Fix crash bugs and secure webhook/TMDB key

- Add missing MovieController::remove/markWatched (routes called undefined methods)
- Fix linkPartner(): commit() was unreachable after an early return, so partner
  linking was never actually persisted in the DB
- Add missing removeMovie/markWatched functions in app.js
- webhook.php now verifies a GitHub HMAC signature before running git reset --hard
- Move TMDB API key server-side via a new TmdbController proxy (tmdb-search/tmdb-details)
  instead of exposing it in client-side JS

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/database.example.php

@@ -7,6 +7,8 @@ class Database {
     private $username = "VOTRE_USER"; // N'utilisez par "root"
     private $password = "VOTRE_MDP";
     public $jwt_secret = "VOTRE_CLE_SECRETE_POUR_JWT"; // Une passphrase est préférable
+    public $tmdb_api_key = "VOTRE_CLE_API_TMDB_V3";
+    public $webhook_secret = "VOTRE_SECRET_WEBHOOK"; // Doit matcher le "Secret" configuré côté GitHub, ex: openssl rand -hex 32
     public $conn;
 
     // Récupérer la connexion