commit c5de8d0c71cf7ee548457ea9ae2134c11c291675
Author: sorcier <sorcier@sorcier-research.com>
Date:   Mon Nov 2 02:24:47 2026 +0100

    Initial commit - NexusPBX IP Telephony Platform

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..abbd33b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,38 @@
+# NexusPBX - Git Ignore Rules
+
+# Bases de données SQLite locales (contient mots de passe, clés, tokens)
+/storage/*.sqlite
+/storage/*.sqlite-shm
+/storage/*.sqlite-wal
+
+# Données dynamiques et métriques
+/storage/metrics_prev.json
+/storage/*.json
+
+# Sauvegardes
+/storage/backups/*
+!/storage/backups/.gitkeep
+/storage/system_backups/*
+!/storage/system_backups/.gitkeep
+
+# Sons et enregistrements personnalisés téléversés
+/storage/sounds/*
+!/storage/sounds/.gitkeep
+
+# Avatars et médias téléversés
+/public/avatars/*
+!/public/avatars/.gitkeep
+
+# Clés et certificats SSL privés
+*.key
+*.pem
+*.crt
+
+# Fichiers temporaires et caches système / éditeurs
+.DS_Store
+Thumbs.db
+*.swp
+*.tmp
+.idea/
+.vscode/
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..7069df7
--- /dev/null
+++ b/README.md
@@ -0,0 +1,99 @@
+# NexusPBX - Système de Téléphonie IP Moderne & Souverain
+
+**NexusPBX** est une plateforme de communication d'entreprise tout-en-un, moderne, ultra-légère et hautement sécurisée, construite au-dessus d'**Asterisk (PJSIP)**, **Nginx**, **PHP 8.4** et **SQLite 3**.
+
+---
+
+## 🚀 Fonctionnalités Clés
+
+### 1. Gestion Avancée des Postes (PJSIP)
+- **Multi-profils de transport** :
+  - **UDP Interne** (Réseau local d'entreprise, faible latence).
+  - **TLS + SRTP Chiffré** (Postes distants et nomades avec chiffrement de la signalisation et de la voix AES-128).
+  - **WebRTC WSS** (Téléphonie navigateur temps réel).
+- **Détection dynamique en temps réel** : Analyse des contacts PJSIP en direct (transport actif négocié, User-Agent du téléphone, latence RTT, statut de joignabilité).
+
+### 2. Annuaire d'Entreprise & XML Téléphones IP (Yealink)
+- Synchronisation automatique en temps réel avec les extensions PBX (numéro, nom, email, groupe).
+- Prise en charge des contacts externes (fournisseurs, clients, partenaires).
+- Gestion des avatars et photos de contacts.
+- **Endpoint XML Yealink officiel** :
+  - `http://<PBX_IP>:8080/phonebook.php?group=<NomDuGroupe>` (ou `?group=all`)
+  - Génération conforme `<YealinkIPPhoneDirectory>` avec `<Name>`, `<Telephone>`, `<Email>`, `<Photo>`, `<Picture>`.
+
+### 3. Trunks SIP & Routage
+- Trunks SIP sortants (Orange Business, OVH Telecom, Free Pro, etc.).
+- Routes sortantes avec sélection de préfixes et restriction par groupes d'extensions (Sites / Agences).
+- Routes entrantes (DID / SDA) avec redirection intelligente vers Postes, Groupes de sonnerie ou SVI.
+
+### 4. Serveur Vocal Interactif (SVI / IVR) & Groupes
+- Menu vocal interactif avec gestion des touches DTMF (0-9, \*, #).
+- Gestion des musiques d'attente (MoH) et téléversement de fichiers audio.
+- Groupes de sonnerie simultanés ou séquentiels.
+
+### 5. Sécurité Renforcée & Pare-feu PBX
+- **Mode Strict Port 80** : Le port 80 standard est hermétiquement verrouillé et exclusivement réservé aux challenges ACME Let's Encrypt Certbot (retour 404 sur tout le reste).
+- **Port d'administration HTTPS dédié** (ex: port 8443) avec certificats SSL Let's Encrypt automatisés.
+- **Fail2ban unifié** : Jails Fail2ban actives pour les attaques SIP (PJSIP brute-force, scan SIPVicious) et attaques Web (recherche d'exploits HTTP).
+
+### 6. Sauvegardes & Restauration
+- Sauvegardes complètes à chaud (Base de données, configurations Asterisk, fichiers sons, règles pare-feu).
+- Stockage local ou export automatique distant via **SSH / SCP / SFTP**.
+- Restauration en un clic.
+
+---
+
+## 📂 Architecture du Projet
+
+```text
+nexus-pbx/
+├── public/                 # Racine Web Nginx
+│   ├── index.php           # Interface Web SPA moderne
+│   ├── api.php             # API RESTful backend
+│   ├── phonebook.php       # Générateur XML Yealink Remote Phonebook
+│   ├── assets/             # JavaScript (app.js), styles Tailwind CSS
+│   └── avatars/            # Photos des contacts de l'annuaire
+├── src/                    # Classes PHP d'orchestration
+│   ├── AmiClient.php       # Client Asterisk Manager Interface (AMI)
+│   ├── Auth.php            # Authentification & sessions
+│   ├── BackupManager.php   # Moteur de sauvegarde locale & distante SSH
+│   ├── CertificateManager.php # Gestionnaire SSL & Certbot
+│   ├── ConfigGenerator.php # Générateur dynamique de conf Asterisk (pjsip, extensions)
+│   ├── Database.php        # Connexion PDO SQLite
+│   ├── FirewallManager.php # Moteur Pare-feu & règles Nginx
+│   ├── PhonebookManager.php # Moteur d'annuaire et export XML
+│   ├── SystemChecker.php   # Diagnostic de santé système
+│   └── SystemMetrics.php   # Monitoring CPU, RAM, Disque, Asterisk
+├── scripts/                # Scripts CLI et daemons système
+│   ├── setup-debian.sh     # Script d'installation automatisé Debian 12 / 13
+│   ├── nexus-firewall      # Script de gestion iptables/nftables
+│   └── nexus_autobackup.php# Cronjob de sauvegarde automatique
+└── storage/                # Données persistantes (exclues du Git)
+    ├── database.sqlite     # Base de données applicative
+    ├── backups/            # Archives de sauvegarde
+    └── sounds/             # Fichiers audio MoH et annonces
+```
+
+---
+
+## ⚙️ Prérequis & Installation
+
+- **Système d'exploitation** : Debian 12 (Bookworm) ou Debian 13 (Trixie).
+- **Paquets requis** : Asterisk 20+, PHP 8.2+, Nginx, SQLite3, Fail2ban, Certbot.
+
+Pour déployer sur une machine fraîche :
+```bash
+sudo bash scripts/setup-debian.sh
+```
+
+---
+
+## 🔒 Confidentialité & Sécurité du Dépôt
+
+Ce dépôt de code source exclut rigoureusement :
+- Les bases de données SQLite contenant les identifiants locaux.
+- Les clés privées et certificats SSL.
+- Les enregistrements vocaux et sauvegardes d'entreprise.
+
+---
+*Développé pour les télécoms d'entreprise souveraines.*
diff --git a/public/api.php b/public/api.php
new file mode 100644
index 0000000..cfb1080
--- /dev/null
+++ b/public/api.php
@@ -0,0 +1,2068 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/Auth.php';
+require_once __DIR__ . '/../src/ConfigGenerator.php';
+require_once __DIR__ . '/../src/AmiClient.php';
+require_once __DIR__ . '/../src/SystemChecker.php';
+require_once __DIR__ . '/../src/SystemMetrics.php';
+require_once __DIR__ . '/../src/CertificateManager.php';
+require_once __DIR__ . '/../src/BackupManager.php';
+require_once __DIR__ . '/../src/FirewallManager.php';
+require_once __DIR__ . '/../src/PhonebookManager.php';
+
+use App\Database;
+use App\Auth;
+use App\ConfigGenerator;
+use App\AmiClient;
+use App\SystemChecker;
+use App\SystemMetrics;
+use App\CertificateManager;
+use App\BackupManager;
+use App\FirewallManager;
+use App\PhonebookManager;
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store, no-cache, must-revalidate');
+
+try {
+    $db = Database::getConnection();
+    Auth::startSession();
+
+    $action  = trim((string)($_GET['action'] ?? ''));
+    $rawBody = file_get_contents('php://input');
+    $payload = $rawBody ? (json_decode($rawBody, true) ?? []) : [];
+    if (empty($payload) && !empty($_POST)) {
+        $payload = $_POST;
+    }
+
+    // Actions publiques (Login / Logout)
+    if ($action === 'login') {
+        $username = trim((string)($payload['username'] ?? ''));
+        $password = (string)($payload['password'] ?? '');
+
+        if (Auth::login($db, $username, $password)) {
+            echo json_encode([
+                'success'  => true,
+                'username' => Auth::getUsername(),
+                'message'  => 'Connexion réussie.',
+            ]);
+        } else {
+            // Journalisation de sécurité pour Fail2ban (jail nexus-web)
+            $clientIp = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
+            if (str_contains($clientIp, ',')) {
+                $clientIp = trim(explode(',', $clientIp)[0]);
+            }
+            $logMsg = date('[Y-m-d H:i:s] ') . "[NEXUS-WEB-AUTH-FAIL]: " . $clientIp . " (username: " . ($username ?: 'vide') . ")\n";
+            @file_put_contents('/var/log/nexus_security.log', $logMsg, FILE_APPEND | LOCK_EX);
+
+            http_response_code(401);
+            echo json_encode([
+                'success' => false,
+                'message' => 'Identifiants incorrects.',
+            ]);
+        }
+        exit;
+    }
+
+    if ($action === 'logout') {
+        Auth::logout();
+        echo json_encode(['success' => true, 'message' => 'Session fermée.']);
+        exit;
+    }
+
+    // Toutes les autres actions requièrent une session authentifiée
+    if (!Auth::isAuthenticated()) {
+        http_response_code(401);
+        echo json_encode([
+            'success'       => false,
+            'unauthenticated' => true,
+            'message'       => 'Session expirée ou non authentifiée.',
+        ]);
+        exit;
+    }
+
+    $generator = new ConfigGenerator($db);
+
+    switch ($action) {
+        case 'get_state':
+            $settings        = $db->query('SELECT * FROM settings WHERE id = 1')->fetch();
+            $extensions      = $db->query('SELECT * FROM extensions ORDER BY CAST(extension AS INTEGER) ASC, extension ASC')->fetchAll();
+            $groups          = $db->query('SELECT * FROM groups ORDER BY CAST(extension AS INTEGER) ASC, extension ASC')->fetchAll();
+            $extensionGroups = $db->query('SELECT * FROM extension_groups ORDER BY id ASC')->fetchAll();
+            $trunks          = $db->query('SELECT * FROM trunks ORDER BY id ASC')->fetchAll();
+            $ivrs            = $db->query('SELECT * FROM ivrs ORDER BY id ASC')->fetchAll();
+            $outboundRoutes  = $db->query('SELECT * FROM outbound_routes ORDER BY priority ASC, id ASC')->fetchAll();
+            $sounds          = $db->query('SELECT * FROM sounds ORDER BY site_category ASC, usage_type ASC, id ASC')->fetchAll();
+            $soundSites      = $db->query('SELECT * FROM sound_sites ORDER BY id ASC')->fetchAll();
+
+            foreach ($groups as &$g) {
+                $g['members'] = json_decode((string)$g['members'], true) ?: [];
+            }
+            unset($g);
+
+            foreach ($extensionGroups as &$eg) {
+                $eg['members'] = json_decode((string)$eg['members'], true) ?: [];
+            }
+            unset($eg);
+
+            foreach ($trunks as &$t) {
+                $t['did_routes'] = ConfigGenerator::normalizeInboundRoutes((string)($t['did_routes_json'] ?? '[]'));
+            }
+            unset($t);
+
+            foreach ($ivrs as &$i) {
+                $i['options'] = json_decode((string)$i['options_json'], true) ?: [];
+            }
+            unset($i);
+
+            foreach ($outboundRoutes as &$or) {
+                $or['trunk_sequence']     = json_decode((string)($or['trunk_sequence_json'] ?? '[]'), true) ?: [];
+                $or['dial_patterns']      = json_decode((string)($or['dial_patterns_json'] ?? '[]'), true) ?: [];
+                $or['allowed_groups']     = json_decode((string)($or['allowed_groups_json'] ?? '[]'), true) ?: [];
+                $or['allowed_extensions'] = json_decode((string)($or['allowed_extensions_json'] ?? '[]'), true) ?: [];
+            }
+            unset($or);
+
+            $settings['local_networks'] = json_decode((string)($settings['local_networks_json'] ?? '[]'), true) ?: [];
+            if (empty($settings['local_networks']) && !empty($settings['local_net'])) {
+                $settings['local_networks'] = [$settings['local_net']];
+            }
+
+            echo json_encode([
+                'success'          => true,
+                'user'             => Auth::getUsername(),
+                'settings'         => $settings,
+                'extensions'       => $extensions,
+                'groups'           => $groups,
+                'extension_groups' => $extensionGroups,
+                'trunks'           => $trunks,
+                'ivrs'             => $ivrs,
+                'outbound_routes'  => $outboundRoutes,
+                'sounds'           => $sounds,
+                'sound_sites'      => $soundSites,
+                'feature_codes'    => $db->query('SELECT * FROM feature_codes ORDER BY category, id')->fetchAll(),
+                'certificates'     => CertificateManager::getAll($db),
+                'active_certificate' => CertificateManager::getDefault($db),
+                'diagnostics'      => SystemChecker::runDiagnostics($db),
+                'backups_count'    => count(BackupManager::listBackups($db)),
+                'phonebook_contacts' => PhonebookManager::getContacts($db),
+                'phonebook_groups' => PhonebookManager::getGroups($db),
+                'metrics'          => SystemMetrics::collect($db),
+                'previews'         => [
+                    'pjsip'      => $generator->generatePjsipConf(),
+                    'extensions' => $generator->generateExtensionsConf(),
+                    'moh'        => $generator->generateMusiconholdConf(),
+                    'rtp'        => $generator->generateRtpConf(),
+                    'voicemail'  => $generator->generateVoicemailConf(),
+                ],
+            ]);
+            break;
+
+        case 'get_metrics':
+            echo json_encode([
+                'success' => true,
+                'metrics' => SystemMetrics::collect($db),
+            ]);
+            break;
+
+        case 'get_security_events':
+            $events = [];
+            $logFile = '/var/log/asterisk/security.log';
+            if (is_readable($logFile)) {
+                $lines = file($logFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
+                foreach (array_reverse($lines) as $line) {
+                    if (!str_contains($line, 'ChallengeResponseFailed') && !str_contains($line, 'InvalidAccountID') && !str_contains($line, 'FailedAuth')) {
+                        continue;
+                    }
+                    preg_match('/\[([^\]]+)\]/', $line, $tm);
+                    preg_match('/SecurityEvent="([^"]+)"/', $line, $em);
+                    preg_match('/Service="([^"]+)"/', $line, $sm);
+                    preg_match('/AccountID="([^"]+)"/', $line, $am);
+                    preg_match('/RemoteAddress="IPV[46]\/[A-Z]+\/([^\/]+)/', $line, $rm);
+                    $events[] = [
+                        'time'    => $tm[1] ?? date('M d H:i:s'),
+                        'event'   => $em[1] ?? 'FailedAuth',
+                        'service' => $sm[1] ?? 'PJSIP',
+                        'account' => $am[1] ?? '-',
+                        'ip'      => $rm[1] ?? '-',
+                    ];
+                    if (count($events) >= 50) break;
+                }
+            }
+            echo json_encode([
+                'success' => true,
+                'events'  => $events,
+            ]);
+            break;
+
+        case 'clear_security_log':
+            $logFile = '/var/log/asterisk/security.log';
+            if (file_exists($logFile)) {
+                @file_put_contents($logFile, '');
+                @chown($logFile, 'asterisk');
+                @chgrp($logFile, 'asterisk');
+                @chmod($logFile, 0664);
+            }
+            $webLog = '/var/log/nexus_security.log';
+            if (file_exists($webLog)) {
+                @file_put_contents($webLog, '');
+                @chown($webLog, 'www-data');
+                @chgrp($webLog, 'asterisk');
+                @chmod($webLog, 0664);
+            }
+            @unlink('/tmp/nexus_fw_status_cache.json');
+            exec('sudo /usr/bin/fail2ban-client reload 2>&1');
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Le journal des événements de sécurité a été vidé avec succès.',
+            ]);
+            break;
+
+        case 'save_extension':
+            $id           = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $extension    = trim((string)($payload['extension'] ?? ''));
+            $name         = trim((string)($payload['name'] ?? ''));
+            $secret       = trim((string)($payload['secret'] ?? ''));
+            $transport    = ($payload['transport'] ?? 'udp') === 'tls' ? 'tls' : 'udp';
+            $encryption   = max(0, min(2, (int)($payload['encryption'] ?? ($transport === 'tls' ? 1 : 0))));
+            $codecs       = preg_replace('/[^a-z0-9,]/', '', strtolower((string)($payload['codecs'] ?? 'alaw,ulaw,opus')));
+            $max_contacts = max(1, min(10, (int)($payload['max_contacts'] ?? 2)));
+            $enabled      = isset($payload['enabled']) ? (int)!empty($payload['enabled']) : 1;
+
+            $voicemail_enabled  = isset($payload['voicemail_enabled']) ? (int)!empty($payload['voicemail_enabled']) : 0;
+            $force_pin_change   = isset($payload['force_pin_change']) ? (int)!empty($payload['force_pin_change']) : 0;
+            $voicemail_pin      = ($force_pin_change === 1) ? '' : preg_replace('/[^\d]/', '', (string)($payload['voicemail_pin'] ?? ''));
+            $voicemail_skip_pin = isset($payload['voicemail_skip_pin']) ? (int)!empty($payload['voicemail_skip_pin']) : 0;
+            $voicemail_email    = trim((string)($payload['voicemail_email'] ?? ''));
+            $voicemail_attach   = isset($payload['voicemail_attach']) ? (int)!empty($payload['voicemail_attach']) : 1;
+            $voicemail_delete   = isset($payload['voicemail_delete']) ? (int)!empty($payload['voicemail_delete']) : 0;
+            $ring_time          = max(5, min(120, (int)($payload['ring_time'] ?? 20)));
+
+            if ($force_pin_change === 1) {
+                $secFile = "/var/spool/asterisk/voicemail/default/{$extension}/secret.conf";
+                if (file_exists($secFile)) {
+                    @unlink($secFile);
+                }
+            }
+
+            if (!preg_match('/^\d{2,6}$/', $extension)) {
+                throw new InvalidArgumentException("Le numéro de poste doit comporter entre 2 et 6 chiffres.");
+            }
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom du poste est obligatoire.");
+            }
+            if (strlen($secret) < 8) {
+                throw new InvalidArgumentException("Le secret SIP doit contenir au moins 8 caractères.");
+            }
+            if ($codecs === '') {
+                $codecs = 'alaw,ulaw';
+            }
+
+            if ($id) {
+                $stmt = $db->prepare('
+                    UPDATE extensions
+                    SET extension = :ext, name = :name, secret = :secret, transport = :transport,
+                        encryption = :encryption, codecs = :codecs, max_contacts = :max_contacts, enabled = :enabled,
+                        voicemail_enabled = :vme, voicemail_pin = :vmp, force_pin_change = :fpc,
+                        voicemail_skip_pin = :vsp, voicemail_email = :vme_mail, voicemail_attach = :vma,
+                        voicemail_delete = :vmd, ring_time = :rt
+                    WHERE id = :id
+                ');
+                $stmt->execute([
+                    ':id'           => $id,
+                    ':ext'          => $extension,
+                    ':name'         => $name,
+                    ':secret'       => $secret,
+                    ':transport'    => $transport,
+                    ':encryption'   => $encryption,
+                    ':codecs'       => $codecs,
+                    ':max_contacts' => $max_contacts,
+                    ':enabled'      => $enabled,
+                    ':vme'          => $voicemail_enabled,
+                    ':vmp'          => $voicemail_pin,
+                    ':fpc'          => $force_pin_change,
+                    ':vsp'          => $voicemail_skip_pin,
+                    ':vme_mail'     => $voicemail_email,
+                    ':vma'          => $voicemail_attach,
+                    ':vmd'          => $voicemail_delete,
+                    ':rt'           => $ring_time,
+                ]);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO extensions (extension, name, secret, transport, encryption, codecs, max_contacts, enabled,
+                                            voicemail_enabled, voicemail_pin, force_pin_change, voicemail_skip_pin,
+                                            voicemail_email, voicemail_attach, voicemail_delete, ring_time)
+                    VALUES (:ext, :name, :secret, :transport, :encryption, :codecs, :max_contacts, :enabled,
+                            :vme, :vmp, :fpc, :vsp, :vme_mail, :vma, :vmd, :rt)
+                    ON CONFLICT(extension) DO UPDATE SET
+                        name = excluded.name,
+                        secret = excluded.secret,
+                        transport = excluded.transport,
+                        encryption = excluded.encryption,
+                        codecs = excluded.codecs,
+                        max_contacts = excluded.max_contacts,
+                        enabled = excluded.enabled,
+                        voicemail_enabled = excluded.voicemail_enabled,
+                        voicemail_pin = excluded.voicemail_pin,
+                        force_pin_change = excluded.force_pin_change,
+                        voicemail_skip_pin = excluded.voicemail_skip_pin,
+                        voicemail_email = excluded.voicemail_email,
+                        voicemail_attach = excluded.voicemail_attach,
+                        voicemail_delete = excluded.voicemail_delete,
+                        ring_time = excluded.ring_time
+                ');
+                $stmt->execute([
+                    ':ext'          => $extension,
+                    ':name'         => $name,
+                    ':secret'       => $secret,
+                    ':transport'    => $transport,
+                    ':encryption'   => $encryption,
+                    ':codecs'       => $codecs,
+                    ':max_contacts' => $max_contacts,
+                    ':enabled'      => $enabled,
+                    ':vme'          => $voicemail_enabled,
+                    ':vmp'          => $voicemail_pin,
+                    ':fpc'          => $force_pin_change,
+                    ':vsp'          => $voicemail_skip_pin,
+                    ':vme_mail'     => $voicemail_email,
+                    ':vma'          => $voicemail_attach,
+                    ':vmd'          => $voicemail_delete,
+                    ':rt'           => $ring_time,
+                ]);
+            }
+
+            // Synchronisation de l'appartenance aux Groupes d'Extensions (Sites / Droits de routes : Nice, Paris...)
+            if (isset($payload['member_extension_groups']) && is_array($payload['member_extension_groups'])) {
+                $selectedExtGroupIds = array_map('intval', $payload['member_extension_groups']);
+                $allExtGroups = $db->query('SELECT id, members FROM extension_groups')->fetchAll();
+                $updEg = $db->prepare('UPDATE extension_groups SET members = :m WHERE id = :id');
+                foreach ($allExtGroups as $egRow) {
+                    $mArr = json_decode((string)$egRow['members'], true) ?: [];
+                    $mArr = array_values(array_filter(array_map('strval', $mArr), fn($x) => $x !== $extension));
+                    if (in_array((int)$egRow['id'], $selectedExtGroupIds, true)) {
+                        $mArr[] = $extension;
+                    }
+                    $updEg->execute([
+                        ':m'  => json_encode(array_values(array_unique($mArr))),
+                        ':id' => (int)$egRow['id'],
+                    ]);
+                }
+            }
+
+            // Synchronisation automatique de l'annuaire d'entreprise
+            PhonebookManager::syncExtensions($db);
+
+            $modeBadge = $transport === 'tls' ? 'Distant (TLS + SRTP)' : ($encryption ? 'Interne (UDP + SRTP)' : 'Interne (UDP)');
+            echo json_encode([
+                'success' => true,
+                'message' => "Poste {$extension} ({$name}) enregistré en mode {$modeBadge}.",
+            ]);
+            break;
+
+        case 'delete_extension':
+            $id = (int)($payload['id'] ?? 0);
+            $stmt = $db->prepare('DELETE FROM extensions WHERE id = :id');
+            $stmt->execute([':id' => $id]);
+            PhonebookManager::syncExtensions($db);
+            echo json_encode([
+                'success' => true,
+                'message' => 'Poste téléphonique supprimé de la base SQLite.',
+            ]);
+            break;
+
+        case 'save_group':
+            $id        = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $extension = trim((string)($payload['extension'] ?? ''));
+            $name      = trim((string)($payload['name'] ?? ''));
+            $strategy  = in_array($payload['strategy'] ?? '', ['ringall', 'hunt', 'random'], true) ? $payload['strategy'] : 'ringall';
+            $ring_time = max(5, min(120, (int)($payload['ring_time'] ?? 20)));
+            $members   = is_array($payload['members'] ?? null) ? array_values(array_filter(array_map('trim', $payload['members']))) : [];
+            $failover  = trim((string)($payload['failover_dest'] ?? 'hangup')) ?: 'hangup';
+
+            if (!preg_match('/^\d{2,6}$/', $extension)) {
+                throw new InvalidArgumentException("Le numéro du groupe doit comporter entre 2 et 6 chiffres.");
+            }
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom du groupe d'appel est obligatoire.");
+            }
+
+            if ($id) {
+                $stmt = $db->prepare('
+                    UPDATE groups
+                    SET extension = :ext, name = :name, strategy = :strategy,
+                        ring_time = :ring_time, members = :members, failover_dest = :failover
+                    WHERE id = :id
+                ');
+                $stmt->execute([
+                    ':id'        => $id,
+                    ':ext'       => $extension,
+                    ':name'      => $name,
+                    ':strategy'  => $strategy,
+                    ':ring_time' => $ring_time,
+                    ':members'   => json_encode($members),
+                    ':failover'  => $failover,
+                ]);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO groups (extension, name, strategy, ring_time, members, failover_dest)
+                    VALUES (:ext, :name, :strategy, :ring_time, :members, :failover)
+                    ON CONFLICT(extension) DO UPDATE SET
+                        name = excluded.name,
+                        strategy = excluded.strategy,
+                        ring_time = excluded.ring_time,
+                        members = excluded.members,
+                        failover_dest = excluded.failover_dest
+                ');
+                $stmt->execute([
+                    ':ext'       => $extension,
+                    ':name'      => $name,
+                    ':strategy'  => $strategy,
+                    ':ring_time' => $ring_time,
+                    ':members'   => json_encode($members),
+                    ':failover'  => $failover,
+                ]);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Groupe d'appel {$extension} ({$name}) sauvegardé.",
+            ]);
+            break;
+
+        case 'delete_group':
+            $id = (int)($payload['id'] ?? 0);
+            $db->prepare('DELETE FROM groups WHERE id = :id')->execute([':id' => $id]);
+            echo json_encode([
+                'success' => true,
+                'message' => "Groupe de sonnerie supprimé.",
+            ]);
+            break;
+
+        case 'save_extension_group':
+            $id          = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $name        = trim((string)($payload['name'] ?? ''));
+            $description = trim((string)($payload['description'] ?? ''));
+            $color       = trim((string)($payload['color'] ?? 'cyan')) ?: 'cyan';
+            $membersRaw  = is_array($payload['members'] ?? null) ? $payload['members'] : [];
+            $members     = array_values(array_unique(array_filter(array_map('strval', $membersRaw))));
+
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom du groupe d'extensions est obligatoire (ex: Groupe Nice, Groupe Paris).");
+            }
+
+            if ($id) {
+                $stmt = $db->prepare('
+                    UPDATE extension_groups
+                    SET name = :name, description = :description, color = :color, members = :members
+                    WHERE id = :id
+                ');
+                $stmt->execute([
+                    ':id'          => $id,
+                    ':name'        => $name,
+                    ':description' => $description,
+                    ':color'       => $color,
+                    ':members'     => json_encode($members),
+                ]);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO extension_groups (name, description, color, members)
+                    VALUES (:name, :description, :color, :members)
+                    ON CONFLICT(name) DO UPDATE SET
+                        description = excluded.description,
+                        color = excluded.color,
+                        members = excluded.members
+                ');
+                $stmt->execute([
+                    ':name'        => $name,
+                    ':description' => $description,
+                    ':color'       => $color,
+                    ':members'     => json_encode($members),
+                ]);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Groupe d'extensions « {$name} » sauvegardé avec " . count($members) . " membre(s).",
+            ]);
+            break;
+
+        case 'delete_extension_group':
+            $id = (int)($payload['id'] ?? 0);
+            $db->prepare('DELETE FROM extension_groups WHERE id = :id')->execute([':id' => $id]);
+            PhonebookManager::syncExtensions($db);
+            echo json_encode([
+                'success' => true,
+                'message' => "Groupe d'extensions supprimé.",
+            ]);
+            break;
+
+        case 'save_phonebook_contact':
+            $cid = PhonebookManager::saveContact($db, $payload);
+            echo json_encode([
+                'success'    => true,
+                'contact_id' => $cid,
+                'contacts'   => PhonebookManager::getContacts($db),
+                'groups'     => PhonebookManager::getGroups($db),
+                'message'    => "Contact enregistré dans l'annuaire d'entreprise.",
+            ]);
+            break;
+
+        case 'delete_phonebook_contact':
+            $cid = (int)($payload['id'] ?? 0);
+            PhonebookManager::deleteContact($db, $cid);
+            echo json_encode([
+                'success'  => true,
+                'contacts' => PhonebookManager::getContacts($db),
+                'groups'   => PhonebookManager::getGroups($db),
+                'message'  => "Contact supprimé de l'annuaire.",
+            ]);
+            break;
+
+        case 'sync_phonebook':
+            PhonebookManager::syncExtensions($db);
+            echo json_encode([
+                'success'  => true,
+                'contacts' => PhonebookManager::getContacts($db),
+                'groups'   => PhonebookManager::getGroups($db),
+                'message'  => "Annuaire synchronisé avec succès.",
+            ]);
+            break;
+
+        case 'upload_phonebook_avatar':
+            PhonebookManager::initDirectory();
+            if (empty($_FILES['avatar']['tmp_name'])) {
+                throw new InvalidArgumentException("Aucun fichier image reçu.");
+            }
+            $file = $_FILES['avatar'];
+            if ($file['error'] !== UPLOAD_ERR_OK) {
+                throw new RuntimeException("Erreur lors de l'envoi du fichier.");
+            }
+            if ($file['size'] > 5 * 1024 * 1024) {
+                throw new InvalidArgumentException("L'image ne doit pas dépasser 5 Mo.");
+            }
+            $finfo = new \finfo(FILEINFO_MIME_TYPE);
+            $mime = $finfo->file($file['tmp_name']);
+            $allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/webp' => 'webp'];
+            if (!isset($allowed[$mime])) {
+                throw new InvalidArgumentException("Format non supporté. Utilisez JPG, PNG ou WebP.");
+            }
+            $ext = $allowed[$mime];
+            $cid = isset($_POST['contact_id']) ? preg_replace('/[^\w\-]/', '', (string)$_POST['contact_id']) : 'temp';
+            $filename = "avatar_{$cid}_" . time() . ".{$ext}";
+            $target = PhonebookManager::AVATARS_DIR . '/' . $filename;
+            if (!move_uploaded_file($file['tmp_name'], $target)) {
+                throw new RuntimeException("Échec de l'enregistrement de l'avatar.");
+            }
+            @chmod($target, 0664);
+            $avatarUrl = "/avatars/{$filename}";
+
+            if (!empty($_POST['contact_id']) && is_numeric($_POST['contact_id'])) {
+                $db->prepare("UPDATE phonebook_contacts SET photo_url = :url, updated_at = CURRENT_TIMESTAMP WHERE id = :id")
+                   ->execute([':url' => $avatarUrl, ':id' => (int)$_POST['contact_id']]);
+            }
+
+            echo json_encode([
+                'success'   => true,
+                'photo_url' => $avatarUrl,
+                'message'   => "Photo de profil mise à jour.",
+            ]);
+            break;
+
+        case 'stream_sound':
+            $id = (int)($_GET['id'] ?? $payload['id'] ?? 0);
+            $stmt = $db->prepare('SELECT * FROM sounds WHERE id = :id');
+            $stmt->execute([':id' => $id]);
+            $sound = $stmt->fetch();
+            if (!$sound) {
+                http_response_code(404);
+                echo json_encode(['success' => false, 'message' => 'Fichier son introuvable.']);
+                exit;
+            }
+
+            $slug = $sound['slug'];
+            $mp3Path = "/var/www/nexus-pbx/storage/sounds/{$slug}.mp3";
+            $wavPath = "/var/lib/asterisk/sounds/custom/{$slug}.wav";
+            $filePath = file_exists($mp3Path) ? $mp3Path : (file_exists($wavPath) ? $wavPath : null);
+
+            if (!$filePath || !is_readable($filePath)) {
+                http_response_code(404);
+                echo json_encode(['success' => false, 'message' => 'Fichier audio non présent sur le disque.']);
+                exit;
+            }
+
+            $mime = str_ends_with($filePath, '.mp3') ? 'audio/mpeg' : 'audio/wav';
+            $size = filesize($filePath);
+
+            while (ob_get_level()) { ob_end_clean(); }
+
+            header("Content-Type: {$mime}");
+            header('Accept-Ranges: bytes');
+            header('Cache-Control: public, max-age=86400');
+
+            if (isset($_SERVER['HTTP_RANGE'])) {
+                list($param, $range) = explode('=', $_SERVER['HTTP_RANGE'], 2);
+                if (strtolower(trim($param)) === 'bytes') {
+                    list($from, $to) = explode('-', $range, 2);
+                    $from = intval($from);
+                    $to = ($to === '') ? ($size - 1) : intval($to);
+                    if ($from > $to || $from >= $size) {
+                        http_response_code(416);
+                        header("Content-Range: bytes */{$size}");
+                        exit;
+                    }
+                    $length = $to - $from + 1;
+                    http_response_code(206);
+                    header("Content-Range: bytes {$from}-{$to}/{$size}");
+                    header("Content-Length: {$length}");
+                    $fp = fopen($filePath, 'rb');
+                    fseek($fp, $from);
+                    $buffer = 1024 * 64;
+                    while (!feof($fp) && ($pos = ftell($fp)) <= $to) {
+                        if ($pos + $buffer > $to) {
+                            $buffer = $to - $pos + 1;
+                        }
+                        echo fread($fp, $buffer);
+                        flush();
+                    }
+                    fclose($fp);
+                    exit;
+                }
+            }
+
+            header("Content-Length: {$size}");
+            readfile($filePath);
+            exit;
+
+        case 'upload_sound':
+            $name         = trim((string)($payload['name'] ?? ''));
+            $siteCategory = trim((string)($payload['site_category'] ?? 'Global')) ?: 'Global';
+            $usageType    = trim((string)($payload['usage_type'] ?? 'announcement'));
+            $description  = trim((string)($payload['description'] ?? ''));
+
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom du fichier son est obligatoire.");
+            }
+
+            $allowedUsages = ['moh', 'announcement', 'ivr', 'congestion', 'custom'];
+            if (!in_array($usageType, $allowedUsages, true)) {
+                $usageType = 'announcement';
+            }
+
+            if (!isset($_FILES['audio_file']) || $_FILES['audio_file']['error'] !== UPLOAD_ERR_OK) {
+                $errCode = $_FILES['audio_file']['error'] ?? -1;
+                $errMap = [
+                    UPLOAD_ERR_INI_SIZE => "Le fichier audio dépasse la limite maximale autorisée par le serveur (64 Mo).",
+                    UPLOAD_ERR_FORM_SIZE => "Le fichier audio dépasse la taille maximale spécifiée.",
+                    UPLOAD_ERR_PARTIAL => "Le fichier audio n'a été que partiellement téléversé.",
+                    UPLOAD_ERR_NO_FILE => "Veuillez sélectionner un fichier audio à téléverser.",
+                    UPLOAD_ERR_NO_TMP_DIR => "Dossier temporaire manquant sur le serveur.",
+                    UPLOAD_ERR_CANT_WRITE => "Échec d'écriture du fichier audio sur le disque.",
+                ];
+                $msg = $errMap[$errCode] ?? "Erreur lors du téléversement du fichier audio (code {$errCode}).";
+                throw new InvalidArgumentException($msg);
+            }
+
+            $fileInfo     = $_FILES['audio_file'];
+            $origFileName = $fileInfo['name'];
+            $tmpPath      = $fileInfo['tmp_name'];
+            $fileSize     = (int)$fileInfo['size'];
+
+            if ($fileSize > 35 * 1024 * 1024) {
+                throw new InvalidArgumentException("Le fichier audio dépasse la taille maximale autorisée (35 Mo).");
+            }
+
+            // Génération d'un slug unique
+            $slugBase = preg_replace('/[^a-z0-9]+/i', '-', strtolower($name));
+            $slugBase = trim($slugBase, '-');
+            if ($slugBase === '') {
+                $slugBase = 'audio-' . time();
+            }
+            $slug = $slugBase;
+            $counter = 1;
+            while ((int)$db->query("SELECT COUNT(*) FROM sounds WHERE slug = " . $db->quote($slug))->fetchColumn() > 0) {
+                $counter++;
+                $slug = "{$slugBase}-{$counter}";
+            }
+
+            // Dossiers cibles
+            $customDir = '/var/lib/asterisk/sounds/custom';
+            $mohBase   = '/var/lib/asterisk/moh';
+            $storeDir  = '/var/www/nexus-pbx/storage/sounds';
+
+            @mkdir($customDir, 0775, true);
+            @mkdir($storeDir, 0775, true);
+
+            $targetWav  = "{$customDir}/{$slug}.wav";
+            $targetAlaw = "{$customDir}/{$slug}.alaw";
+            $targetMp3  = "{$storeDir}/{$slug}.mp3";
+
+            // 1. Conversion Asterisk WAV (8kHz mono 16-bit PCM)
+            $cmdWav = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -c:a pcm_s16le %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetWav));
+            exec($cmdWav, $outWav, $retWav);
+            if ($retWav !== 0) {
+                throw new RuntimeException("Erreur de conversion audio WAV Asterisk : " . implode("\n", $outWav));
+            }
+
+            // 2. Conversion Asterisk ALAW (G.711a 8kHz mono)
+            $cmdAlaw = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -f alaw %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetAlaw));
+            exec($cmdAlaw, $outAlaw, $retAlaw);
+
+            // 3. Conversion MP3 Web preview
+            $cmdMp3 = sprintf('ffmpeg -y -i %s -c:a libmp3lame -b:a 128k %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetMp3));
+            exec($cmdMp3, $outMp3, $retMp3);
+
+            // 4. Si musique d'attente (MOH), copier dans le dossier MOH correspondant
+            if ($usageType === 'moh') {
+                $siteSlug = preg_replace('/[^a-z0-9]+/i', '-', strtolower($siteCategory));
+                $siteSlug = trim($siteSlug, '-') ?: 'default';
+                if ($siteSlug === 'global') $siteSlug = 'default';
+                $siteMohDir = "{$mohBase}/{$siteSlug}";
+                @mkdir($siteMohDir, 0775, true);
+                @copy($targetWav, "{$siteMohDir}/{$slug}.wav");
+                @copy($targetAlaw, "{$siteMohDir}/{$slug}.alaw");
+                @chown($siteMohDir, 'www-data');
+                @chgrp($siteMohDir, 'asterisk');
+            }
+
+            // Calcul de la durée en secondes
+            $cmdDur = sprintf('ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 %s 2>&1', escapeshellarg($targetWav));
+            $durStr = trim((string)shell_exec($cmdDur));
+            $durationSec = max(1, (int)round((float)$durStr));
+
+            // Permissions
+            @chown($targetWav, 'www-data');  @chgrp($targetWav, 'asterisk');
+            @chown($targetAlaw, 'www-data'); @chgrp($targetAlaw, 'asterisk');
+            @chown($targetMp3, 'www-data');  @chgrp($targetMp3, 'asterisk');
+
+            $stmt = $db->prepare('
+                INSERT INTO sounds (name, slug, site_category, usage_type, description, filename, original_filename, duration_sec, file_size, format)
+                VALUES (:name, :slug, :site, :usage, :desc, :file, :orig, :dur, :size, :fmt)
+            ');
+            $stmt->execute([
+                ':name'  => $name,
+                ':slug'  => $slug,
+                ':site'  => $siteCategory,
+                ':usage' => $usageType,
+                ':desc'  => $description,
+                ':file'  => "{$slug}.wav",
+                ':orig'  => $origFileName,
+                ':dur'   => $durationSec,
+                ':size'  => file_exists($targetWav) ? filesize($targetWav) : $fileSize,
+                ':fmt'   => 'wav',
+            ]);
+
+            // Régénération automatique si MoH
+            if ($usageType === 'moh') {
+                $generator->writeAllConfigs();
+                try {
+                    $ami = AmiClient::fromDatabase($db);
+                    $ami->reloadPjsipAndDialplan();
+                } catch (\Throwable $e) {}
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Fichier son « {$name} » téléversé et encodé au format Asterisk avec succès ({$durationSec}s).",
+            ]);
+            break;
+
+        case 'update_sound':
+            $id           = (int)($payload['id'] ?? 0);
+            $name         = trim((string)($payload['name'] ?? ''));
+            $siteCategory = trim((string)($payload['site_category'] ?? 'Global')) ?: 'Global';
+            $usageType    = trim((string)($payload['usage_type'] ?? 'announcement'));
+            $description  = trim((string)($payload['description'] ?? ''));
+
+            if (!$id || $name === '') {
+                throw new InvalidArgumentException("ID et Nom du fichier son obligatoires.");
+            }
+
+            $stmt = $db->prepare('
+                UPDATE sounds
+                SET name = :name, site_category = :site, usage_type = :usage, description = :desc
+                WHERE id = :id
+            ');
+            $stmt->execute([
+                ':name'  => $name,
+                ':site'  => $siteCategory,
+                ':usage' => $usageType,
+                ':desc'  => $description,
+                ':id'    => $id,
+            ]);
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Informations du fichier son mises à jour.",
+            ]);
+            break;
+
+        case 'delete_sound':
+            $id = (int)($payload['id'] ?? 0);
+            $stmt = $db->prepare('SELECT * FROM sounds WHERE id = :id');
+            $stmt->execute([':id' => $id]);
+            $sound = $stmt->fetch();
+            if (!$sound) {
+                throw new InvalidArgumentException("Fichier son introuvable.");
+            }
+
+            $slug = $sound['slug'];
+            @unlink("/var/lib/asterisk/sounds/custom/{$slug}.wav");
+            @unlink("/var/lib/asterisk/sounds/custom/{$slug}.alaw");
+            @unlink("/var/www/nexus-pbx/storage/sounds/{$slug}.mp3");
+
+            foreach (glob("/var/lib/asterisk/moh/*/{$slug}.*") ?: [] as $f) {
+                @unlink($f);
+            }
+
+            $soundDir = "/var/lib/asterisk/moh/sound_{$slug}";
+            if (is_dir($soundDir)) {
+                foreach (glob("{$soundDir}/*") ?: [] as $f) {
+                    @unlink($f);
+                }
+                @rmdir($soundDir);
+            }
+
+            // Réinitialise les références si ce son était sélectionné par défaut ou sur un trunk
+            $db->prepare("UPDATE settings SET default_moh_sound_id = 0 WHERE default_moh_sound_id = :id")->execute([':id' => $id]);
+            $db->prepare("UPDATE trunks SET moh_sound_id = 0 WHERE moh_sound_id = :id")->execute([':id' => $id]);
+
+            $db->prepare('DELETE FROM sounds WHERE id = :id')->execute([':id' => $id]);
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Fichier son « {$sound['name']} » supprimé avec succès.",
+            ]);
+            break;
+
