fix(UI-02): guards rôle sur pages organisations — FAB, édition, suppression SUPER_ADMIN only

- OrgTypesPage: FAB création, tap/édition/suppression type visibles uniquement SUPER_ADMIN
- OrganizationDetailPage: bouton édition visible orgAdmin+superAdmin, suppression SUPER_ADMIN only, section Actions cachée si non autorisé

lib/features/authentication/data/datasources/keycloak_auth_service.dart

@@ -119,6 +119,17 @@ class KeycloakAuthService {
     return null;
   }
 
+  /// Retourne un access token valide, en rafraîchissant automatiquement si expiré.
+  /// Utilisé par les datasources pour éviter d'envoyer un Bearer null ou expiré.
+  Future<String?> getValidAccessToken() async {
+    String? token = await _storage.read(key: _accessK);
+    if (token == null) return null;
+    if (JwtDecoder.isExpired(token)) {
+      token = await refreshToken();
+    }
+    return token;
+  }
+
   /// Récupération de l'utilisateur courant + Mapage Rôles
   Future<User?> getCurrentUser() async {
     String? token = await _storage.read(key: _accessK);

lib/features/communication/data/datasources/messaging_remote_datasource.dart

@@ -4,10 +4,10 @@ library messaging_remote_datasource;
 import 'dart:convert';
 import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:injectable/injectable.dart';
 import '../../../../core/config/environment.dart';
 import '../../../../core/error/exceptions.dart';
+import '../../../authentication/data/datasources/keycloak_auth_service.dart';
 import '../models/message_model.dart';
 import '../models/conversation_model.dart';
 import '../../domain/entities/message.dart';
@@ -15,16 +15,16 @@ import '../../domain/entities/message.dart';
 @lazySingleton
 class MessagingRemoteDatasource {
   final http.Client client;
-  final FlutterSecureStorage secureStorage;
+  final KeycloakAuthService authService;
 
   MessagingRemoteDatasource({
     required this.client,
-    required this.secureStorage,
+    required this.authService,
   });
 
-  /// Headers HTTP avec authentification
+  /// Headers HTTP avec authentification — rafraîchit le token si expiré (fix IC-03)
   Future<Map<String, String>> _getHeaders() async {
-    final token = await secureStorage.read(key: 'kc_access');
+    final token = await authService.getValidAccessToken();
     return {
       'Content-Type': 'application/json',
       'Accept': 'application/json',

lib/features/finance_workflow/data/datasources/finance_workflow_remote_datasource.dart

@@ -3,26 +3,26 @@ library finance_workflow_remote_datasource;
 
 import 'dart:convert';
 import 'package:http/http.dart' as http;
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:injectable/injectable.dart';
 import '../../../../core/config/environment.dart';
 import '../../../../core/error/exceptions.dart';
+import '../../../authentication/data/datasources/keycloak_auth_service.dart';
 import '../models/transaction_approval_model.dart';
 import '../models/budget_model.dart';
 
 @lazySingleton
 class FinanceWorkflowRemoteDatasource {
   final http.Client client;
-  final FlutterSecureStorage secureStorage;
+  final KeycloakAuthService authService;
 
   FinanceWorkflowRemoteDatasource({
     required this.client,
-    required this.secureStorage,
+    required this.authService,
   });
 
-  /// Headers HTTP avec authentification
+  /// Headers HTTP avec authentification — rafraîchit le token si expiré (fix IC-03)
   Future<Map<String, String>> _getHeaders() async {
-    final token = await secureStorage.read(key: 'kc_access');
+    final token = await authService.getValidAccessToken();
     return {
       'Content-Type': 'application/json',
       'Accept': 'application/json',

lib/features/organizations/presentation/pages/org_types_page.dart

@@ -5,6 +5,8 @@ import '../../../../shared/widgets/core_card.dart';
 import '../../../../core/di/injection.dart';
 import '../../bloc/org_types_bloc.dart';
 import '../../domain/entities/type_reference_entity.dart';
+import '../../../../features/authentication/presentation/bloc/auth_bloc.dart';
+import '../../../../features/authentication/data/models/user_role.dart';
 
 class OrgTypesPage extends StatelessWidget {
   const OrgTypesPage({super.key});
@@ -77,11 +79,17 @@ class _OrgTypesViewState extends State<_OrgTypesView> {
           );
         },
       ),
-      floatingActionButton: FloatingActionButton.small(
+      floatingActionButton: Builder(builder: (ctx) {
-        onPressed: () => _showTypeForm(context, null),
+        final authState = ctx.read<AuthBloc>().state;
-        backgroundColor: AppColors.primaryGreen,
+        final isSuperAdmin = authState is AuthAuthenticated &&
-        child: const Icon(Icons.add, color: Colors.white),
+            authState.effectiveRole == UserRole.superAdmin;
-      ),
+        if (!isSuperAdmin) return const SizedBox.shrink();
+        return FloatingActionButton.small(
+          onPressed: () => _showTypeForm(context, null),
+          backgroundColor: AppColors.primaryGreen,
+          child: const Icon(Icons.add, color: Colors.white),
+        );
+      }),
     );
   }
 
