refactor(authz): un seul point de verite pour les autorisations d equipe

ARCH-002. La question "a quelles equipes ce coach est-il rattache ?" etait
posee a huit endroits, de cinq facons differentes, et trois d entre elles
donnaient une mauvaise reponse en production.

Le motif fautif, present tel quel dans six routes :

    OrgTeam.query.filter_by(coach_id=user.id).first()

Il repond au plus une equipe, et seulement par la colonne heritee. Deux
pannes en decoulaient, silencieuses -- les pages s affichaient, vides :

  - un coach rattache uniquement par la relation many-to-many n avait
    aucune equipe, donc aucun joueur, aucun contrat, aucune note d equipe,
    aucun match a venir sur son tableau de bord ;
  - un coach de deux equipes n en voyait qu une. Le formulaire de contrat
    lui proposait la moitie de son effectif, alors que la route POST
    acceptait l autre moitie.

app/permissions.py devient le module ou la question se pose une fois :
coach_org_teams, manager_org_teams, attached_org_teams, visible_org_teams,
can_manage_org_team, org_team_player_ids, coach_player_ids,
can_manage_player_contract, coach_tryouts, coach_manages_tryout. Toutes
lisent les deux rattachements et toutes les equipes.

Le meme ecart existait dans le modele : Coach.get_visible_tryouts ne lisait
que la relation m2m -- calendrier vide pour un coach rattache par la
colonne -- et can_manage_this_tryout ignorait la colonne pour l equipe
cible. Les deux delegent desormais.

Corrections de portee, au passage
  - one_on_one lisait org_team.coach_id : un joueur dont l equipe declare
    ses coachs par la relation etait informe qu il n avait pas de coach, et
    le formulaire de demande restait ferme. Passe par get_coaches(), qui
    retombe deja sur la colonne heritee.
  - notes_dashboard conditionnait les notes personnelles du coach a
    l existence d une equipe : un coach sans equipe ne voyait pas ses
    propres notes.
  - can_manage_team_match reformulait can_manage_this_org_team ; la
    reformulation avait derive. Elle appelle maintenant la regle.

Limite assumee : le panneau de notes d equipe reste ecrit pour une seule
equipe et affiche donc la premiere. La resolution est corrigee, la mise en
page multi-equipes ne l est pas -- c est un choix produit, pas un bug.

14 tests ajoutes. Cinq echouent sur le code d avant, verifie en remettant
les routes et le modele a leur etat precedent.

ARCH-001 fera disparaitre la colonne heritee ; cela demande une migration
de donnees, donc Alembic. D ici la, ce module est ce qui rend la
duplication inoffensive.

Co-Authored-By: Claude Opus 5 <[email protected]>

app/routes/team_matches.py

@@ -11,6 +11,7 @@ from app.models import (
     Admin, Manager, Coach, Player,
     OrgTeam, TeamMatch, TeamMatchParticipant, TeamPlayer,
 )
+from app.permissions import can_manage_org_team, coach_org_teams, visible_org_teams
 from datetime import datetime, timedelta
 from app.discord_bot import send_schedule_notification
 
@@ -18,17 +19,12 @@ team_matches_bp = Blueprint('team_matches', __name__, url_prefix='/team-matches'
 
 
 def can_manage_team_match(team):
-    """Check if current user can manage matches for this team."""
-    if isinstance(current_user, Admin):
-        return True
-    if isinstance(current_user, Manager):
-        return True
-    if isinstance(current_user, Coach):
-        if team.coaches.filter_by(id=current_user.id).first():
-            return True
-        if team.coach_id == current_user.id:
-            return True
-    return False
+    """Whether the current user can manage matches for this team.
+
+    Same rule as administering the team itself, so it is the same call.
+    This function used to restate it, and the restatement drifted.
+    """
+    return can_manage_org_team(current_user, team)
 
 
 @team_matches_bp.route('')
@@ -37,29 +33,17 @@ def list_matches():
     """List all team matches visible to the current user."""
     filter_team_id = request.args.get('team_id', type=int)
 
-    if isinstance(current_user, Admin):
+    # A manager administers every team, so the listing shows them all;
+    # visible_org_teams() only reports the teams they are attached to.
+    if isinstance(current_user, (Admin, Manager)):
         teams = OrgTeam.query.order_by(OrgTeam.name).all()
         matches_query = TeamMatch.query
-    elif isinstance(current_user, Manager):
-        teams = OrgTeam.query.order_by(OrgTeam.name).all()
-        matches_query = TeamMatch.query
-    elif isinstance(current_user, Coach):
-        teams = OrgTeam.query.filter(
-            db.or_(
-                OrgTeam.coaches.any(id=current_user.id),
-                OrgTeam.coach_id == current_user.id,
-            )
-        ).order_by(OrgTeam.name).all()
+    elif isinstance(current_user, (Coach, Player)):
+        teams = visible_org_teams(current_user)
         team_ids = [t.id for t in teams]
         matches_query = TeamMatch.query.filter(
             TeamMatch.org_team_id.in_(team_ids),
         ) if team_ids else TeamMatch.query.filter(TeamMatch.id == -1)
-    elif isinstance(current_user, Player):
-        player_team_ids = [tp.org_team_id for tp in current_user.team_placements]
-        teams = OrgTeam.query.filter(OrgTeam.id.in_(player_team_ids)).all() if player_team_ids else []
-        matches_query = TeamMatch.query.filter(
-            TeamMatch.org_team_id.in_(player_team_ids),
-        ) if player_team_ids else TeamMatch.query.filter(TeamMatch.id == -1)
     else:
         teams = []
         matches_query = TeamMatch.query.filter(TeamMatch.id == -1)
@@ -274,12 +258,7 @@ def api_manageable_teams():
     if isinstance(current_user, (Admin, Manager)):
         teams = OrgTeam.query.order_by(OrgTeam.name).all()
     elif isinstance(current_user, Coach):
-        teams = OrgTeam.query.filter(
-            db.or_(
-                OrgTeam.coaches.any(id=current_user.id),
-                OrgTeam.coach_id == current_user.id,
-            )
-        ).order_by(OrgTeam.name).all()
+        teams = coach_org_teams(current_user)
     else:
         return jsonify([])