fix(audit): moderniser les accès ORM

app/discord_bot.py

@@ -683,9 +683,10 @@ class TeamTryoutsBot(commands.Bot):
             reference_id: ID of the MatchParticipant or TryoutRegistration record.
         """
         # Look up the DB user to get their Discord user ID
+        from app.extensions import db
         from app.models import User as DBUser
 
-        db_user = DBUser.query.get(user_id)
+        db_user = db.session.get(DBUser, user_id)
         if not db_user:
             logger.warning(f"DB user {user_id} not found for schedule notification")
             return None
@@ -754,7 +755,7 @@ class TeamTryoutsBot(commands.Bot):
         from app.models import OneOnOneRequest
 
         try:
-            request = OneOnOneRequest.query.get(request_id)
+            request = db.session.get(OneOnOneRequest, request_id)
             if not request:
                 # The row is gone; no reaction on this message can ever mean
                 # anything again. Keeping the mapping is what PENDING_MAX_AGE_DAYS
@@ -825,7 +826,7 @@ class TeamTryoutsBot(commands.Bot):
         from app.models import OneOnOneRequest
 
         try:
-            request = OneOnOneRequest.query.get(request_id)
+            request = db.session.get(OneOnOneRequest, request_id)
             if not request:
                 logger.info(
                     'One on One request %s no longer exists; its pending message was dropped.',
@@ -918,12 +919,13 @@ class TeamTryoutsBot(commands.Bot):
         Returns:
             tuple: (row, player_id) — either may be None.
         """
+        from app.extensions import db
         from app.models import MatchParticipant, TryoutRegistration
 
         if event_type == 'match':
-            row = MatchParticipant.query.get(reference_id)
+            row = db.session.get(MatchParticipant, reference_id)
         elif event_type == 'tryout':
-            row = TryoutRegistration.query.get(reference_id)
+            row = db.session.get(TryoutRegistration, reference_id)
         else:
             row = None
         return row, getattr(row, 'player_id', None)
@@ -937,11 +939,12 @@ class TeamTryoutsBot(commands.Bot):
         attendance handlers did not (OPS-009) — same message shape, same
         threat, one of them checked. The asymmetry was the bug.
         """
+        from app.extensions import db
         from app.models import User
 
         if not player_id:
             return False
-        owner = User.query.get(player_id)
+        owner = db.session.get(User, player_id)
         return bool(owner and owner.discord_user_id == str(reacting_user.id))
 
     async def handle_attendance_confirm(self, player, message_id, reference_id, channel):