Statistics page redesign (#60)

* feat: Add modal to display watched movies with details

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor movie modal: remove search, improve category display

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor movie category display to use details element

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor movie playback and add clickability to stats

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor: Improve movie linking and player logic

Co-authored-by: mathieumoran1 <[email protected]>

* Prevent caching of sensitive and dynamic API data

Co-authored-by: mathieumoran1 <[email protected]>

* feat: Prevent caching of sensitive admin data

Co-authored-by: mathieumoran1 <[email protected]>

* feat: Add no-cache headers to API requests

Co-authored-by: mathieumoran1 <[email protected]>

* Remove unused movie sorting functionality

The movie sorting dropdown and its associated logic were removed as they are no longer needed.

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor admin settings to use tabs instead of accordion

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor: Adjust button layout for active year selection

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor active year selection UI

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor: Improve admin settings layout for better responsiveness

Co-authored-by: mathieumoran1 <[email protected]>

* Remove redundant completion explanation from user-stat.html

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor user stats page to display year in ranking tab badge

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor: Rename 'Finisseur(s)' column to 'Nombre'

Co-authored-by: mathieumoran1 <[email protected]>

* Refactor: Remove redundant completer count column

Co-authored-by: mathieumoran1 <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>

routes/adminDb.js

@@ -152,6 +152,9 @@ async function listBackupFiles() {
 router.get("/db/backups", async (req, res) => {
   try {
     requireAdmin(req);
+    // Admin + auth-scoped data: never allow caching.
+    res.setHeader("Cache-Control", "private, no-store, must-revalidate");
+    res.setHeader("Vary", "Authorization");
     const backups = await listBackupFiles();
     return res.status(200).json({ backups });
   } catch (err) {
@@ -227,6 +230,8 @@ router.post("/db/backup", async (req, res) => {
 router.get("/db/backups/:name", async (req, res) => {
   try {
     requireAdmin(req);
+    res.setHeader("Cache-Control", "private, no-store, must-revalidate");
+    res.setHeader("Vary", "Authorization");
     const safe = safeBackupFileName(req.params?.name);
     if (!safe) return res.status(400).json({ message: "Invalid backup name" });