feat(post): add Publish toggle for blog posts (no schema change)

Replaces the previous 'Visibility enum' approach (commit 33ecfa7e,
reverted in 42625f5d) with the existing BlogSpotPublication
mechanism. Paul pointed out that the system already had a
publication table and a Publish field on BlogPostEditViewModel;
we just didn't expose it through the API.

The toggle is its own action on the API surface — a dedicated
endpoint rather than a field on the existing BlogPost wire
DTO. This keeps the BlogPostDto contract unchanged and avoids
shoe-horning 'Publish' into the entity model alongside
Title/Article (where the existing BlogSpotService.Modify
already takes two overloads and a third felt like drift).

Server (Yavsc.Blogs / Yavsc.Server)
- PUT /api/BlogApi/{id}/publish  body { publish: bool }
  Returns 204 on success, 404 when the post doesn't exist,
  Challenge() (401) when the caller is not the author
  (EditPermission gate). Idempotent: PUT because the
  resulting state matches the body, not the request.
- BlogSpotService.SetPublishAsync(user, postId, publish)
  factored out of the existing
  Modify(BlogPostEditViewModel) inline toggle, so the new
  endpoint reuses the same BlogSpotPublication row logic
  (add row if missing on publish=true, remove row if
  present on publish=false).
- BlogPost.IsPublished (NotMapped) is now hydrated by the
  service after each Index/Details fetch — a single bulk
  lookup, not N+1 — and surfaces through the wire JSON
  so PostIt can show the current state without a follow-up
  request.
- ApplicationUser nav properties (Posts, Book,
  DeviceDeclaration, Connections, Circles, BlackList,
  Rooms, RoomAccess, Membership, BlogComments) now carry
  BOTH [JsonIgnore] (Newtonsoft) and
  [System.Text.Json.Serialization.JsonIgnore] so the
  Yavsc.Blogs test fixture (System.Text.Json) stops
  exploding on object cycles when serialising
  BlogPost.Author.Posts.Author.Posts. Production
  (Yavsc.Org, NewtonsoftJson) was already safe via the
  Newtonsoft-only attribute; this commit just makes the
  Yavsc.Blogs side consistent.

Client (Yavsc.Api.Client)
- BlogApiClient.SetPublishAsync(id, publish) → PUT to the
  new endpoint.

DTO wire (Yavsc.Abstract.Blogspot.BlogPost)
- BlogPostDto.IsPublished added. Same shape as the entity
  field; serialised as a plain bool in JSON.

UI (PostIt)
- MainPageViewModel.DraftIsPublished (ObservableProperty)
  mirrors the existing DraftTitle/DraftArticle pattern;
  hydrated from SelectedPost.IsPublished on selection
  change. TogglePublish command pushes the new state to
  SetPublishAsync and updates both the buffer and the
  selected post locally so the UI reflects the change
  without a full Refresh.
- MainPage.axaml: a CheckBox 'Publié' in the toolbar,
  bound to DraftIsPublished TwoWay and wired to
  TogglePublishCommand. The toggle is its own action
  (not part of Save), matching the wire contract.

Tests (Yavsc.Blogs.Tests)
- PublishEndpointTests (4 [Fact]):
    * PUT publish=true returns 204 and IsPublished is true
      in the next GET
    * PUT publish=false clears IsPublished
    * PUT on an unknown post returns 404
    * PUT by a non-author does not return 204 (Challenge)
- BlogsWebServerFixture now wires
  app.UseDeveloperExceptionPage() so 500s in tests
  surface a real stack trace instead of an empty
  InternalServerError body — much easier to diagnose
  future regressions.

Test totals: 24/24 Yavsc.Blogs.Tests (was 20, +4
PublishEndpoint), 51/51 PostIt.Tests (no change), 44/44
Yavsc.Org.Tests (no change).

