fix: auth redirect bug + cookie Secure + migration multi-statements

- fetchMe: handle ALL non-ok responses (not just 401) by calling tryRefresh
  → avoids user=null when backend returns 404/500/any error
- DOMContentLoaded guard: check isAuthenticated instead of localStorage token
  → immediate redirect if fetchMe+tryRefresh both fail, no more flash of dashboard
- Cookie Secure flag: check X-Forwarded-Proto header for Traefik/proxy setup
  → cookie gets Secure=true when behind TLS-terminating reverse proxy
- db.go migrate(): split SQL by ; and exec each statement separately
  → fixes SQLite multi-statement limitation (only first stmt was executed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/db/db.go

@@ -126,9 +126,17 @@ func (db *DB) migrate() error {
 			return fmt.Errorf("transaction migration %s : %w", m.name, err)
 		}
 
-		if _, err := tx.Exec(string(content)); err != nil {
-			tx.Rollback()
-			return fmt.Errorf("exécution migration %s : %w", m.name, err)
+		// Splitter par ";" pour exécuter chaque statement séparément
+		// (SQLite / database/sql n'exécute qu'un seul statement par Exec)
+		for _, stmt := range strings.Split(string(content), ";") {
+			stmt = strings.TrimSpace(stmt)
+			if stmt == "" {
+				continue
+			}
+			if _, err := tx.Exec(stmt); err != nil {
+				tx.Rollback()
+				return fmt.Errorf("exécution migration %s : %w", m.name, err)
+			}
 		}
 
 		// Mettre à jour la version (la migration 001 l'insère elle-même, pas besoin de le refaire)