+        case 'save_sound_site':
+            $id          = (int)($payload['id'] ?? 0);
+            $name        = trim((string)($payload['name'] ?? ''));
+            $description = trim((string)($payload['description'] ?? ''));
+
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom de la catégorie de site est obligatoire (ex: Site Nice, Site Paris).");
+            }
+
+            if ($id > 0) {
+                // Récupère l'ancien nom pour mettre à jour les sons associés
+                $stmtOld = $db->prepare('SELECT name FROM sound_sites WHERE id = :id');
+                $stmtOld->execute([':id' => $id]);
+                $oldName = $stmtOld->fetchColumn();
+
+                $stmt = $db->prepare('UPDATE sound_sites SET name = :n, description = :d WHERE id = :id');
+                $stmt->execute([':n' => $name, ':d' => $description, ':id' => $id]);
+
+                if ($oldName && $oldName !== $name) {
+                    $updSounds = $db->prepare('UPDATE sounds SET site_category = :newName WHERE site_category = :oldName');
+                    $updSounds->execute([':newName' => $name, ':oldName' => $oldName]);
+                }
+            } else {
+                $stmt = $db->prepare('INSERT INTO sound_sites (name, description) VALUES (:n, :d)');
+                $stmt->execute([':n' => $name, ':d' => $description]);
+            }
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Catégorie de site « {$name} » enregistrée.",
+            ]);
+            break;
+
+        case 'delete_sound_site':
+            $id = (int)($payload['id'] ?? 0);
+            $stmtSite = $db->prepare('SELECT name FROM sound_sites WHERE id = :id');
+            $stmtSite->execute([':id' => $id]);
+            $siteName = $stmtSite->fetchColumn();
+
+            if (!$siteName) {
+                throw new InvalidArgumentException("Catégorie de site introuvable.");
+            }
+            if (strtolower(trim($siteName)) === 'global') {
+                throw new InvalidArgumentException("La catégorie « Global » est le socle standard du système et ne peut pas être supprimée.");
+            }
+
+            // Réassigne les sons de ce site vers 'Global'
+            $db->prepare("UPDATE sounds SET site_category = 'Global' WHERE site_category = :old")->execute([':old' => $siteName]);
+            $db->prepare('DELETE FROM sound_sites WHERE id = :id')->execute([':id' => $id]);
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Catégorie « {$siteName} » supprimée. Les sons associés ont été réassignés à « Global ».",
+            ]);
+            break;
+
+        case 'set_default_moh':
+            $soundId = (int)($payload['sound_id'] ?? 0);
+            $stmtSnd = $db->prepare("SELECT * FROM sounds WHERE id = :id");
+            $stmtSnd->execute([':id' => $soundId]);
+            $snd = $stmtSnd->fetch();
+
+            if (!$snd) {
+                throw new InvalidArgumentException("Fichier son introuvable.");
+            }
+            if ($snd['usage_type'] !== 'moh') {
+                throw new InvalidArgumentException("Le fichier sélectionné doit avoir pour type d'usage « Musique d'attente ».");
+            }
+
+            $db->prepare("UPDATE settings SET default_moh_sound_id = :id WHERE id = 1")->execute([':id' => $soundId]);
+
+            // Copie vers /var/lib/asterisk/moh/default
+            $defDir = "/var/lib/asterisk/moh/default";
+            @mkdir($defDir, 0775, true);
+            @chown($defDir, 'www-data');
+            @chgrp($defDir, 'asterisk');
+
+            // Nettoyage des anciens fichiers par défaut
+            foreach (glob("{$defDir}/*") ?: [] as $f) {
+                @unlink($f);
+            }
+
+            $srcWav  = "/var/lib/asterisk/sounds/custom/{$snd['slug']}.wav";
+            $srcAlaw = "/var/lib/asterisk/sounds/custom/{$snd['slug']}.alaw";
+            if (file_exists($srcWav))  @copy($srcWav,  "{$defDir}/{$snd['slug']}.wav");
+            if (file_exists($srcAlaw)) @copy($srcAlaw, "{$defDir}/{$snd['slug']}.alaw");
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => "« {$snd['name']} » est maintenant la Musique d'attente (MoH) générale par défaut du PBX.",
+            ]);
+            break;
+
+        case 'save_trunk':
+            $id                     = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $name                   = trim((string)($payload['name'] ?? ''));
+            $host                   = trim((string)($payload['host'] ?? ''));
+            $port                   = max(1, min(65535, (int)($payload['port'] ?? 5060)));
+            $outbound_proxy         = trim((string)($payload['outbound_proxy'] ?? ''));
+            $transportRaw           = strtolower(trim((string)($payload['transport'] ?? 'udp')));
+            $transport              = in_array($transportRaw, ['udp', 'tcp', 'tls'], true) ? $transportRaw : 'udp';
+            $auth_mode              = ($payload['auth_mode'] ?? 'userpass') === 'ip' ? 'ip' : 'userpass';
+            $username               = trim((string)($payload['username'] ?? ''));
+            $auth_username          = trim((string)($payload['auth_username'] ?? ''));
+            $secret                 = trim((string)($payload['secret'] ?? ''));
+            $register               = ($auth_mode === 'ip') ? 0 : (int)!empty($payload['register']);
+            $server_uri             = trim((string)($payload['server_uri'] ?? ''));
+            $client_uri             = trim((string)($payload['client_uri'] ?? ''));
+            $contact_user           = trim((string)($payload['contact_user'] ?? ''));
+            $expiration             = max(60, min(86400, (int)($payload['expiration'] ?? 3600)));
+            $retry_interval         = max(10, min(3600, (int)($payload['retry_interval'] ?? 60)));
+            $line_support           = isset($payload['line_support']) ? (int)!empty($payload['line_support']) : 1;
+            $from_user              = trim((string)($payload['from_user'] ?? ''));
+            $from_domain            = trim((string)($payload['from_domain'] ?? ''));
+            $outbound_callerid      = trim((string)($payload['outbound_callerid'] ?? ''));
+            $send_pai                 = isset($payload['send_pai']) ? (int)!empty($payload['send_pai']) : 1;
+            $send_rpid                = (int)!empty($payload['send_rpid']);
+            $send_diversion           = isset($payload['send_diversion']) ? (int)!empty($payload['send_diversion']) : 1;
+            $trust_id_inbound         = isset($payload['trust_id_inbound']) ? (int)!empty($payload['trust_id_inbound']) : 1;
+            $max_retries              = max(0, (int)($payload['max_retries'] ?? 10000));
+            $forbidden_retry_interval = max(0, (int)($payload['forbidden_retry_interval'] ?? 600));
+            $fatal_retry_interval     = max(0, (int)($payload['fatal_retry_interval'] ?? 0));
+            $codecs                   = preg_replace('/[^a-z0-9,]/', '', strtolower((string)($payload['codecs'] ?? 'alaw,ulaw,g722'))) ?: 'alaw,ulaw';
+            $dtmf_mode                = in_array($payload['dtmf_mode'] ?? '', ['rfc4733', 'inband', 'info', 'auto'], true) ? $payload['dtmf_mode'] : 'rfc4733';
+            $media_encryption         = in_array($payload['media_encryption'] ?? '', ['no', 'sdes', 'dtls'], true) ? $payload['media_encryption'] : 'no';
+            $nat_symmetric            = isset($payload['nat_symmetric']) ? (int)!empty($payload['nat_symmetric']) : 1;
+            $direct_media             = (int)!empty($payload['direct_media']);
+            $qualify_frequency        = max(0, min(3600, (int)($payload['qualify_frequency'] ?? 60)));
+            $max_channels             = max(0, (int)($payload['max_channels'] ?? 0));
+            $timers                   = in_array($payload['timers'] ?? '', ['yes', 'no', 'required', 'always'], true) ? $payload['timers'] : 'yes';
+            $language                 = preg_replace('/[^a-zA-Z_]/', '', trim((string)($payload['language'] ?? 'fr'))) ?: 'fr';
+            $rtp_keepalive            = max(0, min(3600, (int)($payload['rtp_keepalive'] ?? 15)));
+            $t38_udptl                = in_array($payload['t38_udptl'] ?? '', ['no', 'yes', 'nat'], true) ? $payload['t38_udptl'] : 'no';
+            $fax_detect               = (int)!empty($payload['fax_detect']);
+            $inband_progress          = (int)!empty($payload['inband_progress']);
+            $match_ips                = trim((string)($payload['match_ips'] ?? ''));
+            $context                  = preg_replace('/[^a-zA-Z0-9_\-]/', '', trim((string)($payload['context'] ?? 'from-external'))) ?: 'from-external';
+            $inbound_dest             = trim((string)($payload['inbound_dest'] ?? 'ivr-accueil')) ?: 'hangup';
+            $outbound_prefix          = preg_replace('/[^0-9*#X._\[\]\-+]/', '', trim((string)($payload['outbound_prefix'] ?? '')));
+            $custom_endpoint_params   = trim((string)($payload['custom_endpoint_params'] ?? ''));
+            $custom_reg_params        = trim((string)($payload['custom_reg_params'] ?? ''));
+            $custom_aor_params        = trim((string)($payload['custom_aor_params'] ?? ''));
+            $moh_sound_id             = max(0, (int)($payload['moh_sound_id'] ?? 0));
+            $enabled                  = isset($payload['enabled']) ? (int)!empty($payload['enabled']) : 1;
+
+            $didRoutesRaw = is_array($payload['did_routes'] ?? null) ? $payload['did_routes'] : [];
+            $cleanDidRoutes = ConfigGenerator::normalizeInboundRoutes(json_encode($didRoutesRaw));
+            $did_routes_json = json_encode($cleanDidRoutes, JSON_UNESCAPED_UNICODE);
+
+            if ($name === '' || $host === '') {
+                throw new InvalidArgumentException("Le nom du Trunk et l'hôte SIP opérateur sont requis.");
+            }
+
+            $params = [
+                ':name'                     => $name,
+                ':host'                     => $host,
+                ':port'                     => $port,
+                ':outbound_proxy'           => $outbound_proxy,
+                ':transport'                => $transport,
+                ':auth_mode'                => $auth_mode,
+                ':username'                 => $username,
+                ':auth_username'            => $auth_username,
+                ':secret'                   => $secret,
+                ':register'                 => $register,
+                ':server_uri'               => $server_uri,
+                ':client_uri'               => $client_uri,
+                ':contact_user'             => $contact_user,
+                ':expiration'               => $expiration,
+                ':retry_interval'           => $retry_interval,
+                ':max_retries'              => $max_retries,
+                ':forbidden_retry_interval' => $forbidden_retry_interval,
+                ':fatal_retry_interval'     => $fatal_retry_interval,
+                ':line_support'             => $line_support,
+                ':from_user'                => $from_user,
+                ':from_domain'              => $from_domain,
+                ':outbound_callerid'        => $outbound_callerid,
+                ':send_pai'                 => $send_pai,
+                ':send_rpid'                => $send_rpid,
+                ':send_diversion'           => $send_diversion,
+                ':trust_id_inbound'         => $trust_id_inbound,
+                ':codecs'                   => $codecs,
+                ':dtmf_mode'                => $dtmf_mode,
+                ':media_encryption'         => $media_encryption,
+                ':nat_symmetric'            => $nat_symmetric,
+                ':direct_media'             => $direct_media,
+                ':qualify_frequency'        => $qualify_frequency,
+                ':max_channels'             => $max_channels,
+                ':timers'                   => $timers,
+                ':language'                 => $language,
+                ':rtp_keepalive'            => $rtp_keepalive,
+                ':t38_udptl'                => $t38_udptl,
+                ':fax_detect'               => $fax_detect,
+                ':inband_progress'          => $inband_progress,
+                ':match_ips'                => $match_ips,
+                ':context'                  => $context,
+                ':inbound_dest'             => $inbound_dest,
+                ':did_routes_json'          => $did_routes_json,
+                ':outbound_prefix'          => $outbound_prefix,
+                ':custom_endpoint_params'   => $custom_endpoint_params,
+                ':custom_reg_params'        => $custom_reg_params,
+                ':custom_aor_params'        => $custom_aor_params,
+                ':moh_sound_id'             => $moh_sound_id,
+                ':enabled'                  => $enabled,
+            ];
+
+            if ($id) {
+                $params[':id'] = $id;
+                $stmt = $db->prepare('
+                    UPDATE trunks SET
+                        name = :name, host = :host, port = :port, outbound_proxy = :outbound_proxy,
+                        transport = :transport, auth_mode = :auth_mode, username = :username,
+                        auth_username = :auth_username, secret = :secret, register = :register,
+                        server_uri = :server_uri, client_uri = :client_uri, contact_user = :contact_user,
+                        expiration = :expiration, retry_interval = :retry_interval,
+                        max_retries = :max_retries, forbidden_retry_interval = :forbidden_retry_interval,
+                        fatal_retry_interval = :fatal_retry_interval, line_support = :line_support,
+                        from_user = :from_user, from_domain = :from_domain, outbound_callerid = :outbound_callerid,
+                        send_pai = :send_pai, send_rpid = :send_rpid, send_diversion = :send_diversion,
+                        trust_id_inbound = :trust_id_inbound, codecs = :codecs, dtmf_mode = :dtmf_mode,
+                        media_encryption = :media_encryption, nat_symmetric = :nat_symmetric,
+                        direct_media = :direct_media, qualify_frequency = :qualify_frequency,
+                        max_channels = :max_channels, timers = :timers, language = :language,
+                        rtp_keepalive = :rtp_keepalive, t38_udptl = :t38_udptl, fax_detect = :fax_detect,
+                        inband_progress = :inband_progress, match_ips = :match_ips, context = :context,
+                        inbound_dest = :inbound_dest, did_routes_json = :did_routes_json,
+                        outbound_prefix = :outbound_prefix, custom_endpoint_params = :custom_endpoint_params,
+                        custom_reg_params = :custom_reg_params, custom_aor_params = :custom_aor_params,
+                        moh_sound_id = :moh_sound_id,
+                        enabled = :enabled
+                    WHERE id = :id
+                ');
+                $stmt->execute($params);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO trunks (
+                        name, host, port, outbound_proxy, transport, auth_mode, username, auth_username, secret,
+                        register, server_uri, client_uri, contact_user, expiration, retry_interval,
+                        max_retries, forbidden_retry_interval, fatal_retry_interval, line_support,
+                        from_user, from_domain, outbound_callerid, send_pai, send_rpid, send_diversion,
+                        trust_id_inbound, codecs, dtmf_mode, media_encryption, nat_symmetric, direct_media,
+                        qualify_frequency, max_channels, timers, language, rtp_keepalive, t38_udptl,
+                        fax_detect, inband_progress, match_ips, context, inbound_dest, did_routes_json,
+                        outbound_prefix, custom_endpoint_params, custom_reg_params, custom_aor_params, moh_sound_id, enabled
+                    ) VALUES (
+                        :name, :host, :port, :outbound_proxy, :transport, :auth_mode, :username, :auth_username, :secret,
+                        :register, :server_uri, :client_uri, :contact_user, :expiration, :retry_interval,
+                        :max_retries, :forbidden_retry_interval, :fatal_retry_interval, :line_support,
+                        :from_user, :from_domain, :outbound_callerid, :send_pai, :send_rpid, :send_diversion,
+                        :trust_id_inbound, :codecs, :dtmf_mode, :media_encryption, :nat_symmetric, :direct_media,
+                        :qualify_frequency, :max_channels, :timers, :language, :rtp_keepalive, :t38_udptl,
+                        :fax_detect, :inband_progress, :match_ips, :context, :inbound_dest, :did_routes_json,
+                        :outbound_prefix, :custom_endpoint_params, :custom_reg_params, :custom_aor_params, :moh_sound_id, :enabled
+                    )
+                    ON CONFLICT(name) DO UPDATE SET
+                        host = excluded.host, port = excluded.port, outbound_proxy = excluded.outbound_proxy,
+                        transport = excluded.transport, auth_mode = excluded.auth_mode, username = excluded.username,
+                        auth_username = excluded.auth_username, secret = excluded.secret, register = excluded.register,
+                        server_uri = excluded.server_uri, client_uri = excluded.client_uri, contact_user = excluded.contact_user,
+                        expiration = excluded.expiration, retry_interval = excluded.retry_interval,
+                        max_retries = excluded.max_retries, forbidden_retry_interval = excluded.forbidden_retry_interval,
+                        fatal_retry_interval = excluded.fatal_retry_interval, line_support = excluded.line_support,
+                        from_user = excluded.from_user, from_domain = excluded.from_domain, outbound_callerid = excluded.outbound_callerid,
+                        send_pai = excluded.send_pai, send_rpid = excluded.send_rpid, send_diversion = excluded.send_diversion,
+                        trust_id_inbound = excluded.trust_id_inbound, codecs = excluded.codecs, dtmf_mode = excluded.dtmf_mode,
+                        media_encryption = excluded.media_encryption, nat_symmetric = excluded.nat_symmetric,
+                        direct_media = excluded.direct_media, qualify_frequency = excluded.qualify_frequency,
+                        max_channels = excluded.max_channels, timers = excluded.timers, language = excluded.language,
+                        rtp_keepalive = excluded.rtp_keepalive, t38_udptl = excluded.t38_udptl, fax_detect = excluded.fax_detect,
+                        inband_progress = excluded.inband_progress, match_ips = excluded.match_ips, context = excluded.context,
+                        inbound_dest = excluded.inbound_dest, did_routes_json = excluded.did_routes_json,
+                        outbound_prefix = excluded.outbound_prefix, custom_endpoint_params = excluded.custom_endpoint_params,
+                        custom_reg_params = excluded.custom_reg_params, custom_aor_params = excluded.custom_aor_params,
+                        moh_sound_id = excluded.moh_sound_id,
+                        enabled = excluded.enabled
+                ');
+                $stmt->execute($params);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Trunk SIP « {$name} » ({$host}:{$port}) sauvegardé avec tous ses paramètres PJSIP.",
+            ]);
+            break;
+
+        case 'delete_trunk':
+            $id = (int)($payload['id'] ?? 0);
+            $db->prepare('DELETE FROM trunks WHERE id = :id')->execute([':id' => $id]);
+            echo json_encode([
+                'success' => true,
+                'message' => 'Trunk SIP supprimé.',
+            ]);
+            break;
+
+        case 'save_ivr':
+            $id                 = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $name               = trim((string)($payload['name'] ?? ''));
+            $description        = trim((string)($payload['description'] ?? ''));
+            $audio_file         = trim((string)($payload['audio_file'] ?? ''));
+            $timeout            = max(2, min(60, (int)($payload['timeout'] ?? 10)));
+            $direct_dial        = isset($payload['direct_dial']) ? (int)!empty($payload['direct_dial']) : 1;
+            $invalid_retries    = max(1, min(10, (int)($payload['invalid_retries'] ?? 3)));
+            $invalid_sound_id   = max(0, (int)($payload['invalid_sound_id'] ?? 0));
+            $invalid_dest       = trim((string)($payload['invalid_dest'] ?? 'hangup')) ?: 'hangup';
+            $timeout_retries    = max(1, min(10, (int)($payload['timeout_retries'] ?? 2)));
+            $timeout_sound_id   = max(0, (int)($payload['timeout_sound_id'] ?? 0));
+            $timeout_dest       = trim((string)($payload['timeout_dest'] ?? 'hangup')) ?: 'hangup';
+            $options            = is_array($payload['options'] ?? null) ? $payload['options'] : [];
+
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom du serveur vocal (IVR) est obligatoire.");
+            }
+            if ($audio_file === '') {
+                $audio_file = 'demo-instruct';
+            }
+
+            $cleanOptions = [];
+            foreach ($options as $digit => $dest) {
+                $d = preg_replace('/[^0-9*#]/', '', (string)$digit);
+                $v = trim((string)$dest);
+                if ($d !== '' && $v !== '') {
+                    $cleanOptions[$d] = $v;
+                }
+            }
+
+            $params = [
+                ':name'             => $name,
+                ':desc'             => $description,
+                ':audio'            => $audio_file,
+                ':timeout'          => $timeout,
+                ':options'          => json_encode($cleanOptions, JSON_UNESCAPED_UNICODE),
+                ':direct_dial'      => $direct_dial,
+                ':invalid_retries'  => $invalid_retries,
+                ':invalid_sound_id' => $invalid_sound_id,
+                ':invalid_dest'     => $invalid_dest,
+                ':timeout_retries'  => $timeout_retries,
+                ':timeout_sound_id' => $timeout_sound_id,
+                ':timeout_dest'     => $timeout_dest,
+            ];
+
+            if ($id) {
+                $params[':id'] = $id;
+                $stmt = $db->prepare('
+                    UPDATE ivrs SET
+                        name = :name,
+                        description = :desc,
+                        audio_file = :audio,
+                        timeout = :timeout,
+                        options_json = :options,
+                        direct_dial = :direct_dial,
+                        invalid_retries = :invalid_retries,
+                        invalid_sound_id = :invalid_sound_id,
+                        invalid_dest = :invalid_dest,
+                        timeout_retries = :timeout_retries,
+                        timeout_sound_id = :timeout_sound_id,
+                        timeout_dest = :timeout_dest
+                    WHERE id = :id
+                ');
+                $stmt->execute($params);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO ivrs (
+                        name, description, audio_file, timeout, options_json,
+                        direct_dial, invalid_retries, invalid_sound_id, invalid_dest,
+                        timeout_retries, timeout_sound_id, timeout_dest
+                    ) VALUES (
+                        :name, :desc, :audio, :timeout, :options,
+                        :direct_dial, :invalid_retries, :invalid_sound_id, :invalid_dest,
+                        :timeout_retries, :timeout_sound_id, :timeout_dest
+                    )
+                    ON CONFLICT(name) DO UPDATE SET
+                        description = excluded.description,
+                        audio_file = excluded.audio_file,
+                        timeout = excluded.timeout,
+                        options_json = excluded.options_json,
+                        direct_dial = excluded.direct_dial,
+                        invalid_retries = excluded.invalid_retries,
+                        invalid_sound_id = excluded.invalid_sound_id,
+                        invalid_dest = excluded.invalid_dest,
+                        timeout_retries = excluded.timeout_retries,
+                        timeout_sound_id = excluded.timeout_sound_id,
+                        timeout_dest = excluded.timeout_dest
+                ');
+                $stmt->execute($params);
+            }
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => "SVI / IVR « {$name} » enregistré avec " . count($cleanOptions) . " touche(s) et configuré dans Asterisk.",
+            ]);
+            break;
+
+        case 'delete_ivr':
+            $id = (int)($payload['id'] ?? 0);
+            $db->prepare('DELETE FROM ivrs WHERE id = :id')->execute([':id' => $id]);
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+            echo json_encode([
+                'success' => true,
+                'message' => 'Serveur vocal interactif supprimé.',
+            ]);
+            break;
+
+        case 'save_outbound_route':
+            $id                  = isset($payload['id']) && $payload['id'] !== '' ? (int)$payload['id'] : null;
+            $name                = trim((string)($payload['name'] ?? ''));
+            $priority            = max(1, (int)($payload['priority'] ?? 10));
+            $outbound_callerid   = trim((string)($payload['outbound_callerid'] ?? ''));
+            $override_ext_cid    = (int)!empty($payload['override_ext_cid']);
+            $route_password      = preg_replace('/[^0-9*#]/', '', trim((string)($payload['route_password'] ?? '')));
+            $route_type          = in_array($payload['route_type'] ?? '', ['normal', 'emergency', 'intracompany'], true)
+                ? (string)$payload['route_type']
+                : 'normal';
+            $moh_class           = trim((string)($payload['moh_class'] ?? 'default')) ?: 'default';
+            $permission_mode     = ($payload['permission_mode'] ?? 'all') === 'restricted' ? 'restricted' : 'all';
+            $continue_next_route = isset($payload['continue_next_route']) ? (int)!empty($payload['continue_next_route']) : 1;
+            $congestion_dest     = trim((string)($payload['congestion_dest'] ?? 'terminate-congestion')) ?: 'terminate-congestion';
+            $record_mode         = in_array($payload['record_mode'] ?? '', ['force', 'yes', 'dontcare', 'no', 'never'], true)
+                ? (string)$payload['record_mode']
+                : 'dontcare';
+            $enabled             = isset($payload['enabled']) ? (int)!empty($payload['enabled']) : 1;
+
+            if ($name === '') {
+                throw new InvalidArgumentException("Le nom de la Route Sortante est obligatoire (ex: OVH, Livebox, Emergency).");
+            }
+
+            $trunkSeqRaw = is_array($payload['trunk_sequence'] ?? null) ? $payload['trunk_sequence'] : [];
+            $cleanTrunks = [];
+            foreach ($trunkSeqRaw as $tName) {
+                $tName = trim((string)$tName);
+                if ($tName !== '' && !in_array($tName, $cleanTrunks, true)) {
+                    $cleanTrunks[] = $tName;
+                }
+            }
+            if (empty($cleanTrunks)) {
+                throw new InvalidArgumentException("Veuillez sélectionner au moins un Trunk SIP dans la séquence de la route.");
+            }
+
+            $patternsRaw = is_array($payload['dial_patterns'] ?? null) ? $payload['dial_patterns'] : [];
+            $cleanPatterns = [];
+            foreach ($patternsRaw as $pat) {
+                if (!is_array($pat)) {
+                    continue;
+                }
+                $mp = trim((string)($pat['match_pattern'] ?? ''));
+                if ($mp === '') {
+                    continue;
+                }
+                $cleanPatterns[] = [
+                    'prepend'       => preg_replace('/[^0-9*#+]/', '', trim((string)($pat['prepend'] ?? ''))),
+                    'prefix'        => preg_replace('/[^0-9*#+]/', '', trim((string)($pat['prefix'] ?? ''))),
+                    'match_pattern' => $mp,
+                    'callerid'      => trim((string)($pat['callerid'] ?? '')),
+                ];
+            }
+            if (empty($cleanPatterns)) {
+                throw new InvalidArgumentException("Ajoutez au moins un masque de numérotation (Dial Pattern), par exemple 0[1-59]XXXXXXXX ou X.");
+            }
+
+            $allowGrpsRaw = is_array($payload['allowed_groups'] ?? null) ? $payload['allowed_groups'] : [];
+            $cleanGrps = array_values(array_unique(array_filter(array_map(fn($x) => trim((string)$x), $allowGrpsRaw))));
+
+            $allowExtsRaw = is_array($payload['allowed_extensions'] ?? null) ? $payload['allowed_extensions'] : [];
+            $cleanExts = array_values(array_unique(array_filter(array_map(fn($x) => trim((string)$x), $allowExtsRaw))));
+
+            $params = [
+                ':priority'     => $priority,
+                ':name'         => $name,
+                ':cid'          => $outbound_callerid,
+                ':override_cid' => $override_ext_cid,
+                ':pwd'          => $route_password,
+                ':rtype'        => $route_type,
+                ':moh'          => $moh_class,
+                ':trunks'       => json_encode($cleanTrunks),
+                ':patterns'     => json_encode($cleanPatterns),
+                ':pmode'        => $permission_mode,
+                ':agroups'      => json_encode($cleanGrps),
+                ':aexts'        => json_encode($cleanExts),
+                ':cont'         => $continue_next_route,
+                ':cdest'        => $congestion_dest,
+                ':rec'          => $record_mode,
+                ':enabled'      => $enabled,
+            ];
+
+            if ($id) {
+                $params[':id'] = $id;
+                $stmt = $db->prepare('
+                    UPDATE outbound_routes SET
+                        priority = :priority,
+                        name = :name,
+                        outbound_callerid = :cid,
+                        override_ext_cid = :override_cid,
+                        route_password = :pwd,
+                        route_type = :rtype,
+                        moh_class = :moh,
+                        trunk_sequence_json = :trunks,
+                        dial_patterns_json = :patterns,
+                        permission_mode = :pmode,
+                        allowed_groups_json = :agroups,
+                        allowed_extensions_json = :aexts,
+                        continue_next_route = :cont,
+                        congestion_dest = :cdest,
+                        record_mode = :rec,
+                        enabled = :enabled
+                    WHERE id = :id
+                ');
+                $stmt->execute($params);
+            } else {
+                $stmt = $db->prepare('
+                    INSERT INTO outbound_routes (
+                        priority, name, outbound_callerid, override_ext_cid, route_password,
+                        route_type, moh_class, trunk_sequence_json, dial_patterns_json,
+                        permission_mode, allowed_groups_json, allowed_extensions_json,
+                        continue_next_route, congestion_dest, record_mode, enabled
+                    ) VALUES (
+                        :priority, :name, :cid, :override_cid, :pwd,
+                        :rtype, :moh, :trunks, :patterns,
+                        :pmode, :agroups, :aexts,
+                        :cont, :cdest, :rec, :enabled
+                    )
+                ');
+                $stmt->execute($params);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Route Sortante « {$name} » (Priorité #{$priority}) enregistrée avec " . count($cleanTrunks) . " trunk(s) et " . count($cleanPatterns) . " masque(s).",
+            ]);
+            break;
+
+        case 'delete_outbound_route':
+            $id = (int)($payload['id'] ?? 0);
+            $db->prepare('DELETE FROM outbound_routes WHERE id = :id')->execute([':id' => $id]);
+            echo json_encode([
+                'success' => true,
+                'message' => 'Route Sortante supprimée.',
+            ]);
+            break;
+
+        case 'reorder_outbound_route':
+            $id        = (int)($payload['id'] ?? 0);
+            $direction = ($payload['direction'] ?? 'up') === 'down' ? 'down' : 'up';
+
+            $routes = $db->query('SELECT id, priority FROM outbound_routes ORDER BY priority ASC, id ASC')->fetchAll();
+            $idx = null;
+            foreach ($routes as $k => $r) {
+                if ((int)$r['id'] === $id) {
+                    $idx = $k;
+                    break;
+                }
+            }
+            if ($idx !== null) {
+                $swapIdx = $direction === 'up' ? $idx - 1 : $idx + 1;
+                if (isset($routes[$swapIdx])) {
+                    $tmp = $routes[$idx];
+                    $routes[$idx] = $routes[$swapIdx];
+                    $routes[$swapIdx] = $tmp;
+                }
+                $upd = $db->prepare('UPDATE outbound_routes SET priority = :p WHERE id = :id');
+                foreach ($routes as $newOrder => $r) {
+                    $upd->execute([':p' => $newOrder + 1, ':id' => (int)$r['id']]);
+                }
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Ordre de priorité des Routes Sortantes mis à jour.',
+            ]);
+            break;
+
+        case 'save_company_branding':
+            $company_name = trim((string)($payload['company_name'] ?? ''));
+            $company_logo = trim((string)($payload['company_logo'] ?? ''));
+
+            if ($company_logo !== '' && !preg_match('/^data:image\/(png|jpeg|jpg|webp|svg\+xml|gif);base64,/i', $company_logo)) {
+                throw new InvalidArgumentException("Format d'image invalide (utilisez PNG, SVG, JPG ou WebP).");
+            }
+            if (strlen($company_logo) > 2 * 1024 * 1024) {
+                throw new InvalidArgumentException("Le logo est trop volumineux (max 1.5 Mo).");
+            }
+
+            if (array_key_exists('company_name', $payload) && array_key_exists('company_logo', $payload)) {
+                $stmt = $db->prepare('UPDATE settings SET company_name = :cn, company_logo = :cl, updated_at = CURRENT_TIMESTAMP WHERE id = 1');
+                $stmt->execute([':cn' => $company_name, ':cl' => $company_logo]);
+            } elseif (array_key_exists('company_logo', $payload)) {
+                $stmt = $db->prepare('UPDATE settings SET company_logo = :cl, updated_at = CURRENT_TIMESTAMP WHERE id = 1');
+                $stmt->execute([':cl' => $company_logo]);
+            } elseif (array_key_exists('company_name', $payload)) {
+                $stmt = $db->prepare('UPDATE settings SET company_name = :cn, updated_at = CURRENT_TIMESTAMP WHERE id = 1');
+                $stmt->execute([':cn' => $company_name]);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => $company_logo === '' && !array_key_exists('company_name', $payload)
+                    ? 'Logo entreprise réinitialisé.'
+                    : 'Logo et identité entreprise mis à jour sur NexusPBX !',
+            ]);
+            break;
+
+        case 'save_settings':
+            $domain             = trim((string)($payload['domain'] ?? 'pbx.local'));
+            $company_name       = trim((string)($payload['company_name'] ?? ''));
+            $external_ip        = trim((string)($payload['external_ip'] ?? ''));
+            $local_net          = trim((string)($payload['local_net'] ?? '192.168.1.0/24'));
+            $udp_port           = max(1024, min(65535, (int)($payload['udp_port'] ?? 5060)));
+            $tls_port           = max(1024, min(65535, (int)($payload['tls_port'] ?? 5061)));
+            $letsencrypt_domain = trim((string)($payload['letsencrypt_domain'] ?? ''));
+            $ami_host           = trim((string)($payload['ami_host'] ?? '127.0.0.1'));
+            $ami_port           = max(1, min(65535, (int)($payload['ami_port'] ?? 5038)));
+            $ami_user           = trim((string)($payload['ami_user'] ?? 'pbxgui'));
+            $ami_secret         = trim((string)($payload['ami_secret'] ?? ''));
+            $wizard_completed   = isset($payload['wizard_completed']) ? (int)!empty($payload['wizard_completed']) : 1;
+            $tls_verify_client  = isset($payload['tls_verify_client']) ? (int)!empty($payload['tls_verify_client']) : 0;
+            $system_language    = in_array(trim((string)($payload['system_language'] ?? 'fr')), ['fr', 'en'], true) ? trim((string)$payload['system_language']) : 'fr';
+
+            if ($ami_secret === '') {
+                throw new InvalidArgumentException("Le mot de passe AMI ne peut pas être vide.");
+            }
+
+            $stmt = $db->prepare('
+                UPDATE settings
+                SET domain = :domain,
+                    company_name = :company_name,
+                    external_ip = :external_ip,
+                    local_net = :local_net,
+                    udp_port = :udp_port,
+                    tls_port = :tls_port,
+                    letsencrypt_domain = :le_domain,
+                    ami_host = :ami_host,
+                    ami_port = :ami_port,
+                    ami_user = :ami_user,
+                    ami_secret = :ami_secret,
+                    wizard_completed = :wiz,
+                    tls_verify_client = :tvc,
+                    system_language = :syslang,
+                    updated_at = CURRENT_TIMESTAMP
+                WHERE id = 1
+            ');
+            $stmt->execute([
+                ':domain'       => $domain,
+                ':company_name' => $company_name,
+                ':external_ip'  => $external_ip,
+                ':local_net'    => $local_net,
+                ':udp_port'     => $udp_port,
+                ':tls_port'     => $tls_port,
+                ':le_domain'    => $letsencrypt_domain,
+                ':ami_host'     => $ami_host,
+                ':ami_port'     => $ami_port,
+                ':ami_user'     => $ami_user,
+                ':ami_secret'   => $ami_secret,
+                ':wiz'          => $wizard_completed,
+                ':tvc'          => $tls_verify_client,
+                ':syslang'      => $system_language,
+            ]);
+
+            SystemChecker::ensureAsteriskIncludes();
+
+            if (!empty($payload['new_admin_password'])) {
+                $newPass = (string)$payload['new_admin_password'];
+                if (strlen($newPass) < 6) {
+                    throw new InvalidArgumentException("Le nouveau mot de passe administrateur doit faire au moins 6 caractères.");
+                }
+                Auth::updatePassword($db, Auth::getUsername(), $newPass);
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Paramètres globaux enregistrés dans SQLite.',
+            ]);
+            break;
+
+        case 'test_ami':
+            $ami    = AmiClient::fromDatabase($db);
+            $result = $ami->testConnection();
+            $pjsip  = $ami->runCommand('pjsip show endpoints');
+
+            echo json_encode([
+                'success'   => true,
+                'message'   => 'Liaison AMI opérationnelle : ' . ($result['version'] ?: $result['banner']),
+                'version'   => $result['version'],
+                'endpoints' => $pjsip,
+            ]);
+            break;
+
+        case 'apply_config':
+            $writeStats = $generator->writeAllConfigs();
+            $ami        = AmiClient::fromDatabase($db);
+            $reloadInfo = $ami->reloadPjsipAndDialplan();
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Configurations écrites, pile PJSIP rechargée et Re-Register SIP envoyé à tous les opérateurs !',
+                'details' => [
+                    'files'  => $writeStats,
+                    'reload' => $reloadInfo,
+                ],
+            ]);
+            break;
+
+        case 'force_register_trunk':
+            $regName = trim((string)($payload['reg_name'] ?? '*all')) ?: '*all';
+            if ($regName !== '*all' && !preg_match('/^[a-zA-Z0-9_-]+$/', $regName)) {
+                throw new InvalidArgumentException("Identifiant de registration invalide.");
+            }
+            $ami = AmiClient::fromDatabase($db);
+            $out = $ami->forceRegister($regName);
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Requête SIP REGISTER envoyée immédiatement ({$regName}) ! NexusPBX a repris la ligne opérateur.",
+                'output'  => $out,
+            ]);
+            break;
+
+        case 'save_custom_cert':
+            $name     = trim((string)($payload['name'] ?? ($_POST['name'] ?? '')));
+            $certPem  = trim((string)($payload['cert_pem'] ?? ($_POST['cert_pem'] ?? '')));
+            $keyPem   = trim((string)($payload['key_pem'] ?? ($_POST['key_pem'] ?? '')));
+            $chainPem = trim((string)($payload['chain_pem'] ?? ($_POST['chain_pem'] ?? '')));
+
+            // Support upload direct de fichiers .crt, .pem, .key
+            if (!empty($_FILES['cert_file']['tmp_name']) && is_uploaded_file($_FILES['cert_file']['tmp_name'])) {
+                $certPem = (string)file_get_contents($_FILES['cert_file']['tmp_name']);
+            }
+            if (!empty($_FILES['key_file']['tmp_name']) && is_uploaded_file($_FILES['key_file']['tmp_name'])) {
+                $keyPem = (string)file_get_contents($_FILES['key_file']['tmp_name']);
+            }
+            if (!empty($_FILES['chain_file']['tmp_name']) && is_uploaded_file($_FILES['chain_file']['tmp_name'])) {
+                $chainPem = (string)file_get_contents($_FILES['chain_file']['tmp_name']);
+            }
+
+            $makeDefault = !empty($payload['is_default']) || (!empty($_POST['is_default']) && (string)$_POST['is_default'] === '1');
+
+            $cert = CertificateManager::saveCustomCert($db, $name, $certPem, $keyPem, $chainPem, $makeDefault);
+
+            if ($makeDefault) {
+                $generator->writeAllConfigs();
+                try {
+                    $ami = AmiClient::fromDatabase($db);
+                    $ami->reloadPjsipAndDialplan();
+                } catch (\Throwable) {}
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Certificat SSL/TLS importé avec succès ! Pairage de clé vérifié.',
+                'cert'    => $cert,
+            ]);
+            break;
+
+        case 'request_letsencrypt_cert':
+            $name        = trim((string)($payload['name'] ?? ''));
+            $domain      = trim((string)($payload['domain'] ?? ''));
+            $email       = trim((string)($payload['email'] ?? ''));
+            $makeDefault = !empty($payload['is_default']);
+            $staging     = !empty($payload['staging']);
+
+            $cert = CertificateManager::requestLetsEncrypt($db, $name, $domain, $email, $makeDefault, $staging);
+
+            if ($makeDefault) {
+                $generator->writeAllConfigs();
+                try {
+                    $ami = AmiClient::fromDatabase($db);
+                    $ami->reloadPjsipAndDialplan();
+                } catch (\Throwable) {}
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Certificat Let's Encrypt émis avec succès pour {$domain} !",
+                'cert'    => $cert,
+            ]);
+            break;
+
+        case 'set_default_cert':
+            $id = (int)($payload['id'] ?? 0);
+            if ($id <= 0) {
+                throw new InvalidArgumentException("ID de certificat manquant.");
+            }
+
+            CertificateManager::setDefault($db, $id);
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Certificat actif défini par défaut pour le transport PJSIP TLS (5061) et SRTP.',
+            ]);
+            break;
+
+        case 'delete_cert':
+            $id = (int)($payload['id'] ?? 0);
+            if ($id <= 0) {
+                throw new InvalidArgumentException("ID de certificat manquant.");
+            }
+
+            CertificateManager::delete($db, $id);
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Certificat supprimé avec succès.',
+            ]);
+            break;
+
+        case 'renew_cert':
+            $id = (int)($payload['id'] ?? 0);
+            if ($id <= 0) {
+                throw new InvalidArgumentException("ID de certificat manquant.");
+            }
+
+            $cert = CertificateManager::renew($db, $id);
+
+            if ((int)$cert['is_default'] === 1) {
+                $generator->writeAllConfigs();
+                try {
+                    $ami = AmiClient::fromDatabase($db);
+                    $ami->reloadPjsipAndDialplan();
+                } catch (\Throwable) {}
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Certificat renouvelé avec succès (expire le {$cert['valid_to']}) !",
+                'cert'    => $cert,
+            ]);
+            break;
+
+        case 'set_tls_security':
+            $tlsVerifyClient = !empty($payload['tls_verify_client']) ? 1 : 0;
+            $stmt = $db->prepare('UPDATE settings SET tls_verify_client = :tvc, updated_at = CURRENT_TIMESTAMP WHERE id = 1');
+            $stmt->execute([':tvc' => $tlsVerifyClient]);
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable) {}
+
+            echo json_encode([
+                'success' => true,
+                'message' => $tlsVerifyClient === 1
+                    ? 'Mode Mutual TLS (mTLS) activé : certificat client X.509 désormais requis sur le port PJSIP TLS 5061.'