Out of scope (tracked in MEMORY.md, 2026-08-18):
- i18n: only the new 'Publié' label is localised; the
  rest of MainPage.axaml is still hard-coded French.
- BlogPostEditViewModel.Publish ↔ IsPublished reconciliation
  in the admin web Yavsc (the Org UI already edits Publish
  inline; no work needed there).

src/PostIt/PostIt/ViewModels/MainPageViewModel.cs

@@ -35,6 +35,18 @@ public partial class MainPageViewModel : ViewModelBase
     [ObservableProperty]
     public partial string DraftArticle { get; set; }
 
+    /// <summary>Editor buffer for the post's publication state.
+    /// Reflects the server-side <c>IsPublished</c> flag (the
+    /// existence of a row in <c>BlogSpotPublication</c>) and
+    /// is pushed to the server via
+    /// <see cref="BlogApiClient.SetPublishAsync"/> on explicit
+    /// toggle — it is NOT included in the regular Save
+    /// payload, mirroring the wire contract where
+    /// <c>BlogPostDto</c> doesn't carry <c>Publish</c> as a
+    /// mutable field. Toggling is its own action.</summary>
+    [ObservableProperty]
+    public partial bool DraftIsPublished { get; set; }
+
     [ObservableProperty]
     public partial ViewModelBase? CurrentViewModel { get; set; }
 
@@ -102,6 +114,7 @@ public partial class MainPageViewModel : ViewModelBase
         WindowTitle = "PostIt";
         DraftTitle = string.Empty;
         DraftArticle = string.Empty;
+        DraftIsPublished = false;
         CurrentViewModel = this;
     }
 
@@ -131,6 +144,9 @@ public partial class MainPageViewModel : ViewModelBase
         // doesn't show stale content.
         DraftTitle = value?.Title ?? string.Empty;
         DraftArticle = value?.Article ?? string.Empty;
+        // Mirror publication state too. Defaults to false on
+        // null selection so a fresh draft starts unpublished.
+        DraftIsPublished = value?.IsPublished ?? false;
         UpdateCommandStates();
     }
 
@@ -241,6 +257,46 @@ public partial class MainPageViewModel : ViewModelBase
         });
     }
 
+    /// <summary>
+    /// Toggle the publication state of the currently selected
+    /// post. Pushes the new state to
+    /// <c>PUT /api/BlogApi/{id}/publish</c> and reflects it
+    /// locally in <see cref="DraftIsPublished"/> + the
+    /// selected post so the UI updates without a full
+    /// refresh.
+    ///
+    /// <para>The toggle is its own action — separate from Save
+    /// — because <c>Publish</c> is not part of the
+    /// <c>BlogPostDto</c> payload. Bundling it into Save
+    /// would require a wire-shape change and a second server
+    /// overload; the dedicated endpoint keeps the wire
+    /// contract clean.</para>
+    /// </summary>
+    [RelayCommand]
+    internal async Task TogglePublish()
+    {
+        if (SelectedPost is null || SelectedPost.Id == 0)
+        {
+            StatusMessage = "Sélectionnez un billet existant pour changer sa publication.";
+            return;
+        }
+
+        await ExecuteAsync(async () =>
+        {
+            var desired = !DraftIsPublished;
+            await BlogClient.SetPublishAsync(SelectedPost.Id, desired);
+            DraftIsPublished = desired;
+            // Mirror into the selected post so a subsequent
+            // RefreshPostsAsync() doesn't blow away the
+            // locally flipped state until the round-trip
+            // re-hydrates it.
+            SelectedPost.IsPublished = desired;
+            StatusMessage = desired
+                ? $"Billet {SelectedPost.Id} publié."
+                : $"Billet {SelectedPost.Id} remis en brouillon.";
+        });
+    }
+
     [RelayCommand]
     internal void OpenSettings()
     {

src/PostIt/PostIt/Views/MainPage.axaml

@@ -35,6 +35,18 @@
                 <Button Command="{Binding Delete}" Content="Delete" />
                 <Button Command="{Binding ManageAcl}" Content="ACL" />
                 <Button Command="{Binding OpenCircles}" Content="Mes cercles" />
+                <!-- Publication toggle: a CheckBox wired to
+                     DraftIsPublished. Clicking it fires
+                     TogglePublishCommand, which pushes the
+                     new state to /api/blog/{id}/publish.
+                     The CheckBox is the canonical
+                     AvaloniaXaml 'toggle' surface; binding
+                     IsChecked TwoWay keeps the visual state
+                     and the buffer in sync. -->
+                <CheckBox Content="Publié"
+                          IsChecked="{Binding DraftIsPublished, Mode=TwoWay}"
+                          Command="{Binding TogglePublishCommand}"
+                          VerticalAlignment="Center"/>
                 <!--
                     DEV ONLY: temporary shortcut to open the signature
                     capture page. Production entry point is a SignalR