Fix crash bugs and secure webhook/TMDB key

- Add missing MovieController::remove/markWatched (routes called undefined methods)
- Fix linkPartner(): commit() was unreachable after an early return, so partner
  linking was never actually persisted in the DB
- Add missing removeMovie/markWatched functions in app.js
- webhook.php now verifies a GitHub HMAC signature before running git reset --hard
- Move TMDB API key server-side via a new TmdbController proxy (tmdb-search/tmdb-details)
  instead of exposing it in client-side JS

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

index.php

@@ -22,6 +22,7 @@ require_once __DIR__ . '/config/database.php';
 require_once __DIR__ . '/controllers/UserController.php';
 require_once __DIR__ . '/utils/JWT.php';
 require_once __DIR__ . '/controllers/MovieController.php';
+require_once __DIR__ . '/controllers/TmdbController.php';
 
 // Initialisation de la BDD et du contrôleur
 $database = new Database();
@@ -30,6 +31,7 @@ $jwt_secret = $database->jwt_secret;
 
 $userController = new UserController($db, $jwt_secret);
 $movieController = new MovieController($db);
+$tmdbController = new TmdbController($database->tmdb_api_key);
 
 // On récupère la route épurée (ex: si on tape /register, $route vaudra 'register')
 $request_uri = explode('?', $_SERVER['REQUEST_URI'], 2)[0];
@@ -133,6 +135,20 @@ switch ($route) {
         } else { http_response_code(405); }
         break;
 
+    case 'tmdb-search':
+        if ($method === 'POST') {
+            getAuthenticatedUserId($jwt_secret); // On exige juste un token valide, pas d'usage anonyme du quota TMDB
+            $tmdbController->search($data);
+        } else { http_response_code(405); }
+        break;
+
+    case 'tmdb-details':
+        if ($method === 'POST') {
+            getAuthenticatedUserId($jwt_secret);
+            $tmdbController->details($data);
+        } else { http_response_code(405); }
+        break;
+
     default:
         http_response_code(404);
         echo json_encode(["error" => "Route /" . $route . " non trouvée"]);