+                    : 'Mode Mutual TLS désactivé : vérification standard par mot de passe SIP dans le tunnel TLS.',
+            ]);
+            break;
+
+        case 'detect_external_ip':
+            $detectedIp = '';
+            $sources = [
+                'https://api.ipify.org',
+                'https://ifconfig.me/ip',
+                'https://icanhazip.com',
+            ];
+            foreach ($sources as $url) {
+                $ctx = stream_context_create(['http' => ['timeout' => 3, 'user_agent' => 'curl/7.88.1']]);
+                $res = @file_get_contents($url, false, $ctx);
+                if ($res) {
+                    $candidate = trim($res);
+                    if (filter_var($candidate, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+                        $detectedIp = $candidate;
+                        break;
+                    }
+                }
+            }
+            echo json_encode([
+                'success' => true,
+                'ip'      => $detectedIp,
+            ]);
+            break;
+
+        case 'save_sip_settings':
+            $externalIp        = trim((string)($payload['external_ip'] ?? ''));
+            $externalUdpPort   = max(0, min(65535, (int)($payload['external_udp_port'] ?? 0)));
+            $externalTlsPort   = max(0, min(65535, (int)($payload['external_tls_port'] ?? 0)));
+            $udpPort           = max(1024, min(65535, (int)($payload['udp_port'] ?? 5060)));
+            $tlsPort           = max(1024, min(65535, (int)($payload['tls_port'] ?? 5061)));
+            $rtpStart          = max(1024, min(65530, (int)($payload['rtp_start'] ?? 10000)));
+            $rtpEnd            = max($rtpStart + 4, min(65535, (int)($payload['rtp_end'] ?? 20000)));
+            $rtpChecksums      = !empty($payload['rtp_checksums']) ? 1 : 0;
+            $rtpStrict         = !empty($payload['rtp_strict']) ? 1 : 0;
+            $rtpTimeout        = max(5, (int)($payload['rtp_timeout'] ?? 30));
+            $rtpKeepalive      = max(0, (int)($payload['rtp_keepalive'] ?? 15));
+            $allowAnonymousSip = !empty($payload['allow_anonymous_sip']) ? 1 : 0;
+
+            // Réseaux locaux (array)
+            $localNets = $payload['local_networks'] ?? [];
+            if (!is_array($localNets)) {
+                $localNets = array_filter(array_map('trim', explode("\n", (string)$localNets)));
+            }
+            $cleanNets = [];
+            foreach ($localNets as $net) {
+                $net = trim((string)$net);
+                if ($net !== '') {
+                    $cleanNets[] = $net;
+                }
+            }
+            if (empty($cleanNets)) {
+                $cleanNets = ['10.10.0.0/16', '192.168.1.0/24'];
+            }
+            $localNetworksJson = json_encode(array_values(array_unique($cleanNets)));
+
+            $stmt = $db->prepare('
+                UPDATE settings
+                SET external_ip         = :ext_ip,
+                    external_udp_port   = :ext_udp,
+                    external_tls_port   = :ext_tls,
+                    udp_port            = :udp_port,
+                    tls_port            = :tls_port,
+                    local_networks_json = :local_nets,
+                    local_net           = :first_net,
+                    rtp_start           = :rtp_start,
+                    rtp_end             = :rtp_end,
+                    rtp_checksums       = :rtp_checksums,
+                    rtp_strict          = :rtp_strict,
+                    rtp_timeout         = :rtp_timeout,
+                    rtp_keepalive       = :rtp_keepalive,
+                    allow_anonymous_sip = :anon,
+                    updated_at          = CURRENT_TIMESTAMP
+                WHERE id = 1
+            ');
+
+            $stmt->execute([
+                ':ext_ip'        => $externalIp,
+                ':ext_udp'       => $externalUdpPort,
+                ':ext_tls'       => $externalTlsPort,
+                ':udp_port'      => $udpPort,
+                ':tls_port'      => $tlsPort,
+                ':local_nets'    => $localNetworksJson,
+                ':first_net'     => $cleanNets[0] ?? '192.168.1.0/24',
+                ':rtp_start'     => $rtpStart,
+                ':rtp_end'       => $rtpEnd,
+                ':rtp_checksums' => $rtpChecksums,
+                ':rtp_strict'    => $rtpStrict,
+                ':rtp_timeout'   => $rtpTimeout,
+                ':rtp_keepalive' => $rtpKeepalive,
+                ':anon'          => $allowAnonymousSip,
+            ]);
+
+            $writeStats = $generator->writeAllConfigs();
+            $reloadInfo = [];
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $reloadInfo = $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {
+                $reloadInfo['error'] = $e->getMessage();
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Paramètres SIP & NAT enregistrés et appliqués à Asterisk PJSIP & RTP !',
+                'details' => [
+                    'files'  => $writeStats,
+                    'reload' => $reloadInfo,
+                ],
+            ]);
+            break;
+
+        case 'toggle_feature_code':
+            $codeId  = (int)($payload['id'] ?? 0);
+            $enabled = !empty($payload['enabled']) ? 1 : 0;
+            if ($codeId <= 0) {
+                throw new InvalidArgumentException("ID de code de fonction manquant.");
+            }
+
+            $stmt = $db->prepare('UPDATE feature_codes SET enabled = :en, updated_at = CURRENT_TIMESTAMP WHERE id = :id');
+            $stmt->execute([':en' => $enabled, ':id' => $codeId]);
+
+            $writeStats = $generator->writeAllConfigs();
+            $reloadInfo = [];
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $reloadInfo = $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {
+                $reloadInfo['error'] = $e->getMessage();
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Code de fonction ' . ($enabled ? 'activé' : 'désactivé') . ' et dialplan rechargé !',
+                'details' => ['files' => $writeStats, 'reload' => $reloadInfo],
+            ]);
+            break;
+
+        case 'update_feature_code':
+            $codeId  = (int)($payload['id'] ?? 0);
+            $newCode = trim((string)($payload['code'] ?? ''));
+            if ($codeId <= 0 || $newCode === '') {
+                throw new InvalidArgumentException("Code ou ID invalide.");
+            }
+
+            $stmt = $db->prepare('UPDATE feature_codes SET code = :code, updated_at = CURRENT_TIMESTAMP WHERE id = :id');
+            $stmt->execute([':code' => $newCode, ':id' => $codeId]);
+
+            $writeStats = $generator->writeAllConfigs();
+            $reloadInfo = [];
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $reloadInfo = $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {
+                $reloadInfo['error'] = $e->getMessage();
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => "Code de fonction mis à jour ({$newCode}) et dialplan rechargé !",
+                'details' => ['files' => $writeStats, 'reload' => $reloadInfo],
+            ]);
+            break;
+
+        case 'reset_feature_codes':
+            $db->exec('UPDATE feature_codes SET code = default_code, enabled = 1, updated_at = CURRENT_TIMESTAMP');
+            $writeStats = $generator->writeAllConfigs();
+            $reloadInfo = [];
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $reloadInfo = $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {
+                $reloadInfo['error'] = $e->getMessage();
+            }
+
+            echo json_encode([
+                'success' => true,
+                'message' => 'Tous les codes de fonctions ont été réinitialisés aux valeurs standard FreePBX/Asterisk !',
+                'details' => ['files' => $writeStats, 'reload' => $reloadInfo],
+            ]);
+            break;
+
+        case 'get_backup_data':
+            $backupSettings = BackupManager::getBackupSettings();
+            $backups = BackupManager::listBackups();
+            echo json_encode([
+                'success' => true,
+                'settings' => $backupSettings,
+                'backups' => $backups,
+            ]);
+            break;
+
+        case 'save_backup_settings':
+            BackupManager::saveBackupSettings($payload);
+            echo json_encode([
+                'success' => true,
+                'message' => 'Paramètres de sauvegarde enregistrés avec succès !',
+                'settings' => BackupManager::getBackupSettings(),
+            ]);
+            break;
+
+        case 'test_ssh_backup':
+            $testRes = BackupManager::testSshConnection($payload);
+            echo json_encode($testRes);
+            break;
+
+        case 'create_backup':
+            $res = BackupManager::createBackup('manual');
+            echo json_encode([
+                'success' => true,
+                'message' => 'Sauvegarde complète du système générée avec succès !',
+                'data' => $res,
+            ]);
+            break;
+
+        case 'list_backups':
+            $backups = BackupManager::listBackups();
+            echo json_encode([
+                'success' => true,
+                'backups' => $backups,
+            ]);
+            break;
+
+        case 'delete_backup':
+            $filename = trim((string)($payload['filename'] ?? ''));
+            if ($filename === '') {
+                throw new InvalidArgumentException("Nom de fichier manquant.");
+            }
+            $deleted = BackupManager::deleteBackup($filename);
+            echo json_encode([
+                'success' => $deleted,
+                'message' => $deleted ? 'Sauvegarde supprimée avec succès.' : 'Impossible de supprimer cette sauvegarde.',
+            ]);
+            break;
+
+        case 'restore_backup':
+            $filename = trim((string)($payload['filename'] ?? ''));
+            if ($filename === '') {
+                throw new InvalidArgumentException("Nom de fichier manquant.");
+            }
+
+            $localPath = BackupManager::BACKUP_DIR . '/' . basename($filename);
+            $tempDownload = false;
+
+            if (!file_exists($localPath)) {
+                $bSettings = BackupManager::getBackupSettings();
+                if ($bSettings['backup_storage_type'] !== 'ssh' || empty($bSettings['backup_ssh_host'])) {
+                    throw new RuntimeException("Sauvegarde introuvable localement et aucun accès SSH configuré.");
+                }
+                $remoteFile = rtrim($bSettings['backup_ssh_remote_path'], '/') . '/' . basename($filename);
+                $localPath = '/tmp/restore_' . uniqid() . '_' . basename($filename);
+                // Utiliser la méthode de téléchargement depuis SSH
+                $ref = new \ReflectionClass(BackupManager::class);
+                $fetchMethod = $ref->getMethod('fetchFromSsh');
+                $fetchMethod->setAccessible(true);
+                $fRes = $fetchMethod->invoke(null, $remoteFile, $localPath, $bSettings);
+                if (!$fRes['success'] || !file_exists($localPath)) {
+                    throw new RuntimeException("Impossible de rapatrier l'archive distante : " . ($fRes['message'] ?? 'Erreur SCP'));
+                }
+                $tempDownload = true;
+            }
+
+            try {
+                $res = BackupManager::restoreBackup($localPath);
+                echo json_encode($res);
+            } finally {
+                if ($tempDownload && file_exists($localPath)) {
+                    @unlink($localPath);
+                }
+            }
+            break;
+
+        case 'upload_restore_backup':
+            if (empty($_FILES['backup_file']['tmp_name']) || !is_uploaded_file($_FILES['backup_file']['tmp_name'])) {
+                throw new InvalidArgumentException("Aucun fichier de sauvegarde valide n'a été téléversé.");
+            }
+
+            $origName = $_FILES['backup_file']['name'] ?? 'backup.tar.gz';
+            if (!str_ends_with(strtolower($origName), '.tar.gz') && !str_ends_with(strtolower($origName), '.tgz')) {
+                throw new InvalidArgumentException("Format d'archive non supporté. Veuillez sélectionner un fichier .tar.gz");
+            }
+
+            $tmpUploadPath = '/tmp/upload_restore_' . uniqid() . '.tar.gz';
+            if (!move_uploaded_file($_FILES['backup_file']['tmp_name'], $tmpUploadPath)) {
+                throw new RuntimeException("Échec du déplacement du fichier téléversé.");
+            }
+
+            try {
+                $res = BackupManager::restoreBackup($tmpUploadPath);
+                echo json_encode($res);
+            } finally {
+                if (file_exists($tmpUploadPath)) {
+                    @unlink($tmpUploadPath);
+                }
+            }
+            break;
+
+        case 'download_backup':
+            $filename = trim((string)($_GET['filename'] ?? ''));
+            if ($filename === '') {
+                http_response_code(400);
+                die("Paramètre filename manquant.");
+            }
+            BackupManager::downloadBackup($filename);
+            exit;
+
+        case 'get_firewall_status':
+            $status = FirewallManager::getStatus();
+            echo json_encode([
+                'success' => true,
+                'data' => $status,
+            ]);
+            break;
+
+        case 'save_firewall_settings':
+            $res = FirewallManager::saveSettings($payload);
+            echo json_encode($res);
+            break;
+
+        case 'unban_ip':
+            $ip = trim((string)($payload['ip'] ?? ''));
+            $jail = trim((string)($payload['jail'] ?? ''));
+            $res = FirewallManager::unbanIp($ip, $jail);
+            echo json_encode($res);
+            break;
+
+        case 'ban_ip':
+            $ip = trim((string)($payload['ip'] ?? ''));
+            $jail = trim((string)($payload['jail'] ?? 'asterisk'));
+            $res = FirewallManager::banIp($ip, $jail);
+            echo json_encode($res);
+            break;
+
+        default:
+            http_response_code(400);
+            echo json_encode([
+                'success' => false,
+                'message' => "Action AJAX inconnue : {$action}",
+            ]);
+    }
+} catch (Throwable $e) {
+    http_response_code(422);
+    echo json_encode([
+        'success' => false,
+        'message' => $e->getMessage(),
+    ]);
+}
+
diff --git a/public/assets/app.js b/public/assets/app.js
new file mode 100644
index 0000000..fd9c952
--- /dev/null
+++ b/public/assets/app.js
@@ -0,0 +1,5242 @@
+'use strict';
+
+let appState = {
+    settings: {},
+    extensions: [],
+    groups: [],
+    extension_groups: [],
+    trunks: [],
+    ivrs: [],
+    sounds: [],
+    sound_sites: [],
+    feature_codes: [],
+    certificates: [],
+    active_certificate: null,
+    diagnostics: { healthy: false, checks: [] },
+    metrics: null,
+    previews: { pjsip: '', extensions: '', moh: '' }
+};
+
+const MAX_HISTORY_POINTS = 24;
+const chartHistory = {
+    cpu: Array(MAX_HISTORY_POINTS).fill(2),
+    ram: Array(MAX_HISTORY_POINTS).fill(15),
+    rx:  Array(MAX_HISTORY_POINTS).fill(0.5),
+    tx:  Array(MAX_HISTORY_POINTS).fill(0.2)
+};
+
+let metricsTimer = null;
+
+// --- Notifications Toast Tailwind ---
+function showToast(message, type = 'success') {
+    const container = document.getElementById('toast-container');
+    if (!container) return;
+
+    const colors = {
+        success: 'bg-emerald-600/95 border-emerald-400/40 text-white',
+        error: 'bg-red-600/95 border-red-400/40 text-white',
+        info: 'bg-indigo-600/95 border-indigo-400/40 text-white'
+    };
+
+    const toast = document.createElement('div');
+    toast.className = `pointer-events-auto flex items-start justify-between gap-3 px-4 py-3 rounded-xl border shadow-2xl backdrop-blur text-xs sm:text-sm font-medium transition-all duration-300 transform translate-y-2 opacity-0 ${colors[type] || colors.info}`;
+    toast.innerHTML = `
+        <div class="leading-snug">${escapeHtml(message)}</div>
+        <button type="button" class="text-white/70 hover:text-white font-bold">✕</button>
+    `;
+
+    toast.querySelector('button').addEventListener('click', () => toast.remove());
+    container.appendChild(toast);
+
+    requestAnimationFrame(() => {
+        toast.classList.remove('translate-y-2', 'opacity-0');
+    });
+
+    setTimeout(() => {
+        toast.classList.add('opacity-0', 'translate-x-4');
+        setTimeout(() => toast.remove(), 300);
+    }, 4200);
+}
+
+function escapeHtml(str) {
+    return String(str ?? '')
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+
+// --- Client AJAX Fetch API ---
+async function apiCall(action, payload = null) {
+    const options = {
+        method: payload ? 'POST' : 'GET',
+        headers: { 'Accept': 'application/json' }
+    };
+    if (payload) {
+        options.headers['Content-Type'] = 'application/json';
+        options.body = JSON.stringify(payload);
+    }
+
+    const res = await fetch(`/api.php?action=${encodeURIComponent(action)}`, options);
+    const cType = res.headers.get('content-type') || '';
+    let data;
+    if (cType.includes('application/json')) {
+        data = await res.json();
+    } else {
+        const rawText = await res.text();
+        if (res.status === 413) {
+            throw new Error("Le contenu envoyé est trop volumineux pour le serveur (Limite 64 Mo).");
+        }
+        throw new Error(`Erreur serveur (${res.status}) : ${rawText.replace(/<[^>]*>/g, '').trim().slice(0, 150) || 'Réponse inattendue'}`);
+    }
+
+    if (res.status === 401 && data.unauthenticated) {
+        stopMetricsPolling();
+        document.getElementById('app-screen').classList.add('hidden');
+        document.getElementById('login-screen').classList.remove('hidden');
+        throw new Error(data.message || 'Session expirée');
+    }
+
+    if (!res.ok || !data.success) {
+        throw new Error(data.message || 'Erreur lors de la requête AJAX');
+    }
+
+    return data;
+}
+
+// --- Chargement global de l'état ---
+async function loadState() {
+    try {
+        const data = await apiCall('get_state');
+        appState = data;
+        if (data.metrics) {
+            pushMetricsToHistory(data.metrics);
+        }
+        renderAll();
+        loadBackups();
+        startMetricsPolling();
+    } catch (err) {
+        if (err.message !== 'Session expirée') {
+            showToast(err.message, 'error');
+        }
+    }
+}
+
+async function pollMetrics() {
+    try {
+        const data = await apiCall('get_metrics');
+        if (data.metrics) {
+            appState.metrics = data.metrics;
+            pushMetricsToHistory(data.metrics);
+            renderDashboardMetrics();
+            renderExtensionsTable();
+            renderTrunksTable();
+        }
+    } catch (_) {
+        // Silencieux en arrière-plan
+    }
+}
+
+function startMetricsPolling() {
+    if (!metricsTimer) {
+        metricsTimer = setInterval(pollMetrics, 3000);
+    }
+}
+
+function stopMetricsPolling() {
+    if (metricsTimer) {
+        clearInterval(metricsTimer);
+        metricsTimer = null;
+    }
+}
+
+function pushMetricsToHistory(m) {
+    chartHistory.cpu.push(Number(m.cpu?.percent || 0));
+    chartHistory.cpu.shift();
+
+    chartHistory.ram.push(Number(m.memory?.percent || 0));
+    chartHistory.ram.shift();
+
+    chartHistory.rx.push(Number(m.network?.rx_kbps || 0));
+    chartHistory.rx.shift();
+
+    chartHistory.tx.push(Number(m.network?.tx_kbps || 0));
+    chartHistory.tx.shift();
+}
+
+function renderAll() {
+    renderCompanyBranding();
+    renderSummaryCards();
+    renderDashboardMetrics();
+    renderExtensionsTable();
+    renderGroupsTable();
+    renderExtensionGroupsTable();
+    renderPhonebookTable();
+    renderTrunksTable();
+    renderOutboundRoutesTable();
+    renderIvrsTable();
+    renderSoundsTable();
+    renderFeatureCodes();
+    renderSipSettings();
+    renderCertificates();
+    renderSettingsAndDiagnostics();
+}
+
+function renderCompanyBranding() {
+    const s = appState.settings || {};
+    const logo = (s.company_logo || '').trim();
+    const name = (s.company_name || '').trim();
+
+    const emptyBox = document.getElementById('sidebar-company-empty');
+    const filledBox = document.getElementById('sidebar-company-filled');
+    const logoImg = document.getElementById('sidebar-company-logo');
+    const nameEl = document.getElementById('sidebar-company-name');
+    const slot = document.getElementById('sidebar-company-slot');
+
+    const loginBox = document.getElementById('login-company-box');
+    const loginLogo = document.getElementById('login-company-logo');
+    const loginName = document.getElementById('login-company-name');
+
+    // Aperçu dans l'administration (Onglet Système & Paramètres)
+    const settingsPreviewImg = document.getElementById('settings-company-preview-img');
+    const settingsPreviewEmpty = document.getElementById('settings-company-preview-empty');
+    if (settingsPreviewImg && settingsPreviewEmpty) {
+        if (logo) {
+            settingsPreviewImg.src = logo;
+            settingsPreviewImg.classList.remove('hidden');
+            settingsPreviewEmpty.classList.add('hidden');
+        } else {
+            settingsPreviewImg.src = '';
+            settingsPreviewImg.classList.add('hidden');
+            settingsPreviewEmpty.classList.remove('hidden');
+        }
+    }
+
+    if (logo || name) {
+        emptyBox?.classList.add('hidden');
+        filledBox?.classList.remove('hidden');
+
+        if (logo && logoImg) {
+            logoImg.src = logo;
+            logoImg.classList.remove('hidden');
+        } else if (logoImg) {
+            logoImg.src = '';
+            logoImg.classList.add('hidden');
+        }
+
+        if (name && nameEl) {
+            nameEl.textContent = name;
+            nameEl.classList.remove('hidden');
+        } else if (nameEl) {
+            nameEl.textContent = '';
+            nameEl.classList.add('hidden');
+        }
+
+        if (loginBox) {
+            loginBox.classList.remove('hidden');
+            if (logo && loginLogo) {
+                loginLogo.src = logo;
+                loginLogo.classList.remove('hidden');
+            } else if (loginLogo) {
+                loginLogo.classList.add('hidden');
+            }
+            if (loginName) loginName.textContent = name;
+        }
+    } else {
+        emptyBox?.classList.remove('hidden');
+        filledBox?.classList.add('hidden');
+        if (logoImg) { logoImg.src = ''; logoImg.classList.add('hidden'); }
+        if (nameEl) { nameEl.textContent = ''; nameEl.classList.add('hidden'); }
+        loginBox?.classList.add('hidden');
+    }
+}
+
+function triggerCompanyLogoPicker() {
+    document.getElementById('company-logo-file-input')?.click();
+}
+
+function handleCompanyLogoUpload(input) {
+    const file = input?.files?.[0];
+    if (!file) return;
+
+    if (file.size > 1500000) {
+        showToast('Le fichier logo ne doit pas dépasser 1.5 Mo.', 'error');
+        input.value = '';
+        return;
+    }
+
+    const reader = new FileReader();
+    reader.onload = async (ev) => {
+        const dataUrl = String(ev.target?.result || '');
+        try {
+            const res = await apiCall('save_company_branding', { company_logo: dataUrl });
+            showToast(res.message, 'success');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        } finally {
+            input.value = '';
+        }
+    };
+    reader.readAsDataURL(file);
+}
+
+async function clearCompanyLogo() {
+    try {
+        const res = await apiCall('save_company_branding', { company_logo: '' });
+        showToast(res.message, 'info');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function renderSummaryCards() {
+    const exts = appState.extensions || [];
+    const grps = appState.groups || [];
+    const trks = appState.trunks || [];
+    const ivrs = appState.ivrs || [];
+    const obRoutes = appState.outbound_routes || [];
+
+    const tlsCount = exts.filter(e => e.transport === 'tls').length;
+    const udpCount = exts.length - tlsCount;
+
+    document.getElementById('stat-extensions').textContent = exts.length;
+    document.getElementById('stat-extensions-sub').textContent = `${udpCount} Interne UDP • ${tlsCount} TLS/SRTP`;
+    document.getElementById('stat-groups').textContent = grps.length;
+    document.getElementById('stat-trunks').textContent = trks.length;
+    document.getElementById('stat-ivrs').textContent = ivrs.length;
+
+    // Badges menu gauche
+    document.getElementById('nav-badge-extensions').textContent = exts.length;
+    document.getElementById('nav-badge-groups').textContent = grps.length;
+    const egBadge = document.getElementById('nav-badge-extgroups');
+    if (egBadge) egBadge.textContent = (appState.extension_groups || []).length;
+    const pbBadge = document.getElementById('nav-badge-phonebook');
+    if (pbBadge) pbBadge.textContent = (appState.phonebook_contacts || []).length;
+    document.getElementById('nav-badge-trunks').textContent = trks.length;
+    const obBadge = document.getElementById('nav-badge-outbound');
+    if (obBadge) obBadge.textContent = obRoutes.length;
+    document.getElementById('nav-badge-ivrs').textContent = ivrs.length;
+    const soundsBadge = document.getElementById('nav-badge-sounds');
+    if (soundsBadge) soundsBadge.textContent = (appState.sounds || []).length;
+    const backupsBadge = document.getElementById('nav-badge-backups');
+    if (backupsBadge && typeof appState.backups_count !== 'undefined') {
+        backupsBadge.textContent = appState.backups_count;
+    }
+
+    const diag = appState.diagnostics || { healthy: false, checks: [] };
+    const healthEl = document.getElementById('stat-health');
+    const amiDot = document.getElementById('ami-dot');
+    const sideBadge = document.getElementById('sidebar-health-badge');
+
+    if (diag.healthy) {
+        healthEl.textContent = 'AMI & PJSIP OK';
+        healthEl.className = 'text-[11px] font-bold text-emerald-400';
+        amiDot.className = 'w-2 h-2 rounded-full bg-emerald-400';
+        sideBadge.textContent = 'EN LIGNE';
+        sideBadge.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30';
+    } else {
+        healthEl.textContent = 'Vérifier Config';
+        healthEl.className = 'text-[11px] font-bold text-amber-400';
+        amiDot.className = 'w-2 h-2 rounded-full bg-amber-400';
+        sideBadge.textContent = 'ATTENTION';
+        sideBadge.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/30';
+    }
+
+    const lastApplied = appState.settings?.last_applied_at;
+    document.getElementById('last-applied-label').textContent = lastApplied
+        ? `Dernière application Asterisk : ${lastApplied} UTC`
+        : `Cliquez sur « Appliquer les configurations » pour synchroniser Asterisk`;
+}
+
+// --- Rendu Dashboard Métriques & Graphes SVG ---
+function renderDashboardMetrics() {
+    const m = appState.metrics;
+    if (!m) return;
+
+    // Sidebar infos
+    const osVerEl = document.getElementById('sidebar-os-version');
+    if (osVerEl && m.os_version) osVerEl.textContent = m.os_version;
+    const astVerEl = document.getElementById('sidebar-ast-version');
+    if (astVerEl && m.asterisk?.version) astVerEl.textContent = m.asterisk.version;
+    document.getElementById('sidebar-ip').textContent = m.network?.ip || '10.10.175.204';
+    document.getElementById('sidebar-uptime').textContent = m.uptime || '—';
+    document.getElementById('sidebar-online-phones').textContent = `${m.asterisk?.online_contacts ?? 0} / ${(appState.extensions || []).length}`;
+
+    // 1. CPU
+    const cpuPct = Number(m.cpu?.percent || 0);
+    document.getElementById('metric-cpu-pct').textContent = `${cpuPct.toFixed(1)}%`;
+    document.getElementById('metric-cpu-cores').textContent = `${m.cpu?.cores || 1} cœur(s)`;
+    document.getElementById('metric-cpu-model').textContent = m.cpu?.model || 'Processeur Debian';
+    document.getElementById('metric-cpu-load').textContent = `${m.cpu?.load_1 ?? 0} / ${m.cpu?.load_5 ?? 0} / ${m.cpu?.load_15 ?? 0}`;
+    document.getElementById('bar-cpu').style.width = `${Math.max(3, Math.min(100, cpuPct))}%`;
+
+    // 2. RAM
+    const ramPct = Number(m.memory?.percent || 0);
+    document.getElementById('metric-ram-pct').textContent = `${ramPct.toFixed(1)}%`;
+    document.getElementById('metric-ram-used').textContent = `${m.memory?.used_mb || 0} / ${m.memory?.total_mb || 0} Mo`;
+    document.getElementById('metric-ram-free').textContent = `Disponible : ${m.memory?.free_mb || 0} Mo`;
+    document.getElementById('metric-swap').textContent = `${m.memory?.swap_used_mb || 0} / ${m.memory?.swap_total_mb || 0} Mo`;
+    document.getElementById('bar-ram').style.width = `${Math.max(3, Math.min(100, ramPct))}%`;
+
+    // 3. Réseau
+    document.getElementById('metric-net-rx').textContent = `${Number(m.network?.rx_kbps || 0).toFixed(1)} Ko/s`;
+    document.getElementById('metric-net-tx').textContent = `${Number(m.network?.tx_kbps || 0).toFixed(1)} Ko/s`;
+    document.getElementById('metric-net-iface').textContent = `${m.network?.interface || 'eth0'} (${m.network?.ip || ''})`;
+    document.getElementById('metric-net-totals').textContent = `Total : ↓ ${m.network?.rx_total_mb || 0} Mo • ↑ ${m.network?.tx_total_mb || 0} Mo`;
+
+    // 4. Disque HDD
+    const diskPct = Number(m.disk?.percent || 0);
+    document.getElementById('metric-disk-pct').textContent = `${diskPct.toFixed(1)}%`;
+    document.getElementById('metric-disk-used').textContent = `${m.disk?.used_gb || 0} / ${m.disk?.total_gb || 0} Go`;
+    document.getElementById('metric-disk-free').textContent = `Espace libre sur / : ${m.disk?.free_gb || 0} Go`;
+    document.getElementById('bar-disk').style.width = `${Math.max(3, Math.min(100, diskPct))}%`;
+
+    // 5. Jauges Anneaux (Donuts)
+    updateDonut('donut-cpu', 'donut-cpu-label', cpuPct);
+    updateDonut('donut-ram', 'donut-ram-label', ramPct);
+    updateDonut('donut-disk', 'donut-disk-label', diskPct);
+
+    document.getElementById('dash-active-calls').textContent = m.asterisk?.active_calls ?? 0;
+    document.getElementById('dash-online-contacts').textContent = `${m.asterisk?.online_contacts ?? 0} / ${(appState.extensions || []).length}`;
+
+    // 6. Graphes SVG Temps Réel
+    drawDualAreaChart('chart-cpu-ram', chartHistory.cpu, chartHistory.ram, 100, '#818cf8', '#34d399', '%');
+    const maxNet = Math.max(10, ...chartHistory.rx, ...chartHistory.tx) * 1.25;
+    drawDualAreaChart('chart-network', chartHistory.rx, chartHistory.tx, maxNet, '#22d3ee', '#c084fc', 'Ko/s');
+
+    // 7. Table des téléphones SIP en direct sur le Dashboard
+    renderDashboardPhonesTable();
+
+    // 8. Sécurité, Pare-feu, Fail2ban & IPs bloquées
+    if (m.security) {
+        const sec = m.security;
+        const fwDot = document.getElementById('dash-fw-dot');
+        const fwStatus = document.getElementById('dash-fw-status');
+        const fwDetail = document.getElementById('dash-fw-detail');
+
+        const isFwActive = Boolean(sec.firewall_enabled || sec.strict_port80) && Boolean(sec.fail2ban_running);
+        if (isFwActive) {
+            if (fwDot) fwDot.className = 'w-2 h-2 rounded-full bg-emerald-400 shadow-sm shadow-emerald-500/50';
+            if (fwStatus) {
+                fwStatus.textContent = 'Actif';
+                fwStatus.className = 'text-sm font-extrabold text-emerald-400 mt-1';
+            }
+            if (fwDetail) fwDetail.textContent = sec.strict_port80 ? 'Mode Strict (Port 80 Certbot)' : `Port HTTPS : ${sec.admin_port || 8443}`;
+        } else {
+            if (fwDot) fwDot.className = 'w-2 h-2 rounded-full bg-slate-500';
+            if (fwStatus) {
+                fwStatus.textContent = 'Inactif';
+                fwStatus.className = 'text-sm font-extrabold text-slate-400 mt-1';
+            }
+            if (fwDetail) fwDetail.textContent = !sec.fail2ban_running ? 'Moteur Fail2ban arrêté' : 'Tout le trafic autorisé';
+        }
+
+        const f2bDot = document.getElementById('dash-f2b-dot');
+        const f2bStatus = document.getElementById('dash-f2b-status');
+        const f2bDetail = document.getElementById('dash-f2b-detail');
+
+        if (sec.fail2ban_running) {
+            if (f2bDot) f2bDot.className = 'w-2 h-2 rounded-full bg-emerald-400 animate-pulse';
+            if (f2bStatus) {
+                f2bStatus.textContent = 'En ligne';
+                f2bStatus.className = 'text-sm font-extrabold text-emerald-400 mt-1';
+            }
+            const activeJailCount = Object.keys(sec.jails || {}).length;
+            if (f2bDetail) f2bDetail.textContent = `${activeJailCount} prison(s) active(s)`;
+        } else {
+            if (f2bDot) f2bDot.className = 'w-2 h-2 rounded-full bg-rose-500';
+            if (f2bStatus) {
+                f2bStatus.textContent = 'Arrêté';
+                f2bStatus.className = 'text-sm font-extrabold text-rose-400 mt-1';
+            }
+            if (f2bDetail) f2bDetail.textContent = 'Service non démarré';
+        }
+
+        const bannedCountEl = document.getElementById('dash-banned-count');
+        if (bannedCountEl) bannedCountEl.textContent = sec.total_banned || 0;
+
+        let totalFailedAll = 0;
+        let totalBannedAll = 0;
+        Object.values(sec.jails || {}).forEach(j => {
+            totalFailedAll += (j.total_failed || 0);
+            totalBannedAll += (j.total_banned || 0);
+        });
+
+        const blockedBadge = document.getElementById('dash-total-blocked-badge');
+        if (blockedBadge) {
+            blockedBadge.textContent = `${totalFailedAll} attaque(s) contrée(s)`;
+            if (totalFailedAll > 0) {
+                blockedBadge.className = 'px-2.5 py-1 rounded-full text-[11px] font-bold bg-amber-500/15 text-amber-300 border border-amber-500/30 font-mono';
+            } else {
+                blockedBadge.className = 'px-2.5 py-1 rounded-full text-[11px] font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30 font-mono';
+            }
+        }
+
+        const latestBannedEl = document.getElementById('dash-latest-banned');
+        if (latestBannedEl) {
+            if (sec.banned_ips && sec.banned_ips.length > 0) {
+                latestBannedEl.textContent = `Bannie : ${sec.banned_ips[0].ip}`;
+                latestBannedEl.className = 'text-[10px] text-rose-400 mt-1 truncate font-mono font-bold';
+            } else {
+                latestBannedEl.textContent = 'Aucun ban actif';
+                latestBannedEl.className = 'text-[10px] text-emerald-400 mt-1 truncate';
+            }
+        }
+
+        const clientIpEl = document.getElementById('dash-client-ip');
+        if (clientIpEl && m.network?.ip) {
+            clientIpEl.textContent = `IP locale PBX : ${m.network.ip}`;
+        }
+
+        // Graphique Répartition Jails
+        const astJail = sec.jails?.asterisk || {};
+        const webJail = sec.jails?.['nexus-web'] || {};
+        const sshJail = sec.jails?.sshd || {};
+
+        const astFailed = astJail.total_failed || 0;
+        const webFailed = webJail.total_failed || 0;
+        const sshFailed = sshJail.total_failed || 0;
+        const totalThreats = astFailed + webFailed + sshFailed;
+
+        const astPct = totalThreats > 0 ? Math.round((astFailed / totalThreats) * 100) : 0;
+        const webPct = totalThreats > 0 ? Math.round((webFailed / totalThreats) * 100) : 0;
+        const sshPct = totalThreats > 0 ? Math.round((sshFailed / totalThreats) * 100) : 0;
+
+        const astStats = document.getElementById('dash-jail-ast-stats');
+        const astBar = document.getElementById('dash-jail-ast-bar');
+        if (astStats) astStats.textContent = `${astFailed} contrée(s) (${astPct}%) • ${astJail.currently_banned || 0} ban actif`;
+        if (astBar) astBar.style.width = `${astPct}%`;
+
+        const webStats = document.getElementById('dash-jail-web-stats');
+        const webBar = document.getElementById('dash-jail-web-bar');
+        if (webStats) webStats.textContent = `${webFailed} contrée(s) (${webPct}%) • ${webJail.currently_banned || 0} ban actif`;
+        if (webBar) webBar.style.width = `${webPct}%`;
+
+        const sshStats = document.getElementById('dash-jail-ssh-stats');
+        const sshBar = document.getElementById('dash-jail-ssh-bar');
+        if (sshStats) sshStats.textContent = `${sshFailed} contrée(s) (${sshPct}%) • ${sshJail.currently_banned || 0} ban actif`;
+        if (sshBar) sshBar.style.width = `${sshPct}%`;
+    }
+
+    // 9. Rendu de la liste des Services Système
+    if (m.services && Array.isArray(m.services)) {
+        renderDashboardServicesList(m.services);
+    }
+}
+
+function renderDashboardServicesList(services) {
+    const container = document.getElementById('dash-services-list');
+    if (!container) return;
+
+    let allOk = true;
+    const html = services.map(s => {
+        if (!s.active && s.id !== 'firewall') allOk = false;
+        const dotClass = s.active 
+            ? 'w-2 h-2 rounded-full bg-emerald-400 shadow-sm shadow-emerald-400/50' 
+            : 'w-2 h-2 rounded-full bg-rose-500';
+        const badgeClass = s.active
+            ? 'px-2 py-0.5 rounded text-[10px] font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30'
+            : 'px-2 py-0.5 rounded text-[10px] font-bold bg-rose-500/15 text-rose-300 border border-rose-500/30';
+        
+        return `
+            <div class="py-2.5 flex items-center justify-between text-xs">
+                <div class="flex items-center gap-2.5">
+                    <span class="${dotClass}"></span>
+                    <div>
+                        <div class="font-bold text-white flex items-center gap-2">
+                            <span>${escapeHtml(s.name)}</span>
+                            <span class="text-[10px] font-mono text-slate-400 font-normal">(${escapeHtml(s.port)})</span>
+                        </div>
+                        <div class="text-[11px] text-slate-400">${escapeHtml(s.desc)}</div>
+                    </div>
+                </div>
+                <div class="text-right">
+                    <span class="${badgeClass}">${escapeHtml(s.status_text)}</span>
+                    <div class="text-[10px] font-mono text-slate-400 mt-0.5">${escapeHtml(s.uptime)}</div>
+                </div>
+            </div>
+        `;
+    }).join('');
+
+    container.innerHTML = html;
+
+    const allBadge = document.getElementById('dash-services-all-badge');
+    if (allBadge) {
+        if (allOk) {
+            allBadge.textContent = 'TOUS OPÉRATIONNELS';
+            allBadge.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30';
+        } else {
+            allBadge.textContent = 'ATTENTION DÉMON';
+            allBadge.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/30';
+        }
+    }
+}
+
+function updateDonut(circleId, labelId, pct) {
+    const circle = document.getElementById(circleId);
+    const label = document.getElementById(labelId);
+    const clamped = Math.max(0, Math.min(100, Math.round(pct)));
+    if (circle) {
+        circle.setAttribute('stroke-dasharray', `${clamped}, 100`);
+    }
+    if (label) {
+        label.textContent = `${clamped}%`;
+    }
+}
+
+function drawDualAreaChart(svgId, seriesA, seriesB, maxVal, colorA, colorB, unitLabel) {
+    const svg = document.getElementById(svgId);
+    if (!svg) return;
+
+    const width = 500;
+    const height = 180;
+    const padTop = 14;
+    const padBottom = 18;
+    const plotH = height - padTop - padBottom;
+    const safeMax = maxVal > 0 ? maxVal : 100;
+
+    const toPoints = (arr) => arr.map((val, idx) => {
+        const x = (idx / (arr.length - 1)) * width;
+        const ratio = Math.max(0, Math.min(1, val / safeMax));
+        const y = padTop + plotH - (ratio * plotH);
+        return `${x.toFixed(1)},${y.toFixed(1)}`;
+    });
+
+    const ptsA = toPoints(seriesA);
+    const ptsB = toPoints(seriesB);
+
+    const areaA = `0,${padTop + plotH} ` + ptsA.join(' ') + ` ${width},${padTop + plotH}`;
+    const areaB = `0,${padTop + plotH} ` + ptsB.join(' ') + ` ${width},${padTop + plotH}`;
+
+    const gradIdA = `${svgId}-grad-a`;
+    const gradIdB = `${svgId}-grad-b`;
+
+    svg.innerHTML = `
+        <defs>
+            <linearGradient id="${gradIdA}" x1="0" y1="0" x2="0" y2="1">
+                <stop offset="0%" stop-color="${colorA}" stop-opacity="0.38"/>
+                <stop offset="100%" stop-color="${colorA}" stop-opacity="0.02"/>
+            </linearGradient>
+            <linearGradient id="${gradIdB}" x1="0" y1="0" x2="0" y2="1">
+                <stop offset="0%" stop-color="${colorB}" stop-opacity="0.32"/>
+                <stop offset="100%" stop-color="${colorB}" stop-opacity="0.02"/>
+            </linearGradient>
+        </defs>
+
+        <!-- Lignes de grille horizontales -->
+        <line x1="0" y1="${padTop}" x2="${width}" y2="${padTop}" stroke="#2c323f" stroke-dasharray="3,3" stroke-width="1"/>
+        <line x1="0" y1="${padTop + plotH / 2}" x2="${width}" y2="${padTop + plotH / 2}" stroke="#2c323f" stroke-dasharray="3,3" stroke-width="1"/>
+        <line x1="0" y1="${padTop + plotH}" x2="${width}" y2="${padTop + plotH}" stroke="#3d4657" stroke-width="1"/>
+
+        <text x="6" y="${padTop + 10}" fill="#94a3b8" font-size="10" font-family="monospace">${Math.round(safeMax)} ${unitLabel}</text>
+        <text x="6" y="${padTop + plotH / 2 - 4}" fill="#64748b" font-size="10" font-family="monospace">${Math.round(safeMax / 2)} ${unitLabel}</text>
+
+        <!-- Courbe B -->
+        <polygon points="${areaB}" fill="url(#${gradIdB})"/>
+        <polyline fill="none" stroke="${colorB}" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" points="${ptsB.join(' ')}"/>
+
+        <!-- Courbe A -->
+        <polygon points="${areaA}" fill="url(#${gradIdA})"/>
+        <polyline fill="none" stroke="${colorA}" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" points="${ptsA.join(' ')}"/>
+    `;
+}
+
+function getContactMap() {
+    const map = {};
+    const contacts = appState.metrics?.asterisk?.contacts || [];
+    contacts.forEach(c => {
+        map[String(c.extension)] = c;
+    });
+    return map;
+}
+
+function extractCleanIp(uri) {
+    if (!uri) return '';
+    const m = uri.match(/@([0-9a-zA-Z\.\-]+(?::\d+)?)/);
+    if (m) return m[1];
+    const m2 = uri.match(/^sip:([0-9a-zA-Z\.\-]+(?::\d+)?)/);
+    if (m2) return m2[1];
+    return uri.split(';')[0].replace(/^sip:/, '');
+}
+
+function renderDashboardPhonesTable() {
+    const tbody = document.getElementById('dashboard-phones-tbody');
+    if (!tbody) return;
+
+    const exts = appState.extensions || [];
+    const contactMap = getContactMap();
+
+    if (exts.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="6" class="py-8 text-center text-slate-400 text-xs">Aucun poste SIP configuré.</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = exts.map(ext => {
+        const c = contactMap[String(ext.extension)];
+        const isTls = ext.transport === 'tls';
+        const st = c ? String(c.status).toLowerCase() : '';
+        const isUnavail = c && st.includes('unavail');
+        const isOnline = c && !isUnavail && (st.startsWith('avail') || st.includes('nonqual'));
+
+        // Chiffrement Voix (SRTP) configuré pour l'extension
+        const encMode = Number(ext.encryption ?? (isTls ? 1 : 0));
+        let srtpBadge = '';
+        if (encMode === 2) {
+            srtpBadge = `<span class="inline-flex items-center gap-1 px-1.5 py-0.2 rounded text-[10px] font-semibold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30" title="Chiffrement média SRTP obligatoire (AES-128)">🛡️ SRTP Forcé</span>`;
+        } else if (encMode === 1) {
+            srtpBadge = `<span class="inline-flex items-center gap-1 px-1.5 py-0.2 rounded text-[10px] font-semibold bg-cyan-500/15 text-cyan-300 border border-cyan-500/30" title="Chiffrement média SRTP négociable si supporté par le poste">🛡️ SRTP Négociable</span>`;
+        } else {
+            srtpBadge = `<span class="inline-flex items-center gap-1 px-1.5 py-0.2 rounded text-[10px] font-medium bg-anthracite-900 text-slate-400 border border-anthracite-700" title="Voix en clair (RTP standard)">🔈 RTP Clair</span>`;
+        }
+
+        // Détection dynamique du mode réel négocié en direct par le téléphone
+        let modeBadge = '';
+        if (c) {
+            const actTr = (c.active_transport || 'udp').toLowerCase();
+            let trPill = '';
+            let profileNote = '';
+
+            if (actTr === 'tls') {
+                trPill = `
+                    <span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/40 shadow-sm shadow-emerald-500/10">
+                        🔒 TLS Actif (Chiffré)
+                    </span>
+                `;
+                profileNote = `<span class="${isTls ? 'text-emerald-300 font-semibold' : 'text-slate-300'}">${isTls ? 'TLS Strict' : 'UDP Interne'}</span>`;
+            } else if (actTr === 'wss') {
+                trPill = `
+                    <span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/40">
+                        🔒 WSS WebRTC
+                    </span>
+                `;
+                profileNote = `<span class="text-cyan-300 font-semibold">WebRTC</span>`;
+            } else if (actTr === 'tcp') {
+                trPill = `
+                    <span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-semibold bg-indigo-500/20 text-indigo-300 border border-indigo-500/35">
+                        🔓 TCP Actif (Clair)
+                    </span>
+                `;
+                profileNote = `<span class="text-slate-300">${isTls ? 'TLS Strict' : 'UDP Interne'}</span>`;
+            } else {
+                // UDP
+                trPill = `
+                    <span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-semibold ${isTls ? 'bg-amber-500/20 text-amber-300 border border-amber-500/40' : 'bg-anthracite-750 text-slate-200 border border-anthracite-600'}">
+                        🔓 UDP Actif (Clair)
+                    </span>
+                `;
+                profileNote = isTls ? '<span class="text-amber-400 font-semibold">⚠️ Exige TLS</span>' : '<span class="text-slate-400">UDP Interne</span>';
+            }
+
+            modeBadge = `
+                <div class="space-y-1">
+                    <div>${trPill}</div>
+                    <div class="flex items-center gap-1.5 flex-wrap pl-0.5">
+                        ${srtpBadge}
+                        <span class="text-[10px] text-slate-400 font-mono">Profil: ${profileNote}</span>
+                    </div>
+                </div>
+            `;
+        } else {
+            modeBadge = `
+                <div class="space-y-1">
+                    <div>
+                        <span class="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-medium bg-anthracite-950 text-slate-400 border border-anthracite-700">
+                            Inactif
+                        </span>
+                    </div>
+                    <div class="flex items-center gap-1.5 flex-wrap pl-0.5">
+                        ${srtpBadge}
+                        <span class="text-[10px] text-slate-500 font-mono">Profil: ${isTls ? 'TLS Strict' : 'UDP Interne'}</span>
+                    </div>
+                </div>
+            `;
+        }
+
+        // Statut SIP
+        let statusBadge = '';
+        if (isOnline) {
+            statusBadge = `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30"><i class="w-2 h-2 rounded-full bg-emerald-400 animate-pulse"></i>En ligne (${escapeHtml(c.status)})</span>`;
+        } else if (isUnavail) {
+            statusBadge = `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-rose-500/20 text-rose-300 border border-rose-500/30" title="Contact injoignable (rejet de transport ou délai d'attente dépassé)"><i class="w-2 h-2 rounded-full bg-rose-400"></i>Injoignable (${escapeHtml(c.status)})</span>`;
+        } else {
+            statusBadge = `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-medium bg-anthracite-950 text-slate-400 border border-anthracite-700"><i class="w-2 h-2 rounded-full bg-slate-500"></i>Hors-ligne</span>`;
+        }
+
+        // Contact / IP & Modèle Téléphone (User-Agent)
+        let contactHtml = '';
+        if (c) {
+            const cleanIp = extractCleanIp(c.uri);
+            const ua = c.user_agent ? escapeHtml(c.user_agent) : '';
+            contactHtml = `
+                <div>
+                    <div class="font-mono text-xs text-slate-200 font-semibold">${escapeHtml(cleanIp)}</div>
+                    ${ua ? `<div class="text-[11px] text-indigo-300 font-medium truncate max-w-[240px]" title="${ua}">📱 ${ua}</div>` : ''}
+                </div>
+            `;
+        } else {
+            contactHtml = `<span class="text-xs text-slate-500 italic">Non enregistré</span>`;
+        }
+
+        let rttText = '—';
+        let rttColor = 'text-slate-500';
+        if (isOnline && c && c.rtt_ms !== null && !isNaN(c.rtt_ms)) {
+            rttText = `${c.rtt_ms} ms`;
+            rttColor = c.rtt_ms < 30 ? 'text-emerald-300 font-bold' : (c.rtt_ms < 100 ? 'text-cyan-300' : 'text-amber-300');
+        } else if (isUnavail) {
+            rttText = 'Inaccessible';
+            rttColor = 'text-rose-400/90 font-semibold italic';
+        }
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3 px-4 font-mono font-bold text-indigo-300">${escapeHtml(ext.extension)}</td>
+                <td class="py-3 px-4 font-medium text-white">${escapeHtml(ext.name)}</td>
+                <td class="py-3 px-4">${modeBadge}</td>
+                <td class="py-3 px-4">${statusBadge}</td>
+                <td class="py-3 px-4">${contactHtml}</td>
+                <td class="py-3 px-4 text-right font-mono text-xs ${rttColor}">${rttText}</td>
+            </tr>
+        `;
+    }).join('');
+}
+
+// --- 1. Rendu & CRUD Extensions ---
+function renderExtensionsTable() {
+    const tbody = document.getElementById('extensions-tbody');
+    if (!tbody) return;
+    const rows = appState.extensions || [];
+    const contactMap = getContactMap();
+    const groups = appState.groups || [];
+
+    if (rows.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="8" class="py-8 text-center text-slate-400 text-xs">Aucun poste configuré. Cliquez sur « + Nouveau Poste SIP ».</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = rows.map(ext => {
+        const c = contactMap[String(ext.extension)];
+        const isTls = ext.transport === 'tls';
+        const encMode = Number(ext.encryption ?? (isTls ? 1 : 0));
+        let encLabel = '';
+        if (encMode === 2) {
+            encLabel = '<span class="text-[10px] font-bold text-emerald-400">SRTP Forcé</span>';
+        } else if (encMode === 1) {
+            encLabel = '<span class="text-[10px] font-bold text-cyan-400">SRTP Négociable</span>';
+        } else {
+            encLabel = '<span class="text-[10px] text-slate-400">RTP Clair</span>';
+        }
+        const badge = isTls
+            ? `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-semibold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">🔒 TLS (${encLabel})</span>`
+            : (encMode > 0
+                ? `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-semibold bg-indigo-500/15 text-indigo-300 border border-indigo-500/30">🛡️ UDP (${encLabel})</span>`
+                : `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-semibold bg-anthracite-750 text-slate-200 border border-anthracite-600">🏢 UDP (RTP Clair)</span>`);
+
+        const actTr = c ? (c.active_transport || 'udp').toUpperCase() : '';
+        const stLower = c ? String(c.status).toLowerCase() : '';
+        const isCUnavail = c && stLower.includes('unavail');
+        const isCOnline = c && !isCUnavail && (stLower.startsWith('avail') || stLower.includes('nonqual'));
+        const regBadge = c
+            ? (isCOnline
+                ? `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30" title="${escapeHtml(c.user_agent || '')}"><i class="w-1.5 h-1.5 rounded-full bg-emerald-400"></i>Connecté (${actTr}${c.rtt_ms !== null && !isNaN(c.rtt_ms) ? ` • ${c.rtt_ms}ms` : ''})</span>`
+                : `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-rose-500/20 text-rose-300 border border-rose-500/30" title="Contact rejeté ou injoignable (rejet de transport ou délai dépassé)"><i class="w-1.5 h-1.5 rounded-full bg-rose-400"></i>Injoignable (${actTr})</span>`)
+            : `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-medium bg-anthracite-950 text-slate-400 border border-anthracite-700">Non connecté</span>`;
+
+        // Trouve à quels groupes d'extensions (Sites/Droits) ce poste appartient (ex: Nice, Paris)
+        const extGroups = appState.extension_groups || [];
+        const myExtGroups = extGroups.filter(eg => {
+            const mList = Array.isArray(eg.members) ? eg.members.map(String) : [];
+            return mList.includes(String(ext.extension));
+        });
+        const groupBadges = myExtGroups.length > 0
+            ? myExtGroups.map(eg => `<span class="px-2 py-0.5 rounded-md bg-cyan-500/15 text-cyan-300 border border-cyan-500/30 text-[11px] font-semibold">${escapeHtml(eg.name)}</span>`).join(' ')
+            : `<span class="text-slate-500 text-xs italic">Aucun</span>`;
+
+        const vmBadge = Number(ext.voicemail_enabled) === 1
+            ? `<span class="inline-flex items-center gap-1 px-1.5 py-0.5 rounded text-[10px] font-semibold bg-amber-500/15 text-amber-300 border border-amber-500/30" title="Boîte vocale active (${ext.ring_time || 20}s)">📟 Boîte</span>`
+            : '';
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4 font-mono font-bold text-indigo-300">${escapeHtml(ext.extension)}</td>
+                <td class="py-3.5 px-4 font-medium text-white">
+                    <div class="flex items-center gap-2">
+                        <span>${escapeHtml(ext.name)}</span>
+                        ${vmBadge}
+                    </div>
+                </td>
+                <td class="py-3.5 px-4"><div class="flex flex-wrap gap-1">${groupBadges}</div></td>
+                <td class="py-3.5 px-4">${regBadge}</td>
+                <td class="py-3.5 px-4">${badge}</td>
+                <td class="py-3.5 px-4 font-mono text-xs text-slate-200">${escapeHtml(ext.codecs)}</td>
+                <td class="py-3.5 px-4">
+                    <code class="px-2 py-0.5 rounded bg-anthracite-950 border border-anthracite-700 text-xs font-mono text-slate-300">${escapeHtml(ext.secret)}</code>
+                </td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    <button type="button" onclick="editExtension(${Number(ext.id)})" class="text-xs font-semibold text-indigo-300 hover:text-indigo-200">Modifier</button>
+                    <button type="button" onclick="deleteExtension(${Number(ext.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function switchExtModalTab(tab) {
+    const isGeneral = (tab === 'general');
+    const btnGen = document.getElementById('tab-btn-ext-general');
+    const btnVm = document.getElementById('tab-btn-ext-voicemail');
+    const panGen = document.getElementById('tab-panel-ext-general');
+    const panVm = document.getElementById('tab-panel-ext-voicemail');
+
+    if (btnGen) {
+        btnGen.className = isGeneral
+            ? 'px-3 py-1.5 rounded-lg text-xs font-bold transition bg-indigo-600 text-white'
+            : 'px-3 py-1.5 rounded-lg text-xs font-semibold transition text-slate-300 hover:text-white hover:bg-anthracite-700';
+    }
+    if (btnVm) {
+        btnVm.className = !isGeneral
+            ? 'px-3 py-1.5 rounded-lg text-xs font-bold transition bg-indigo-600 text-white flex items-center gap-1.5'
+            : 'px-3 py-1.5 rounded-lg text-xs font-semibold transition text-slate-300 hover:text-white hover:bg-anthracite-700 flex items-center gap-1.5';
+    }
+    if (panGen) panGen.classList.toggle('hidden', !isGeneral);
+    if (panVm) panVm.classList.toggle('hidden', isGeneral);
+}
+
+function syncVoicemailToggle(enabled) {
+    const details = document.getElementById('voicemail-details-container');
+    if (details) {
+        details.style.opacity = enabled ? '1' : '0.4';
+        details.style.pointerEvents = enabled ? 'auto' : 'none';
+    }
+    const badge = document.getElementById('badge-ext-vm-status');
+    if (badge) {
+        badge.className = `w-2 h-2 rounded-full ${enabled ? 'bg-amber-400' : 'bg-slate-500'}`;
+    }
+}
+
+function syncPinMode(mode) {
+    const isManual = (mode === 'manual');
+    const pinBox = document.getElementById('pin-input-box');
+    const forceInput = document.getElementById('ext-force-pin-change');
+    if (pinBox) {
+        pinBox.style.display = isManual ? 'block' : 'none';
+    }
+    if (forceInput) {
+        forceInput.value = isManual ? '0' : '1';
+    }
+}
+
+function openExtensionModal(ext = null) {
+    const form = document.getElementById('form-extension');
+    form.reset();
+    document.getElementById('modal-extension-title').textContent = ext ? `Modifier le poste ${ext.extension}` : 'Nouveau Poste SIP';
+
+    form.elements['id'].value = ext ? ext.id : '';
+    form.elements['extension'].value = ext ? ext.extension : '';
+    form.elements['name'].value = ext ? ext.name : '';
+    form.elements['secret'].value = ext ? ext.secret : generateSecretString();
+    form.elements['codecs'].value = ext ? ext.codecs : 'alaw,ulaw,g722,opus';
+    form.elements['max_contacts'].value = ext ? ext.max_contacts : 2;
+
+    const transport = ext ? ext.transport : 'udp';
+    form.querySelectorAll('input[name="transport"]').forEach(r => {
+        r.checked = (r.value === transport);
+    });
+    syncEncryptionToggle(transport, ext ? (ext.encryption ?? (transport === 'tls' ? 1 : 0)) : (transport === 'tls' ? 1 : 0));
+
+    // Réinitialisation de l'onglet actif vers "Général"
+    switchExtModalTab('general');
+
+    // Initialisation des champs Messagerie Vocale
+    const vmEnabled = ext ? (Number(ext.voicemail_enabled) === 1) : false;
+    const vmCheckbox = document.getElementById('ext-voicemail-enabled');
+    if (vmCheckbox) vmCheckbox.checked = vmEnabled;
+
+    const isFirstCall = ext ? (Number(ext.force_pin_change) === 1) : false;
+    form.querySelectorAll('input[name="pin_mode"]').forEach(r => {
+        r.checked = isFirstCall ? (r.value === 'first_call') : (r.value === 'manual');
+    });
+    syncPinMode(isFirstCall ? 'first_call' : 'manual');
+
+    if (form.elements['voicemail_pin']) {
+        form.elements['voicemail_pin'].value = ext ? (ext.voicemail_pin || '') : '';
+    }
+    if (form.elements['ring_time']) {
+        form.elements['ring_time'].value = ext ? (ext.ring_time || 20) : 20;
+    }
+
+    const skipPinCb = document.getElementById('ext-skip-pin');
+    if (skipPinCb) {
+        skipPinCb.checked = ext ? (Number(ext.voicemail_skip_pin) === 1) : true;
+    }
+
+    if (form.elements['voicemail_email']) {
+        form.elements['voicemail_email'].value = ext ? (ext.voicemail_email || '') : '';
+    }
+
+    const vmAttachCb = document.getElementById('ext-vm-attach');
+    if (vmAttachCb) {
+        vmAttachCb.checked = ext ? (Number(ext.voicemail_attach) === 1) : true;
+    }
+
+    const vmDeleteCb = document.getElementById('ext-vm-delete');
+    if (vmDeleteCb) {
+        vmDeleteCb.checked = ext ? (Number(ext.voicemail_delete) === 1) : false;
+    }
+
+    syncVoicemailToggle(vmEnabled);
+
+    // Rendu des cases d'appartenance aux Groupes d'Extensions (Sites: Nice, Paris...)
