table cells never merge;
  unchanged blocks left untouched (typography preserved, fixes duplicate
  hyperlinks); attempted/changed stats + route gate now cover PDF;
  CJK font paths; scanned PDFs via Mistral OCR (detection + admin settings)

Features:
- formality param (formal/informal) + automatic regional-variant prompts
- output_mode=bilingual docx (source above translation)
- per-user translation memory on Redis (falls back to LRU), context-hashed
- QA report + 0-100 confidence score in job status; L0 on by default
- OpenAI-compatible providers: whole chunk in ONE numbered-JSON request
  (~15x fewer calls) with per-item fallback; base prompt always present
  (custom prompt no longer replaces translation instructions)

Infra & marketing alignment:
- plan-based engine gating + vision gating (closes paid-engine leak);
  /providers/available filtered per plan; 107 languages exposed
- zh-CN/zh-TW validation fixed; libmagic disabled on Windows (native crash)
- admin: Mistral OCR settings + engine status dashboard; httpx<0.28 pin
  (TestClient breakage); Prometheus test fixture fixed
- marketing docs aligned with code (PDF+OCR, retention, engines, pricing)
- security: .env.ionos/.env.production/provider_settings.json removed

Tests: 1173 passed / 0 failed (6 network tests deselected: free Google
endpoint temporarily blocked from this machine)

frontend/src/app/admin/ProviderStatus.tsx

@@ -24,6 +24,7 @@ const PROVIDER_LABELS: Record<string, string> = {
   deepseek: "IA Express",
   minimax: "IA Avancée",
   zai: "Grok (xAI)",
+  mistral_ocr: "OCR Mistral (PDF scannés)",
 };
 
 const STATUS_CONFIG = {
@@ -132,6 +133,11 @@ export function ProviderStatus({ data, isLoading }: ProviderStatusProps) {
                       {new Date(provider.last_check).toLocaleTimeString()}
                     </span>
                   )}
+                  {provider.config_only && (
+                    <span className="text-muted-foreground">
+                      Statut dérivé de la configuration (pas d'appel réseau)
+                    </span>
+                  )}
                   {provider.error && (
                     <span className="text-red-500">{provider.error}</span>
                   )}

frontend/src/app/admin/settings/page.tsx

@@ -42,6 +42,7 @@ interface SettingsConfig {
   openrouter: ProviderConfig;
   openrouter_premium: ProviderConfig;
   zai: ProviderConfig;
+  mistral: ProviderConfig;
   smtp: SmtpConfig;
   fallback_chain: string;
   fallback_chain_classic: string;
@@ -54,6 +55,7 @@ interface EnvInfo {
   openrouter: boolean;
   openrouter_premium: boolean;
   zai: boolean;
+  mistral: boolean;
   ollama: boolean;
   google_cloud: boolean;
   smtp: boolean;
@@ -74,6 +76,7 @@ const defaultConfig: SettingsConfig = {
   openrouter: { enabled: false, api_key: "", model: "deepseek/deepseek-chat" },
   openrouter_premium: { enabled: false, api_key: "", model: "openai/gpt-4o-mini" },
   zai: { enabled: false, api_key: "", base_url: "https://api.x.ai/v1", model: "grok-2-1212" },
+  mistral: { enabled: false, api_key: "", model: "mistral-ocr-latest", timeout: 180 },
   smtp: { enabled: false, host: "", port: 587, username: "", password: "", from_email: "", use_tls: true },
   fallback_chain: "google,google_cloud,deepl,openrouter,openrouter_premium,openai,deepseek,zai",
   fallback_chain_classic: "google,google_cloud,deepl",
@@ -86,6 +89,7 @@ const defaultEnvInfo: EnvInfo = {
   openrouter: false,
   openrouter_premium: false,
   zai: false,
+  mistral: false,
   ollama: false,
   google_cloud: false,
   smtp: false,
@@ -608,6 +612,42 @@ export default function AdminSettingsPage() {
           </div>
         </ProviderCard>
 
+        <ProviderCard
+          title="OCR Mistral (PDF scannés)"
+          description="Extraction du texte des PDF scannés (pages image) avant traduction. Sans clé, ces fichiers sont refusés avec un message clair. ~1 € / 1 000 pages. Clé : console.mistral.ai"
+          enabled={config.mistral.enabled}
+          onToggle={(enabled) => updateProvider("mistral", { enabled })}
+          onTest={() => testProvider("mistral")}
+          testResult={testResults.mistral ?? "idle"}
+          testMessage={testMessages.mistral}
+          envKeySet={envInfo.mistral}
+        >
+          <div className="grid gap-4 sm:grid-cols-2">
+            <div className="space-y-2">
+              <Label htmlFor="mistral-key">Clé API Mistral</Label>
+              <Input
+                id="mistral-key"
+                type="password"
+                placeholder={envInfo.mistral ? "Clé configurée dans .env (laisser vide pour l'utiliser)" : "Clé console.mistral.ai"}
+                value={config.mistral.api_key || ""}
+                onChange={(e) => updateProvider("mistral", { api_key: e.target.value })}
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="mistral-model">Modèle OCR</Label>
+              <Input
+                id="mistral-model"
+                placeholder="mistral-ocr-latest"
+                value={config.mistral.model || ""}
+                onChange={(e) => updateProvider("mistral", { model: e.target.value })}
+              />
+              <p className="text-xs text-muted-foreground">
+                Recommandé : <code>mistral-ocr-latest</code>
+              </p>
+            </div>
+          </div>
+        </ProviderCard>
+
         <Card>
           <CardHeader>
             <CardTitle className="text-base">Chaîne de fallback</CardTitle>

frontend/src/app/admin/types.ts

@@ -30,6 +30,10 @@ export interface ProviderStatus {
   last_check: string | null;
   latency_ms?: number;
   error?: string;
+  /** true when availability is derived from configuration (no live call) */
+  config_only?: boolean;
+  /** optional display label provided by the backend */
+  label?: string;
 }
 
 export interface CleanupResponse {