fix: BUG-02 IC-03 session expirée sur Workflow Financier et Messagerie

Ajoute KeycloakAuthService.getValidAccessToken() qui vérifie l'expiration
du JWT et rafraîchit automatiquement avant de retourner le token.

FinanceWorkflowRemoteDatasource et MessagingRemoteDatasource injectent
désormais KeycloakAuthService au lieu de FlutterSecureStorage directement,
ce qui évite d'envoyer un Bearer expiré et d'obtenir un 401 silencieux.

lib/features/authentication/data/datasources/keycloak_auth_service.dart

@@ -119,6 +119,17 @@ class KeycloakAuthService {
     return null;
   }
 
+  /// Retourne un access token valide, en rafraîchissant automatiquement si expiré.
+  /// Utilisé par les datasources pour éviter d'envoyer un Bearer null ou expiré.
+  Future<String?> getValidAccessToken() async {
+    String? token = await _storage.read(key: _accessK);
+    if (token == null) return null;
+    if (JwtDecoder.isExpired(token)) {
+      token = await refreshToken();
+    }
+    return token;
+  }
+
   /// Récupération de l'utilisateur courant + Mapage Rôles
   Future<User?> getCurrentUser() async {
     String? token = await _storage.read(key: _accessK);

lib/features/communication/data/datasources/messaging_remote_datasource.dart

@@ -4,10 +4,10 @@ library messaging_remote_datasource;
 import 'dart:convert';
 import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:injectable/injectable.dart';
 import '../../../../core/config/environment.dart';
 import '../../../../core/error/exceptions.dart';
+import '../../../authentication/data/datasources/keycloak_auth_service.dart';
 import '../models/message_model.dart';
 import '../models/conversation_model.dart';
 import '../../domain/entities/message.dart';
@@ -15,16 +15,16 @@ import '../../domain/entities/message.dart';
 @lazySingleton
 class MessagingRemoteDatasource {
   final http.Client client;
-  final FlutterSecureStorage secureStorage;
+  final KeycloakAuthService authService;
 
   MessagingRemoteDatasource({
     required this.client,
-    required this.secureStorage,
+    required this.authService,
   });
 
-  /// Headers HTTP avec authentification
+  /// Headers HTTP avec authentification — rafraîchit le token si expiré (fix IC-03)
   Future<Map<String, String>> _getHeaders() async {
-    final token = await secureStorage.read(key: 'kc_access');
+    final token = await authService.getValidAccessToken();
     return {
       'Content-Type': 'application/json',
       'Accept': 'application/json',

lib/features/finance_workflow/data/datasources/finance_workflow_remote_datasource.dart

@@ -3,26 +3,26 @@ library finance_workflow_remote_datasource;
 
 import 'dart:convert';
 import 'package:http/http.dart' as http;
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:injectable/injectable.dart';
 import '../../../../core/config/environment.dart';
 import '../../../../core/error/exceptions.dart';
+import '../../../authentication/data/datasources/keycloak_auth_service.dart';
 import '../models/transaction_approval_model.dart';
 import '../models/budget_model.dart';
 
 @lazySingleton
 class FinanceWorkflowRemoteDatasource {
   final http.Client client;
-  final FlutterSecureStorage secureStorage;
+  final KeycloakAuthService authService;
 
   FinanceWorkflowRemoteDatasource({
     required this.client,
-    required this.secureStorage,
+    required this.authService,
   });
 
-  /// Headers HTTP avec authentification
+  /// Headers HTTP avec authentification — rafraîchit le token si expiré (fix IC-03)
   Future<Map<String, String>> _getHeaders() async {
-    final token = await secureStorage.read(key: 'kc_access');
+    final token = await authService.getValidAccessToken();
     return {
       'Content-Type': 'application/json',
       'Accept': 'application/json',