+    const grpBox = document.getElementById('extension-groups-checkboxes');
+    if (grpBox) {
+        const extGroups = appState.extension_groups || [];
+        if (extGroups.length === 0) {
+            grpBox.innerHTML = `<span class="text-slate-500 text-xs col-span-2">Aucun groupe d'extensions créé. Vous pouvez en créer dans « Groupes » → « Groupes d'extensions ».</span>`;
+        } else {
+            const currentExt = ext ? String(ext.extension) : '';
+            grpBox.innerHTML = extGroups.map(eg => {
+                const isMember = currentExt && Array.isArray(eg.members) && eg.members.map(String).includes(currentExt);
+                return `
+                    <label class="flex items-center gap-2 p-2 rounded-lg bg-anthracite-900 border border-anthracite-700 hover:border-cyan-500/50 cursor-pointer">
+                        <input type="checkbox" name="member_extension_groups[]" value="${Number(eg.id)}" ${isMember ? 'checked' : ''} class="rounded bg-anthracite-950 border-anthracite-600">
+                        <div class="leading-tight">
+                            <span class="text-xs font-bold text-white">${escapeHtml(eg.name)}</span>
+                            ${eg.description ? `<span class="text-[10px] text-slate-400 block">${escapeHtml(eg.description)}</span>` : ''}
+                        </div>
+                    </label>
+                `;
+            }).join('');
+        }
+    }
+
+    openModal('modal-extension');
+}
+
+function editExtension(id) {
+    const ext = (appState.extensions || []).find(e => Number(e.id) === Number(id));
+    if (ext) openExtensionModal(ext);
+}
+
+async function deleteExtension(id, optNum = null) {
+    const ext = (appState.extensions || []).find(e => Number(e.id) === Number(id));
+    const num = optNum || (ext ? ext.extension : 'ce poste');
+    if (!confirm(`Supprimer définitivement le poste SIP ${num} ?`)) return;
+    try {
+        const res = await apiCall('delete_extension', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function syncEncryptionToggle(transport, currentVal = null) {
+    const sel = document.getElementById('ext-encryption');
+    if (!sel) return;
+    if (currentVal !== null) {
+        sel.value = String(currentVal);
+    } else if (transport === 'tls' && sel.value === '0') {
+        sel.value = '1';
+    }
+}
+
+function generateSecretString() {
+    const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%';
+    let out = '';
+    for (let i = 0; i < 14; i++) {
+        out += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return out;
+}
+
+function generateRandomSecret() {
+    const form = document.getElementById('form-extension');
+    form.elements['secret'].value = generateSecretString();
+}
+
+// --- 2A. Rendu & CRUD Groupes de Sonnerie (Ring Groups) ---
+function renderGroupsTable() {
+    const tbody = document.getElementById('groups-tbody');
+    if (!tbody) return;
+    const rows = appState.groups || [];
+
+    if (rows.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="6" class="py-8 text-center text-slate-400 text-xs">Aucun groupe de sonnerie configuré. Cliquez sur « + Nouveau Groupe de Sonnerie ».</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = rows.map(grp => {
+        const members = Array.isArray(grp.members) ? grp.members : [];
+        const badges = members.length
+            ? members.map(m => `<span class="px-2 py-0.5 rounded bg-indigo-500/20 text-indigo-200 border border-indigo-500/30 font-mono text-xs font-semibold">${escapeHtml(m)}</span>`).join(' ')
+            : '<span class="text-slate-500 text-xs italic">Aucun membre</span>';
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4 font-mono font-bold text-indigo-300">${escapeHtml(grp.extension)}</td>
+                <td class="py-3.5 px-4 font-bold text-white">${escapeHtml(grp.name)}</td>
+                <td class="py-3.5 px-4"><code class="text-xs text-cyan-300 font-mono">${escapeHtml(grp.strategy)}</code></td>
+                <td class="py-3.5 px-4"><div class="flex flex-wrap gap-1">${badges}</div></td>
+                <td class="py-3.5 px-4 text-xs text-slate-200">${Number(grp.ring_time)}s → <code class="text-slate-300">${escapeHtml(grp.failover_dest)}</code></td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    <button type="button" onclick="editGroup(${Number(grp.id)})" class="text-xs font-semibold text-indigo-300 hover:text-indigo-200">Modifier</button>
+                    <button type="button" onclick="deleteGroup(${Number(grp.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+let activeGroupSelectedExts = new Set();
+
+function openGroupModal(grp = null) {
+    const form = document.getElementById('form-group');
+    form.reset();
+    document.getElementById('modal-group-title').textContent = grp ? `Modifier le groupe de sonnerie ${grp.name} (${grp.extension})` : "Nouveau Groupe de Sonnerie";
+
+    form.elements['id'].value = grp ? grp.id : '';
+    form.elements['extension'].value = grp ? grp.extension : '';
+    form.elements['name'].value = grp ? grp.name : '';
+    form.elements['strategy'].value = grp ? grp.strategy : 'ringall';
+    form.elements['ring_time'].value = grp ? grp.ring_time : 20;
+
+    // Failover destinations
+    const failoverSel = document.getElementById('group-failover-select');
+    if (failoverSel) {
+        failoverSel.innerHTML = buildDestinationOptionsHtml(grp ? grp.failover_dest : 'hangup');
+    }
+
+    activeGroupSelectedExts = new Set(grp && Array.isArray(grp.members) ? grp.members.map(String) : []);
+    renderGroupInteractiveBoxes();
+
+    openModal('modal-group');
+}
+
+function renderGroupInteractiveBoxes() {
+    const allowedBox = document.getElementById('group-members-allowed-box');
+    const blockedBox = document.getElementById('group-members-blocked-box');
+    const hiddenBox = document.getElementById('group-members-checkboxes');
+    if (!allowedBox || !blockedBox) return;
+
+    const allExts = appState.extensions || [];
+    let allowedHtml = '';
+    let blockedHtml = '';
+    let hiddenHtml = '';
+    let allowedCount = 0;
+    let blockedCount = 0;
+
+    allExts.forEach(ext => {
+        const extStr = String(ext.extension);
+        const isSel = activeGroupSelectedExts.has(extStr);
+        if (isSel) {
+            allowedCount++;
+            allowedHtml += `
+                <button type="button" onclick="toggleGroupMemberExt('${escapeHtml(extStr)}')"
+                    class="group inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg bg-emerald-500/20 hover:bg-red-500/20 border border-emerald-500/40 hover:border-red-500/40 text-xs font-semibold text-emerald-300 hover:text-red-300 transition cursor-pointer">
+                    <span class="font-mono">${escapeHtml(extStr)}</span>
+                    <span class="text-slate-300">(${escapeHtml(ext.name)})</span>
+                    <span class="text-slate-400 group-hover:text-red-300 ml-1 font-bold">✕</span>
+                </button>
+            `;
+            hiddenHtml += `<input type="checkbox" name="member_ext" value="${escapeHtml(extStr)}" checked>`;
+        } else {
+            blockedCount++;
+            blockedHtml += `
+                <button type="button" onclick="toggleGroupMemberExt('${escapeHtml(extStr)}')"
+                    class="group inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg bg-anthracite-950 hover:bg-emerald-500/20 border border-anthracite-700 hover:border-emerald-500/40 text-xs font-medium text-slate-300 hover:text-emerald-300 transition cursor-pointer">
+                    <span class="font-mono text-indigo-300 font-bold">${escapeHtml(extStr)}</span>
+                    <span class="text-slate-300">(${escapeHtml(ext.name)})</span>
+                    <span class="text-slate-500 group-hover:text-emerald-300 ml-1 font-bold">+</span>
+                </button>
+            `;
+        }
+    });
+
+    allowedBox.innerHTML = allowedHtml || `<div class="text-slate-500 text-xs italic py-2">Aucun poste qui sonne. Cliquez sur un poste à droite pour l'ajouter.</div>`;
+    blockedBox.innerHTML = blockedHtml || `<div class="text-slate-500 text-xs italic py-2">Tous les postes sonnent dans ce groupe !</div>`;
+    if (hiddenBox) hiddenBox.innerHTML = hiddenHtml;
+
+    const countA = document.getElementById('group-selected-count');
+    const countB = document.getElementById('group-unselected-count');
+    if (countA) countA.textContent = String(allowedCount);
+    if (countB) countB.textContent = String(blockedCount);
+}
+
+function toggleGroupMemberExt(extStr) {
+    if (activeGroupSelectedExts.has(extStr)) {
+        activeGroupSelectedExts.delete(extStr);
+    } else {
+        activeGroupSelectedExts.add(extStr);
+    }
+    renderGroupInteractiveBoxes();
+}
+
+function groupTransferAllExtensions(includeAll) {
+    const allExts = appState.extensions || [];
+    if (includeAll) {
+        allExts.forEach(e => activeGroupSelectedExts.add(String(e.extension)));
+    } else {
+        activeGroupSelectedExts.clear();
+    }
+    renderGroupInteractiveBoxes();
+}
+
+function editGroup(id) {
+    const grp = (appState.groups || []).find(g => Number(g.id) === Number(id));
+    if (grp) openGroupModal(grp);
+}
+
+async function deleteGroup(id, optNum = null) {
+    const grp = (appState.groups || []).find(g => Number(g.id) === Number(id));
+    const num = optNum || (grp ? grp.extension : 'ce groupe');
+    if (!confirm(`Supprimer le groupe de sonnerie ${num} ?`)) return;
+    try {
+        const res = await apiCall('delete_group', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- 2B. Rendu & CRUD Groupes d'Extensions (Sites & Droits Routes Sortantes) ---
+function renderExtensionGroupsTable() {
+    const tbody = document.getElementById('extgroups-tbody');
+    if (!tbody) return;
+    const rows = appState.extension_groups || [];
+    const obRoutes = appState.outbound_routes || [];
+
+    if (rows.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="5" class="py-8 text-center text-slate-400 text-xs">Aucun groupe d'extensions configuré. Cliquez sur « + Nouveau Groupe d'Extensions ».</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = rows.map(eg => {
+        const members = Array.isArray(eg.members) ? eg.members : [];
+        const badges = members.length
+            ? members.map(m => `<span class="px-2 py-0.5 rounded bg-cyan-500/20 text-cyan-200 border border-cyan-500/30 font-mono text-xs font-semibold">${escapeHtml(m)}</span>`).join(' ')
+            : '<span class="text-slate-500 text-xs italic">Aucune extension</span>';
+
+        // Routes sortantes où ce groupe d'extensions a accès
+        const egIdStr = String(eg.id);
+        const egNameStr = String(eg.name);
+        const accessibleRoutes = obRoutes.filter(r => {
+            if (r.permission_mode === 'all') return true;
+            const ag = Array.isArray(r.allowed_groups) ? r.allowed_groups.map(String) : [];
+            return ag.includes(egIdStr) || ag.includes(egNameStr);
+        });
+        const routeBadges = accessibleRoutes.length > 0
+            ? accessibleRoutes.map(r => `<span class="px-2 py-0.5 rounded bg-emerald-500/15 text-emerald-300 border border-emerald-500/30 text-[11px] font-semibold">${escapeHtml(r.name)}</span>`).join(' ')
+            : `<span class="px-2 py-0.5 rounded bg-amber-500/15 text-amber-300 border border-amber-500/30 text-[11px]">Aucune (Verrouillé)</span>`;
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4 font-bold text-white text-sm">
+                    <div class="flex items-center gap-2">
+                        <span class="w-2.5 h-2.5 rounded-full bg-cyan-400"></span>
+                        <span>${escapeHtml(eg.name)}</span>
+                    </div>
+                </td>
+                <td class="py-3.5 px-4 text-xs text-slate-300">${escapeHtml(eg.description || '—')}</td>
+                <td class="py-3.5 px-4"><div class="flex flex-wrap gap-1">${badges}</div></td>
+                <td class="py-3.5 px-4"><div class="flex flex-wrap gap-1">${routeBadges}</div></td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    <button type="button" onclick="editExtGroup(${Number(eg.id)})" class="text-xs font-semibold text-cyan-300 hover:text-cyan-200">Modifier</button>
+                    <button type="button" onclick="deleteExtGroup(${Number(eg.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+let activeExtGroupSelectedExts = new Set();
+
+function openExtGroupModal(eg = null) {
+    const form = document.getElementById('form-extgroup');
+    form.reset();
+    document.getElementById('modal-extgroup-title').textContent = eg ? `Modifier le groupe d'extensions ${eg.name}` : "Nouveau Groupe d'Extensions";
+
+    form.elements['id'].value = eg ? eg.id : '';
+    form.elements['name'].value = eg ? eg.name : '';
+    form.elements['description'].value = eg ? eg.description : '';
+
+    activeExtGroupSelectedExts = new Set(eg && Array.isArray(eg.members) ? eg.members.map(String) : []);
+    renderExtGroupInteractiveBoxes();
+
+    openModal('modal-extgroup');
+}
+
+function renderExtGroupInteractiveBoxes() {
+    const allowedBox = document.getElementById('extgroup-members-allowed-box');
+    const blockedBox = document.getElementById('extgroup-members-blocked-box');
+    if (!allowedBox || !blockedBox) return;
+
+    const allExts = appState.extensions || [];
+    let allowedHtml = '';
+    let blockedHtml = '';
+    let allowedCount = 0;
+    let blockedCount = 0;
+
+    allExts.forEach(ext => {
+        const extStr = String(ext.extension);
+        const isSel = activeExtGroupSelectedExts.has(extStr);
+        if (isSel) {
+            allowedCount++;
+            allowedHtml += `
+                <button type="button" onclick="toggleExtGroupMember('${escapeHtml(extStr)}')"
+                    class="group inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg bg-cyan-500/20 hover:bg-red-500/20 border border-cyan-500/40 hover:border-red-500/40 text-xs font-semibold text-cyan-300 hover:text-red-300 transition cursor-pointer">
+                    <span class="font-mono">${escapeHtml(extStr)}</span>
+                    <span class="text-slate-300">(${escapeHtml(ext.name)})</span>
+                    <span class="text-slate-400 group-hover:text-red-300 ml-1 font-bold">✕</span>
+                </button>
+            `;
+        } else {
+            blockedCount++;
+            blockedHtml += `
+                <button type="button" onclick="toggleExtGroupMember('${escapeHtml(extStr)}')"
+                    class="group inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg bg-anthracite-950 hover:bg-cyan-500/20 border border-anthracite-700 hover:border-cyan-500/40 text-xs font-medium text-slate-300 hover:text-cyan-300 transition cursor-pointer">
+                    <span class="font-mono text-indigo-300 font-bold">${escapeHtml(extStr)}</span>
+                    <span class="text-slate-300">(${escapeHtml(ext.name)})</span>
+                    <span class="text-slate-500 group-hover:text-cyan-300 ml-1 font-bold">+</span>
+                </button>
+            `;
+        }
+    });
+
+    allowedBox.innerHTML = allowedHtml || `<div class="text-slate-500 text-xs italic py-2">Aucune extension rattachée. Cliquez à droite pour en ajouter.</div>`;
+    blockedBox.innerHTML = blockedHtml || `<div class="text-slate-500 text-xs italic py-2">Toutes les extensions sont dans ce groupe !</div>`;
+
+    const countA = document.getElementById('extgroup-selected-count');
+    const countB = document.getElementById('extgroup-unselected-count');
+    if (countA) countA.textContent = String(allowedCount);
+    if (countB) countB.textContent = String(blockedCount);
+}
+
+function toggleExtGroupMember(extStr) {
+    if (activeExtGroupSelectedExts.has(extStr)) {
+        activeExtGroupSelectedExts.delete(extStr);
+    } else {
+        activeExtGroupSelectedExts.add(extStr);
+    }
+    renderExtGroupInteractiveBoxes();
+}
+
+function extGroupTransferAll(includeAll) {
+    const allExts = appState.extensions || [];
+    if (includeAll) {
+        allExts.forEach(e => activeExtGroupSelectedExts.add(String(e.extension)));
+    } else {
+        activeExtGroupSelectedExts.clear();
+    }
+    renderExtGroupInteractiveBoxes();
+}
+
+function editExtGroup(id) {
+    const eg = (appState.extension_groups || []).find(g => Number(g.id) === Number(id));
+    if (eg) openExtGroupModal(eg);
+}
+
+async function deleteExtGroup(id, optName = null) {
+    const eg = (appState.extension_groups || []).find(g => Number(g.id) === Number(id));
+    const name = optName || (eg ? eg.name : 'ce groupe');
+    if (!confirm(`Supprimer définitivement le groupe d'extensions « ${name} » ?`)) return;
+    try {
+        const res = await apiCall('delete_extension_group', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- 3. Rendu & CRUD Trunks SIP (Configuration PJSIP Avancée) ---
+function slugifyTrunkName(text) {
+    return String(text || '')
+        .toLowerCase()
+        .trim()
+        .replace(/^ivr-/, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'default';
+}
+
+function renderTrunksTable() {
+    const tbody = document.getElementById('trunks-tbody');
+    if (!tbody) return;
+    const rows = appState.trunks || [];
+    const regs = appState.metrics?.asterisk?.registrations || {};
+
+    if (rows.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="7" class="py-8 text-center text-slate-400 text-xs">Aucun Trunk SIP opérateur configuré. Cliquez sur « + Nouveau Trunk SIP ».</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = rows.map(t => {
+        const slug = `trunk-${slugifyTrunkName(t.name)}`;
+        const regInfo = regs[slug];
+        const isIpAuth = t.auth_mode === 'ip';
+        const wantsReg = !isIpAuth && Number(t.register) === 1;
+
+        let statusBadge = '';
+        if (Number(t.enabled ?? 1) === 0) {
+            statusBadge = `<span class="px-2.5 py-0.5 rounded-full text-xs font-medium bg-anthracite-950 text-slate-400 border border-anthracite-700">Désactivé</span>`;
+        } else if (isIpAuth || !wantsReg) {
+            statusBadge = `<span class="px-2.5 py-0.5 rounded-full text-xs font-semibold bg-cyan-500/15 text-cyan-300 border border-cyan-500/30">Peering / Sans Reg.</span>`;
+        } else if (regInfo && /Registered/i.test(regInfo.status)) {
+            statusBadge = `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30"><i class="w-1.5 h-1.5 rounded-full bg-emerald-400 animate-pulse"></i>Registered</span>`;
+        } else if (regInfo) {
+            statusBadge = `<span class="inline-flex items-center gap-1.5 px-2.5 py-0.5 rounded-full text-xs font-bold bg-amber-500/20 text-amber-300 border border-amber-500/30">${escapeHtml(regInfo.status)}</span>`;
+        } else {
+            statusBadge = `<span class="px-2.5 py-0.5 rounded-full text-xs font-medium bg-anthracite-950 text-slate-300 border border-anthracite-700">En attente Apply</span>`;
+        }
+
+        const routesArr = Array.isArray(t.did_routes) ? t.did_routes : Object.entries(t.did_routes || {}).map(([did, destination]) => ({ cid: 'Any', did, description: '', destination }));
+        const didCount = routesArr.length;
+        const blockCount = routesArr.filter(r => String(r.destination || '').startsWith('terminate-')).length;
+        const tcCount = routesArr.filter(r => Number(r.time_condition_enabled) === 1).length;
+        const paiBadges = [
+            Number(t.send_pai ?? 1) === 1 ? 'PAI' : null,
+            Number(t.send_rpid ?? 0) === 1 ? 'RPID' : null,
+            t.media_encryption && t.media_encryption !== 'no' ? t.media_encryption.toUpperCase() : null
+        ].filter(Boolean).map(b => `<span class="px-1.5 py-0.5 rounded bg-indigo-500/20 text-indigo-300 text-[10px] font-mono">${b}</span>`).join(' ');
+
+        const mohSound = (appState.sounds || []).find(s => Number(s.id) === Number(t.moh_sound_id));
+        const mohBadge = mohSound
+            ? `<span class="inline-flex items-center gap-1 px-1.5 py-0.5 rounded bg-amber-500/15 text-amber-300 border border-amber-500/30 text-[10px] font-semibold">🎵 ${escapeHtml(mohSound.name)}</span>`
+            : `<span class="text-[10px] text-slate-500">MoH : Globale</span>`;
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4">
+                    <div class="font-semibold text-white">${escapeHtml(t.name)}</div>
+                    <div class="text-[11px] font-mono text-slate-400">[${escapeHtml(slug)}]</div>
+                </td>
+                <td class="py-3.5 px-4">${statusBadge}</td>
+                <td class="py-3.5 px-4">
+                    <div class="font-mono text-xs text-indigo-300">${escapeHtml(t.host)}:${Number(t.port)}</div>
+                    ${t.outbound_proxy ? `<div class="text-[11px] font-mono text-slate-400 truncate max-w-[180px]">Proxy: ${escapeHtml(t.outbound_proxy)}</div>` : ''}
+                </td>
+                <td class="py-3.5 px-4">
+                    <div class="font-mono text-xs text-slate-200">${escapeHtml(isIpAuth ? 'Auth par IP' : (t.username || '—'))}</div>
+                    <div class="text-[11px] text-slate-400">${escapeHtml(t.from_domain || t.host)} ${paiBadges}</div>
+                </td>
+                <td class="py-3.5 px-4 text-xs">
+                    <span class="px-2 py-0.5 rounded bg-anthracite-950 text-slate-200 uppercase font-mono border border-anthracite-700">${escapeHtml(t.transport)}</span>
+                    <span class="ml-1 font-mono text-slate-300">${escapeHtml(t.codecs)}</span>
+                </td>
+                <td class="py-3.5 px-4">
+                    <div class="font-mono text-xs text-emerald-300">→ ${escapeHtml(t.inbound_dest)}</div>
+                    <div class="text-[11px] text-slate-400">
+                        ${didCount > 0 ? `<span class="text-indigo-300 font-semibold">${didCount} règle(s) entrante(s)</span>` : 'Tous numéros (Any)'}
+                        ${blockCount > 0 ? `<span class="ml-1 px-1.5 py-0.5 rounded bg-amber-500/20 text-amber-300 text-[10px] font-semibold">${blockCount} blocage(s) CID</span>` : ''}
+                        ${tcCount > 0 ? `<span class="ml-1 px-1.5 py-0.5 rounded bg-amber-500/20 text-amber-300 text-[10px] font-semibold">⏱️ ${tcCount} horaire(s)</span>` : ''}
+                    </div>
+                    <div class="mt-1">${mohBadge}</div>
+                </td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    ${wantsReg ? `<button type="button" onclick="forceRegisterTrunk('${escapeHtml(slug)}-reg')" title="Forcer l'envoi immédiat d'un SIP REGISTER vers l'opérateur pour reprendre la ligne" class="px-2 py-1 rounded-lg bg-cyan-500/15 hover:bg-cyan-500/25 border border-cyan-500/30 text-xs font-semibold text-cyan-300 transition">🔄 Re-Register</button>` : ''}
+                    <button type="button" onclick="editTrunk(${Number(t.id)}, 'inbound')" class="text-xs font-semibold text-emerald-300 hover:text-emerald-200">Routes Entrantes</button>
+                    <button type="button" onclick="editTrunk(${Number(t.id)})" class="text-xs font-semibold text-indigo-300 hover:text-indigo-200">Modifier</button>
+                    <button type="button" onclick="deleteTrunk(${Number(t.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+async function forceRegisterTrunk(regName = '*all') {
+    try {
+        const res = await apiCall('force_register_trunk', { reg_name: regName });
+        showToast(res.message, 'success');
+        await loadState(true);
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function switchTrunkModalTab(subTab) {
+    document.querySelectorAll('.trunk-subpanel').forEach(p => p.classList.add('hidden'));
+    const target = document.getElementById(`trunk-panel-${subTab}`);
+    if (target) target.classList.remove('hidden');
+
+    document.querySelectorAll('.trunk-tab-btn').forEach(btn => {
+        if (btn.dataset.trunkTab === subTab) {
+            btn.className = 'trunk-tab-btn px-3.5 py-2 text-xs font-bold rounded-t-xl bg-indigo-600 text-white transition flex items-center gap-1.5';
+        } else {
+            btn.className = 'trunk-tab-btn px-3.5 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-slate-300 hover:text-white transition flex items-center gap-1.5';
+        }
+    });
+}
+
+function toggleTrunkAuthFields(mode) {
+    const container = document.getElementById('trunk-auth-fields');
+    const form = document.getElementById('form-trunk');
+    if (!container || !form) return;
+    if (mode === 'ip') {
+        container.classList.add('opacity-40', 'pointer-events-none');
+        form.elements['register'].checked = false;
+    } else {
+        container.classList.remove('opacity-40', 'pointer-events-none');
+    }
+}
+
+function normalizeDestinationValue(rawVal) {
+    const exts = appState.extensions || [];
+    const grps = appState.groups || [];
+    let normVal = String(rawVal || '').trim();
+    if (!normVal) return 'ext-101';
+    if (normVal === 'busy') return 'terminate-busy';
+    if (normVal === 'congestion') return 'terminate-congestion';
+    if (normVal === 'zapateller') return 'terminate-zapateller';
+    if (normVal === 'hangup') return 'terminate-hangup';
+    if (/^\d+$/.test(normVal)) {
+        if (exts.some(e => String(e.extension) === normVal)) return `ext-${normVal}`;
+        if (grps.some(g => String(g.extension) === normVal)) return `grp-${normVal}`;
+    }
+    return normVal;
+}
+
+function buildDestinationOptionsHtml(selectedValue = 'ext-101') {
+    const exts = appState.extensions || [];
+    const grps = appState.groups || [];
+    const ivrs = appState.ivrs || [];
+    const sounds = appState.sounds || [];
+    const normVal = normalizeDestinationValue(selectedValue);
+
+    let html = '';
+    if (exts.length > 0) {
+        html += `<optgroup label="📱 Postes SIP (Extensions)">`;
+        exts.forEach(e => {
+            const val = `ext-${e.extension}`;
+            html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>Poste: ${escapeHtml(e.extension)} — ${escapeHtml(e.name)}</option>`;
+        });
+        html += `</optgroup>`;
+    }
+
+    if (grps.length > 0) {
+        html += `<optgroup label="👥 Ring Groups (Groupes d'appel)">`;
+        grps.forEach(g => {
+            const val = `grp-${g.extension}`;
+            html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>Ring Group: ${escapeHtml(g.extension)} — ${escapeHtml(g.name)}</option>`;
+        });
+        html += `</optgroup>`;
+    }
+
+    if (ivrs.length > 0) {
+        html += `<optgroup label="🎙️ Serveurs Vocaux (SVI / IVR)">`;
+        ivrs.forEach(i => {
+            const val = i.name;
+            html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>SVI / IVR: ${escapeHtml(i.name)} ${i.description ? '(' + escapeHtml(i.description) + ')' : ''}</option>`;
+        });
+        html += `</optgroup>`;
+    }
+
+    // Piège à Spammeurs / Musique d'attente en boucle continue (MoH)
+    const mohSounds = sounds.filter(s => s.usage_type === 'moh');
+    html += `<optgroup label="🎵 Piège à Spammeurs (Musique d'attente en boucle infinie)">`;
+    html += `<option value="moh-default" ${normVal === 'moh-default' ? 'selected' : ''}>🎵 Musique MoH générale par défaut (en boucle infinie)</option>`;
+    mohSounds.forEach(s => {
+        const val = `moh-${s.id}`;
+        html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>🎵 Musique MoH dédiée : ${escapeHtml(s.name)} [${escapeHtml(s.site_category)}]</option>`;
+    });
+    html += `</optgroup>`;
+
+    const announcements = sounds.filter(s => s.usage_type !== 'moh');
+    if (announcements.length > 0) {
+        html += `<optgroup label="📢 Annonces Vocales (Diffuser 1 fois puis raccrocher)">`;
+        announcements.forEach(s => {
+            const val = `sound-${s.id}`;
+            html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>Annonce : ${escapeHtml(s.name)} [${escapeHtml(s.site_category)}]</option>`;
+        });
+        html += `</optgroup>`;
+
+        html += `<optgroup label="👵 Piège Scammer / Fausse Voix en boucle infinie (Anti-Spam Tarpit)">`;
+        announcements.forEach(s => {
+            const val = `sound-loop-${s.id}`;
+            html += `<option value="${escapeHtml(val)}" ${normVal === val ? 'selected' : ''}>👵 Voix en boucle infinie (ex: vieille dame) : ${escapeHtml(s.name)}</option>`;
+        });
+        html += `</optgroup>`;
+    }
+
+    html += `
+        <optgroup label="🚫 Terminer l'appel (Terminate Call)">
+            <option value="terminate-hangup" ${normVal === 'terminate-hangup' || normVal === 'hangup' ? 'selected' : ''}>Raccrocher immédiatement (Hangup)</option>
+            <option value="terminate-busy" ${normVal === 'terminate-busy' || normVal === 'busy' ? 'selected' : ''}>Tonalité d'occupation (Busy)</option>
+            <option value="terminate-congestion" ${normVal === 'terminate-congestion' || normVal === 'congestion' ? 'selected' : ''}>Tonalité de congestion / réseau saturé (Congestion)</option>
+            <option value="terminate-zapateller" ${normVal === 'terminate-zapateller' || normVal === 'zapateller' ? 'selected' : ''}>Tonalité SIT Numéro non attribué (Anti-Spam / Robot)</option>
+            <option value="terminate-ringforever" ${normVal === 'terminate-ringforever' || normVal === 'ringforever' ? 'selected' : ''}>Faire sonner indéfiniment (Wait Ringing)</option>
+        </optgroup>
+    `;
+
+    return html;
+}
+
+function updateInboundRoutesBadge() {
+    const count = document.querySelectorAll('#trunk-did-container .trunk-did-row').length;
+    const badge = document.getElementById('trunk-inbound-rules-badge');
+    if (badge) badge.textContent = String(count);
+}
+
+function styleDestinationSelect(selectEl) {
+    if (!selectEl) return;
+    const val = selectEl.value || '';
+    if (val.startsWith('terminate-')) {
+        selectEl.className = 'trunk-did-dest w-full px-2.5 py-1.5 rounded-lg bg-amber-500/10 border border-amber-500/40 text-xs text-amber-300 font-semibold';
+    } else if (val.startsWith('moh-') || val.startsWith('sound-loop-')) {
+        selectEl.className = 'trunk-did-dest w-full px-2.5 py-1.5 rounded-lg bg-fuchsia-500/15 border border-fuchsia-500/40 text-xs text-fuchsia-300 font-semibold';
+    } else if (val.startsWith('grp-')) {
+        selectEl.className = 'trunk-did-dest w-full px-2.5 py-1.5 rounded-lg bg-cyan-500/10 border border-cyan-500/40 text-xs text-cyan-300 font-semibold';
+    } else {
+        selectEl.className = 'trunk-did-dest w-full px-2.5 py-1.5 rounded-lg bg-emerald-500/10 border border-emerald-500/40 text-xs text-emerald-300 font-semibold';
+    }
+}
+
+function addTrunkInboundRouteRow(cid = 'Any', did = 'Any', description = '', dest = 'ext-101', prepend = false, timeOpts = {}) {
+    const container = document.getElementById('trunk-did-container');
+    if (!container) return;
+
+    const tcEnabled = Boolean(timeOpts && timeOpts.time_condition_enabled);
+    const tcStart = (timeOpts && timeOpts.time_start) ? timeOpts.time_start : '08:30';
+    const tcFinish = (timeOpts && timeOpts.time_finish) ? timeOpts.time_finish : '18:00';
+    const tcWeekdays = (timeOpts && timeOpts.weekdays) ? timeOpts.weekdays : 'mon-fri';
+    const tcClosed = (timeOpts && timeOpts.time_dest_closed) ? timeOpts.time_dest_closed : 'terminate-hangup';
+
+    const row = document.createElement('div');
+    row.className = 'trunk-did-row border-b border-anthracite-700/60 transition hover:bg-anthracite-800/40';
+
+    row.innerHTML = `
+        <div class="grid grid-cols-12 gap-3 items-center px-4 py-2.5">
+            <div class="col-span-3">
+                <input type="text" placeholder="Any ou _0162XXXXXX" value="${escapeHtml(cid || 'Any')}"
+                    class="trunk-did-cid w-full px-3 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono">
+                <input type="hidden" value="${escapeHtml(did || 'Any')}" class="trunk-did-num">
+            </div>
+            <div class="col-span-3">
+                <input type="text" placeholder="ex: Ligne Standard" value="${escapeHtml(description)}"
+                    class="trunk-did-desc w-full px-3 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white">
+                <div class="time-badge-container mt-1"></div>
+            </div>
+            <div class="col-span-4">
+                <select class="trunk-did-dest w-full px-2.5 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white"
+                    onchange="styleDestinationSelect(this)">
+                    ${buildDestinationOptionsHtml(dest)}
+                </select>
+            </div>
+            <div class="col-span-2 flex items-center justify-end gap-1.5">
+                <button type="button" class="btn-toggle-time px-2 py-1.5 rounded-lg text-xs font-semibold border transition" title="Configurer les horaires d'ouverture (Mode Jour / Nuit)">
+                    ⏱️ <span class="hidden sm:inline">Horaires</span>
+                </button>
+                <button type="button" title="Dupliquer cette règle" class="btn-dup-route p-1.5 rounded-lg bg-anthracite-950 hover:bg-indigo-500/20 text-slate-300 hover:text-indigo-300 border border-anthracite-700 text-xs">⧉</button>
+                <button type="button" title="Supprimer cette règle" class="btn-del-route p-1.5 rounded-lg bg-anthracite-950 hover:bg-red-500/20 text-slate-300 hover:text-red-300 border border-anthracite-700 text-xs">🗑️</button>
+            </div>
+        </div>
+
+        <!-- Tiroir rétractable des conditions horaires (Mode Jour / Nuit) -->
+        <div class="time-drawer hidden px-4 pb-3.5 pt-2 border-t border-anthracite-700/50 bg-anthracite-950/80 space-y-3">
+            <div class="flex flex-wrap items-center justify-between gap-2">
+                <label class="flex items-center gap-2 cursor-pointer">
+                    <input type="checkbox" class="trunk-tc-enabled rounded bg-anthracite-900 border-anthracite-600 text-amber-500 focus:ring-0" ${tcEnabled ? 'checked' : ''}>
+                    <span class="text-xs font-bold text-amber-300">Activer la condition horaire (Mode Jour / Nuit)</span>
+                </label>
+                <span class="text-[11px] text-slate-400">Si actif, l'appel bascule automatiquement selon l'heure de réception</span>
+            </div>
+
+            <div class="time-fields-grid grid grid-cols-1 sm:grid-cols-12 gap-3 items-center ${tcEnabled ? '' : 'opacity-50 pointer-events-none'}">
+                <div class="sm:col-span-3">
+                    <label class="block text-[10px] uppercase font-bold text-slate-400 mb-1">Heures d'ouverture</label>
+                    <div class="flex items-center gap-1.5">
+                        <input type="time" class="trunk-tc-start px-2 py-1 rounded bg-anthracite-900 border border-anthracite-700 text-xs text-white" value="${escapeHtml(tcStart)}">
+                        <span class="text-slate-400 text-xs">à</span>
+                        <input type="time" class="trunk-tc-finish px-2 py-1 rounded bg-anthracite-900 border border-anthracite-700 text-xs text-white" value="${escapeHtml(tcFinish)}">
+                    </div>
+                </div>
+
+                <div class="sm:col-span-4">
+                    <label class="block text-[10px] uppercase font-bold text-slate-400 mb-1">Jours actifs</label>
+                    <select class="trunk-tc-weekdays w-full px-2 py-1 rounded bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                        <option value="mon-fri" ${tcWeekdays === 'mon-fri' ? 'selected' : ''}>Du Lundi au Vendredi (Semaine)</option>
+                        <option value="mon-sat" ${tcWeekdays === 'mon-sat' ? 'selected' : ''}>Du Lundi au Samedi</option>
+                        <option value="*" ${tcWeekdays === '*' ? 'selected' : ''}>Tous les jours (7j/7)</option>
+                        <option value="sat-sun" ${tcWeekdays === 'sat-sun' ? 'selected' : ''}>Week-end uniquement (Sam-Dim)</option>
+                    </select>
+                </div>
+
+                <div class="sm:col-span-5">
+                    <label class="block text-[10px] uppercase font-bold text-red-400 mb-1">Destination si FERMÉ (Hors horaires)</label>
+                    <select class="trunk-tc-closed-dest w-full px-2.5 py-1 rounded bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                        ${buildDestinationOptionsHtml(tcClosed)}
+                    </select>
+                </div>
+            </div>
+        </div>
+    `;
+
+    const selectEl = row.querySelector('.trunk-did-dest');
+    styleDestinationSelect(selectEl);
+
+    const tcCheck = row.querySelector('.trunk-tc-enabled');
+    const timeDrawer = row.querySelector('.time-drawer');
+    const timeFields = row.querySelector('.time-fields-grid');
+    const toggleBtn = row.querySelector('.btn-toggle-time');
+    const badgeContainer = row.querySelector('.time-badge-container');
+    const tcStartInput = row.querySelector('.trunk-tc-start');
+    const tcFinishInput = row.querySelector('.trunk-tc-finish');
+    const tcWeekdaysSelect = row.querySelector('.trunk-tc-weekdays');
+
+    function updateTimeUi() {
+        const isEnabled = tcCheck.checked;
+        timeFields.classList.toggle('opacity-50', !isEnabled);
+        timeFields.classList.toggle('pointer-events-none', !isEnabled);
+
+        if (isEnabled) {
+            toggleBtn.className = 'btn-toggle-time px-2 py-1.5 rounded-lg text-xs font-semibold bg-amber-500/20 text-amber-300 border border-amber-500/40 transition shadow-sm';
+            const daysLabel = tcWeekdaysSelect.value === 'mon-fri' ? 'Lun-Ven' : (tcWeekdaysSelect.value === 'mon-sat' ? 'Lun-Sam' : (tcWeekdaysSelect.value === '*' ? '7j/7' : 'Sam-Dim'));
+            badgeContainer.innerHTML = `<span class="inline-flex items-center gap-1 px-1.5 py-0.5 rounded text-[10px] font-semibold bg-amber-500/15 text-amber-300 border border-amber-500/30">⏱️ ${escapeHtml(tcStartInput.value)}-${escapeHtml(tcFinishInput.value)} (${escapeHtml(daysLabel)})</span>`;
+        } else {
+            toggleBtn.className = 'btn-toggle-time px-2 py-1.5 rounded-lg text-xs font-semibold bg-anthracite-950 hover:bg-anthracite-900 text-slate-400 hover:text-white border border-anthracite-700 transition';
+            badgeContainer.innerHTML = '';
+        }
+    }
+
+    tcCheck.addEventListener('change', updateTimeUi);
+    tcStartInput.addEventListener('change', updateTimeUi);
+    tcFinishInput.addEventListener('change', updateTimeUi);
+    tcWeekdaysSelect.addEventListener('change', updateTimeUi);
+
+    toggleBtn.addEventListener('click', () => {
+        timeDrawer.classList.toggle('hidden');
+    });
+
+    updateTimeUi();
+
+    row.querySelector('.btn-del-route').addEventListener('click', () => {
+        row.remove();
+        updateInboundRoutesBadge();
+    });
+
+    row.querySelector('.btn-dup-route').addEventListener('click', () => {
+        const curCid = row.querySelector('.trunk-did-cid').value;
+        const curDid = row.querySelector('.trunk-did-num').value;
+        const curDesc = row.querySelector('.trunk-did-desc').value + ' (Copie)';
+        const curDest = row.querySelector('.trunk-did-dest').value;
+        const curTcOpts = {
+            time_condition_enabled: tcCheck.checked,
+            time_start: tcStartInput.value,
+            time_finish: tcFinishInput.value,
+            weekdays: tcWeekdaysSelect.value,
