feat(codev): retire Surprise + QR public + mode admin suppr fiches

- carto.vue : retire bouton Surprise (Alliance seul reste), ajoute isAdmin + deleteFiche + colonne supprimer annuaire
- middleware : /codev/qr exempté d'authentification
- auth.post.ts : détecte mdp admin → pose cookie codev_admin
- DELETE /api/codev/fiches/[id] : vérifie cookie admin avant suppression NocoDB
- GET /api/codev/me : retourne { admin, session }
- nuxt.config.ts : codevAdminPassword ajouté

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pages/codev/carto.vue

@@ -61,15 +61,6 @@
           Alliance
           <span class="hint">besoins partages</span>
         </button>
-        <button
-          :class="{ active: mode === 'surprise' }"
-          style="--mode-color: #3b82f6"
-          @click="setMode('surprise')"
-          type="button"
-        >
-          Surprise
-          <span class="hint">offres partagees</span>
-        </button>
         <button
           v-if="mode !== 'none'"
           class="reset"
@@ -94,6 +85,7 @@
               <th class="col-nom">Prénom</th>
               <th class="col-besoin">Besoin</th>
               <th class="col-offre">Ce que j'offre</th>
+              <th v-if="isAdmin" class="col-actions"></th>
             </tr>
           </thead>
           <tbody>
@@ -101,6 +93,9 @@
               <td class="col-nom">{{ f.nom }}</td>
               <td class="col-besoin">{{ f.besoin }}</td>
               <td class="col-offre">{{ f.offre }}</td>
+              <td v-if="isAdmin" class="col-actions">
+                <button @click.stop="deleteFiche(f.id)" class="delete-btn" type="button" title="Supprimer">✕</button>
+              </td>
             </tr>
           </tbody>
         </table>
@@ -145,7 +140,7 @@ import { computeMatches } from '~/utils/codev/matching'
 
 useHead({ title: 'Carto - Co-developpement' })
 
-const { data, pending } = await useFetch<{ list: CodevFiche[] }>('/api/codev/fiches')
+const { data, pending, refresh } = await useFetch<{ list: CodevFiche[] }>('/api/codev/fiches')
 const fiches = computed(() => data.value?.list ?? [])
 
 const matches = ref<CodevMatch[]>([])
@@ -155,6 +150,15 @@ const tab = ref<'carto' | 'annuaire'>('carto')
 const selectedFiche = ref<CodevFiche | null>(null)
 const isMobileView = typeof window !== 'undefined' ? window.innerWidth < 600 : false
 
+const isAdmin = ref(false)
+
+onMounted(async () => {
+  try {
+    const r = await $fetch<{ admin: boolean }>('/api/codev/me')
+    isAdmin.value = r.admin
+  } catch { isAdmin.value = false }
+})
+
 const MODE_LABELS: Record<string, string> = {
   solution: 'Solution',
   alliance: 'Alliance',
@@ -177,6 +181,12 @@ function onSelectFiche(id: number) {
     navigateTo(`/codev/fiche?id=${id}`)
   }
 }
+
+async function deleteFiche(id: number) {
+  if (!confirm('Supprimer la fiche ?')) return
+  await $fetch(`/api/codev/fiches/${id}`, { method: 'DELETE' })
+  await refresh()
+}
 </script>
 
 <style scoped>
@@ -503,6 +513,19 @@ thead tr .col-nom { background: #f9fafb; }
   margin: 0;
 }
 
+.col-actions { width: 40px; text-align: center; }
+.delete-btn {
+  background: transparent;
+  border: none;
+  cursor: pointer;
+  color: #ef4444;
+  font-size: 1rem;
+  padding: 4px 8px;
+  border-radius: 4px;
+  transition: background 0.1s;
+}
+.delete-btn:hover { background: #fef2f2; }
+
 /* ── Mobile ── */
 
 @media (max-width: 600px) {