fix : correctifs de sécurité et robustesse post-review

- MeProvider : guard null user avec AccessDeniedHttpException
- MaintenanceToggleProcessor : vérification des opérations filesystem
- User : restreindre Get/GetCollection aux ROLE_ADMIN
- useAppVersion : corriger le path relatif '/version'

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/State/MaintenanceToggleProcessor.php

@@ -44,13 +44,17 @@ final readonly class MaintenanceToggleProcessor implements ProcessorInterface
         if ($data->maintenance) {
             $directory = dirname($maintenancePath);
 
-            if (!is_dir($directory)) {
-                mkdir($directory, 0755, true);
+            if (!is_dir($directory) && !mkdir($directory, 0755, true)) {
+                throw new \RuntimeException(sprintf('Cannot create directory "%s".', $directory));
             }
 
-            touch($maintenancePath);
+            if (!touch($maintenancePath)) {
+                throw new \RuntimeException(sprintf('Cannot create maintenance file at "%s".', $maintenancePath));
+            }
         } elseif (file_exists($maintenancePath)) {
-            unlink($maintenancePath);
+            if (!unlink($maintenancePath)) {
+                throw new \RuntimeException(sprintf('Cannot remove maintenance file at "%s".', $maintenancePath));
+            }
         }
 
         $dto              = new ManagedApplication();