+            time_dest_closed: row.querySelector('.trunk-tc-closed-dest').value
+        };
+        addTrunkInboundRouteRow(curCid, curDid, curDesc, curDest, false, curTcOpts);
+    });
+
+    if (prepend && container.firstChild) {
+        container.insertBefore(row, container.firstChild);
+    } else {
+        container.appendChild(row);
+    }
+    updateInboundRoutesBadge();
+}
+
+function addArcepSpamBlockPreset() {
+    const spamRanges = [
+        { cid: '_0162XXXXXX', desc: 'Block 0162 Démarchage' },
+        { cid: '_0163XXXXXX', desc: 'Block 0163 Démarchage' },
+        { cid: '_0270XXXXXX', desc: 'Block 0270 Démarchage' },
+        { cid: '_0271XXXXXX', desc: 'Block 0271 Démarchage' },
+        { cid: '_0377XXXXXX', desc: 'Block 0377 Démarchage' },
+        { cid: '_0378XXXXXX', desc: 'Block 0378 Démarchage' },
+        { cid: '_0424XXXXXX', desc: 'Block 0424 Démarchage' },
+        { cid: '_0425XXXXXX', desc: 'Block 0425 Démarchage' },
+        { cid: '_0568XXXXXX', desc: 'Block 0568 Démarchage' },
+        { cid: '_0569XXXXXX', desc: 'Block 0569 Démarchage' },
+        { cid: '_0948XXXXXX', desc: 'Block 0948 Démarchage' },
+    ];
+
+    const existingCids = new Set(
+        Array.from(document.querySelectorAll('#trunk-did-container .trunk-did-cid')).map(el => el.value.trim())
+    );
+
+    let added = 0;
+    spamRanges.forEach(item => {
+        if (!existingCids.has(item.cid)) {
+            addTrunkInboundRouteRow(item.cid, 'Any', item.desc, 'terminate-busy', false);
+            added++;
+        }
+    });
+
+    if (added > 0) {
+        showToast(`${added} plages de démarchage ajoutées en mode « Terminate Call: Occupation » !`, 'success');
+    } else {
+        showToast('Toutes les plages anti-démarchage sont déjà présentes dans la liste.', 'info');
+    }
+}
+
+function filterInboundRoutesRows(query) {
+    const q = String(query || '').toLowerCase().trim();
+    document.querySelectorAll('#trunk-did-container .trunk-did-row').forEach(row => {
+        const cid = row.querySelector('.trunk-did-cid')?.value.toLowerCase() || '';
+        const did = row.querySelector('.trunk-did-num')?.value.toLowerCase() || '';
+        const desc = row.querySelector('.trunk-did-desc')?.value.toLowerCase() || '';
+        const dest = row.querySelector('.trunk-did-dest')?.selectedOptions?.[0]?.textContent?.toLowerCase() || '';
+        const match = !q || cid.includes(q) || did.includes(q) || desc.includes(q) || dest.includes(q);
+        row.classList.toggle('hidden', !match);
+    });
+}
+
+function syncTrunkHostDomain(hostVal) {
+    const form = document.getElementById('form-trunk');
+    if (!form) return;
+    // Laisse from_domain vide pour qu'il prenne automatiquement la valeur exacte de host
+    form.elements['from_domain'].value = '';
+}
+
+function populateInboundDestDropdown(selectedValue = '101') {
+    const select = document.getElementById('trunk-inbound-select');
+    const form = document.getElementById('form-trunk');
+    if (!select || !form) return;
+
+    select.innerHTML = buildDestinationOptionsHtml(selectedValue);
+    form.elements['inbound_dest'].value = select.value;
+}
+
+function syncInboundDestSelect(val) {
+    const form = document.getElementById('form-trunk');
+    if (form) {
+        form.elements['inbound_dest'].value = val;
+    }
+}
+
+function toggleFreePbxImporter() {
+    const box = document.getElementById('freepbx-importer-box');
+    if (box) box.classList.toggle('hidden');
+}
+
+function parseFreePbxConfig() {
+    const raw = (document.getElementById('freepbx-paste-input')?.value || '').trim();
+    const form = document.getElementById('form-trunk');
+    if (!raw || !form) return;
+
+    // 1. Test format Register String : user:secret@host:port/contact
+    const regMatch = raw.match(/^(?:sip:)?([^:@\s]+):([^@\s]+)@([^:\/\s]+)(?::(\d+))?(?:\/(\S+))?$/i);
+    if (regMatch) {
+        const [, user, secret, host, port, contact] = regMatch;
+        if (!form.elements['name'].value) form.elements['name'].value = host.split('.')[0] + '-trunk';
+        form.elements['host'].value = host;
+        form.elements['port'].value = port || 5060;
+        form.elements['username'].value = user;
+        form.elements['secret'].value = secret;
+        form.elements['from_domain'].value = '';
+        if (contact) form.elements['contact_user'].value = contact;
+        form.elements['register'].checked = true;
+        toggleFreePbxImporter();
+        showToast('Register String FreePBX convertie et appliquée !', 'success');
+        return;
+    }
+
+    // 2. Format PEER Details (clé=valeur)
+    const lines = raw.split(/\r?\n/);
+    let found = 0;
+    lines.forEach(line => {
+        const m = line.match(/^\s*([a-zA-Z0-9_]+)\s*=\s*(.+?)\s*$/);
+        if (!m) return;
+        const key = m[1].toLowerCase();
+        const val = m[2].trim();
+        found++;
+
+        if (key === 'host') form.elements['host'].value = val;
+        else if (key === 'port') form.elements['port'].value = val;
+        else if (key === 'username' || key === 'defaultuser') form.elements['username'].value = val;
+        else if (key === 'authuser' || key === 'auth') form.elements['auth_username'].value = val;
+        else if (key === 'secret' || key === 'password') form.elements['secret'].value = val;
+        else if (key === 'fromuser') form.elements['from_user'].value = val;
+        else if (key === 'fromdomain') form.elements['from_domain'].value = val;
+        else if (key === 'context') {
+            if (val.includes('toheader')) form.elements['context'].value = 'from-pstn-toheader';
+            else form.elements['context'].value = 'from-external';
+        }
+        else if (key === 'outboundproxy') form.elements['outbound_proxy'].value = val;
+    });
+
+    if (found > 0) {
+        if (!form.elements['name'].value && form.elements['host'].value) {
+            form.elements['name'].value = form.elements['host'].value.split('.')[0] + '-trunk';
+        }
+        toggleFreePbxImporter();
+        showToast(`${found} paramètres FreePBX convertis vers PJSIP !`, 'success');
+    } else {
+        showToast('Format non reconnu. Collez user:pass@host ou host=...', 'error');
+    }
+}
+
+function applyTrunkArchitecture(arch) {
+    const form = document.getElementById('form-trunk');
+    if (!form) return;
+
+    const architectures = {
+        register_auth: {
+            label: 'Trunk avec Enregistrement (REGISTER + Auth)',
+            port: 5060,
+            transport: 'udp',
+            auth_mode: 'userpass',
+            register: true,
+            line_support: true,
+            media_encryption: 'no',
+            nat_symmetric: true,
+            qualify_frequency: 60
+        },
+        ip_peering: {
+            label: 'Peering IP / SBC / Passerelle (Sans REGISTER)',
+            port: 5060,
+            transport: 'udp',
+            auth_mode: 'ip',
+            register: false,
+            line_support: false,
+            media_encryption: 'no',
+            nat_symmetric: true,
+            qualify_frequency: 30
+        },
+        tls_srtp: {
+            label: 'Trunk Sécurisé (TLS 5061 + SRTP SDES)',
+            port: 5061,
+            transport: 'tls',
+            auth_mode: 'userpass',
+            register: true,
+            line_support: true,
+            media_encryption: 'sdes',
+            nat_symmetric: true,
+            qualify_frequency: 60
+        }
+    };
+
+    const a = architectures[arch];
+    if (!a) return;
+
+    // Ne jamais écraser le nom, l'hôte, les identifiants ou le from_domain de l'utilisateur !
+    form.elements['port'].value = a.port;
+    form.elements['transport'].value = a.transport;
+    form.querySelectorAll('input[name="auth_mode"]').forEach(r => { r.checked = (r.value === a.auth_mode); });
+    toggleTrunkAuthFields(a.auth_mode);
+
+    form.elements['register'].checked = a.register;
+    form.elements['line_support'].checked = a.line_support;
+    form.elements['media_encryption'].value = a.media_encryption;
+    form.elements['nat_symmetric'].checked = a.nat_symmetric;
+    form.elements['qualify_frequency'].value = a.qualify_frequency;
+
+    showToast(`Architecture « ${a.label} » appliquée sans écraser votre serveur ni vos identifiants.`, 'info');
+}
+
+function openTrunkModal(trunk = null) {
+    const form = document.getElementById('form-trunk');
+    form.reset();
+    switchTrunkModalTab('general');
+    document.getElementById('freepbx-importer-box')?.classList.add('hidden');
+    document.getElementById('modal-trunk-title').textContent = trunk ? `Modifier le Trunk ${trunk.name}` : 'Nouveau Trunk SIP / PJSIP Universel';
+
+    form.elements['id'].value = trunk ? trunk.id : '';
+    form.elements['name'].value = trunk ? trunk.name : '';
+    form.elements['host'].value = trunk ? trunk.host : '';
+    form.elements['port'].value = trunk ? (trunk.port ?? 5060) : 5060;
+    form.elements['outbound_proxy'].value = trunk ? (trunk.outbound_proxy ?? '') : '';
+    form.elements['transport'].value = trunk ? (trunk.transport ?? 'udp') : 'udp';
+
+    const authMode = trunk ? (trunk.auth_mode || 'userpass') : 'userpass';
+    form.querySelectorAll('input[name="auth_mode"]').forEach(r => {
+        r.checked = (r.value === authMode);
+    });
+    toggleTrunkAuthFields(authMode);
+
+    form.elements['username'].value = trunk ? (trunk.username ?? '') : '';
+    form.elements['auth_username'].value = trunk ? (trunk.auth_username ?? '') : '';
+    form.elements['secret'].value = trunk ? (trunk.secret ?? '') : '';
+    form.elements['enabled'].checked = trunk ? Number(trunk.enabled ?? 1) === 1 : true;
+
+    // Onglet 2 : Registration & Identité SIP
+    form.elements['register'].checked = trunk ? Number(trunk.register ?? 1) === 1 : true;
+    form.elements['line_support'].checked = trunk ? Number(trunk.line_support ?? 1) === 1 : true;
+    form.elements['contact_user'].value = trunk ? (trunk.contact_user ?? '') : '';
+    form.elements['expiration'].value = trunk ? (trunk.expiration ?? 3600) : 3600;
+    form.elements['retry_interval'].value = trunk ? (trunk.retry_interval ?? 60) : 60;
+    form.elements['max_retries'].value = trunk ? (trunk.max_retries ?? 10000) : 10000;
+    form.elements['forbidden_retry_interval'].value = trunk ? (trunk.forbidden_retry_interval ?? 600) : 600;
+    form.elements['fatal_retry_interval'].value = trunk ? (trunk.fatal_retry_interval ?? 0) : 0;
+    form.elements['server_uri'].value = trunk ? (trunk.server_uri ?? '') : '';
+    form.elements['client_uri'].value = trunk ? (trunk.client_uri ?? '') : '';
+    form.elements['from_user'].value = trunk ? (trunk.from_user ?? '') : '';
+    form.elements['from_domain'].value = trunk ? (trunk.from_domain ?? '') : '';
+    form.elements['outbound_callerid'].value = trunk ? (trunk.outbound_callerid ?? '') : '';
+    form.elements['send_pai'].checked = trunk ? Number(trunk.send_pai ?? 1) === 1 : true;
+    form.elements['send_rpid'].checked = trunk ? Number(trunk.send_rpid ?? 0) === 1 : false;
+    form.elements['send_diversion'].checked = trunk ? Number(trunk.send_diversion ?? 1) === 1 : true;
+    form.elements['trust_id_inbound'].checked = trunk ? Number(trunk.trust_id_inbound ?? 1) === 1 : true;
+
+    // Onglet 3 : Codecs, NAT, Timers, T.38 & Identify
+    form.elements['codecs'].value = trunk ? (trunk.codecs || 'alaw,ulaw,g722') : 'alaw,ulaw,g722';
+    form.elements['dtmf_mode'].value = trunk ? (trunk.dtmf_mode || 'rfc4733') : 'rfc4733';
+    form.elements['media_encryption'].value = trunk ? (trunk.media_encryption || 'no') : 'no';
+    form.elements['qualify_frequency'].value = trunk ? (trunk.qualify_frequency ?? 60) : 60;
+    form.elements['rtp_keepalive'].value = trunk ? (trunk.rtp_keepalive ?? 15) : 15;
+    form.elements['max_channels'].value = trunk ? (trunk.max_channels ?? 0) : 0;
+    form.elements['timers'].value = trunk ? (trunk.timers || 'yes') : 'yes';
+    form.elements['t38_udptl'].value = trunk ? (trunk.t38_udptl || 'no') : 'no';
+    form.elements['language'].value = trunk ? (trunk.language || 'fr') : 'fr';
+    form.elements['nat_symmetric'].checked = trunk ? Number(trunk.nat_symmetric ?? 1) === 1 : true;
+    form.elements['direct_media'].checked = trunk ? Number(trunk.direct_media ?? 0) === 1 : false;
+    form.elements['inband_progress'].checked = trunk ? Number(trunk.inband_progress ?? 0) === 1 : false;
+    form.elements['fax_detect'].checked = trunk ? Number(trunk.fax_detect ?? 0) === 1 : false;
+    form.elements['match_ips'].value = trunk ? (trunk.match_ips ?? '') : '';
+
+    // Contexte & Destination entrante (Totalement libres + assistés)
+    form.elements['context'].value = trunk ? (trunk.context || 'from-pstn-toheader') : 'from-pstn-toheader';
+    populateInboundDestDropdown(trunk ? (trunk.inbound_dest || '101') : '101');
+
+    // Musique d'attente (MoH) spécifique à ce Trunk
+    const mohSelect = document.getElementById('trunk-moh-sound-id');
+    if (mohSelect) {
+        const mohSounds = (appState.sounds || []).filter(s => s.usage_type === 'moh');
+        const curMohId = trunk ? Number(trunk.moh_sound_id || 0) : 0;
+        let opts = `<option value="0" ${curMohId === 0 ? 'selected' : ''}>🌐 Hériter de la musique générale par défaut</option>`;
+        mohSounds.forEach(s => {
+            const isSel = (Number(s.id) === curMohId) ? 'selected' : '';
+            opts += `<option value="${s.id}" ${isSel}>🎵 ${escapeHtml(s.name)} (${escapeHtml(s.site_category || 'Global')})</option>`;
+        });
+        mohSelect.innerHTML = opts;
+    }
+
+    // Onglet 4 : Routage SDA & Directives PJSIP Natives ([endpoint], [registration], [aor])
+    form.elements['outbound_prefix'].value = trunk ? (trunk.outbound_prefix ?? '') : '';
+    form.elements['custom_endpoint_params'].value = trunk ? (trunk.custom_endpoint_params ?? '') : '';
+    form.elements['custom_reg_params'].value = trunk ? (trunk.custom_reg_params ?? '') : '';
+    form.elements['custom_aor_params'].value = trunk ? (trunk.custom_aor_params ?? '') : '';
+
+    const filterInput = document.getElementById('inbound-routes-filter');
+    if (filterInput) filterInput.value = '';
+
+    const didContainer = document.getElementById('trunk-did-container');
+    if (didContainer) {
+        didContainer.innerHTML = '';
+        const rawRoutes = trunk && trunk.did_routes ? trunk.did_routes : [];
+        let routesList = [];
+
+        if (Array.isArray(rawRoutes)) {
+            routesList = rawRoutes;
+        } else if (typeof rawRoutes === 'object' && rawRoutes !== null) {
+            routesList = Object.entries(rawRoutes).map(([did, destination]) => ({
+                cid: 'Any',
+                did,
+                description: `SDA ${did}`,
+                destination
+            }));
+        }
+
+        if (routesList.length === 0) {
+            const defDest = trunk ? (trunk.inbound_dest || 'ext-101') : 'ext-101';
+            const defDesc = trunk ? `Ligne ${trunk.name}` : 'Route Principale';
+            addTrunkInboundRouteRow('Any', 'Any', defDesc, defDest, false);
+        } else {
+            routesList.forEach(r => {
+                addTrunkInboundRouteRow(
+                    r.cid || 'Any',
+                    r.did || 'Any',
+                    r.description || '',
+                    r.destination || 'ext-101',
+                    false,
+                    {
+                        time_condition_enabled: Boolean(Number(r.time_condition_enabled)),
+                        time_start: r.time_start || '08:30',
+                        time_finish: r.time_finish || '18:00',
+                        weekdays: r.weekdays || 'mon-fri',
+                        time_dest_closed: r.time_dest_closed || 'terminate-hangup'
+                    }
+                );
+            });
+        }
+    }
+
+    openModal('modal-trunk');
+}
+
+function editTrunk(id, initialTab = 'general') {
+    const trunk = (appState.trunks || []).find(t => Number(t.id) === Number(id));
+    if (trunk) {
+        openTrunkModal(trunk);
+        if (initialTab && initialTab !== 'general') {
+            switchTrunkModalTab(initialTab);
+        }
+    }
+}
+
+async function deleteTrunk(id, optName = null) {
+    const t = (appState.trunks || []).find(tr => Number(tr.id) === Number(id));
+    const name = optName || (t ? t.name : 'ce trunk');
+    if (!confirm(`Supprimer le Trunk SIP ${name} ?`)) return;
+    try {
+        const res = await apiCall('delete_trunk', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- 3B. Rendu & CRUD Routes Sortantes (Outbound Routes & Failover Trunks) ---
+function renderOutboundRoutesTable() {
+    const tbody = document.getElementById('outbound-routes-tbody');
+    if (!tbody) return;
+    const routes = appState.outbound_routes || [];
+
+    if (routes.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="7" class="py-8 text-center text-slate-400 text-xs">Aucune route sortante configurée. Cliquez sur « + Ajout route sortante ».</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = routes.map((r, idx) => {
+        const trunkSeq = Array.isArray(r.trunk_sequence) ? r.trunk_sequence : [];
+        const trunkBadges = trunkSeq.length > 0
+            ? trunkSeq.map((t, tIdx) => `
+                <span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-lg ${tIdx === 0 ? 'bg-indigo-500/20 text-indigo-200 border border-indigo-500/30 font-bold' : 'bg-anthracite-950 text-slate-300 border border-anthracite-700'} text-xs font-mono">
+                    <span class="text-[10px] text-slate-400">${tIdx + 1}.</span>${escapeHtml(t)}
+                </span>
+            `).join(' <span class="text-slate-500 text-xs">→</span> ')
+            : `<span class="text-amber-400 text-xs font-semibold">⚠️ Aucun Trunk associé</span>`;
+
+        const isRestricted = r.permission_mode === 'restricted';
+        const allowedGrps = Array.isArray(r.allowed_groups) ? r.allowed_groups : [];
+        const allowedExts = Array.isArray(r.allowed_extensions) ? r.allowed_extensions : [];
+
+        let permBadge = '';
+        if (!isRestricted) {
+            permBadge = `<span class="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-semibold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">✓ Tous Postes & Groupes</span>`;
+        } else {
+            const grpTags = allowedGrps.map(g => `<span class="px-1.5 py-0.2 rounded bg-cyan-500/20 text-cyan-300 text-[11px] font-bold">Grp ${escapeHtml(g)}</span>`).join(' ');
+            const extTags = allowedExts.length > 0 ? `<span class="text-[11px] text-indigo-300 font-mono">${allowedExts.length} poste(s)</span>` : '';
+            permBadge = `
+                <div class="space-y-1">
+                    <span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-bold bg-cyan-500/15 text-cyan-300 border border-cyan-500/30">Restreint</span>
+                    <div class="flex flex-wrap gap-1">${grpTags} ${extTags}</div>
+                </div>
+            `;
+        }
+
+        const patterns = Array.isArray(r.dial_patterns) ? r.dial_patterns : [];
+        const patCount = patterns.length;
+        const patPreview = patterns.slice(0, 2).map(p => escapeHtml(p.match_pattern || '')).filter(Boolean).join(', ');
+
+        const rTypeBadge = r.route_type === 'emergency'
+            ? `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/40">🚑 Urgence</span>`
+            : (r.route_type === 'intracompany'
+                ? `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/40">Intra</span>`
+                : `<span class="px-2 py-0.5 rounded-full text-[10px] font-medium bg-anthracite-950 text-slate-300 border border-anthracite-700">Standard</span>`);
+
+        const isFirst = idx === 0;
+        const isLast = idx === routes.length - 1;
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4">
+                    <div class="flex items-center gap-1">
+                        <span class="w-6 h-6 rounded-lg bg-indigo-600/30 border border-indigo-500/40 text-indigo-300 font-mono font-bold text-xs flex items-center justify-center">#${Number(r.priority)}</span>
+                        <div class="flex flex-col gap-0.5">
+                            <button type="button" onclick="reorderOutboundRoute(${Number(r.id)}, 'up')" ${isFirst ? 'disabled class="opacity-20 cursor-not-allowed"' : 'class="hover:text-white text-slate-400"'} title="Monter">▲</button>
+                            <button type="button" onclick="reorderOutboundRoute(${Number(r.id)}, 'down')" ${isLast ? 'disabled class="opacity-20 cursor-not-allowed"' : 'class="hover:text-white text-slate-400"'} title="Descendre">▼</button>
+                        </div>
+                    </div>
+                </td>
+                <td class="py-3.5 px-4">
+                    <div class="font-bold text-white text-sm flex items-center gap-2">
+                        <span>${escapeHtml(r.name)}</span>
+                        ${rTypeBadge}
+                    </div>
+                </td>
+                <td class="py-3.5 px-4 font-mono text-xs text-indigo-300">
+                    ${r.outbound_callerid ? escapeHtml(r.outbound_callerid) : '<span class="text-slate-500 italic">CID du poste ou du trunk</span>'}
+                    ${Number(r.override_ext_cid) === 1 ? '<span class="ml-1 text-[10px] text-amber-300 font-bold">(Force)</span>' : ''}
+                </td>
+                <td class="py-3.5 px-4">
+                    <div class="flex flex-wrap items-center gap-1">${trunkBadges}</div>
+                </td>
+                <td class="py-3.5 px-4">${permBadge}</td>
+                <td class="py-3.5 px-4">
+                    <div class="text-xs font-semibold text-slate-200">${patCount} masque(s)</div>
+                    <div class="text-[11px] font-mono text-slate-400 truncate max-w-[160px]">${patPreview}${patCount > 2 ? '...' : ''}</div>
+                </td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    <button type="button" onclick="editOutboundRoute(${Number(r.id)})" class="text-xs font-semibold text-emerald-300 hover:text-emerald-200">Éditer</button>
+                    <button type="button" onclick="deleteOutboundRoute(${Number(r.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+let activeObAllowedExts = new Set();
+let activeObBlockedExts = new Set();
+
+function switchOutboundModalTab(tabKey) {
+    document.querySelectorAll('.ob-subpanel').forEach(p => p.classList.add('hidden'));
+    const target = document.getElementById(`ob-panel-${tabKey}`);
+    if (target) target.classList.remove('hidden');
+
+    document.querySelectorAll('.ob-tab-btn').forEach(btn => {
+        if (btn.dataset.obTab === tabKey) {
+            btn.className = 'ob-tab-btn px-4 py-2 text-xs font-bold rounded-t-xl bg-indigo-600 text-white transition flex items-center gap-1.5';
+        } else {
+            btn.className = 'ob-tab-btn px-4 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-slate-300 hover:text-white transition flex items-center gap-1.5';
+        }
+    });
+}
+
+function openOutboundRouteModal(route = null) {
+    const form = document.getElementById('form-outbound');
+    form.reset();
+    document.getElementById('modal-outbound-title').textContent = route ? `Éditer la Route Sortante : ${route.name}` : 'Ajout Route Sortante';
+
+    form.elements['id'].value = route ? route.id : '';
+    form.elements['name'].value = route ? route.name : '';
+    form.elements['outbound_callerid'].value = route ? route.outbound_callerid : '';
+    form.elements['priority'].value = route ? route.priority : ((appState.outbound_routes || []).length + 1);
+    form.elements['route_password'].value = route ? route.route_password : '';
+    form.elements['enabled'].checked = route ? Number(route.enabled) === 1 : true;
+    form.elements['continue_next_route'].checked = route ? Number(route.continue_next_route) === 1 : true;
+
+    // Radios
+    const overrideCid = route ? String(route.override_ext_cid) : '0';
+    form.querySelectorAll('input[name="override_ext_cid"]').forEach(r => r.checked = (r.value === overrideCid));
+
+    const routeType = route ? route.route_type : 'normal';
+    form.querySelectorAll('input[name="route_type"]').forEach(r => r.checked = (r.value === routeType));
+
+    const permMode = route ? route.permission_mode : 'all';
+    form.querySelectorAll('input[name="permission_mode"]').forEach(r => r.checked = (r.value === permMode));
+    toggleOutboundPermissionMode(permMode);
+
+    const recMode = route ? route.record_mode : 'dontcare';
+    form.querySelectorAll('input[name="record_mode"]').forEach(r => r.checked = (r.value === recMode));
+
+    // Destination sur congestion
+    const congSel = document.getElementById('ob-congestion-dest-select');
+    if (congSel) {
+        congSel.innerHTML = `
+            <option value="terminate-congestion" ${(!route || route.congestion_dest === 'terminate-congestion') ? 'selected' : ''}>Congestion (Tonalité réseau saturé)</option>
+            <option value="terminate-busy" ${route?.congestion_dest === 'terminate-busy' ? 'selected' : ''}>Busy (Occupation définitive)</option>
+            <option value="terminate-hangup" ${route?.congestion_dest === 'terminate-hangup' ? 'selected' : ''}>Hangup (Raccrocher)</option>
+        `;
+    }
+
+    // Musique d'attente (MOH)
+    const mohSel = document.getElementById('ob-musicclass-select');
+    if (mohSel) {
+        const curMoh = route ? (route.moh_class || 'default') : 'default';
+        const mohSounds = (appState.sounds || []).filter(s => s.usage_type === 'moh');
+        let mohOpts = `<option value="default" ${curMoh === 'default' ? 'selected' : ''}>Défaut (Standard)</option>`;
+        mohSounds.forEach(s => {
+            const sSlug = slugifyTrunkName(s.site_category || 'global');
+            const cName = (sSlug === 'global' || sSlug === 'default') ? 'default' : `moh-${sSlug}`;
+            if (cName !== 'default') {
+                mohOpts += `<option value="${cName}" ${curMoh === cName ? 'selected' : ''}>${escapeHtml(s.name)} [${escapeHtml(s.site_category)}]</option>`;
+            }
+        });
+        mohSel.innerHTML = mohOpts;
+    }
+
+    // Séquence Trunks
+    const tSeqContainer = document.getElementById('ob-trunk-seq-container');
+    tSeqContainer.innerHTML = '';
+    const initialTrunks = route && Array.isArray(route.trunk_sequence) && route.trunk_sequence.length > 0
+        ? route.trunk_sequence
+        : [(appState.trunks?.[0]?.name || '')];
+    initialTrunks.forEach(tName => addOutboundTrunkSeqRow(tName));
+
+    // Dial Patterns
+    const pContainer = document.getElementById('ob-patterns-container');
+    pContainer.innerHTML = '';
+    const initialPatterns = route && Array.isArray(route.dial_patterns) && route.dial_patterns.length > 0
+        ? route.dial_patterns
+        : [
+            { prepend: '', prefix: '', match_pattern: '0[1-59]XXXXXXXX', callerid: '' },
+            { prepend: '', prefix: '', match_pattern: '0[67]XXXXXXXX', callerid: '' }
+        ];
+    initialPatterns.forEach(p => addOutboundPatternRow(p.prepend, p.prefix, p.match_pattern, p.callerid));
+    updateOutboundPatternsBadge();
+
+    // Groupes d'extensions autorisés (Sites & Droits Sortants)
+    const grpsContainer = document.getElementById('ob-allowed-groups-container');
+    const allowedGrpsSet = new Set(route && Array.isArray(route.allowed_groups) ? route.allowed_groups.map(String) : []);
+    const groups = appState.extension_groups || [];
+    if (groups.length === 0) {
+        grpsContainer.innerHTML = `<span class="text-slate-500 text-xs col-span-3">Aucun groupe d'extensions configuré. Allez dans « Groupes » > « Groupes d'extensions » pour créer le Groupe Nice, Groupe Paris, etc.</span>`;
+    } else {
+        grpsContainer.innerHTML = groups.map(g => {
+            const isChecked = allowedGrpsSet.has(String(g.id)) || allowedGrpsSet.has(String(g.name));
+            const mCount = Array.isArray(g.members) ? g.members.length : 0;
+            return `
+                <label class="flex items-center gap-2.5 p-2.5 rounded-xl bg-anthracite-900 border border-anthracite-700 hover:border-cyan-400 cursor-pointer">
+                    <input type="checkbox" name="ob_allowed_groups[]" value="${escapeHtml(g.name)}" ${isChecked ? 'checked' : ''} class="rounded bg-anthracite-950 border-anthracite-600">
+                    <div class="leading-tight">
+                        <div class="text-xs font-bold text-white">${escapeHtml(g.name)}</div>
+                        <div class="text-[10px] text-cyan-300 font-mono">${mCount} poste(s)${g.description ? ` • ${escapeHtml(g.description)}` : ''}</div>
+                    </div>
+                </label>
+            `;
+        }).join('');
+    }
+
+    // Extension Routing (Allowed Extensions <-> Blocked Extensions)
+    const allExts = appState.extensions || [];
+    const routeAllowedExts = route && Array.isArray(route.allowed_extensions) ? route.allowed_extensions.map(String) : null;
+    activeObAllowedExts = new Set();
+    activeObBlockedExts = new Set();
+
+    allExts.forEach(e => {
+        const eStr = String(e.extension);
+        if (routeAllowedExts === null) {
+            // Par défaut, tous autorisés
+            activeObAllowedExts.add(eStr);
+        } else if (routeAllowedExts.includes(eStr)) {
+            activeObAllowedExts.add(eStr);
+        } else {
+            activeObBlockedExts.add(eStr);
+        }
+    });
+
+    renderOutboundExtensionBoxes();
+    switchOutboundModalTab('settings');
+    openModal('modal-outbound');
+}
+
+function editOutboundRoute(id) {
+    const route = (appState.outbound_routes || []).find(r => Number(r.id) === Number(id));
+    if (route) openOutboundRouteModal(route);
+}
+
+async function deleteOutboundRoute(id, optName = null) {
+    const r = (appState.outbound_routes || []).find(rt => Number(rt.id) === Number(id));
+    const name = optName || (r ? r.name : 'cette route');
+    if (!confirm(`Supprimer définitivement la Route Sortante « ${name} » ?`)) return;
+    try {
+        const res = await apiCall('delete_outbound_route', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function reorderOutboundRoute(id, direction) {
+    try {
+        const res = await apiCall('reorder_outbound_route', { id, direction });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function addOutboundTrunkSeqRow(selectedTrunk = '') {
+    const container = document.getElementById('ob-trunk-seq-container');
+    if (!container) return;
+    const trunks = appState.trunks || [];
+
+    const row = document.createElement('div');
+    row.className = 'flex items-center gap-2 ob-trunk-seq-row';
+
+    const optsHtml = trunks.map(t => {
+        const isSel = (t.name === selectedTrunk) || (!selectedTrunk && trunks.indexOf(t) === 0);
+        return `<option value="${escapeHtml(t.name)}" ${isSel ? 'selected' : ''}>${escapeHtml(t.name)} (${escapeHtml(t.host)}:${Number(t.port)})</option>`;
+    }).join('');
+
+    const currentCount = container.querySelectorAll('.ob-trunk-seq-row').length + 1;
+    row.innerHTML = `
+        <span class="w-7 h-7 rounded-lg bg-indigo-500/20 text-indigo-300 border border-indigo-500/30 font-bold text-xs flex items-center justify-center shrink-0">
+            ${currentCount}
+        </span>
+        <select class="ob-trunk-select flex-1 px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-medium">
+            ${optsHtml || '<option value="">Aucun Trunk disponible (Créez un Trunk)</option>'}
+        </select>
+        <button type="button" class="btn-del-trunk-row p-2 rounded-lg bg-anthracite-900 hover:bg-red-500/20 text-slate-400 hover:text-red-300 border border-anthracite-700 text-xs">🗑️</button>
+    `;
+
+    row.querySelector('.btn-del-trunk-row').addEventListener('click', () => {
+        if (container.querySelectorAll('.ob-trunk-seq-row').length <= 1) {
+            showToast('Une route sortante doit avoir au moins un Trunk.', 'error');
+            return;
+        }
+        row.remove();
+        container.querySelectorAll('.ob-trunk-seq-row').forEach((r, idx) => {
+            r.querySelector('span').textContent = String(idx + 1);
+        });
+    });
+
+    container.appendChild(row);
+}
+
+function updateOutboundPatternsBadge() {
+    const count = document.querySelectorAll('#ob-patterns-container .ob-pat-row').length;
+    const badge = document.getElementById('ob-patterns-count-badge');
+    if (badge) badge.textContent = String(count);
+}
+
+function addOutboundPatternRow(prepend = '', prefix = '', match = '', cid = '') {
+    const container = document.getElementById('ob-patterns-container');
+    if (!container) return;
+
+    const row = document.createElement('div');
+    row.className = 'grid grid-cols-12 gap-2 px-4 py-2 items-center hover:bg-anthracite-800/60 transition ob-pat-row';
+    row.innerHTML = `
+        <div class="col-span-2">
+            <input type="text" placeholder="prepend" value="${escapeHtml(prepend)}"
+                class="ob-pat-prepend w-full px-2.5 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono">
+        </div>
+        <div class="col-span-2">
+            <input type="text" placeholder="préfixe |" value="${escapeHtml(prefix)}"
+                class="ob-pat-prefix w-full px-2.5 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono">
+        </div>
+        <div class="col-span-5">
+            <input type="text" placeholder="0[1-59]XXXXXXXX ou X." value="${escapeHtml(match)}" required
+                class="ob-pat-match w-full px-2.5 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-emerald-300 font-mono font-semibold">
+        </div>
+        <div class="col-span-2">
+            <input type="text" placeholder="/ CallerID" value="${escapeHtml(cid)}"
+                class="ob-pat-cid w-full px-2.5 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-indigo-300 font-mono">
+        </div>
+        <div class="col-span-1 text-right">
+            <button type="button" class="btn-del-pat p-1.5 rounded-lg bg-anthracite-950 hover:bg-red-500/20 text-slate-400 hover:text-red-300 border border-anthracite-700 text-xs">🗑️</button>
+        </div>
+    `;
+
+    row.querySelector('.btn-del-pat').addEventListener('click', () => {
+        row.remove();
+        updateOutboundPatternsBadge();
+    });
+
+    container.appendChild(row);
+    updateOutboundPatternsBadge();
+}
+
+function applyOutboundPatternPreset(presetKey) {
+    if (presetKey === 'fr_national') {
+        addOutboundPatternRow('', '', '0[1-59]XXXXXXXX', '');
+        addOutboundPatternRow('', '', '0[67]XXXXXXXX', '');
+    } else if (presetKey === 'fr_free') {
+        addOutboundPatternRow('', '', '080[0-9]XXXXXX', '');
+    } else if (presetKey === 'fr_emergency') {
+        ['15', '17', '18', '112', '114'].forEach(num => addOutboundPatternRow('', '', num, ''));
+    } else if (presetKey === 'international') {
+        addOutboundPatternRow('', '', '00.', '');
+        addOutboundPatternRow('', '', '+X.', '');
+    } else if (presetKey === 'all') {
+        addOutboundPatternRow('', '', 'X.', '');
+    }
+}
+
+function toggleOutboundPermissionMode(mode) {
+    const details = document.getElementById('ob-permissions-details');
+    if (!details) return;
+    if (mode === 'restricted') {
+        details.classList.remove('opacity-40', 'pointer-events-none');
+    } else {
+        details.classList.add('opacity-40', 'pointer-events-none');
+    }
+}
+
+function renderOutboundExtensionBoxes() {
+    const allowedBox = document.getElementById('ob-allowed-exts-box');
+    const blockedBox = document.getElementById('ob-blocked-exts-box');
+    if (!allowedBox || !blockedBox) return;
+
+    const allExts = appState.extensions || [];
+    let allowedHtml = '';
+    let blockedHtml = '';
+
+    allExts.forEach(e => {
+        const eStr = String(e.extension);
+        if (activeObAllowedExts.has(eStr)) {
+            allowedHtml += `
+                <button type="button" onclick="obToggleSingleExt('${escapeHtml(eStr)}')"
+                    class="group px-3 py-1.5 rounded-xl bg-emerald-500/15 hover:bg-amber-500/20 border border-emerald-500/30 hover:border-amber-500/40 text-xs font-semibold text-emerald-300 hover:text-amber-300 transition cursor-pointer flex items-center gap-1.5">
+                    <span class="font-mono">${escapeHtml(eStr)}</span>
+                    <span class="text-slate-200">(${escapeHtml(e.name)})</span>
+                    <span class="text-slate-400 group-hover:text-amber-300 ml-1">→</span>
+                </button>
+            `;
+        } else {
+            blockedHtml += `
+                <button type="button" onclick="obToggleSingleExt('${escapeHtml(eStr)}')"
+                    class="group px-3 py-1.5 rounded-xl bg-anthracite-950 hover:bg-emerald-500/20 border border-anthracite-700 hover:border-emerald-500/40 text-xs font-medium text-slate-300 hover:text-emerald-300 transition cursor-pointer flex items-center gap-1.5">
+                    <span class="text-slate-400 group-hover:text-emerald-300 mr-1">←</span>
+                    <span class="font-mono text-indigo-300 font-bold">${escapeHtml(eStr)}</span>
+                    <span class="text-slate-300">(${escapeHtml(e.name)})</span>
+                </button>
+            `;
+        }
+    });
+
+    allowedBox.innerHTML = allowedHtml || `<div class="text-slate-500 text-xs italic py-2">Aucun poste individuel autorisé.</div>`;
+    blockedBox.innerHTML = blockedHtml || `<div class="text-slate-500 text-xs italic py-2">Tous les postes sont autorisés sur cette route !</div>`;
+
+    document.getElementById('ob-allowed-exts-count').textContent = String(activeObAllowedExts.size);
+    document.getElementById('ob-blocked-exts-count').textContent = String(activeObBlockedExts.size);
+}
+
+function obToggleSingleExt(eStr) {
+    if (activeObAllowedExts.has(eStr)) {
+        activeObAllowedExts.delete(eStr);
+        activeObBlockedExts.add(eStr);
+    } else {
+        activeObBlockedExts.delete(eStr);
+        activeObAllowedExts.add(eStr);
+    }
+    renderOutboundExtensionBoxes();
+}
+
+function obTransferExtensions(action) {
+    const allExts = appState.extensions || [];
+    if (action === 'all_allow') {
+        allExts.forEach(e => {
+            activeObAllowedExts.add(String(e.extension));
+            activeObBlockedExts.delete(String(e.extension));
+        });
+    } else if (action === 'all_block') {
+        allExts.forEach(e => {
+            activeObBlockedExts.add(String(e.extension));
+            activeObAllowedExts.delete(String(e.extension));
+        });
+    } else if (action === 'invert') {
+        allExts.forEach(e => {
+            const eStr = String(e.extension);
+            if (activeObAllowedExts.has(eStr)) {
+                activeObAllowedExts.delete(eStr);
+                activeObBlockedExts.add(eStr);
+            } else {
+                activeObBlockedExts.delete(eStr);
+                activeObAllowedExts.add(eStr);
+            }
+        });
+    }
+    renderOutboundExtensionBoxes();
+}
+
+// --- 4. Rendu & CRUD SVI / IVR ---
+function renderIvrsTable() {
+    const tbody = document.getElementById('ivrs-tbody');
+    const rows = appState.ivrs || [];
+
+    if (rows.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="7" class="py-8 text-center text-slate-400 text-xs">Aucun serveur vocal interactif configuré. Cliquez sur « + Nouveau SVI / IVR » pour en créer un.</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = rows.map(ivr => {