@@ -96,12 +104,15 @@ class _OrgTypesViewState extends State<_OrgTypesView> {
   Widget _buildTypeCard(BuildContext context, TypeReferenceEntity type, OrgTypesState state) {
     final isOperating = state is OrgTypeOperating;
     final color = _parseColor(type.couleur) ?? AppColors.primaryGreen;
+    final authState = context.read<AuthBloc>().state;
+    final isSuperAdmin = authState is AuthAuthenticated &&
+        authState.effectiveRole == UserRole.superAdmin;
 
     return Opacity(
       opacity: isOperating ? 0.6 : 1.0,
       child: CoreCard(
         margin: EdgeInsets.zero,
-        onTap: (!type.estSysteme && !isOperating) ? () => _showTypeForm(context, type) : null,
+        onTap: (isSuperAdmin && !type.estSysteme && !isOperating) ? () => _showTypeForm(context, type) : null,
         child: Container(
           decoration: BoxDecoration(
             border: Border(left: BorderSide(color: color, width: 3)),
@@ -163,7 +174,7 @@ class _OrgTypesViewState extends State<_OrgTypesView> {
                   ],
                 ),
               ),
-              if (!type.estSysteme && !isOperating) ...[
+              if (isSuperAdmin && !type.estSysteme && !isOperating) ...[
                 IconButton(
                   icon: const Icon(Icons.edit_outlined, size: 16),
                   color: AppColors.textSecondaryLight,
@@ -187,6 +198,10 @@ class _OrgTypesViewState extends State<_OrgTypesView> {
   }
 
   Widget _buildEmptyState(BuildContext context) {
+    final authState = context.read<AuthBloc>().state;
+    final isSuperAdmin = authState is AuthAuthenticated &&
+        authState.effectiveRole == UserRole.superAdmin;
+
     return Center(
       child: Padding(
         padding: const EdgeInsets.all(24),
@@ -201,22 +216,26 @@ class _OrgTypesViewState extends State<_OrgTypesView> {
             ),
             const SizedBox(height: 6),
             Text(
-              'Créez votre premier type d\'organisation',
+              isSuperAdmin
+                  ? 'Créez votre premier type d\'organisation'
+                  : 'Aucun type d\'organisation disponible',
               style: TextStyle(fontSize: 12, color: Colors.grey[500]),
               textAlign: TextAlign.center,
             ),
-            const SizedBox(height: 16),
+            if (isSuperAdmin) ...[
-            ElevatedButton.icon(
+              const SizedBox(height: 16),
-              onPressed: () => _showTypeForm(context, null),
+              ElevatedButton.icon(
-              icon: const Icon(Icons.add, size: 16),
+                onPressed: () => _showTypeForm(context, null),
-              label: const Text('Créer un type'),
+                icon: const Icon(Icons.add, size: 16),
-              style: ElevatedButton.styleFrom(
+                label: const Text('Créer un type'),
-                backgroundColor: AppColors.primaryGreen,
+                style: ElevatedButton.styleFrom(
-                foregroundColor: Colors.white,
+                  backgroundColor: AppColors.primaryGreen,
-                padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
+                  foregroundColor: Colors.white,
-                shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(8)),
+                  padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
+                  shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(8)),
+                ),
               ),
-            ),
+            ],
           ],
         ),
       ),

lib/features/organizations/presentation/pages/organization_detail_page.dart

@@ -51,7 +51,14 @@ class _OrganizationDetailPageState extends State<OrganizationDetailPage> {
         title: const Text('Détail Organisation'),
         elevation: 0,
         actions: [
-          IconButton(onPressed: _showEditPage, icon: const Icon(Icons.edit), tooltip: 'Modifier'),
+          Builder(builder: (ctx) {
+            final authState = ctx.read<AuthBloc>().state;
+            final canEdit = authState is AuthAuthenticated &&
+                (authState.effectiveRole == UserRole.superAdmin ||
+                    authState.effectiveRole == UserRole.orgAdmin);
+            if (!canEdit) return const SizedBox.shrink();
+            return IconButton(onPressed: _showEditPage, icon: const Icon(Icons.edit), tooltip: 'Modifier');
+          }),
           Builder(builder: (ctx) {
             final authState = ctx.read<AuthBloc>().state;
             final isSuperAdmin = authState is AuthAuthenticated &&
@@ -314,6 +321,16 @@ class _OrganizationDetailPageState extends State<OrganizationDetailPage> {
   // ── Actions ─────────────────────────────────────────────────────────────────
 
   Widget _buildActionsCard(OrganizationModel org) {
+    final authState = context.read<AuthBloc>().state;
+    final isSuperAdmin = authState is AuthAuthenticated &&
+        authState.effectiveRole == UserRole.superAdmin;
+    final canEdit = authState is AuthAuthenticated &&
+        (authState.effectiveRole == UserRole.superAdmin ||
+            authState.effectiveRole == UserRole.orgAdmin);
+
+    // Aucune action autorisée → ne pas afficher la section
+    if (!canEdit) return const SizedBox.shrink();
+
     return _buildCard('Actions', Icons.bolt, [
       Row(children: [
         Expanded(child: ElevatedButton.icon(
@@ -322,13 +339,15 @@ class _OrganizationDetailPageState extends State<OrganizationDetailPage> {
           label: const Text('Modifier'),
           style: ElevatedButton.styleFrom(backgroundColor: AppColors.primaryGreen, foregroundColor: Colors.white),
         )),
-        const SizedBox(width: 12),
+        if (isSuperAdmin) ...[
-        Expanded(child: OutlinedButton.icon(
+          const SizedBox(width: 12),
-          onPressed: () => _showDeleteConfirmation(org),
+          Expanded(child: OutlinedButton.icon(
-          icon: const Icon(Icons.delete),
+            onPressed: () => _showDeleteConfirmation(org),
-          label: const Text('Supprimer'),
+            icon: const Icon(Icons.delete),
-          style: OutlinedButton.styleFrom(foregroundColor: Colors.red, side: const BorderSide(color: Colors.red)),
+            label: const Text('Supprimer'),
-        )),
+            style: OutlinedButton.styleFrom(foregroundColor: Colors.red, side: const BorderSide(color: Colors.red)),
+          )),
+        ],
       ]),
     ]);
   }