refactor(deploy): use lecoffreio for nested secrets symlinks (not notary)

- deploy-conf-handling: symlink sites lecoffreio|enso|genealogie
- pousse: build message lists lecoffreio
- kogus docs: align mandatory secrets wording

deploy/lib/deploy-conf-handling.sh

@@ -30,8 +30,8 @@ ia_dev_deploy_secrets_export_from_conf() {
 
 # ia_dev_deploy_ensure_nested_secrets_symlinks <secrets_parent> <env>
 # LeCoffre connect-db-paths expects `.secrets/<site>/<env>/` under secrets_parent. ia_dev conf often has a flat `<env>/` tree only.
-# For each site in notary, enso, genealogie: if `<secrets_parent>/<site>/<env>` is missing and `<secrets_parent>/<env>` is a directory,
-# create `<site>/<env>` as a symlink to `../<env>` (same convention as a manual `ln -sfn ../pprod notary/pprod`).
+# For each site in lecoffreio, enso, genealogie: if `<secrets_parent>/<site>/<env>` is missing and `<secrets_parent>/<env>` is a directory,
+# create `<site>/<env>` as a symlink to `../<env>` (same convention as a manual `ln -sfn ../pprod lecoffreio/pprod`).
 # Skips a site when a real (non-symlink) directory already exists at the nested path.
 ia_dev_deploy_ensure_nested_secrets_symlinks() {
 	local secrets_parent="${1:?}"
@@ -47,7 +47,7 @@ ia_dev_deploy_ensure_nested_secrets_symlinks() {
 		return 0
 	fi
 	local site nested
-	for site in notary enso genealogie; do
+	for site in lecoffreio enso genealogie; do
 		nested="${secrets_parent}/${site}/${env_name}"
 		if [[ -d "$nested" && ! -L "$nested" ]]; then
 			continue

deploy/pousse.sh

@@ -148,7 +148,7 @@ if [[ ${#build_dirs[@]} -gt 0 ]]; then
 		fi
 		build_basename="$(basename "$abs_dir")"
 		if [[ -z "${NEXT_PUBLIC_SITE_CODE:-}" && ( "$build_basename" == "front-common" || "$build_basename" == "lecoffre-front-main" ) ]]; then
-			echo "[pousse] Building ${dir} (npm run build:all-sites: notary, enso, genealogie)..."
+			echo "[pousse] Building ${dir} (npm run build:all-sites: lecoffreio, enso, genealogie)..."
 			(cd "$abs_dir" && npm run build:all-sites) || {
 				echo "[pousse][ERROR] build:all-sites failed in ${dir}" >&2
 				exit 1

projects/kogus/docs/README.md

@@ -22,7 +22,7 @@ Ces fichiers **ne sont pas** dans **`projects/kogus/docs/`** (ni dans le wiki) :
 | Fichier (nom relatif, voir `<env>`) | Rôle |
 |-------------------------------------|--------|
 | **`role-permissions-matrix-<env>.json`** | Injection / export-import de la **matrice des droits** (`role_permissions_matrix`) — API **back-admin**, voir `docs/features/secrets-devai-kogus-sites-and-imports.md`. |
-| **`office-deed-catalog-<env>.json`** | **Catalogue actes** / types de documents par bureau — **absent tant que non exporté** via **back-admin** `POST /api/office-deed-catalog/export-to-secrets`. Chemin sur le clone LeCoffre : **`.secrets/<site>/<env>/office-deed-catalog-<env>.json`** (ex. `.secrets/lecoffreio/test/office-deed-catalog-test.json`). **Pas** sous un dossier disque nommé **`notary`** : le code mappe **`notary` → `lecoffreio`**. Vérification : **GET** `/api/site-config/file-status?env=&site=`. |
+| **`office-deed-catalog-<env>.json`** | **Catalogue actes** — obligatoire pour **`deploy-site.sh`** (manifeste `site_env_required`). Export depuis la base : **back-admin** `POST /api/office-deed-catalog/export-to-secrets` ou lot **`POST /api/site-mandatory-artifacts/export-to-secrets`**. Chemin : **`.secrets/<site>/<env>/office-deed-catalog-<env>.json`** (ex. `.secrets/lecoffreio/test/office-deed-catalog-test.json`). Dossier disque **`lecoffreio`** (plus de segment **`notary`** côté **ia_dev** pour les symlinks secrets : voir **`ia_dev/deploy/lib/deploy-conf-handling.sh`**). Vérification : **GET** `/api/site-config/file-status?env=&site=`. |
 | **`site-config-<env>.json`** | **Configuration de la ligne** `sites` (intégrations, hôtes, drapeaux) — export/import **back-admin**. |
 | **`seed-site-texts-<env>.ts`** | **Textes i18n** publiés via `site_texts` ; **y compris les libellés et listes liés aux tiers** (clés `thirdParty.*`, `forms.thirdParty.*`, etc., selon `docs/Deployment.md` / seeds LeCoffre). |