+        const opts = ivr.options || {};
+        const optEntries = Object.entries(opts);
+        const badges = optEntries.map(([k, v]) => {
+            let label = v;
+            if (v.startsWith('ext-')) label = `Poste ${v.replace('ext-', '')}`;
+            else if (v.startsWith('grp-')) label = `Groupe ${v.replace('grp-', '')}`;
+            else if (v.startsWith('sound-')) label = `Annonce`;
+            else if (v.startsWith('terminate-')) label = v.replace('terminate-', '');
+
+            return `<span class="inline-flex items-center gap-1 px-2 py-0.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs font-mono shadow-sm">
+                <span class="w-4 h-4 rounded bg-indigo-500/20 text-indigo-300 font-bold flex items-center justify-center text-[10px]">${escapeHtml(k)}</span>
+                <span class="text-slate-400">→</span>
+                <span class="text-slate-200 font-semibold">${escapeHtml(label)}</span>
+            </span>`;
+        }).join(' ');
+
+        const directDialBadge = Number(ivr.direct_dial) !== 0
+            ? `<span class="inline-flex items-center gap-1 px-2.5 py-1 rounded-full bg-emerald-500/10 text-emerald-400 border border-emerald-500/30 text-[11px] font-semibold">
+                <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/></svg>
+                Activée
+               </span>`
+            : `<span class="inline-flex items-center gap-1 px-2.5 py-1 rounded-full bg-slate-500/10 text-slate-400 border border-slate-500/30 text-[11px] font-semibold">Désactivée</span>`;
+
+        const testCode = '*8' + String(ivr.id).padStart(2, '0');
+
+        // Résolution du libellé de l'annonce audio
+        let audioName = escapeHtml(ivr.audio_file || 'demo-instruct');
+        const foundSound = (appState.sounds || []).find(s => `custom/${s.slug}` === ivr.audio_file || s.slug === ivr.audio_file);
+        if (foundSound) {
+            audioName = `${escapeHtml(foundSound.name)} <span class="text-[10px] text-slate-400">(${escapeHtml(foundSound.site_category)})</span>`;
+        }
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4">
+                    <div class="font-bold text-white flex items-center gap-2">
+                        <span class="w-2 h-2 rounded-full bg-indigo-400"></span>
+                        <span>${escapeHtml(ivr.name)}</span>
+                    </div>
+                    ${ivr.description ? `<div class="text-[11px] text-slate-400 mt-0.5">${escapeHtml(ivr.description)}</div>` : ''}
+                </td>
+                <td class="py-3.5 px-4 text-xs font-mono text-slate-200">
+                    <div class="flex items-center gap-1.5">
+                        <svg class="w-3.5 h-3.5 text-amber-400 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.536 8.464a5 5 0 010 7.072m2.828-9.9a9 9 0 010 12.728M5.586 15H4a1 1 0 01-1-1v-4a1 1 0 011-1h1.586l4.707-4.707C10.923 3.663 12 4.109 12 5v14c0 .891-1.077 1.337-1.707.707L5.586 15z"/>
+                        </svg>
+                        <span>${audioName}</span>
+                    </div>
+                </td>
+                <td class="py-3.5 px-4">${directDialBadge}</td>
+                <td class="py-3.5 px-4">
+                    <div class="flex flex-wrap gap-1.5 max-w-xs">
+                        ${badges || '<span class="text-xs text-slate-400 italic">Aucune touche</span>'}
+                    </div>
+                </td>
+                <td class="py-3.5 px-4 text-xs text-slate-300">
+                    <div>⏱️ Attente : <strong class="text-white">${Number(ivr.timeout)}s</strong> <span class="text-slate-400">(${Number(ivr.timeout_retries || 2)} rép)</span></div>
+                    <div class="text-[11px] text-slate-400 mt-0.5">⚠️ Erreur : max <strong class="text-slate-200">${Number(ivr.invalid_retries || 3)}</strong> essais</div>
+                </td>
+                <td class="py-3.5 px-4">
+                    <span class="inline-flex items-center gap-1 px-2.5 py-1 rounded-lg bg-indigo-500/10 text-indigo-300 border border-indigo-500/30 text-xs font-mono font-bold" title="Composer ce code depuis un poste interne pour tester le SVI">
+                        <svg class="w-3 h-3 text-indigo-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 5a2 2 0 012-2h3.28a1 1 0 01.948.684l1.498 4.493a1 1 0 01-.502 1.21l-2.257 1.13a11.042 11.042 0 005.516 5.516l1.13-2.257a1 1 0 011.21-.502l4.493 1.498a1 1 0 01.684.949V19a2 2 0 01-2 2h-1C9.716 21 3 14.284 3 6V5z"/></svg>
+                        ${testCode}
+                    </span>
+                </td>
+                <td class="py-3.5 px-4 text-right space-x-2">
+                    <button type="button" onclick="editIvr(${Number(ivr.id)})" class="text-xs font-semibold text-indigo-300 hover:text-indigo-200 transition">Modifier</button>
+                    <button type="button" onclick="deleteIvr(${Number(ivr.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300 transition">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function addIvrOptionRow(digit = '', dest = '') {
+    const container = document.getElementById('ivr-options-container');
+    const row = document.createElement('div');
+    row.className = 'flex items-center gap-2.5 p-2 rounded-xl bg-anthracite-950/80 border border-anthracite-700/80 ivr-opt-row transition hover:border-indigo-500/50';
+
+    const digits = ['1', '2', '3', '4', '5', '6', '7', '8', '9', '0', '*', '#'];
+    let digitOptions = digits.map(d => `<option value="${d}" ${String(digit) === d ? 'selected' : ''}>Touche ${d}</option>`).join('');
+
+    row.innerHTML = `
+        <div class="flex items-center gap-1.5 flex-shrink-0">
+            <span class="text-xs text-slate-400 font-mono">Touche :</span>
+            <select class="ivr-digit px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs font-bold text-indigo-300 font-mono focus:outline-none focus:border-indigo-500">
+                ${digitOptions}
+            </select>
+        </div>
+        <span class="text-slate-400 font-bold">→</span>
+        <div class="flex-1 min-w-0">
+            <select class="ivr-dest w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white focus:outline-none focus:border-indigo-500">
+                ${buildDestinationOptionsHtml(dest || 'ext-101')}
+            </select>
+        </div>
+        <button type="button" class="p-1.5 text-slate-400 hover:text-red-400 hover:bg-red-500/10 rounded-lg transition" title="Supprimer cette touche">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+            </svg>
+        </button>
+    `;
+    row.querySelector('button').addEventListener('click', () => row.remove());
+    container.appendChild(row);
+}
+
+function openIvrModal(ivr = null) {
+    const form = document.getElementById('form-ivr');
+    form.reset();
+    document.getElementById('modal-ivr-title').textContent = ivr ? `Modifier le SVI « ${ivr.name} »` : 'Nouveau Serveur Vocal Interactif (SVI / IVR)';
+
+    form.elements['id'].value = ivr ? ivr.id : '';
+    form.elements['name'].value = ivr ? ivr.name : 'ivr-accueil';
+    form.elements['description'].value = ivr && ivr.description ? ivr.description : '';
+    form.elements['timeout'].value = ivr ? Number(ivr.timeout) : 5;
+    form.elements['timeout_retries'].value = ivr ? Number(ivr.timeout_retries || 2) : 2;
+    form.elements['invalid_retries'].value = ivr ? Number(ivr.invalid_retries || 3) : 3;
+
+    // Numérotation directe (défaut activé si nouveau ou si direct_dial == 1)
+    const directDialCheck = document.getElementById('ivr-direct-dial-checkbox');
+    if (directDialCheck) {
+        directDialCheck.checked = ivr ? Boolean(Number(ivr.direct_dial)) : true;
+    }
+
+    // Sélecteur audio d'accueil (audio_file)
+    const audioSel = document.getElementById('ivr-audio-select');
+    if (audioSel) {
+        const curAudio = ivr ? String(ivr.audio_file || '') : '';
+        const sounds = appState.sounds || [];
+        let audioHtml = '';
+
+        if (sounds.length > 0) {
+            audioHtml += `<optgroup label="📂 Fichiers sons de la médiathèque">`;
+            sounds.forEach(s => {
+                const val = `custom/${s.slug}`;
+                const isSel = curAudio === val || curAudio === s.slug || curAudio === String(s.id);
+                audioHtml += `<option value="${escapeHtml(val)}" ${isSel ? 'selected' : ''}>${escapeHtml(s.name)} [${escapeHtml(s.site_category)} • ${escapeHtml(s.usage_type)}]</option>`;
+            });
+            audioHtml += `</optgroup>`;
+        }
+
+        audioHtml += `
+            <optgroup label="🔔 Messages système Asterisk par défaut">
+                <option value="demo-instruct" ${curAudio === 'demo-instruct' || !curAudio ? 'selected' : ''}>demo-instruct (Instructions d'accueil)</option>
+                <option value="hello-world" ${curAudio === 'hello-world' ? 'selected' : ''}>hello-world (Message d'accueil basique)</option>
+                <option value="beep" ${curAudio === 'beep' ? 'selected' : ''}>beep (Simple bip sonore)</option>
+            </optgroup>
+        `;
+        audioSel.innerHTML = audioHtml;
+    }
+
+    // Sélecteur message d'erreur invalide (invalid_sound_id)
+    const invalidSoundSel = document.getElementById('ivr-invalid-sound-select');
+    if (invalidSoundSel) {
+        const curInvId = ivr ? Number(ivr.invalid_sound_id || 0) : 0;
+        let invSoundHtml = `<option value="0" ${curInvId === 0 ? 'selected' : ''}>Message par défaut (pbx-invalid : « Choix invalide »)</option>`;
+        (appState.sounds || []).forEach(s => {
+            invSoundHtml += `<option value="${s.id}" ${curInvId === Number(s.id) ? 'selected' : ''}>${escapeHtml(s.name)} [${escapeHtml(s.site_category)}]</option>`;
+        });
+        invalidSoundSel.innerHTML = invSoundHtml;
+    }
+
+    // Sélecteur destination d'échec invalide (invalid_dest)
+    const invalidDestSel = document.getElementById('ivr-invalid-dest-select');
+    if (invalidDestSel) {
+        invalidDestSel.innerHTML = buildDestinationOptionsHtml(ivr ? (ivr.invalid_dest || 'terminate-hangup') : 'terminate-hangup');
+    }
+
+    // Sélecteur message timeout (timeout_sound_id)
+    const timeoutSoundSel = document.getElementById('ivr-timeout-sound-select');
+    if (timeoutSoundSel) {
+        const curToutId = ivr ? Number(ivr.timeout_sound_id || 0) : 0;
+        let toutSoundHtml = `<option value="0" ${curToutId === 0 ? 'selected' : ''}>Aucun message supplémentaire (rejouer annonce)</option>`;
+        (appState.sounds || []).forEach(s => {
+            toutSoundHtml += `<option value="${s.id}" ${curToutId === Number(s.id) ? 'selected' : ''}>${escapeHtml(s.name)} [${escapeHtml(s.site_category)}]</option>`;
+        });
+        timeoutSoundSel.innerHTML = toutSoundHtml;
+    }
+
+    // Sélecteur destination d'échec timeout (timeout_dest)
+    const timeoutDestSel = document.getElementById('ivr-timeout-dest-select');
+    if (timeoutDestSel) {
+        timeoutDestSel.innerHTML = buildDestinationOptionsHtml(ivr ? (ivr.timeout_dest || 'terminate-hangup') : 'terminate-hangup');
+    }
+
+    // Conteneur des touches DTMF
+    const container = document.getElementById('ivr-options-container');
+    container.innerHTML = '';
+    const opts = ivr && ivr.options && Object.keys(ivr.options).length > 0
+        ? ivr.options
+        : { '1': 'ext-101', '2': 'grp-600' };
+    Object.entries(opts).forEach(([d, dest]) => addIvrOptionRow(d, dest));
+
+    openModal('modal-ivr');
+}
+
+function editIvr(id) {
+    const ivr = (appState.ivrs || []).find(i => Number(i.id) === Number(id));
+    if (ivr) openIvrModal(ivr);
+}
+
+async function deleteIvr(id, optName = null) {
+    const ivr = (appState.ivrs || []).find(i => Number(i.id) === Number(id));
+    const name = optName || (ivr ? ivr.name : 'ce SVI');
+    if (!confirm(`Supprimer le SVI ${name} ?`)) return;
+    try {
+        const res = await apiCall('delete_ivr', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- 4B. Rendu & CRUD Médiathèque & Fichiers Sons (MoH, Annonces, IVR, Congestion) ---
+const USAGE_LABELS = {
+    moh: { label: "Musique d'attente (MoH)", color: "amber" },
+    announcement: { label: "Annonce d'accueil / Info", color: "indigo" },
+    ivr: { label: "Menu SVI / Guide interactif", color: "cyan" },
+    congestion: { label: "Ligne occupée / Congestion", color: "rose" },
+    custom: { label: "Autre / Personnalisé", color: "slate" }
+};
+
+function formatDurationSec(sec) {
+    const s = Math.max(0, parseInt(sec, 10) || 0);
+    const m = Math.floor(s / 60);
+    const rem = s % 60;
+    return `${m}:${rem.toString().padStart(2, '0')}`;
+}
+
+function formatBytes(bytes) {
+    const b = parseInt(bytes, 10) || 0;
+    if (b < 1024) return `${b} o`;
+    if (b < 1024 * 1024) return `${(b / 1024).toFixed(1)} Ko`;
+    return `${(b / (1024 * 1024)).toFixed(1)} Mo`;
+}
+
+function renderSoundsTable() {
+    const tbody = document.getElementById('sounds-tbody');
+    if (!tbody) return;
+
+    const allSounds = appState.sounds || [];
+    const soundSites = appState.sound_sites || [];
+
+    // Met à jour la liste des sites dans le filtre (sans icône)
+    const siteFilterEl = document.getElementById('filter-sound-site');
+    if (siteFilterEl) {
+        const curVal = siteFilterEl.value || 'all';
+        let siteOpts = `<option value="all">Tous les sites</option>`;
+        soundSites.forEach(st => {
+            const isSel = (st.name === curVal) ? 'selected' : '';
+            siteOpts += `<option value="${escapeHtml(st.name)}" ${isSel}>${escapeHtml(st.name)}</option>`;
+        });
+        siteFilterEl.innerHTML = siteOpts;
+    }
+
+    // Met à jour le sélecteur de la Musique d'attente générale par défaut (MoH)
+    const defMohSelect = document.getElementById('global-default-moh-select');
+    if (defMohSelect) {
+        const mohSounds = allSounds.filter(s => s.usage_type === 'moh');
+        const curDefaultId = Number(appState.settings?.default_moh_sound_id || 0);
+        if (mohSounds.length === 0) {
+            defMohSelect.innerHTML = `<option value="">Aucune musique d'attente disponible</option>`;
+        } else {
+            defMohSelect.innerHTML = mohSounds.map(s => {
+                const isSel = (Number(s.id) === curDefaultId) ? 'selected' : '';
+                return `<option value="${s.id}" ${isSel}>${escapeHtml(s.name)} [${escapeHtml(s.site_category || 'Global')}]</option>`;
+            }).join('');
+        }
+    }
+
+    // Récupération des filtres actifs
+    const selSite = siteFilterEl ? siteFilterEl.value : 'all';
+    const selUsage = document.getElementById('filter-sound-usage')?.value || 'all';
+    const searchTxt = (document.getElementById('filter-sound-search')?.value || '').toLowerCase().trim();
+
+    const filtered = allSounds.filter(s => {
+        if (selSite !== 'all' && s.site_category !== selSite) return false;
+        if (selUsage !== 'all' && s.usage_type !== selUsage) return false;
+        if (searchTxt) {
+            const hay = `${s.name} ${s.description} ${s.slug} ${s.site_category} ${s.usage_type}`.toLowerCase();
+            if (!hay.includes(searchTxt)) return false;
+        }
+        return true;
+    });
+
+    if (filtered.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="7" class="py-8 text-center text-slate-400 text-xs">Aucun fichier son trouvé pour les filtres sélectionnés. Cliquez sur « + Téléverser un Fichier Son ».</td></tr>`;
+        return;
+    }
+
+    const curDefaultMohId = Number(appState.settings?.default_moh_sound_id || 0);
+
+    tbody.innerHTML = filtered.map(snd => {
+        const usage = USAGE_LABELS[snd.usage_type] || USAGE_LABELS.custom;
+        const siteBadge = `<span class="px-2.5 py-1 rounded-lg text-xs font-semibold bg-amber-500/15 text-amber-300 border border-amber-500/30">${escapeHtml(snd.site_category || 'Global')}</span>`;
+        const usageBadge = `<span class="inline-flex items-center px-2.5 py-1 rounded-lg text-xs font-medium bg-anthracite-950 border border-anthracite-700 text-slate-200">${escapeHtml(usage.label || snd.usage_type)}</span>`;
+        const defaultBadge = (Number(snd.id) === curDefaultMohId)
+            ? `<span class="ml-2 px-2 py-0.5 rounded text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/40">Par défaut</span>`
+            : '';
+
+        let astRef = `custom/${escapeHtml(snd.slug)}`;
+        if (snd.usage_type === 'moh') {
+            const sSlug = slugifyTrunkName(snd.site_category || 'global');
+            astRef = (sSlug === 'global' || sSlug === 'default') ? 'default' : `moh-${sSlug}`;
+        }
+
+        const audioUrl = `/api.php?action=stream_sound&id=${Number(snd.id)}`;
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3.5 px-4">
+                    <div class="font-bold text-white text-sm flex items-center">
+                        <span>${escapeHtml(snd.name)}</span>
+                        ${defaultBadge}
+                    </div>
+                    <div class="text-xs text-slate-400 mt-0.5">${escapeHtml(snd.description || '—')}</div>
+                </td>
+                <td class="py-3.5 px-4">${siteBadge}</td>
+                <td class="py-3.5 px-4">${usageBadge}</td>
+                <td class="py-3.5 px-4">
+                    <audio controls preload="none" class="h-8 w-48 sm:w-56 rounded bg-anthracite-900 border border-anthracite-700" src="${audioUrl}"></audio>
+                </td>
+                <td class="py-3.5 px-4 font-mono text-xs text-slate-300 whitespace-nowrap">
+                    <div>${formatDurationSec(snd.duration_sec)}</div>
+                    <div class="text-[10px] text-slate-500">${formatBytes(snd.file_size)} • ${escapeHtml((snd.format || 'wav').toUpperCase())}</div>
+                </td>
+                <td class="py-3.5 px-4">
+                    <div class="inline-flex items-center gap-1.5 px-2 py-1 rounded bg-anthracite-950 border border-anthracite-700 font-mono text-xs text-amber-300">
+                        <span>${astRef}</span>
+                        <button type="button" onclick="navigator.clipboard.writeText('${astRef}'); showToast('Code copié : ${astRef}', 'info');" title="Copier la référence Asterisk" class="text-slate-400 hover:text-white text-[11px] font-sans underline">Copier</button>
+                    </div>
+                </td>
+                <td class="py-3.5 px-4 text-right space-x-2 whitespace-nowrap">
+                    <button type="button" onclick="editSound(${Number(snd.id)})" class="text-xs font-semibold text-amber-400 hover:text-amber-300">Modifier</button>
+                    <button type="button" onclick="deleteSound(${Number(snd.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+async function applyDefaultMohFromSelect() {
+    const sel = document.getElementById('global-default-moh-select');
+    if (!sel || !sel.value) {
+        showToast("Veuillez sélectionner un fichier son pour la musique d'attente par défaut.", 'error');
+        return;
+    }
+    try {
+        const res = await apiCall('set_default_moh', { sound_id: Number(sel.value) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- Gestion des catégories de sites (Création, Modification, Suppression) ---
+function openSoundSitesModal() {
+    const form = document.getElementById('form-sound-site');
+    if (form) form.reset();
+    const idInput = document.getElementById('sound-site-id');
+    if (idInput) idInput.value = '';
+    const btn = document.getElementById('btn-save-sound-site');
+    if (btn) btn.textContent = 'Enregistrer';
+    renderSoundSitesTable();
+    openModal('modal-sound-sites');
+}
+
+function renderSoundSitesTable() {
+    const tbody = document.getElementById('sound-sites-tbody');
+    if (!tbody) return;
+
+    const sites = appState.sound_sites || [];
+    const sounds = appState.sounds || [];
+
+    if (sites.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="4" class="py-6 text-center text-slate-400">Aucune catégorie de site définie.</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = sites.map(st => {
+        const count = sounds.filter(s => (s.site_category || '').toLowerCase() === (st.name || '').toLowerCase()).length;
+        const isGlobal = (st.name || '').toLowerCase() === 'global';
+
+        const deleteBtn = isGlobal
+            ? `<span class="text-slate-600 text-xs italic" title="Socle standard du système, non supprimable">Protégé</span>`
+            : `<button type="button" onclick="deleteSoundSite(${Number(st.id)})" class="text-xs font-semibold text-red-400 hover:text-red-300">Supprimer</button>`;
+
+        return `
+            <tr class="hover:bg-anthracite-900/50 transition">
+                <td class="py-2.5 px-4 font-semibold text-white">
+                    ${escapeHtml(st.name)}
+                    ${isGlobal ? '<span class="ml-1.5 px-1.5 py-0.5 rounded text-[10px] bg-slate-800 text-slate-300 border border-slate-700">Système</span>' : ''}
+                </td>
+                <td class="py-2.5 px-4 text-slate-300">${escapeHtml(st.description || '—')}</td>
+                <td class="py-2.5 px-4 text-slate-300">
+                    <span class="px-2 py-0.5 rounded-full text-xs font-mono bg-anthracite-900 border border-anthracite-700">${count} fichier${count > 1 ? 's' : ''}</span>
+                </td>
+                <td class="py-2.5 px-4 text-right space-x-2 whitespace-nowrap">
+                    <button type="button" onclick="editSoundSite(${Number(st.id)})" class="text-xs font-semibold text-amber-400 hover:text-amber-300">Modifier</button>
+                    ${deleteBtn}
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function editSoundSite(id) {
+    const site = (appState.sound_sites || []).find(s => Number(s.id) === Number(id));
+    if (!site) return;
+    const idInput = document.getElementById('sound-site-id');
+    const nameInput = document.getElementById('sound-site-name');
+    const descInput = document.getElementById('sound-site-desc');
+    const btn = document.getElementById('btn-save-sound-site');
+
+    if (idInput) idInput.value = site.id;
+    if (nameInput) {
+        nameInput.value = site.name;
+        nameInput.focus();
+    }
+    if (descInput) descInput.value = site.description || '';
+    if (btn) btn.textContent = 'Mettre à jour';
+}
+
+async function deleteSoundSite(id, optName = null) {
+    const st = (appState.sound_sites || []).find(s => Number(s.id) === Number(id));
+    const name = optName || (st ? st.name : 'ce site');
+    if (!confirm(`Supprimer la catégorie de site « ${name} » ?\nTous les sons associés seront automatiquement réassignés à « Global ».`)) return;
+    try {
+        const res = await apiCall('delete_sound_site', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+        renderSoundSitesTable();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function handleSoundFileSelected(input) {
+    const file = input.files?.[0];
+    const placeEl = document.getElementById('sound-upload-placeholder');
+    const prevEl = document.getElementById('sound-upload-preview');
+    const nameEl = document.getElementById('sound-upload-filename');
+    const sizeEl = document.getElementById('sound-upload-filesize');
+    const nameInput = document.getElementById('sound-input-name');
+
+    if (file) {
+        placeEl?.classList.add('hidden');
+        prevEl?.classList.remove('hidden');
+        if (nameEl) nameEl.textContent = file.name;
+        if (sizeEl) sizeEl.textContent = formatBytes(file.size);
+
+        if (nameInput && !nameInput.value.trim()) {
+            const cleanName = file.name.replace(/\.[^/.]+$/, '').replace(/[-_]+/g, ' ');
+            nameInput.value = cleanName.charAt(0).toUpperCase() + cleanName.slice(1);
+        }
+    } else {
+        placeEl?.classList.remove('hidden');
+        prevEl?.classList.add('hidden');
+    }
+}
+
+function openSoundModal(snd = null) {
+    const form = document.getElementById('form-sound');
+    form.reset();
+    document.getElementById('modal-sound-title').textContent = snd ? `Modifier le fichier « ${snd.name} »` : "Téléverser un Fichier Son";
+    document.getElementById('btn-submit-sound').textContent = snd ? "Enregistrer les Modifications" : "Téléverser & Enregistrer";
+
+    form.elements['id'].value = snd ? snd.id : '';
+    form.elements['name'].value = snd ? snd.name : '';
+    form.elements['usage_type'].value = snd ? snd.usage_type : 'announcement';
+    form.elements['description'].value = snd ? snd.description : '';
+
+    // Remplit la liste déroulante des catégories de sites
+    const siteSelect = document.getElementById('sound-input-site');
+    if (siteSelect) {
+        const sites = appState.sound_sites || [];
+        const curSite = snd ? snd.site_category : 'Global';
+        siteSelect.innerHTML = sites.map(st => {
+            const isSel = (st.name === curSite) ? 'selected' : '';
+            return `<option value="${escapeHtml(st.name)}" ${isSel}>${escapeHtml(st.name)}</option>`;
+        }).join('');
+        if (curSite && !sites.some(st => st.name === curSite)) {
+            siteSelect.insertAdjacentHTML('afterbegin', `<option value="${escapeHtml(curSite)}" selected>${escapeHtml(curSite)}</option>`);
+        }
+    }
+
+    const uploadBlock = document.getElementById('sound-file-upload-block');
+    const fileInput = document.getElementById('sound-audio-file-input');
+    const placeEl = document.getElementById('sound-upload-placeholder');
+    const prevEl = document.getElementById('sound-upload-preview');
+
+    if (snd) {
+        if (uploadBlock) uploadBlock.classList.add('hidden');
+        if (fileInput) fileInput.removeAttribute('required');
+    } else {
+        if (uploadBlock) uploadBlock.classList.remove('hidden');
+        if (fileInput) fileInput.setAttribute('required', 'required');
+        placeEl?.classList.remove('hidden');
+        prevEl?.classList.add('hidden');
+    }
+
+    openModal('modal-sound');
+}
+
+function editSound(id) {
+    const snd = (appState.sounds || []).find(s => Number(s.id) === Number(id));
+    if (snd) openSoundModal(snd);
+}
+
+async function deleteSound(id, optName = null) {
+    const snd = (appState.sounds || []).find(s => Number(s.id) === Number(id));
+    const name = optName || (snd ? snd.name : 'ce fichier son');
+    if (!confirm(`Supprimer définitivement le fichier son « ${name} » et ses encodages Asterisk ?`)) return;
+    try {
+        const res = await apiCall('delete_sound', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// --- 5. Rendu Paramètres, Diagnostic Debian & Prévisualisations .conf ---
+function renderSettingsAndDiagnostics() {
+    const s = appState.settings || {};
+    const form = document.getElementById('settings-form');
+    if (form) {
+        if (form.elements['company_name']) {
+            form.elements['company_name'].value = s.company_name || '';
+        }
+        if (form.elements['system_language']) {
+            form.elements['system_language'].value = s.system_language || 'fr';
+        }
+        form.elements['domain'].value = s.domain || 'pbx.local';
+        form.elements['letsencrypt_domain'].value = s.letsencrypt_domain || '';
+        form.elements['local_net'].value = s.local_net || '10.10.0.0/16';
+        form.elements['external_ip'].value = s.external_ip || '';
+        form.elements['udp_port'].value = s.udp_port || 5060;
+        form.elements['tls_port'].value = s.tls_port || 5061;
+        form.elements['ami_host'].value = s.ami_host || '127.0.0.1';
+        form.elements['ami_port'].value = s.ami_port || 5038;
+        form.elements['ami_user'].value = s.ami_user || 'pbxgui';
+        form.elements['ami_secret'].value = s.ami_secret || '';
+        form.elements['new_admin_password'].value = '';
+    }
+
+    const diagList = document.getElementById('diagnostics-list');
+    const checks = appState.diagnostics?.checks || [];
+    diagList.innerHTML = checks.map(c => `
+        <div class="flex items-start gap-3 p-3 rounded-xl bg-anthracite-950 border ${c.ok ? 'border-anthracite-700' : 'border-amber-500/40'}">
+            <span class="mt-0.5 w-5 h-5 rounded-full flex items-center justify-center text-xs font-bold ${c.ok ? 'bg-emerald-500/20 text-emerald-300' : 'bg-amber-500/20 text-amber-300'}">
+                ${c.ok ? '✓' : '!'}
+            </span>
+            <div class="flex-1 min-w-0">
+                <div class="text-xs font-semibold text-white">${escapeHtml(c.label)}</div>
+                <div class="text-[11px] text-slate-300 break-words mt-0.5">${escapeHtml(c.detail)}</div>
+            </div>
+        </div>
+    `).join('');
+
+    document.getElementById('preview-pjsip').textContent = appState.previews?.pjsip || '';
+    document.getElementById('preview-extensions').textContent = appState.previews?.extensions || '';
+    const prevVm = document.getElementById('preview-voicemail');
+    if (prevVm) {
+        prevVm.textContent = appState.previews?.voicemail || '';
+    }
+}
+
+// --- Navigation Sidebar & Modales ---
+const PAGE_TITLES = {
+    dashboard: 'Tableau de Bord & Supervision Temps Réel',
+    extensions: 'Postes Téléphoniques SIP (PJSIP)',
+    groups: "Groupes de Sonnerie (Ring Groups)",
+    extgroups: "Groupes d'Extensions (Sites & Droits Sortants)",
+    trunks: 'Trunks Opérateurs SIP',
+    outbound: 'Routes Sortantes (Outbound Routes & Séquence Trunks)',
+    ivrs: 'Serveurs Vocaux Interactifs (SVI / IVR)',
+    sounds: 'Fichiers sons',
+    featurecodes: 'Codes de Fonctions & Services Téléphoniques Asterisk',
+    sipsettings: 'Paramètres SIP Globaux & Configuration NAT (PJSIP & RTP)',
+    certificates: 'Gestionnaire de Certificats SSL / TLS (Let\'s Encrypt & Imports)',
+    system: 'Paramètres Globaux, Diagnostic Debian & Fichiers .conf',
+    backups: 'Sauvegardes & Restauration Système (Disaster Recovery)',
+    firewall: 'Pare-feu Réseau & Sécurité Téléphonie (Fail2ban & NFTables)'
+};
+
+function switchTab(tabId) {
+    document.querySelectorAll('.tab-panel').forEach(p => p.classList.add('hidden'));
+    const target = document.getElementById(`tab-${tabId}`);
+    if (target) target.classList.remove('hidden');
+
+    const titleEl = document.getElementById('page-header-title');
+    if (titleEl && PAGE_TITLES[tabId]) {
+        titleEl.textContent = PAGE_TITLES[tabId];
+    }
+
+    document.querySelectorAll('.tab-btn').forEach(btn => {
+        const isSubBtn = btn.parentElement?.id === 'submenu-operators' || btn.parentElement?.id === 'submenu-groups' || btn.parentElement?.id === 'submenu-system';
+        if (btn.dataset.tab === tabId) {
+            if (isSubBtn) {
+                btn.className = 'tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-bold bg-indigo-600 text-white shadow-sm transition text-left';
+            } else {
+                btn.className = 'tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-semibold bg-indigo-600 text-white shadow-md shadow-indigo-600/20 transition';
+            }
+        } else {
+            if (isSubBtn) {
+                btn.className = 'tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition text-left';
+            } else {
+                btn.className = 'tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition';
+            }
+        }
+    });
+
+    // Si on clique sur un sous-menu Opérateurs, s'assurer que le menu parent est bien déplié
+    if (tabId === 'trunks' || tabId === 'outbound') {
+        const submenu = document.getElementById('submenu-operators');
+        const arrow = document.getElementById('arrow-menu-operators');
+        if (submenu && submenu.classList.contains('hidden')) {
+            submenu.classList.remove('hidden');
+            arrow?.classList.remove('-rotate-90');
+        }
+    }
+
+    // Si on clique sur un sous-menu Groupes, s'assurer que le menu parent est bien déplié
+    if (tabId === 'groups' || tabId === 'extgroups') {
+        const submenu = document.getElementById('submenu-groups');
+        const arrow = document.getElementById('arrow-menu-groups');
+        if (submenu && submenu.classList.contains('hidden')) {
+            submenu.classList.remove('hidden');
+            arrow?.classList.remove('-rotate-90');
+        }
+    }
+
+    // Si on clique sur un sous-menu Système, s'assurer que le menu parent est bien déplié
+    if (tabId === 'system' || tabId === 'backups' || tabId === 'firewall') {
+        const submenu = document.getElementById('submenu-system');
+        const arrow = document.getElementById('arrow-menu-system');
+        if (submenu && submenu.classList.contains('hidden')) {
+            submenu.classList.remove('hidden');
+            arrow?.classList.remove('-rotate-90');
+        }
+    }
+
+    // Si onglet Sauvegardes, charger la liste des sauvegardes et la configuration
+    if (tabId === 'backups') {
+        loadBackups();
+    }
+
+    // Si onglet Pare-feu, charger le statut en direct
+    if (tabId === 'firewall') {
+        loadFirewallStatus();
+    }
+
+    toggleMobileSidebar(false);
+}
+
+function toggleSystemMenu() {
+    const submenu = document.getElementById('submenu-system');
+    const arrow = document.getElementById('arrow-menu-system');
+    if (!submenu) return;
+    const isHidden = submenu.classList.toggle('hidden');
+    if (arrow) {
+        if (isHidden) {
+            arrow.classList.add('-rotate-90');
+        } else {
+            arrow.classList.remove('-rotate-90');
+        }
+    }
+}
+
+function toggleGroupsMenu() {
+    const submenu = document.getElementById('submenu-groups');
+    const arrow = document.getElementById('arrow-menu-groups');
+    if (!submenu) return;
+    const isHidden = submenu.classList.toggle('hidden');
+    if (arrow) {
+        if (isHidden) {
+            arrow.classList.add('-rotate-90');
+        } else {
+            arrow.classList.remove('-rotate-90');
+        }
+    }
+}
+
+function toggleOperatorsMenu() {
+    const submenu = document.getElementById('submenu-operators');
+    const arrow = document.getElementById('arrow-menu-operators');
+    if (!submenu) return;
+    const isHidden = submenu.classList.toggle('hidden');
+    if (arrow) {
+        if (isHidden) {
+            arrow.classList.add('-rotate-90');
+        } else {
+            arrow.classList.remove('-rotate-90');
+        }
+    }
+}
+
+function toggleMobileSidebar(open) {
+    const sidebar = document.getElementById('sidebar');
+    const backdrop = document.getElementById('sidebar-backdrop');
+    if (!sidebar || !backdrop) return;
+
+    if (open) {
+        sidebar.classList.remove('-translate-x-full');
+        backdrop.classList.remove('hidden');
+    } else {
+        sidebar.classList.add('-translate-x-full');
+        backdrop.classList.add('hidden');
+    }
+}
+
+function openModal(id) {
+    const el = document.getElementById(id);
+    if (el) {
+        el.classList.remove('hidden');
+        el.classList.add('flex');
+    }
+}
+
+function closeModal(id) {
+    const el = document.getElementById(id);
+    if (el) {
+        el.classList.add('hidden');
+        el.classList.remove('flex');
+    }
+}
+
+// --- Écouteurs d'événements DOM ---
+document.addEventListener('DOMContentLoaded', () => {
+    // Login AJAX
+    document.getElementById('login-form')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const formData = Object.fromEntries(new FormData(e.target).entries());
+        try {
+            const res = await apiCall('login', formData);
+            showToast(res.message, 'success');
+            document.getElementById('login-screen').classList.add('hidden');
+            document.getElementById('app-screen').classList.remove('hidden');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Logout AJAX
+    document.getElementById('btn-logout')?.addEventListener('click', async () => {
+        stopMetricsPolling();
+        await apiCall('logout', {});
+        document.getElementById('app-screen').classList.add('hidden');
+        document.getElementById('login-screen').classList.remove('hidden');
+        showToast('Vous êtes déconnecté.', 'info');
+    });
+
+    // Form Extension
+    document.getElementById('form-extension')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const fd = new FormData(e.target);
+        const payload = Object.fromEntries(fd.entries());
+        payload.encryption = Number(document.getElementById('ext-encryption')?.value ?? 1);
+        payload.member_extension_groups = Array.from(e.target.querySelectorAll('input[name="member_extension_groups[]"]:checked')).map(c => c.value);
+        payload.voicemail_enabled = document.getElementById('ext-voicemail-enabled')?.checked ? 1 : 0;
+        payload.force_pin_change = (payload.pin_mode === 'first_call') ? 1 : 0;
+        payload.voicemail_skip_pin = document.getElementById('ext-skip-pin')?.checked ? 1 : 0;
+        payload.voicemail_attach = document.getElementById('ext-vm-attach')?.checked ? 1 : 0;
+        payload.voicemail_delete = document.getElementById('ext-vm-delete')?.checked ? 1 : 0;
+        payload.ring_time = Number(payload.ring_time || 20);
+
+        try {
+            const res = await apiCall('save_extension', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-extension');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Groupe de Sonnerie (Ring Groups)
+    document.getElementById('form-group')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const fd = new FormData(e.target);
+        const payload = Object.fromEntries(fd.entries());
+        payload.members = Array.from(e.target.querySelectorAll('input[name="member_ext"]:checked')).map(c => c.value);
+
+        try {
+            const res = await apiCall('save_group', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-group');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Groupe d'Extensions (Sites & Droits Sortants)
+    document.getElementById('form-extgroup')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const fd = new FormData(e.target);
+        const payload = Object.fromEntries(fd.entries());
+        payload.members = Array.from(activeExtGroupSelectedExts);
+
+        try {
+            const res = await apiCall('save_extension_group', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-extgroup');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Trunk (Configuration PJSIP complète)
+    document.getElementById('form-trunk')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const form = e.target;
+        const fd = new FormData(form);
+        const payload = Object.fromEntries(fd.entries());
+
+        payload.enabled          = form.elements['enabled'].checked ? 1 : 0;
+        payload.register         = form.elements['register'].checked ? 1 : 0;
+        payload.line_support     = form.elements['line_support'].checked ? 1 : 0;
+        payload.send_pai         = form.elements['send_pai'].checked ? 1 : 0;
+        payload.send_rpid        = form.elements['send_rpid'].checked ? 1 : 0;
+        payload.send_diversion   = form.elements['send_diversion'].checked ? 1 : 0;
+        payload.trust_id_inbound = form.elements['trust_id_inbound'].checked ? 1 : 0;
+        payload.nat_symmetric    = form.elements['nat_symmetric'].checked ? 1 : 0;
+        payload.direct_media     = form.elements['direct_media'].checked ? 1 : 0;
+        payload.inband_progress  = form.elements['inband_progress'].checked ? 1 : 0;
+        payload.fax_detect       = form.elements['fax_detect'].checked ? 1 : 0;
+
+        const didRoutes = [];
+        document.querySelectorAll('#trunk-did-container .trunk-did-row').forEach(row => {
+            const cid       = row.querySelector('.trunk-did-cid')?.value.trim() || 'Any';
+            const did       = row.querySelector('.trunk-did-num')?.value.trim() || 'Any';
+            const desc      = row.querySelector('.trunk-did-desc')?.value.trim() || '';
+            const dest      = row.querySelector('.trunk-did-dest')?.value.trim() || '';
+            const tcEnabled = row.querySelector('.trunk-tc-enabled')?.checked ? 1 : 0;
+            const tcStart   = row.querySelector('.trunk-tc-start')?.value || '08:30';
+            const tcFinish  = row.querySelector('.trunk-tc-finish')?.value || '18:00';
+            const weekdays  = row.querySelector('.trunk-tc-weekdays')?.value || 'mon-fri';
+            const tcClosed  = row.querySelector('.trunk-tc-closed-dest')?.value || 'terminate-hangup';
+
+            if (dest) {
+                didRoutes.push({
+                    cid,
+                    did,
+                    description: desc,
+                    destination: dest,
+                    time_condition_enabled: tcEnabled,
+                    time_start: tcStart,
+                    time_finish: tcFinish,
+                    weekdays: weekdays,
+                    time_dest_closed: tcClosed
+                });
+            }
+        });
+        payload.did_routes = didRoutes;
+
+        try {
+            const res = await apiCall('save_trunk', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-trunk');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Outbound Route
+    document.getElementById('form-outbound')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const form = e.target;
+        const fd = new FormData(form);
+        const payload = Object.fromEntries(fd.entries());
+
+        payload.enabled = form.elements['enabled'].checked ? 1 : 0;
+        payload.continue_next_route = form.elements['continue_next_route'].checked ? 1 : 0;
+        payload.override_ext_cid = form.querySelector('input[name="override_ext_cid"]:checked')?.value === '1' ? 1 : 0;
+        payload.route_type = form.querySelector('input[name="route_type"]:checked')?.value || 'normal';
+        payload.permission_mode = form.querySelector('input[name="permission_mode"]:checked')?.value || 'all';
+        payload.record_mode = form.querySelector('input[name="record_mode"]:checked')?.value || 'dontcare';
+
+        // Séquence de Trunks
+        const trunks = [];
+        document.querySelectorAll('#ob-trunk-seq-container .ob-trunk-select').forEach(sel => {
+            const val = sel.value.trim();
+            if (val && !trunks.includes(val)) trunks.push(val);
+        });
+        payload.trunk_sequence = trunks;
+
+        // Dial Patterns
+        const patterns = [];
+        document.querySelectorAll('#ob-patterns-container .ob-pat-row').forEach(row => {
+            const prep = row.querySelector('.ob-pat-prepend')?.value.trim() || '';
+            const pfx  = row.querySelector('.ob-pat-prefix')?.value.trim() || '';
+            const mtch = row.querySelector('.ob-pat-match')?.value.trim() || '';
+            const cid  = row.querySelector('.ob-pat-cid')?.value.trim() || '';
+            if (mtch) {
+                patterns.push({
+                    prepend: prep,
+                    prefix: pfx,
+                    match_pattern: mtch,
+                    callerid: cid
+                });
+            }
+        });
+        payload.dial_patterns = patterns;
+
+        // Groupes autorisés
+        payload.allowed_groups = Array.from(form.querySelectorAll('input[name="ob_allowed_groups[]"]:checked')).map(c => c.value);
+
+        // Extensions autorisées (depuis le drag/transfert interactif)
+        payload.allowed_extensions = Array.from(activeObAllowedExts);
+
+        try {
+            const res = await apiCall('save_outbound_route', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-outbound');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form IVR
+    document.getElementById('form-ivr')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const fd = new FormData(e.target);
+        const payload = Object.fromEntries(fd.entries());
+        payload.direct_dial = document.getElementById('ivr-direct-dial-checkbox')?.checked ? 1 : 0;
+
+        const options = {};
+        document.querySelectorAll('#ivr-options-container .ivr-opt-row').forEach(row => {
+            const d = (row.querySelector('.ivr-digit')?.value || '').trim();
+            const dest = (row.querySelector('.ivr-dest')?.value || '').trim();
+            if (d && dest) options[d] = dest;
+        });
+        payload.options = options;
+
+        try {
+            const res = await apiCall('save_ivr', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-ivr');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Fichier Son (Upload multipart / Update)
+    document.getElementById('form-sound')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const form = e.target;
+        const fd = new FormData(form);
+        const id = form.elements['id'].value;
+        const submitBtn = document.getElementById('btn-submit-sound');
+
+        if (submitBtn) {
+            submitBtn.disabled = true;
+            submitBtn.textContent = "Traitement audio en cours...";
+        }
+
+        try {
+            let res;
+            if (id) {
+                const payload = Object.fromEntries(fd.entries());
+                res = await apiCall('update_sound', payload);
+            } else {
+                const response = await fetch('/api.php?action=upload_sound', {
+                    method: 'POST',
+                    body: fd
+                });
+                const cType = response.headers.get('content-type') || '';
+                if (cType.includes('application/json')) {
+                    res = await response.json();
+                } else {
+                    const rawText = await response.text();
+                    if (response.status === 413) {
+                        throw new Error("Le fichier audio est trop volumineux pour le serveur (Limite 64 Mo).");
+                    }
+                    throw new Error(`Erreur serveur (${response.status}) : ${rawText.replace(/<[^>]*>/g, '').trim().slice(0, 150) || 'Réponse inattendue'}`);
+                }
+                if (!response.ok || !res.success) {
+                    throw new Error(res.message || 'Erreur lors du téléversement du fichier audio.');
+                }
+            }
+            showToast(res.message, 'success');
+            closeModal('modal-sound');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        } finally {
+            if (submitBtn) {
+                submitBtn.disabled = false;
+                submitBtn.textContent = id ? "Enregistrer les Modifications" : "Téléverser & Enregistrer";
+            }
+        }
+    });
+
+    // Form Catégories de sites
+    document.getElementById('form-sound-site')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const form = e.target;
+        const payload = Object.fromEntries(new FormData(form).entries());
+        try {
+            const res = await apiCall('save_sound_site', payload);
+            showToast(res.message, 'success');
+            form.reset();
+            const idInput = document.getElementById('sound-site-id');
+            if (idInput) idInput.value = '';
+            const btn = document.getElementById('btn-save-sound-site');
+            if (btn) btn.textContent = 'Enregistrer';
+            await loadState();
+            renderSoundSitesTable();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Form Settings
+    document.getElementById('settings-form')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const payload = Object.fromEntries(new FormData(e.target).entries());
+        payload.wizard_completed = 1;
+        try {
+            const res = await apiCall('save_settings', payload);
+            showToast(res.message, 'success');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Bouton Tester AMI
+    document.getElementById('btn-test-ami')?.addEventListener('click', async () => {
+        try {
+            const res = await apiCall('test_ami');
+            showToast(res.message, 'success');
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    // Bouton Appliquer les configurations (Écriture /etc/asterisk + Reload AMI)
+    document.getElementById('btn-apply-config')?.addEventListener('click', async () => {
+        const icon = document.getElementById('apply-icon');
+        icon?.classList.add('animate-spin');
+        try {
+            const res = await apiCall('apply_config', {});
+            showToast(res.message, 'success');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        } finally {
+            icon?.classList.remove('animate-spin');
+        }
+    });
+
+    // Formulaire Let's Encrypt
+    document.getElementById('form-cert-letsencrypt')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const btn = document.getElementById('btn-submit-letsencrypt');
+        const spinner = document.getElementById('spinner-letsencrypt');
+        const btnText = document.getElementById('btn-text-letsencrypt');
+        const msgBox = document.getElementById('letsencrypt-msg-box');
+
+        const formData = new FormData(f);
+        const payload = {
+            name: (formData.get('name') || '').trim(),
+            domain: (formData.get('domain') || '').trim(),
+            email: (formData.get('email') || '').trim(),
+            is_default: formData.get('is_default') === '1' ? 1 : 0,
+            staging: formData.get('staging') === '1' ? 1 : 0
+        };
+
+        if (btn) btn.disabled = true;
+        if (spinner) spinner.classList.remove('hidden');
+        if (btnText) btnText.textContent = "Communication avec Let's Encrypt...";
+        if (msgBox) { msgBox.className = 'hidden'; msgBox.textContent = ''; }
+
+        try {
+            const res = await apiCall('request_letsencrypt_cert', payload);
+            showToast(res.message, 'success');
+            closeModal('modal-cert-letsencrypt');
+            await loadState();
+        } catch (err) {
+            if (msgBox) {
+                msgBox.className = 'p-3 rounded-xl text-xs font-mono bg-rose-950/60 border border-rose-500/40 text-rose-300';
+                msgBox.textContent = "Erreur Let's Encrypt :\n" + err.message;
+            }
+            showToast("Échec de l'émission Let's Encrypt", 'error');
+        } finally {
+            if (btn) btn.disabled = false;
+            if (spinner) spinner.classList.add('hidden');
+            if (btnText) btnText.textContent = "Lancer l'émission ACME";
+        }
+    });
+
+    // Formulaire Import Certificat Custom (supporte FormData multipart pour fichiers .crt, .key)
+    document.getElementById('form-cert-custom')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const btn = document.getElementById('btn-submit-custom-cert');
+        const spinner = document.getElementById('spinner-custom-cert');
+        const msgBox = document.getElementById('custom-cert-msg-box');
+
+        const formData = new FormData(f);
+
+        if (btn) btn.disabled = true;
+        if (spinner) spinner.classList.remove('hidden');
+        if (msgBox) { msgBox.className = 'hidden'; msgBox.textContent = ''; }
+
+        try {
+            const resp = await fetch('/api.php?action=save_custom_cert', {
+                method: 'POST',
+                body: formData
+            });
+            const data = await resp.json();
+            if (!data.success) {
+                throw new Error(data.message || 'Erreur lors de l\'enregistrement du certificat');
+            }
+            showToast(data.message, 'success');
+            closeModal('modal-cert-custom');
+            await loadState();
+        } catch (err) {
+            if (msgBox) {
+                msgBox.className = 'p-3 rounded-xl text-xs font-mono bg-rose-950/60 border border-rose-500/40 text-rose-300';
+                msgBox.textContent = "Erreur de validation du certificat :\n" + err.message;
+            }
+            showToast(err.message, 'error');
+        } finally {
+            if (btn) btn.disabled = false;
+            if (spinner) spinner.classList.add('hidden');
+        }
+    });
+
+    // Lecture automatique des fichiers .crt, .key dans les textareas lors de la sélection
+    const bindFileReader = (fileInputId, textareaId) => {
+        const input = document.getElementById(fileInputId);
+        const textarea = document.getElementById(textareaId);
+        if (input && textarea) {
+            input.addEventListener('change', (e) => {
+                const file = e.target.files[0];
+                if (file) {
+                    const reader = new FileReader();
+                    reader.onload = (re) => { textarea.value = re.target.result; };
+                    reader.readAsText(file);
+                }
+            });
+        }
+    };
+    bindFileReader('file-cert-custom', 'textarea-cert-pem');
+    bindFileReader('file-key-custom', 'textarea-key-pem');
+    bindFileReader('file-chain-custom', 'textarea-chain-pem');
+
+    // Formulaire Paramètres SIP & NAT
+    document.getElementById('form-sip-settings')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const btn = document.getElementById('btn-save-sip-settings');
+        const spinner = document.getElementById('spinner-save-sip-settings');
+
+        const netInputs = f.querySelectorAll('input[name="local_networks[]"]');
+        const localNets = Array.from(netInputs).map(i => i.value.trim()).filter(v => v !== '');
+
+        const payload = {
+            external_ip: (document.getElementById('sip-external-ip')?.value || '').trim(),
+            external_udp_port: Number(document.getElementById('sip-external-udp-port')?.value || 0),
+            external_tls_port: Number(document.getElementById('sip-external-tls-port')?.value || 0),
+            udp_port: Number(document.getElementById('sip-udp-port')?.value || 5060),
+            tls_port: Number(document.getElementById('sip-tls-port')?.value || 5061),
+            rtp_start: Number(document.getElementById('sip-rtp-start')?.value || 10000),
+            rtp_end: Number(document.getElementById('sip-rtp-end')?.value || 20000),
+            rtp_strict: Number(document.getElementById('sip-rtp-strict')?.value || 1),
+            rtp_checksums: Number(document.getElementById('sip-rtp-checksums')?.value || 1),
+            rtp_keepalive: Number(document.getElementById('sip-rtp-keepalive')?.value || 15),
+            rtp_timeout: Number(document.getElementById('sip-rtp-timeout')?.value || 30),
+            allow_anonymous_sip: Number(document.getElementById('sip-allow-anonymous')?.value || 0),
+            local_networks: localNets
+        };
+
+        if (btn) btn.disabled = true;
+        if (spinner) spinner.classList.remove('hidden');
+
+        try {
+            const res = await apiCall('save_sip_settings', payload);
+            showToast(res.message, 'success');
+            const container = document.getElementById('local-networks-container');
+            if (container) delete container.dataset.initialized;
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        } finally {
+            if (btn) btn.disabled = false;
+            if (spinner) spinner.classList.add('hidden');
+        }
+    });
+
+    // Formulaire Édition d'un Code de Fonction
+    document.getElementById('form-edit-feature-code')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const btn = document.getElementById('btn-submit-edit-fc');
+        const spinner = document.getElementById('spinner-edit-fc');
+        const id = Number(document.getElementById('edit-fc-id')?.value || 0);
+        const code = (document.getElementById('edit-fc-code')?.value || '').trim();
+
+        if (btn) btn.disabled = true;
+        if (spinner) spinner.classList.remove('hidden');
+
+        try {
+            const res = await apiCall('update_feature_code', { id, code });
+            showToast(res.message, 'success');
+            closeModal('modal-edit-feature-code');
+            await loadState();
+        } catch (err) {
+            showToast(err.message, 'error');
+        } finally {
+            if (btn) btn.disabled = false;
+            if (spinner) spinner.classList.add('hidden');
+        }
+    });
+
+    // Formulaire Paramètres de Sauvegarde & SSH
+    document.getElementById('backup-settings-form')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const autoEnabled = f.elements['backup_auto_enabled']?.checked ? 1 : 0;
+        const frequency = f.elements['backup_frequency']?.value || 'daily';
+        const retention = Number(f.elements['backup_retention']?.value || 7);
+        const storageType = f.querySelector('input[name="backup_storage_type"]:checked')?.value || 'local';
+        const sshHost = (f.elements['backup_ssh_host']?.value || '').trim();
+        const sshPort = Number(f.elements['backup_ssh_port']?.value || 22);
+        const sshUser = (f.elements['backup_ssh_user']?.value || '').trim();
+        const sshPassword = f.elements['backup_ssh_password']?.value || '';
+        const sshRemotePath = (f.elements['backup_ssh_remote_path']?.value || '/backups/nexus').trim();
+
+        const payload = {
+            backup_auto_enabled: autoEnabled,
+            backup_frequency: frequency,
+            backup_retention: retention,
+            backup_storage_type: storageType,
+            backup_ssh_host: sshHost,
+            backup_ssh_port: sshPort,
+            backup_ssh_user: sshUser,
+            backup_ssh_auth_type: 'password',
+            backup_ssh_password: sshPassword,
+            backup_ssh_remote_path: sshRemotePath
+        };
+
+        try {
+            const res = await apiCall('save_backup_settings', payload);
+            showToast(res.message, 'success');
+            await loadBackups();
+        } catch (err) {
+            showToast("Erreur enregistrement : " + err.message, 'error');
+        }
+    });
+
+    // Formulaire Paramètres Pare-feu & Fail2ban
+    document.getElementById('firewall-settings-form')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const btn = document.getElementById('btn-save-firewall-settings');
+        if (btn) btn.disabled = true;
+
+        const payload = {
+            firewall_enabled: f.elements['firewall_enabled']?.checked ? 1 : (f.elements['certbot_strict_port80']?.checked ? 1 : 0),
+            admin_https_port: Number(f.elements['admin_https_port']?.value || 8443),
+            certbot_strict_port80: f.elements['certbot_strict_port80']?.checked ? 1 : 0,
+            fail2ban_sip_maxretry: Number(f.elements['fail2ban_sip_maxretry']?.value || 3),
+            fail2ban_sip_bantime: Number(f.elements['fail2ban_sip_bantime']?.value || 3600),
+            fail2ban_whitelist_ips: (f.elements['fail2ban_whitelist_ips']?.value || '').trim()
+        };
+
+        try {
+            const res = await apiCall('save_firewall_settings', payload);
+            showToast(res.message, 'success');
+            await loadFirewallStatus();
+        } catch (err) {
+            showToast("Erreur application sécurité : " + err.message, 'error');
+        } finally {
+            if (btn) btn.disabled = false;
+        }
+    });
+
+    // Formulaire Bannissement Manuel Rapide
+    document.getElementById('form-manual-ban')?.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const ip = (document.getElementById('manual-ban-ip')?.value || '').trim();
+        const jail = document.getElementById('manual-ban-jail')?.value || 'asterisk';
+        if (!ip) return;
+
+        try {
+            const res = await apiCall('ban_ip', { ip, jail });
+            showToast(res.message, res.success ? 'success' : 'error');
+            document.getElementById('manual-ban-ip').value = '';
+            await loadFirewallStatus();
+        } catch (err) {
+            showToast("Erreur lors du bannissement : " + err.message, 'error');
+        }
+    });
+
+    // Si déjà authentifié au chargement initial
+    if (!document.getElementById('app-screen').classList.contains('hidden')) {
+        loadState();
+    }
+});
+
+// =========================================================================
+// GESTIONNAIRE DE CERTIFICATS SSL / TLS (FONCTIONS GLOBALES)
+// =========================================================================
+function renderCertificates() {
+    const certs = appState.certificates || [];
+    const activeCert = appState.active_certificate || certs.find(c => Number(c.is_default) === 1) || certs[0];
+
+    // Badge sidebar
+    const badgeSidebar = document.getElementById('nav-badge-certificates');
+    if (badgeSidebar) {
+        badgeSidebar.textContent = certs.length;
+    }
+
+    const badgeTable = document.getElementById('certs-count-badge');
+    if (badgeTable) {
+        badgeTable.textContent = `${certs.length} certificat${certs.length > 1 ? 's' : ''}`;
+    }
+
+    // Carte Résumé Actif
+    if (activeCert) {
+        const nameEl = document.getElementById('active-cert-name');
+        const domEl  = document.getElementById('active-cert-domain');
+        const issEl  = document.getElementById('active-cert-issuer');
+        const typeEl = document.getElementById('active-cert-type-badge');
+        const daysEl = document.getElementById('active-cert-days');
+        const renewWrap = document.getElementById('active-cert-renew-wrapper');
+
+        if (nameEl) nameEl.textContent = activeCert.name || 'Certificat Actif';
+        if (domEl)  domEl.textContent  = activeCert.primary_domain || 'pbx.local';
+        if (issEl)  issEl.textContent  = activeCert.issuer || 'Inconnu';
+
+        if (typeEl) {
+            if (activeCert.type === 'letsencrypt') {
+                typeEl.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/40';
+                typeEl.textContent = "Let's Encrypt (ACME Auto)";
+            } else if (activeCert.type === 'custom') {
+                typeEl.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/40';
+                typeEl.textContent = "Certificat Entreprise (Import)";
+            } else {
+                typeEl.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-anthracite-700 text-slate-300 border border-anthracite-600';
+                typeEl.textContent = "Auto-signé Système";
+            }
+        }
+
+        if (daysEl) {
+            const days = Number(activeCert.days_remaining ?? 0);
+            if (days < 0) {
+                daysEl.className = 'text-xs font-bold text-rose-400 mt-0.5';
+                daysEl.textContent = `Expiré (${Math.abs(days)}j)`;
+            } else if (days <= 15) {
+                daysEl.className = 'text-xs font-bold text-amber-400 mt-0.5';
+                daysEl.textContent = `${days} j restants (À renouveler)`;
+            } else {
+                daysEl.className = 'text-xs font-bold text-emerald-400 mt-0.5';
+                daysEl.textContent = `${days} j restants`;
+            }
+        }
+
+        if (renewWrap) {
+            if (activeCert.type === 'letsencrypt') {
+                renewWrap.classList.remove('hidden');
+            } else {
+                renewWrap.classList.add('hidden');
+            }
+        }
+    }
+
+    // Statut Mutual TLS (mTLS) verify_client
+    const settings = appState.settings || {};
+    const mtlsVal = Number(settings.tls_verify_client ?? 0);
+    const selMtls = document.getElementById('select-tls-verify-client');
+    const badgeMtls = document.getElementById('badge-mtls-status');
+    if (selMtls) {
+        selMtls.value = String(mtlsVal);
+    }
+    if (badgeMtls) {
+        if (mtlsVal === 1) {
+            badgeMtls.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/40';
+            badgeMtls.textContent = 'Activé (Strict / mTLS)';
+        } else {
+            badgeMtls.className = 'px-2 py-0.5 rounded-full text-[10px] font-bold bg-anthracite-700 text-slate-300 border border-anthracite-600';
+            badgeMtls.textContent = 'Désactivé (Standard)';
+        }
+    }
+
+    // Tableau des certificats
+    const tbody = document.getElementById('certificates-tbody');
+    if (!tbody) return;
+
+    if (certs.length === 0) {
+        tbody.innerHTML = `
+            <tr>
+                <td colspan="7" class="py-8 text-center text-slate-400">
+                    Aucun certificat enregistré. Cliquez sur « Générer via Let's Encrypt » ou « Importer un Certificat ».
+                </td>
+            </tr>
+        `;
+        return;
+    }
+
+    tbody.innerHTML = certs.map(c => {
+        const isDefault = Number(c.is_default) === 1;
+        const days = Number(c.days_remaining ?? 0);
+
+        let typeBadge = '';
+        if (c.type === 'letsencrypt') {
+            typeBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/40">Let's Encrypt</span>`;
+        } else if (c.type === 'custom') {
+            typeBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/40">Import Custom</span>`;
+        } else {
+            typeBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-anthracite-700 text-slate-300 border border-anthracite-600">Auto-signé</span>`;
+        }
+
+        let validityBadge = '';
+        if (days < 0) {
+            validityBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-rose-500/20 text-rose-300 border border-rose-500/40">Expiré (${c.valid_to ? c.valid_to.substring(0, 10) : ''})</span>`;
+        } else if (days <= 15) {
+            validityBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/40">${days}j restants (${c.valid_to ? c.valid_to.substring(0, 10) : ''})</span>`;
+        } else {
+            validityBadge = `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/40">${days}j restants (${c.valid_to ? c.valid_to.substring(0, 10) : ''})</span>`;
+        }
+
+        let defaultBadge = '';
+        if (isDefault) {
+            defaultBadge = `
+                <div class="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg bg-emerald-500/20 text-emerald-300 border border-emerald-500/40 font-bold text-[11px]">
+                    <span class="w-1.5 h-1.5 rounded-full bg-emerald-400 animate-pulse"></span>
+                    <span>ACTIF PAR DÉFAUT</span>
+                </div>
+            `;
+        } else {
+            defaultBadge = `
+                <button type="button" onclick="setDefaultCertificate(${c.id})"
+                    class="px-2.5 py-1 rounded-lg bg-anthracite-700 hover:bg-emerald-600 hover:text-white text-slate-300 border border-anthracite-600 font-semibold text-xs transition">
+                    Activer
+                </button>
+            `;
+        }
+
+        let actions = '<div class="flex items-center justify-end gap-1.5">';
+        if (c.type === 'letsencrypt') {
+            actions += `
+                <button type="button" onclick="renewCertificate(${c.id})" title="Renouveler ce certificat Let's Encrypt"
+                    class="p-1.5 rounded-lg text-emerald-400 hover:bg-emerald-500/20 border border-emerald-500/30 transition">
+                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg>
+                </button>
+            `;
+        }
+
+        if (!isDefault) {
+            actions += `
+                <button type="button" onclick="deleteCertificate(${c.id}, '${escapeHtml(c.name)}')" title="Supprimer ce certificat"
+                    class="p-1.5 rounded-lg text-rose-400 hover:bg-rose-500/20 border border-rose-500/30 transition">
+                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"/></svg>
+                </button>
+            `;
+        }
+        actions += '</div>';
+
+        const sanDisplay = c.alt_names ? `<div class="text-[10px] text-slate-400 font-mono mt-0.5 truncate max-w-xs" title="${escapeHtml(c.alt_names)}">+ ${escapeHtml(c.alt_names)}</div>` : '';
+
+        return `
+            <tr class="hover:bg-anthracite-900/50 transition">
+                <td class="py-3 px-4 font-semibold text-white">
+                    <div class="flex items-center gap-2">
+                        <span>${escapeHtml(c.name)}</span>
+                        ${isDefault ? '<span class="text-emerald-400" title="Actif en production">★</span>' : ''}
+                    </div>
+                </td>
+                <td class="py-3 px-4">${typeBadge}</td>
+                <td class="py-3 px-4 font-mono text-slate-200">
+                    <div class="font-bold text-white">${escapeHtml(c.primary_domain)}</div>
+                    ${sanDisplay}
+                </td>
+                <td class="py-3 px-4 text-slate-300 font-medium">${escapeHtml(c.issuer || '-')}</td>
+                <td class="py-3 px-4">${validityBadge}</td>
+                <td class="py-3 px-4 text-center">${defaultBadge}</td>
+                <td class="py-3 px-4 text-right">${actions}</td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function openLetsEncryptModal() {
+    const f = document.getElementById('form-cert-letsencrypt');
+    if (f) f.reset();
+    const box = document.getElementById('letsencrypt-msg-box');
+    if (box) { box.className = 'hidden'; box.textContent = ''; }
+    if (appState.settings && appState.settings.domain && appState.settings.domain !== 'pbx.local') {
+        const domInput = f?.querySelector('input[name="domain"]');
+        if (domInput && !domInput.value) domInput.value = appState.settings.domain;
+    }
+    openModal('modal-cert-letsencrypt');
+}
+
+function openCustomCertModal() {
+    const f = document.getElementById('form-cert-custom');
+    if (f) f.reset();
+    const box = document.getElementById('custom-cert-msg-box');
+    if (box) { box.className = 'hidden'; box.textContent = ''; }
+    openModal('modal-cert-custom');
+}
+
+async function setDefaultCertificate(id) {
+    if (!confirm("Voulez-vous activer ce certificat comme certificat par défaut ?\n\nIl sera immédiatement utilisé pour le transport PJSIP TLS (port 5061) et le chiffrement des communications audio (SRTP).")) {
+        return;
+    }
+    try {
+        const res = await apiCall('set_default_cert', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function renewCertificate(id) {
+    if (!confirm("Lancer le renouvellement ACME Let's Encrypt pour ce certificat ?")) {
+        return;
+    }
+    try {
+        showToast("Renouvellement Let's Encrypt en cours...", 'info');
+        const res = await apiCall('renew_cert', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast("Erreur de renouvellement : " + err.message, 'error');
+    }
+}
+
+async function renewCertificateFromBanner() {
+    const certs = appState.certificates || [];
+    const activeCert = appState.active_certificate || certs.find(c => Number(c.is_default) === 1);
+    if (activeCert && activeCert.id) {
+        await renewCertificate(activeCert.id);
+    }
+}
+
+async function deleteCertificate(id, name) {
+    if (!confirm(`Confirmez-vous la suppression du certificat « ${name} » ?\nCette action est irréversible.`)) {
+        return;
+    }
+    try {
+        const res = await apiCall('delete_cert', { id: Number(id) });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function saveTlsSecurityPolicy() {
+    const sel = document.getElementById('select-tls-verify-client');
+    const val = Number(sel?.value ?? 0);
+    const label = val === 1
+        ? 'Activer le mode Mutual TLS strict (certificat client X.509 obligatoirement exigé sur chaque téléphone)'
+        : 'Désactiver le mode Mutual TLS (standard : authentification par mot de passe SIP dans le tunnel TLS)';
+    if (!confirm(`Confirmez-vous cette modification de la politique TLS ?\n\n${label}\n\nAsterisk rechargera immédiatement le transport TLS 5061.`)) {
+        return;
+    }
+    try {
+        const res = await apiCall('set_tls_security', { tls_verify_client: val });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// =========================================================================
+// PARAMÈTRES SIP GLOBAUX & NAT (FONCTIONS GLOBALES)
+// =========================================================================
+function renderSipSettings() {
+    const s = appState.settings || {};
+
+    const extIpEl = document.getElementById('sip-external-ip');
+    if (extIpEl && document.activeElement !== extIpEl) {
+        extIpEl.value = s.external_ip || '';
+    }
+
+    const extUdpPortEl = document.getElementById('sip-external-udp-port');
+    if (extUdpPortEl && document.activeElement !== extUdpPortEl) {
+        extUdpPortEl.value = (s.external_udp_port && Number(s.external_udp_port) > 0) ? s.external_udp_port : '';
+    }
+
+    const extTlsPortEl = document.getElementById('sip-external-tls-port');
+    if (extTlsPortEl && document.activeElement !== extTlsPortEl) {
+        extTlsPortEl.value = (s.external_tls_port && Number(s.external_tls_port) > 0) ? s.external_tls_port : '';
+    }
+
+    const udpPortEl = document.getElementById('sip-udp-port');
+    if (udpPortEl && document.activeElement !== udpPortEl) {
+        udpPortEl.value = s.udp_port || 5060;
+    }
+
+    const tlsPortEl = document.getElementById('sip-tls-port');
+    if (tlsPortEl && document.activeElement !== tlsPortEl) {
+        tlsPortEl.value = s.tls_port || 5061;
+    }
+
+    const rtpStartEl = document.getElementById('sip-rtp-start');
+    if (rtpStartEl && document.activeElement !== rtpStartEl) {
+        rtpStartEl.value = s.rtp_start || 10000;
+    }
+
+    const rtpEndEl = document.getElementById('sip-rtp-end');
+    if (rtpEndEl && document.activeElement !== rtpEndEl) {
+        rtpEndEl.value = s.rtp_end || 20000;
+    }
+
+    const rtpStrictEl = document.getElementById('sip-rtp-strict');
+    if (rtpStrictEl) {
+        rtpStrictEl.value = (s.rtp_strict !== undefined && s.rtp_strict !== null) ? String(s.rtp_strict) : '1';
+    }
+
+    const rtpChecksumsEl = document.getElementById('sip-rtp-checksums');
+    if (rtpChecksumsEl) {
+        rtpChecksumsEl.value = (s.rtp_checksums !== undefined && s.rtp_checksums !== null) ? String(s.rtp_checksums) : '1';
+    }
+
+    const rtpKeepaliveEl = document.getElementById('sip-rtp-keepalive');
+    if (rtpKeepaliveEl && document.activeElement !== rtpKeepaliveEl) {
+        rtpKeepaliveEl.value = (s.rtp_keepalive !== undefined && s.rtp_keepalive !== null) ? s.rtp_keepalive : 15;
+    }
+
+    const rtpTimeoutEl = document.getElementById('sip-rtp-timeout');
+    if (rtpTimeoutEl && document.activeElement !== rtpTimeoutEl) {
+        rtpTimeoutEl.value = (s.rtp_timeout !== undefined && s.rtp_timeout !== null) ? s.rtp_timeout : 30;
+    }
+
+    const allowAnonEl = document.getElementById('sip-allow-anonymous');
+    if (allowAnonEl) {
+        allowAnonEl.value = (s.allow_anonymous_sip !== undefined && s.allow_anonymous_sip !== null) ? String(s.allow_anonymous_sip) : '0';
+    }
+
+    // Réseaux locaux (Local Networks list)
+    const container = document.getElementById('local-networks-container');
+    if (container && !container.dataset.initialized) {
+        container.innerHTML = '';
+        const nets = Array.isArray(s.local_networks) && s.local_networks.length > 0
+            ? s.local_networks
+            : (s.local_net ? [s.local_net] : ['10.10.0.0/16']);
+
+        nets.forEach(net => addLocalNetworkField(net));
+        container.dataset.initialized = 'true';
+    }
+}
+
+function addLocalNetworkField(value = '') {
+    const container = document.getElementById('local-networks-container');
+    if (!container) return;
+
+    const row = document.createElement('div');
+    row.className = 'flex items-center gap-2 local-network-row';
+    row.innerHTML = `
+        <div class="relative flex-1">
+            <input type="text" name="local_networks[]" value="${escapeHtml(value)}" placeholder="ex: 10.10.0.0/16 ou 192.168.1.0/24"
+                class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+        </div>
+        <button type="button" onclick="removeLocalNetworkField(this)" title="Supprimer ce réseau"
+            class="p-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-slate-400 hover:text-rose-400 hover:border-rose-500/50 transition">
+            <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+            </svg>
+        </button>
+    `;
+    container.appendChild(row);
+}
+
+function removeLocalNetworkField(btn) {
+    const container = document.getElementById('local-networks-container');
+    if (!container) return;
+    const rows = container.querySelectorAll('.local-network-row');
+    if (rows.length <= 1) {
+        showToast("Au moins un réseau local doit être défini.", "error");
+        return;
+    }
+    btn.closest('.local-network-row')?.remove();
+}
+
+async function detectPublicIp() {
+    const btn = document.getElementById('btn-detect-ip');
+    const spinner = document.getElementById('spinner-detect-ip');
+    const input = document.getElementById('sip-external-ip');
+
+    if (btn) btn.disabled = true;
+    if (spinner) spinner.classList.remove('hidden');
+
+    try {
+        const res = await apiCall('detect_external_ip');
+        if (res.ip && input) {
+            input.value = res.ip;
+            showToast(`IP publique détectée avec succès : ${res.ip}`, 'success');
+        } else {
+            showToast("Impossible de déterminer l'adresse IP publique automatiquement.", "error");
+        }
+    } catch (err) {
+        showToast("Erreur de détection : " + err.message, "error");
+    } finally {
+        if (btn) btn.disabled = false;
+        if (spinner) spinner.classList.add('hidden');
+    }
+}
+
+// =========================================================================
+// CODES DE FONCTIONS TÉLÉPHONIQUES & SERVICES (FONCTIONS GLOBALES)
+// =========================================================================
+let currentFeatureCategory = 'all';
+
+function filterFeatureCodes(category) {
+    currentFeatureCategory = category;
+    document.querySelectorAll('.fc-filter-btn').forEach(btn => {
+        if (btn.dataset.category === category) {
+            btn.className = 'fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-indigo-600 text-white transition';
+        } else {
+            btn.className = 'fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition';
+        }
+    });
+    renderFeatureCodes();
+}
+
+function renderFeatureCodes() {
+    const list = appState.feature_codes || [];
+    const tbody = document.getElementById('feature-codes-table-body');
+    const badge = document.getElementById('nav-badge-featurecodes');
+    const countAll = document.getElementById('fc-count-all');
+
+    const activeCount = list.filter(f => Number(f.enabled) === 1).length;
+    if (badge) badge.textContent = String(activeCount);
+    if (countAll) countAll.textContent = String(list.length);
+
+    if (!tbody) return;
+
+    const filtered = (currentFeatureCategory === 'all')
+        ? list
+        : list.filter(item => item.category === currentFeatureCategory);
+
+    if (filtered.length === 0) {
+        tbody.innerHTML = `
+            <tr>
+                <td colspan="6" class="text-center py-8 text-slate-400 text-xs">
+                    Aucun code de fonction trouvé dans cette catégorie.
+                </td>
+            </tr>
+        `;
+        return;
+    }
+
+    const categoryBadges = {
+        forward: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-amber-500/20 text-amber-300 border border-amber-500/30">Renvois</span>',
+        pickup: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">BLF / Capture</span>',
+        dnd: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-rose-500/20 text-rose-300 border border-rose-500/30">Ne Pas Déranger</span>',
+        voicemail: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-purple-500/20 text-purple-300 border border-purple-500/30">Messagerie</span>',
+        security: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-rose-500/20 text-rose-300 border border-rose-500/30">Sécurité</span>',
+        tools: '<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/30">Outils</span>'
+    };
+
+    tbody.innerHTML = filtered.map(fc => {
+        const isEnabled = Number(fc.enabled) === 1;
+        const catBadge = categoryBadges[fc.category] || `<span class="px-2 py-0.5 rounded-md text-[10px] font-bold bg-anthracite-700 text-slate-300">${fc.category}</span>`;
+        const codeDisplay = escapeHtml(fc.code);
+
+        return `
+            <tr class="hover:bg-anthracite-750 transition group">
+                <td class="py-3 px-4 font-mono font-bold text-sm text-indigo-300">
+                    <span class="px-2.5 py-1 rounded-lg bg-indigo-500/15 border border-indigo-500/30 inline-block">${codeDisplay}</span>
+                </td>
+                <td class="py-3 px-4">
+                    <div class="font-semibold text-white text-xs">${escapeHtml(fc.name)}</div>
+                    <div class="text-[10px] text-slate-400 font-mono">Standard : ${escapeHtml(fc.default_code)}</div>
+                </td>
+                <td class="py-3 px-4 text-xs text-slate-300 max-w-xs hidden sm:table-cell leading-relaxed">
+                    ${escapeHtml(fc.description)}
+                </td>
+                <td class="py-3 px-4">
+                    ${catBadge}
+                </td>
+                <td class="py-3 px-4 text-center">
+                    <label class="relative inline-flex items-center cursor-pointer">
+                        <input type="checkbox" ${isEnabled ? 'checked' : ''} onchange="toggleFeatureCode(${fc.id}, this.checked)" class="sr-only peer">
+                        <div class="w-9 h-5 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-4 after:w-4 after:transition-all peer-checked:bg-emerald-600"></div>
+                    </label>
+                </td>
+                <td class="py-3 px-4 text-right">
+                    <button type="button" onclick="openEditFeatureCodeModal(${fc.id})"
+                        class="p-1.5 rounded-lg bg-anthracite-700 hover:bg-indigo-600 text-slate-300 hover:text-white transition" title="Personnaliser ce code">
+                        <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
+                        </svg>
+                    </button>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+async function toggleFeatureCode(id, enabled) {
+    try {
+        const res = await apiCall('toggle_feature_code', { id: Number(id), enabled: enabled ? 1 : 0 });
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+        await loadState();
+    }
+}
+
+function openEditFeatureCodeModal(id) {
+    const list = appState.feature_codes || [];
+    const item = list.find(f => Number(f.id) === Number(id));
+    if (!item) return;
+
+    document.getElementById('edit-fc-id').value = item.id;
+    document.getElementById('edit-fc-code').value = item.code;
+    document.getElementById('modal-fc-service-name').textContent = item.name;
+    document.getElementById('modal-fc-default-code').textContent = item.default_code;
+
+    openModal('modal-edit-feature-code');
+}
+
+async function resetFeatureCodes() {
+    if (!confirm("Voulez-vous réinitialiser tous les codes de fonctions aux valeurs standard FreePBX / Asterisk ?\n\n(ex: ** pour BLF, *8 pour groupe, *72/*73 pour renvois, *78/*79 pour DND, *97 pour boîte vocale)")) {
+        return;
+    }
+    try {
+        const res = await apiCall('reset_feature_codes');
+        showToast(res.message, 'success');
+        await loadState();
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+// =========================================================================
+// GESTIONNAIRE DE SAUVEGARDES & RESTAURATION (DISASTER RECOVERY)
+// =========================================================================
+
+let appBackupsState = {
+    settings: {},
+    backups: []
+};
+
+async function loadBackups() {
+    try {
+        const res = await apiCall('get_backup_data', {});
+        if (res.success) {
+            appBackupsState.settings = res.settings || {};
+            appBackupsState.backups = res.backups || [];
+            renderBackups();
+        }
+    } catch (err) {
+        showToast("Erreur chargement des sauvegardes : " + err.message, 'error');
+    }
+}
+
+function renderBackups() {
+    const s = appBackupsState.settings || {};
+    const backups = appBackupsState.backups || [];
+
+    // 1. Stats d'en-tête
+    const lastRunEl = document.getElementById('backup-stat-last-run');
+    if (lastRunEl) {
+        lastRunEl.textContent = s.backup_last_run ? s.backup_last_run : 'Jamais exécutée';
+    }
+
+    const storageEl = document.getElementById('backup-stat-storage');
+    if (storageEl) {
+        if (s.backup_storage_type === 'ssh') {
+            storageEl.textContent = `Distant SSH (${s.backup_ssh_host || 'non configuré'})`;
+            storageEl.className = 'text-sm font-bold text-purple-400 truncate';
+        } else {
+            storageEl.textContent = 'Stockage Local';
+            storageEl.className = 'text-sm font-bold text-emerald-400 truncate';
+        }
+    }
+
+    const countEl = document.getElementById('backup-stat-count');
+    if (countEl) {
+        countEl.textContent = `${backups.length} archive(s)`;
+    }
+
+    const badgeSidebar = document.getElementById('nav-badge-backups');
+    if (badgeSidebar) {
+        badgeSidebar.textContent = backups.length;
+    }
+
+    // 2. Remplissage du formulaire de configuration
+    const form = document.getElementById('backup-settings-form');
+    if (form) {
+        if (form.elements['backup_auto_enabled']) {
+            form.elements['backup_auto_enabled'].checked = Number(s.backup_auto_enabled) === 1;
+        }
+        if (form.elements['backup_frequency']) {
+            form.elements['backup_frequency'].value = s.backup_frequency || 'daily';
+        }
+        if (form.elements['backup_retention']) {
+            form.elements['backup_retention'].value = s.backup_retention || 7;
+        }
+        const storageRadios = form.querySelectorAll('input[name="backup_storage_type"]');
+        storageRadios.forEach(r => {
+            r.checked = (r.value === (s.backup_storage_type || 'local'));
+        });
+        if (form.elements['backup_ssh_host']) {
+            form.elements['backup_ssh_host'].value = s.backup_ssh_host || '';
+        }
+        if (form.elements['backup_ssh_port']) {
+            form.elements['backup_ssh_port'].value = s.backup_ssh_port || 22;
+        }
+        if (form.elements['backup_ssh_user']) {
+            form.elements['backup_ssh_user'].value = s.backup_ssh_user || '';
+        }
+        if (form.elements['backup_ssh_password']) {
+            form.elements['backup_ssh_password'].value = s.backup_ssh_password || '';
+        }
+        if (form.elements['backup_ssh_remote_path']) {
+            form.elements['backup_ssh_remote_path'].value = s.backup_ssh_remote_path || '/backups/nexus';
+        }
+
+        toggleSshBackupFields((s.backup_storage_type || 'local') === 'ssh');
+    }
+
+    // 3. Remplissage du tableau des archives
+    const tbody = document.getElementById('backups-table-body');
+    if (!tbody) return;
+
+    if (backups.length === 0) {
+        tbody.innerHTML = `
+            <tr>
+                <td colspan="5" class="px-4 py-8 text-center text-slate-400">
+                    <div class="flex flex-col items-center justify-center gap-2">
+                        <svg class="w-8 h-8 text-slate-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M8 7H5a2 2 0 00-2 2v9a2 2 0 002 2h14a2 2 0 002-2V9a2 2 0 00-2-2h-3m-1 4l-3 3m0 0l-3-3m3 3V4"/>
+                        </svg>
+                        <span>Aucune archive de sauvegarde disponible. Cliquez sur "Créer une Sauvegarde Immédiate" pour générer la première.</span>
+                    </div>
+                </td>
+            </tr>
+        `;
+        return;
+    }
+
+    tbody.innerHTML = backups.map(b => {
+        const isLocal = b.is_local;
+        const locBadge = isLocal
+            ? `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">Local</span>`
+            : `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-purple-500/20 text-purple-300 border border-purple-500/30">Distant (SSH)</span>`;
+
+        const versionBadge = `<span class="px-1.5 py-0.2 rounded text-[10px] font-mono font-bold bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v${escapeHtml(b.version || '1.2.0')}</span>`;
+
+        return `
+            <tr class="hover:bg-anthracite-750 transition">
+                <td class="px-4 py-3 font-mono font-medium text-white">
+                    <div class="flex items-center gap-2">
+                        <svg class="w-4 h-4 text-purple-400 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"/>
+                        </svg>
+                        <span class="truncate max-w-xs sm:max-w-md">${escapeHtml(b.filename)}</span>
+                        ${versionBadge}
+                    </div>
+                </td>
+                <td class="px-4 py-3 text-slate-300 whitespace-nowrap">${escapeHtml(b.date_formatted)}</td>
+                <td class="px-4 py-3 font-mono text-emerald-300 whitespace-nowrap">${escapeHtml(b.size_formatted)}</td>
+                <td class="px-4 py-3 whitespace-nowrap">${locBadge}</td>
+                <td class="px-4 py-3 text-right whitespace-nowrap">
+                    <div class="flex items-center justify-end gap-1.5">
+                        <button type="button" onclick="downloadBackup('${escapeHtml(b.filename)}')"
+                            class="px-2.5 py-1 rounded-lg bg-anthracite-700 hover:bg-indigo-600 text-slate-200 hover:text-white transition flex items-center gap-1 font-semibold text-xs" title="Télécharger l'archive">
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"/>
+                            </svg>
+                            <span>Télécharger</span>
+                        </button>
+                        <button type="button" onclick="confirmRestoreBackup('${escapeHtml(b.filename)}')"
+                            class="px-2.5 py-1 rounded-lg bg-anthracite-700 hover:bg-emerald-600 text-slate-200 hover:text-white transition flex items-center gap-1 font-semibold text-xs" title="Restaurer cette sauvegarde">
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/>
+                            </svg>
+                            <span>Restaurer</span>
+                        </button>
+                        <button type="button" onclick="deleteBackup('${escapeHtml(b.filename)}')"
+                            class="p-1.5 rounded-lg bg-anthracite-700 hover:bg-rose-600 text-slate-400 hover:text-white transition" title="Supprimer">
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"/>
+                            </svg>
+                        </button>
+                    </div>
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function toggleSshBackupFields(show) {
+    const fields = document.getElementById('backup-ssh-fields');
+    if (!fields) return;
+    if (show) {
+        fields.classList.remove('hidden');
+    } else {
+        fields.classList.add('hidden');
+    }
+}
+
+async function createBackupNow() {
+    const btn = document.getElementById('btn-create-backup-now');
+    const label = document.getElementById('btn-create-backup-label');
+    if (btn) btn.disabled = true;
+    if (label) label.textContent = 'Génération de l\'archive...';
+
+    try {
+        const res = await apiCall('create_backup', {});
+        showToast(res.message, 'success');
+        await loadBackups();
+    } catch (err) {
+        showToast("Échec de création : " + err.message, 'error');
+    } finally {
+        if (btn) btn.disabled = false;
+        if (label) label.textContent = 'Créer une Sauvegarde Immédiate';
+    }
+}
+
+async function confirmRestoreBackup(filename) {
+    const ok = confirm(`⚠️ ATTENTION — RESTAURATION COMPLÈTE DU SYSTÈME NEXUSPBX ⚠️\n\nVoulez-vous restaurer le système depuis l'archive :\n${filename} ?\n\nCette action va :\n1. Remplacer la base de données SQLite\n2. Restaurer tous les fichiers sons, annonces et musiques\n3. Restaurer toutes les boîtes vocales, salutations et PINs\n4. Recharger l'intégralité du PBX Asterisk\n\nConfirmez-vous la restauration immédiate ?`);
+    if (!ok) return;
+
+    showToast("Restauration du système en cours... Veuillez patienter.", "info");
+
+    try {
+        const res = await apiCall('restore_backup', { filename });
+        showToast(res.message || "Restauration terminée avec succès !", 'success');
+        setTimeout(() => {
+            window.location.reload();
+        }, 2000);
+    } catch (err) {
+        showToast("Échec de la restauration : " + err.message, 'error');
+    }
+}
+
+function triggerBackupUpload() {
+    document.getElementById('backup-upload-input')?.click();
+}
+
+async function handleBackupUpload(input) {
+    const file = input?.files?.[0];
+    if (!file) return;
+
+    const ok = confirm(`⚠️ RESTAURATION DISASTER RECOVERY VIA FICHIER TÉLÉVERSÉ ⚠️\n\nFichier sélectionné : ${file.name} (${(file.size / (1024 * 1024)).toFixed(2)} Mo)\n\nVoulez-vous restaurer immédiatement le système NexusPBX avec cette archive ?\nToutes les données actuelles seront remplacées.`);
+    if (!ok) {
+        input.value = '';
+        return;
+    }
+
+    showToast("Téléversement et restauration de l'archive en cours...", "info");
+
+    const fd = new FormData();
+    fd.append('backup_file', file);
+
+    try {
+        const response = await fetch('/api.php?action=upload_restore_backup', {
+            method: 'POST',
+            body: fd
+        });
+        const res = await response.json();
+        if (!res.success) {
+            throw new Error(res.message || "Erreur lors de la restauration");
+        }
+        showToast(res.message, 'success');
+        setTimeout(() => {
+            window.location.reload();
+        }, 2000);
+    } catch (err) {
+        showToast("Échec de la restauration : " + err.message, 'error');
+    } finally {
+        input.value = '';
+    }
+}
+
+function downloadBackup(filename) {
+    window.location.href = `/api.php?action=download_backup&filename=${encodeURIComponent(filename)}`;
+}
+
+async function deleteBackup(filename) {
+    if (!confirm(`Êtes-vous sûr de vouloir supprimer définitivement l'archive de sauvegarde suivante ?\n\n${filename}`)) {
+        return;
+    }
+
+    try {
+        const res = await apiCall('delete_backup', { filename });
+        showToast(res.message, res.success ? 'success' : 'error');
+        await loadBackups();
+    } catch (err) {
+        showToast("Erreur lors de la suppression : " + err.message, 'error');
+    }
+}
+
+async function testSshBackupConnection() {
+    const form = document.getElementById('backup-settings-form');
+    if (!form) return;
+
+    const payload = {
+        backup_ssh_host: (form.elements['backup_ssh_host']?.value || '').trim(),
+        backup_ssh_port: Number(form.elements['backup_ssh_port']?.value || 22),
+        backup_ssh_user: (form.elements['backup_ssh_user']?.value || '').trim(),
+        backup_ssh_password: form.elements['backup_ssh_password']?.value || '',
+        backup_ssh_remote_path: (form.elements['backup_ssh_remote_path']?.value || '/backups/nexus').trim(),
+        backup_ssh_auth_type: 'password'
+    };
+
+    showToast("Test de la connexion SSH vers " + payload.backup_ssh_host + "...", "info");
+
+    try {
+        const res = await apiCall('test_ssh_backup', payload);
+        if (res.success) {
+            showToast(res.message, 'success');
+        } else {
+            showToast(res.message, 'error');
+        }
+    } catch (err) {
+        showToast("Échec du test SSH : " + err.message, 'error');
+    }
+}
+
+// =========================================================================
+// GESTIONNAIRE DE PARE-FEU & SÉCURITÉ (FAIL2BAN & NFTABLES)
+// =========================================================================
+
+let appFirewallState = {
+    is_running: false,
+    settings: {},
+    jails: {},
+    banned_ips: [],
+    total_banned: 0,
+    client_ip: ''
+};
+
+async function loadFirewallStatus() {
+    try {
+        const res = await apiCall('get_firewall_status', {});
+        if (res.success && res.data) {
+            appFirewallState = res.data;
+            renderFirewall();
+        }
+    } catch (err) {
+        showToast("Erreur chargement sécurité : " + err.message, 'error');
+    }
+}
+
+function renderFirewall() {
+    const d = appFirewallState;
+    const s = d.settings || {};
+    const banned = d.banned_ips || [];
+
+    // 1. Stat cards
+    const engineEl = document.getElementById('fw-stat-engine');
+    if (engineEl) {
+        engineEl.textContent = d.is_running ? 'En ligne (Actif)' : 'Arrêté (Inactif)';
+        engineEl.className = d.is_running ? 'text-sm font-bold text-emerald-400 truncate' : 'text-sm font-bold text-rose-400 truncate';
+    }
+
+    const sipJail = d.jails?.asterisk;
+    const sipJailEl = document.getElementById('fw-stat-sip-jail');
+    if (sipJailEl) {
+        sipJailEl.textContent = sipJail ? `Actif (${sipJail.banned_ips?.length || 0} banni)` : 'Inactif';
+    }
+
+    const webJail = d.jails?.['nexus-web'];
+    const webJailEl = document.getElementById('fw-stat-web-jail');
+    if (webJailEl) {
+        webJailEl.textContent = webJail ? `Protégé (${webJail.banned_ips?.length || 0} banni)` : 'Inactif';
+    }
+
+    const countEl = document.getElementById('fw-stat-banned-count');
+    if (countEl) {
+        countEl.textContent = `${d.total_banned} bannie(s)`;
+        countEl.className = d.total_banned > 0 ? 'text-sm font-bold text-rose-400 truncate' : 'text-sm font-bold text-emerald-400 truncate';
+    }
+
+    const badgeSidebar = document.getElementById('nav-badge-firewall');
+    if (badgeSidebar) {
+        badgeSidebar.textContent = d.total_banned;
+        badgeSidebar.className = d.total_banned > 0 
+            ? 'ml-2 shrink-0 px-1.5 py-0.2 text-[10px] rounded-full bg-rose-500/20 text-rose-300 border border-rose-500/30 font-bold'
+            : 'ml-2 shrink-0 px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-emerald-300 border border-anthracite-700 font-bold';
+    }
+
+    // 2. Table of banned IPs
+    const tbody = document.getElementById('firewall-banned-table-body');
+    if (tbody) {
+        if (banned.length === 0) {
+            tbody.innerHTML = `
+                <tr>
+                    <td colspan="4" class="px-4 py-8 text-center text-slate-400">
+                        <div class="flex flex-col items-center justify-center gap-2">
+                            <svg class="w-8 h-8 text-emerald-500/60" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                            </svg>
+                            <span class="text-slate-300 font-medium">Aucune adresse IP n'est actuellement bloquée.</span>
+                            <span class="text-[11px] text-slate-500">Le pare-feu NFTables et Fail2ban surveillent les flux SIP et Web 24h/24.</span>
+                        </div>
+                    </td>
+                </tr>
+            `;
+        } else {
+            tbody.innerHTML = banned.map(b => {
+                const jailClass = b.jail === 'asterisk' ? 'bg-cyan-500/20 text-cyan-300 border border-cyan-500/30' : 'bg-purple-500/20 text-purple-300 border border-purple-500/30';
+                return `
+                    <tr class="hover:bg-anthracite-750 transition">
+                        <td class="px-4 py-3 font-mono font-bold text-white text-sm">
+                            <span class="text-rose-400">⛔ ${escapeHtml(b.ip)}</span>
+                        </td>
+                        <td class="px-4 py-3">
+                            <span class="px-2 py-0.5 rounded-full text-[10px] font-bold ${jailClass}">${escapeHtml(b.jail_label || b.jail)}</span>
+                        </td>
+                        <td class="px-4 py-3">
+                            <span class="px-2 py-0.5 rounded text-[10px] font-bold bg-rose-950/80 text-rose-300 border border-rose-600/40">DROP (Bloqué)</span>
+                        </td>
+                        <td class="px-4 py-3 text-right">
+                            <button type="button" onclick="unbanIp('${escapeHtml(b.ip)}', '${escapeHtml(b.jail)}')"
+                                class="px-2.5 py-1 rounded-lg bg-emerald-600/20 hover:bg-emerald-600 text-emerald-300 hover:text-white border border-emerald-500/40 text-xs font-semibold transition">
+                                Débannir
+                            </button>
+                        </td>
+                    </tr>
+                `;
+            }).join('');
+        }
+    }
+
+    // 3. Form fields
+    const form = document.getElementById('firewall-settings-form');
+    if (form) {
+        if (form.elements['admin_https_port']) {
+            form.elements['admin_https_port'].value = s.admin_https_port || 8443;
+        }
+        if (form.elements['certbot_strict_port80']) {
+            form.elements['certbot_strict_port80'].checked = Number(s.certbot_strict_port80) === 1;
+        }
+        if (form.elements['firewall_enabled']) {
+            form.elements['firewall_enabled'].checked = (Number(s.firewall_enabled) === 1 || Number(s.certbot_strict_port80) === 1);
+        }
+        if (form.elements['fail2ban_sip_maxretry']) {
+            form.elements['fail2ban_sip_maxretry'].value = s.fail2ban_sip_maxretry || 3;
+        }
+        if (form.elements['fail2ban_sip_bantime']) {
+            form.elements['fail2ban_sip_bantime'].value = s.fail2ban_sip_bantime || 3600;
+        }
+        if (form.elements['fail2ban_whitelist_ips'] && document.activeElement !== form.elements['fail2ban_whitelist_ips']) {
+            form.elements['fail2ban_whitelist_ips'].value = s.fail2ban_whitelist_ips || '';
+        }
+    }
+}
+
+async function unbanIp(ip, jail) {
+    if (!confirm(`Débannir l'adresse IP ${ip} et rétablir son accès immédiat ?`)) {
+        return;
+    }
+
+    try {
+        const res = await apiCall('unban_ip', { ip, jail });
+        showToast(res.message, res.success ? 'success' : 'error');
+        await loadFirewallStatus();
+    } catch (err) {
+        showToast("Erreur lors du débannissement : " + err.message, 'error');
+    }
+}
+
+function whitelistMyIp() {
+    const clientIp = appFirewallState.client_ip;
+    if (!clientIp) {
+        showToast("Impossible de déterminer votre adresse IP actuelle.", 'error');
+        return;
+    }
+
+    const textarea = document.getElementById('fail2ban_whitelist_ips');
+    if (!textarea) return;
+
+    const currentVal = textarea.value.trim();
+    const tokens = currentVal ? currentVal.split(/\s+/) : [];
+
+    if (tokens.includes(clientIp)) {
+        showToast(`Votre IP actuelle (${clientIp}) est déjà dans la liste blanche.`, 'info');
+        return;
+    }
+
+    tokens.push(clientIp);
+    textarea.value = tokens.join(' ');
+    showToast(`Votre IP actuelle (${clientIp}) a été ajoutée. Pensez à cliquer sur "Enregistrer" pour appliquer.`, 'success');
+}
+
+// Modal Journal des Événements de Sécurité
+async function openSecurityEventsModal() {
+    const modal = document.getElementById('modal-security-events');
+    const tbody = document.getElementById('security-events-tbody');
+    const emptyState = document.getElementById('security-events-empty');
+    if (!modal) return;
+
+    modal.classList.remove('hidden');
+    if (tbody) tbody.innerHTML = '<tr><td colspan="5" class="py-8 text-center text-slate-400">Chargement des événements de sécurité en direct...</td></tr>';
+    if (emptyState) emptyState.classList.add('hidden');
+
+    try {
+        const resp = await fetch('/api.php?action=get_security_events');
+        const data = await resp.json();
+        const events = data.events || [];
+
+        if (events.length === 0) {
+            if (tbody) tbody.innerHTML = '';
+            if (emptyState) emptyState.classList.remove('hidden');
+            return;
+        }
+
+        if (tbody) {
+            tbody.innerHTML = events.map(e => `
+                <tr class="hover:bg-anthracite-900/50 transition border-b border-anthracite-800">
+                    <td class="py-2.5 px-3 font-mono text-[11px] text-slate-300 whitespace-nowrap">${escapeHtml(e.time)}</td>
+                    <td class="py-2.5 px-3">
+                        <span class="px-2 py-0.5 rounded text-[10px] font-bold bg-indigo-500/15 text-indigo-300 border border-indigo-500/30 font-mono">
+                            ${escapeHtml(e.service)}
+                        </span>
+                    </td>
+                    <td class="py-2.5 px-3">
+                        <span class="text-rose-400 font-semibold font-mono text-xs">${escapeHtml(e.event)}</span>
+                        <div class="text-[10px] text-slate-400">Échec mot de passe / Défi SIP</div>
+                    </td>
+                    <td class="py-2.5 px-3 font-mono text-xs text-amber-300 font-bold">${escapeHtml(e.account)}</td>
+                    <td class="py-2.5 px-3 font-mono text-xs text-cyan-300 font-bold">${escapeHtml(e.ip)}</td>
+                </tr>
+            `).join('');
+        }
+    } catch (err) {
+        if (tbody) {
+            tbody.innerHTML = `<tr><td colspan="5" class="py-4 text-center text-rose-400">Erreur : ${escapeHtml(err.message)}</td></tr>`;
+        }
+    }
+}
+
+async function clearSecurityLog() {
+    if (!confirm("Voulez-vous vraiment vider le journal des événements de sécurité et réinitialiser les compteurs d'attaques à zéro ?")) {
+        return;
+    }
+    try {
+        const res = await apiCall('clear_security_log', {});
+        showToast(res.message, 'success');
+        await openSecurityEventsModal();
+        await pollMetrics();
+    } catch (err) {
+        showToast("Erreur lors de la purge du journal : " + err.message, 'error');
+    }
+}
+
+// =========================================================================
+// 2C. ANNUAIRE D'ENTREPRISE & YEALINK REMOTE PHONEBOOK XML
+// =========================================================================
+let selectedPhonebookGroup = 'all';
+
+function renderPhonebookTable() {
+    const tbody = document.getElementById('phonebook-tbody');
+    if (!tbody) return;
+
+    const contacts = appState.phonebook_contacts || [];
+    const groups = appState.phonebook_groups || [];
+    const searchVal = (document.getElementById('phonebook-search')?.value || '').trim().toLowerCase();
+
+    // 1. Rendu des Group Pills
+    const pillsContainer = document.getElementById('phonebook-group-pills');
+    if (pillsContainer) {
+        let pillsHtml = `
+            <button type="button" onclick="selectPhonebookGroupFilter('all')"
+                class="phonebook-grp-pill ${selectedPhonebookGroup === 'all' ? 'active bg-indigo-600 text-white' : 'bg-anthracite-950 text-slate-400 hover:text-white'} px-3 py-1 rounded-lg text-xs font-semibold border border-anthracite-700 transition">
+                Tous les groupes (${contacts.length})
+            </button>
+        `;
+
+        groups.forEach(g => {
+            const count = contacts.filter(c => {
+                const cg = (c.group_name || '').toLowerCase();
+                const gl = g.toLowerCase();
+                return cg === gl || cg.includes(gl) || cg === 'tous' || cg === 'all';
+            }).length;
+            const isActive = selectedPhonebookGroup.toLowerCase() === g.toLowerCase();
+            pillsHtml += `
+                <button type="button" onclick="selectPhonebookGroupFilter('${escapeHtml(g)}')"
+                    class="phonebook-grp-pill ${isActive ? 'active bg-teal-600 text-white border-teal-500' : 'bg-anthracite-950 text-slate-400 hover:text-white border-anthracite-700'} px-3 py-1 rounded-lg text-xs font-semibold border transition">
+                    ${escapeHtml(g)} (${count})
+                </button>
+            `;
+        });
+        pillsContainer.innerHTML = pillsHtml;
+    }
+
+    // 2. Filtrage des contacts
+    const filtered = contacts.filter(c => {
+        // Filtre de groupe
+        if (selectedPhonebookGroup !== 'all') {
+            const cg = (c.group_name || '').toLowerCase();
+            const sg = selectedPhonebookGroup.toLowerCase();
+            if (cg !== sg && !cg.includes(sg) && cg !== 'tous' && cg !== 'all') {
+                return false;
+            }
+        }
+        // Filtre de recherche
+        if (searchVal !== '') {
+            const matchName = (c.display_name || '').toLowerCase().includes(searchVal);
+            const matchInt = (c.internal_number || '').toLowerCase().includes(searchVal);
+            const matchMob = (c.mobile_number || '').toLowerCase().includes(searchVal);
+            const matchOth = (c.other_number || '').toLowerCase().includes(searchVal);
+            const matchMail = (c.email || '').toLowerCase().includes(searchVal);
+            const matchGrp = (c.group_name || '').toLowerCase().includes(searchVal);
+            if (!matchName && !matchInt && !matchMob && !matchOth && !matchMail && !matchGrp) {
+                return false;
+            }
+        }
+        return true;
+    });
+
+    // 3. Statistiques affichées
+    const statsEl = document.getElementById('phonebook-stats');
+    if (statsEl) {
+        const intCount = contacts.filter(c => c.is_internal).length;
+        const extCount = contacts.length - intCount;
+        statsEl.innerHTML = `<span><strong>${filtered.length}</strong> affiché(s) • ${intCount} interne(s) • ${extCount} externe(s)</span>`;
+    }
+
+    if (filtered.length === 0) {
+        tbody.innerHTML = `<tr><td colspan="9" class="py-10 text-center text-slate-400 text-xs">Aucun contact trouvé dans l'annuaire pour ces critères.</td></tr>`;
+        return;
+    }
+
+    tbody.innerHTML = filtered.map(c => {
+        const initials = getInitials(c.display_name || '?');
+        const colorClass = getAvatarBgColor(c.display_name || '');
+        const avatarHtml = c.photo_url
+            ? `<img src="${escapeHtml(c.photo_url)}" alt="${escapeHtml(c.display_name)}" class="w-8 h-8 rounded-full object-cover border border-anthracite-700 shadow">`
+            : `<div class="w-8 h-8 rounded-full ${colorClass} text-white flex items-center justify-center font-bold text-xs shadow-inner">${escapeHtml(initials)}</div>`;
+
+        const typeBadge = c.is_internal
+            ? `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-indigo-500/15 text-indigo-300 border border-indigo-500/30">Poste ${escapeHtml(c.internal_number)}</span>`
+            : `<span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-slate-700/60 text-slate-300 border border-slate-600">Contact Externe</span>`;
+
+        return `
+            <tr class="hover:bg-anthracite-750/60 transition">
+                <td class="py-3 px-4">${avatarHtml}</td>
+                <td class="py-3 px-4 font-semibold text-white">
+                    <div>${escapeHtml(c.display_name)}</div>
+                    ${c.photo_url ? '<span class="text-[10px] text-teal-400 font-mono">Photo active</span>' : ''}
+                </td>
+                <td class="py-3 px-4 font-mono font-bold text-indigo-300">${c.internal_number ? escapeHtml(c.internal_number) : '<span class="text-slate-600">—</span>'}</td>
+                <td class="py-3 px-4 font-mono text-xs text-slate-200">${c.mobile_number ? escapeHtml(c.mobile_number) : '<span class="text-slate-600">—</span>'}</td>
+                <td class="py-3 px-4 font-mono text-xs text-slate-400">${c.other_number ? escapeHtml(c.other_number) : '<span class="text-slate-600">—</span>'}</td>
+                <td class="py-3 px-4 text-xs text-slate-300">${c.email ? `<a href="mailto:${escapeHtml(c.email)}" class="hover:text-teal-300 underline">${escapeHtml(c.email)}</a>` : '<span class="text-slate-600">—</span>'}</td>
+                <td class="py-3 px-4">
+                    <span class="px-2 py-0.5 rounded text-[11px] font-semibold bg-teal-500/15 text-teal-300 border border-teal-500/30">${escapeHtml(c.group_name || 'Général')}</span>
+                </td>
+                <td class="py-3 px-4">${typeBadge}</td>
+                <td class="py-3 px-4 text-right space-x-2">
+                    <button type="button" onclick="editPhonebookContact(${c.id})" class="text-xs font-semibold text-indigo-300 hover:text-indigo-200">Modifier</button>
+                    ${!c.is_internal ? `<button type="button" onclick="deletePhonebookContact(${c.id})" class="text-xs font-semibold text-rose-400 hover:text-rose-300">Supprimer</button>` : ''}
+                </td>
+            </tr>
+        `;
+    }).join('');
+}
+
+function getInitials(name) {
+    const parts = name.trim().split(/\s+/);
+    if (parts.length >= 2) {
+        return (parts[0][0] + parts[1][0]).toUpperCase();
+    }
+    return (name.substring(0, 2) || '?').toUpperCase();
+}
+
+function getAvatarBgColor(str) {
+    const colors = [
+        'bg-teal-600', 'bg-indigo-600', 'bg-emerald-600', 'bg-cyan-600', 
+        'bg-purple-600', 'bg-amber-600', 'bg-rose-600', 'bg-blue-600'
+    ];
+    let hash = 0;
+    for (let i = 0; i < str.length; i++) {
+        hash = str.charCodeAt(i) + ((hash << 5) - hash);
+    }
+    return colors[Math.abs(hash) % colors.length];
+}
+
+function filterPhonebook() {
+    renderPhonebookTable();
+}
+
+function selectPhonebookGroupFilter(grp) {
+    selectedPhonebookGroup = grp;
+    renderPhonebookTable();
+}
+
+function openPhonebookContactModal(contact = null) {
+    const form = document.getElementById('form-phonebook-contact');
+    if (!form) return;
+    form.reset();
+
+    const titleEl = document.getElementById('modal-phonebook-title');
+    if (titleEl) {
+        titleEl.textContent = contact ? `Modifier le Contact ${contact.display_name}` : 'Nouveau Contact Annuaire';
+    }
+
+    form.elements['id'].value = contact ? contact.id : '';
+    form.elements['extension_id'].value = contact ? (contact.extension_id || '') : '';
+    form.elements['is_internal'].value = contact ? (contact.is_internal ? 1 : 0) : 0;
+    form.elements['photo_url'].value = contact ? (contact.photo_url || '') : '';
+    form.elements['display_name'].value = contact ? contact.display_name : '';
+    form.elements['internal_number'].value = contact ? (contact.internal_number || '') : '';
+    form.elements['mobile_number'].value = contact ? (contact.mobile_number || '') : '';
+    form.elements['other_number'].value = contact ? (contact.other_number || '') : '';
+    form.elements['email'].value = contact ? (contact.email || '') : '';
+    form.elements['group_name'].value = contact ? (contact.group_name || 'Général') : (selectedPhonebookGroup !== 'all' ? selectedPhonebookGroup : 'Général');
+
+    // Datalist des groupes existants
+    const dl = document.getElementById('phonebook-groups-datalist');
+    if (dl) {
+        dl.innerHTML = (appState.phonebook_groups || []).map(g => `<option value="${escapeHtml(g)}">`).join('');
+    }
+
+    updateAvatarPreview(contact?.photo_url || '', contact?.display_name || '?');
+    openModal('modal-phonebook-contact');
+}
+
+function editPhonebookContact(id) {
+    const contact = (appState.phonebook_contacts || []).find(c => Number(c.id) === Number(id));
+    if (contact) {
+        openPhonebookContactModal(contact);
+    }
+}
+
+async function savePhonebookContact(e) {
+    e.preventDefault();
+    const form = e.target;
+    const payload = {
+        id: form.elements['id'].value ? Number(form.elements['id'].value) : null,
+        extension_id: form.elements['extension_id'].value ? Number(form.elements['extension_id'].value) : null,
+        is_internal: Number(form.elements['is_internal'].value) || 0,
+        display_name: form.elements['display_name'].value.trim(),
+        internal_number: form.elements['internal_number'].value.trim(),
+        mobile_number: form.elements['mobile_number'].value.trim(),
+        other_number: form.elements['other_number'].value.trim(),
+        email: form.elements['email'].value.trim(),
+        group_name: form.elements['group_name'].value.trim() || 'Général',
+        photo_url: form.elements['photo_url'].value.trim(),
+    };
+
+    try {
+        const res = await apiCall('save_phonebook_contact', payload);
+        showToast(res.message, 'success');
+        closeModal('modal-phonebook-contact');
+        if (res.contacts) appState.phonebook_contacts = res.contacts;
+        if (res.groups) appState.phonebook_groups = res.groups;
+        renderPhonebookTable();
+        const pbBadge = document.getElementById('nav-badge-phonebook');
+        if (pbBadge) pbBadge.textContent = appState.phonebook_contacts.length;
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function deletePhonebookContact(id) {
+    const contact = (appState.phonebook_contacts || []).find(c => Number(c.id) === Number(id));
+    if (!contact) return;
+    if (!confirm(`Supprimer le contact « ${contact.display_name} » de l'annuaire ?`)) return;
+
+    try {
+        const res = await apiCall('delete_phonebook_contact', { id });
+        showToast(res.message, 'info');
+        if (res.contacts) appState.phonebook_contacts = res.contacts;
+        if (res.groups) appState.phonebook_groups = res.groups;
+        renderPhonebookTable();
+        const pbBadge = document.getElementById('nav-badge-phonebook');
+        if (pbBadge) pbBadge.textContent = appState.phonebook_contacts.length;
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function syncPhonebookNow() {
+    try {
+        const res = await apiCall('sync_phonebook', {});
+        showToast(res.message, 'success');
+        if (res.contacts) appState.phonebook_contacts = res.contacts;
+        if (res.groups) appState.phonebook_groups = res.groups;
+        renderPhonebookTable();
+        const pbBadge = document.getElementById('nav-badge-phonebook');
+        if (pbBadge) pbBadge.textContent = appState.phonebook_contacts.length;
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+async function uploadContactPhoto(input) {
+    if (!input.files || !input.files[0]) return;
+    const file = input.files[0];
+    const form = document.getElementById('form-phonebook-contact');
+    const contactId = form ? form.elements['id'].value : '';
+
+    const formData = new FormData();
+    formData.append('avatar', file);
+    formData.append('contact_id', contactId);
+
+    try {
+        const res = await fetch('/api.php?action=upload_phonebook_avatar', {
+            method: 'POST',
+            body: formData,
+        });
+        const data = await res.json();
+        if (!data.success) throw new Error(data.message || "Erreur d'envoi");
+
+        document.getElementById('phonebook-input-photo-url').value = data.photo_url;
+        updateAvatarPreview(data.photo_url, form.elements['display_name'].value || '?');
+        showToast(data.message, 'success');
+    } catch (err) {
+        showToast(err.message, 'error');
+    }
+}
+
+function clearContactPhoto() {
+    document.getElementById('phonebook-input-photo-url').value = '';
+    const form = document.getElementById('form-phonebook-contact');
+    updateAvatarPreview('', form?.elements['display_name']?.value || '?');
+}
+
+function updateAvatarPreview(photoUrl, name) {
+    const preview = document.getElementById('phonebook-avatar-preview');
+    const clearBtn = document.getElementById('phonebook-btn-clear-photo');
+    if (!preview) return;
+
+    if (photoUrl) {
+        preview.className = 'w-14 h-14 rounded-full overflow-hidden border border-teal-500/40 shrink-0 shadow';
+        preview.innerHTML = `<img src="${escapeHtml(photoUrl)}" class="w-full h-full object-cover">`;
+        clearBtn?.classList.remove('hidden');
+    } else {
+        const initials = getInitials(name || '?');
+        const colorClass = getAvatarBgColor(name || '');
+        preview.className = `w-14 h-14 rounded-full ${colorClass} text-white flex items-center justify-center font-bold text-lg overflow-hidden shrink-0 shadow-inner`;
+        preview.textContent = initials;
+        clearBtn?.classList.add('hidden');
+    }
+}
+
+// Modal Yealink Remote XML Phonebook
+function openYealinkXmlModal() {
+    const sel = document.getElementById('yealink-modal-group-select');
+    if (sel) {
+        const groups = appState.phonebook_groups || [];
+        sel.innerHTML = `<option value="all">Tous les groupes (Annuaire complet de l'entreprise)</option>` +
+            groups.map(g => `<option value="${escapeHtml(g)}">${escapeHtml(g)}</option>`).join('');
+        if (selectedPhonebookGroup !== 'all' && groups.includes(selectedPhonebookGroup)) {
+            sel.value = selectedPhonebookGroup;
+        }
+    }
+    updateYealinkXmlUrls();
+    openModal('modal-yealink-xml');
+}
+
+function updateYealinkXmlUrls() {
+    const sel = document.getElementById('yealink-modal-group-select');
+    const grp = sel ? sel.value : 'all';
+    const host = window.location.hostname || '10.10.175.204';
+    const httpsPort = window.location.port || '8443';
+    const groupParam = grp !== 'all' ? `?group=${encodeURIComponent(grp)}` : `?group=all`;
+
+    const url8080 = `http://${host}:8080/phonebook.php${groupParam}`;
+    const urlHttps = `https://${host}:${httpsPort}/phonebook.php${groupParam}`;
+
+    const el8080 = document.getElementById('yealink-url-8080');
+    if (el8080) el8080.value = url8080;
+    const elHttps = document.getElementById('yealink-url-https');
+    if (elHttps) elHttps.value = urlHttps;
+
+    const openBtn = document.getElementById('yealink-open-browser-btn');
+    if (openBtn) openBtn.href = url8080;
+
+    const previewEl = document.getElementById('yealink-xml-preview');
+    if (previewEl) {
+        previewEl.textContent = 'Chargement du flux XML...';
+        fetch(`/phonebook.php${groupParam}`)
+            .then(r => r.text())
+            .then(xml => {
+                previewEl.textContent = xml;
+            })
+            .catch(() => {
+                previewEl.textContent = `<?xml version="1.0" encoding="UTF-8"?>\n<YealinkIPPhoneDirectory>\n  <Title>Annuaire ${grp}</Title>\n</YealinkIPPhoneDirectory>`;
+            });
+    }
+}
+
+function copyYealinkUrl(inputId, btn) {
+    const el = document.getElementById(inputId);
+    if (!el) return;
+    el.select();
+    navigator.clipboard.writeText(el.value).then(() => {
+        showToast("URL Yealink copiée dans le presse-papiers !", 'success');
+        const origText = btn.innerHTML;
+        btn.innerHTML = '<span>Copié !</span>';
+        setTimeout(() => { btn.innerHTML = origText; }, 2000);
+    }).catch(() => {
+        showToast("Sélectionnez l'URL et appuyez sur Ctrl+C.", 'info');
+    });
+}
diff --git a/public/avatars/.gitkeep b/public/avatars/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/public/index.php b/public/index.php
new file mode 100644
index 0000000..9930465
--- /dev/null
+++ b/public/index.php
@@ -0,0 +1,4398 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/Auth.php';
+
+use App\Database;
+use App\Auth;
+
+Database::getConnection();
+$isAuth = Auth::isAuthenticated();
+$currentUser = Auth::getUsername();
+?>
+<!DOCTYPE html>
+<html lang="fr" class="h-full">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>NexusPBX — Supervision & Gestion PJSIP sur Debian</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script>
+        tailwind.config = {
+            theme: {
+                extend: {
+                    colors: {
+                        anthracite: {
+                            950: '#1b1f27',
+                            900: '#232832',
+                            800: '#2c323f',
+                            750: '#323947',
+                            700: '#3d4657',
+                            600: '#4f5b70',
+                        }
+                    },
+                    fontFamily: {
+                        sans: ['Inter', 'system-ui', '-apple-system', 'sans-serif'],
+                        mono: ['JetBrains Mono', 'Fira Code', 'monospace'],
+                    }
+                }
+            }
+        };
+    </script>
+    <style>
+        body { background-color: #232832; color: #f1f5f9; }
+        ::-webkit-scrollbar { width: 8px; height: 8px; }
+        ::-webkit-scrollbar-track { background: #1b1f27; }
+        ::-webkit-scrollbar-thumb { background: #3d4657; border-radius: 4px; }
+        ::-webkit-scrollbar-thumb:hover { background: #4f5b70; }
+
+        /* ========================================================================== */
+        /* ALIGNEMENT & HARMONISATION PARFAITE : INPUTS ET SELECTS DE MÊME TAILLE    */
+        /* ========================================================================== */
+
+        /* 1. Hauteur standardisée à 40px pour tous les champs de saisie et listes déroulantes */
+        input:not([type="checkbox"]):not([type="radio"]):not([type="range"]):not([type="submit"]):not([type="button"]):not([type="file"]):not([type="hidden"]),
+        select {
+            box-sizing: border-box !important;
+            height: 40px !important;
+            min-height: 40px !important;
+            max-height: 40px !important;
+            line-height: 20px !important;
+            font-size: 0.875rem !important; /* 14px / text-sm */
+            padding-top: 8px !important;
+            padding-bottom: 8px !important;
+            vertical-align: middle !important;
+        }
+
+        /* 2. Hauteur compacte à 34px pour les tableaux, DTMF, SDA et filtres denses */
+        input.text-xs,
+        select.text-xs,
+        .compact-field,
+        .ivr-digit,
+        .ivr-dest,
+        .trunk-did-cid,
+        .trunk-did-desc,
+        .trunk-did-dest,
+        .trunk-tc-start,
+        .trunk-tc-finish,
+        .trunk-tc-weekdays,
+        .trunk-tc-closed-dest,
+        #filter-sound-site,
+        #filter-sound-usage,
+        #filter-sound-search,
+        #inbound-routes-filter {
+            height: 34px !important;
+            min-height: 34px !important;
+            max-height: 34px !important;
+            line-height: 18px !important;
+            font-size: 0.75rem !important; /* 12px / text-xs */
+            padding-top: 6px !important;
+            padding-bottom: 6px !important;
+        }
+
+        /* 3. Habillage moderne des listes déroulantes (select) : flèche SVG centrée et suppression du widget OS */
+        select {
+            -webkit-appearance: none !important;
+            -moz-appearance: none !important;
+            appearance: none !important;
+            background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 20 20'%3e%3cpath stroke='%2394a3b8' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.5' d='M6 8l4 4 4-4'/%3e%3c/svg%3e") !important;
+            background-position: right 0.75rem center !important;
+            background-repeat: no-repeat !important;
+            background-size: 1.15em 1.15em !important;
+            padding-right: 2.25rem !important;
+            cursor: pointer;
+        }
+
+        select option,
+        select optgroup {
+            background-color: #1b1f27 !important;
+            color: #f1f5f9 !important;
+        }
+
+        /* 4. Focus harmonisé */
+        input:focus,
+        select:focus,
+        textarea:focus {
+            outline: none !important;
+            border-color: #6366f1 !important;
+            box-shadow: 0 0 0 1px rgba(99, 102, 241, 0.4) !important;
+        }
+    </style>
+</head>
+<body class="min-h-screen w-full bg-anthracite-900 text-slate-100 antialiased selection:bg-indigo-500 selection:text-white">
+
+    <!-- Conteneur de notifications Toast (AJAX) -->
+    <div id="toast-container" class="fixed bottom-5 right-5 z-50 flex flex-col gap-2.5 max-w-md w-full pointer-events-none px-4 sm:px-0"></div>
+
+    <!-- ÉCRAN DE CONNEXION -->
+    <div id="login-screen" class="<?= $isAuth ? 'hidden' : 'flex' ?> min-h-screen w-full items-center justify-center p-4 bg-gradient-to-br from-anthracite-950 via-anthracite-900 to-indigo-950/40">
+        <div class="w-full max-w-md bg-anthracite-800 border border-anthracite-700 rounded-2xl shadow-2xl p-8">
+            <div class="flex items-center gap-3.5 mb-6">
+                <div class="w-12 h-12 rounded-xl bg-indigo-500/20 border border-indigo-400/40 flex items-center justify-center text-indigo-300 shadow-inner">
+                    <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 5a2 2 0 012-2h3.28a1 1 0 01.948.684l1.498 4.493a1 1 0 01-.502 1.21l-2.257 1.13a11.042 11.042 0 005.516 5.516l1.13-2.257a1 1 0 011.21-.502l4.493 1.498a1 1 0 01.684.949V19a2 2 0 01-2 2h-1C9.716 21 3 14.284 3 6V5z"/>
+                    </svg>
+                </div>
+                <div>
+                    <h1 class="text-xl font-bold text-white tracking-tight">NexusPBX</h1>
+                    <p class="text-xs text-slate-300">Supervision & Gestion PJSIP • Debian 13</p>
+                </div>
+            </div>
+
+            <!-- Aperçu Logo Entreprise sur l'écran de connexion (si configuré) -->
+            <div id="login-company-box" class="hidden mb-5 p-3 rounded-xl bg-anthracite-950/90 border border-anthracite-700 flex items-center justify-center gap-3">
+                <img id="login-company-logo" src="" alt="Logo Entreprise" class="max-h-10 max-w-[160px] object-contain hidden">
+                <span id="login-company-name" class="text-xs font-semibold text-slate-200"></span>
+            </div>
+
+            <form id="login-form" class="space-y-4">
+                <div>
+                    <label class="block text-xs font-semibold uppercase tracking-wider text-slate-300 mb-1.5">Identifiant</label>
+                    <input type="text" name="username" value="admin" required
+                        class="w-full px-3.5 py-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-white focus:outline-none focus:border-indigo-400 text-sm">
+                </div>
+                <div>
+                    <label class="block text-xs font-semibold uppercase tracking-wider text-slate-300 mb-1.5">Mot de passe</label>
+                    <input type="password" name="password" placeholder="••••••••" required
+                        class="w-full px-3.5 py-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-white focus:outline-none focus:border-indigo-400 text-sm">
+                </div>
+                <button type="submit"
+                    class="w-full py-2.5 px-4 bg-indigo-600 hover:bg-indigo-500 active:bg-indigo-700 text-white font-semibold rounded-lg shadow-lg shadow-indigo-600/25 transition text-sm">
+                    Se connecter au PBX
+                </button>
+            </form>
+
+            <div class="mt-6 pt-5 border-t border-anthracite-700 text-xs text-slate-300 flex items-center justify-between">
+                <span>Accès initial par défaut :</span>
+                <code class="px-2.5 py-1 rounded bg-anthracite-950 border border-anthracite-700 text-indigo-300 font-mono">admin / admin123</code>
+            </div>
+        </div>
+    </div>
+
+    <!-- APPLICATION PRINCIPALE PLEIN ÉCRAN (SIDEBAR GAUCHE + CONTENU FLUIDE) -->
+    <div id="app-screen" class="<?= $isAuth ? 'flex' : 'hidden' ?> min-h-screen w-full bg-anthracite-900">
+
+        <!-- Overlay Mobile pour le menu latéral -->
+        <div id="sidebar-backdrop" onclick="toggleMobileSidebar(false)" class="fixed inset-0 z-30 bg-black/60 backdrop-blur-xs hidden lg:hidden"></div>
+
+        <!-- MENU LATÉRAL GAUCHE (SIDEBAR ANTHRACITE) -->
+        <aside id="sidebar" class="fixed lg:static inset-y-0 left-0 z-40 w-72 bg-anthracite-950 border-r border-anthracite-700 flex flex-col justify-between transform -translate-x-full lg:translate-x-0 transition-transform duration-200 ease-in-out shrink-0">
+            <div>
+                <!-- Logo NexusPBX & Espace Exploitant (Opéré par) -->
+                <div class="px-4 py-3.5 border-b border-anthracite-700/80 space-y-2.5">
+                    <div class="flex items-center justify-between">
+                        <div class="flex items-center gap-3">
+                            <div class="w-10 h-10 rounded-xl bg-gradient-to-br from-indigo-500/30 to-purple-600/20 border border-indigo-400/40 flex items-center justify-center text-indigo-300 shadow-lg shadow-indigo-500/10 shrink-0">
+                                <svg class="w-5 h-5 text-indigo-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 5a2 2 0 012-2h3.28a1 1 0 01.948.684l1.498 4.493a1 1 0 01-.502 1.21l-2.257 1.13a11.042 11.042 0 005.516 5.516l1.13-2.257a1 1 0 011.21-.502l4.493 1.498a1 1 0 01.684.949V19a2 2 0 01-2 2h-1C9.716 21 3 14.284 3 6V5z"/>
+                                </svg>
+                            </div>
+                            <div>
+                                <div class="flex items-center gap-2">
+                                    <div class="font-black text-white text-2xl tracking-tight leading-none">
+                                        Nexus<span class="text-indigo-400">PBX</span>
+                                    </div>
+                                    <span class="px-1.5 py-0.5 text-[10px] font-mono font-bold tracking-wider rounded bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v1.2.0</span>
+                                </div>
+                                <div class="text-[10px] text-slate-400 font-medium tracking-wide mt-0.5">Moteur VoIP & Téléphonie IP</div>
+                            </div>
+                        </div>
+                        <button type="button" onclick="toggleMobileSidebar(false)" class="lg:hidden text-slate-400 hover:text-white p-1">✕</button>
+                    </div>
+
+                    <!-- Espace Logo Exploitant (Affichage pur : modification uniquement dans Administration / Paramètres) -->
+                    <div id="sidebar-company-slot" class="rounded-xl bg-anthracite-900/90 border border-anthracite-750/70 p-2.5 flex flex-col items-center justify-center min-h-[46px] select-none">
+                        <!-- État rempli : Logo et/ou Nom de l'exploitant affiché -->
+                        <div id="sidebar-company-filled" class="hidden w-full flex flex-col items-center justify-center gap-1 text-center">
+                            <span class="text-[9px] font-bold uppercase tracking-widest text-slate-400">Opéré par</span>
+                            <img id="sidebar-company-logo" src="" alt="Logo Exploitant" class="max-h-9 max-w-[190px] object-contain hidden">
+                            <span id="sidebar-company-name" class="text-xs font-semibold text-slate-200 tracking-wide truncate max-w-[210px] hidden"></span>
+                        </div>
+
+                        <!-- État vide : Indicateur sobre et propre -->
+                        <div id="sidebar-company-empty" class="w-full flex items-center justify-center gap-2 py-0.5 text-[11px] text-slate-400 font-medium">
+                            <span class="w-1.5 h-1.5 rounded-full bg-emerald-400 animate-pulse"></span>
+                            <span>Plateforme Opérationnelle</span>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Navigation principale -->
+                <div class="p-3.5 space-y-1">
+                    <div class="px-3 py-1.5 text-[11px] font-bold uppercase tracking-wider text-slate-400">Navigation</div>
+
+                    <!-- Bouton Accueil / Dashboard -->
+                    <button type="button" data-tab="dashboard" onclick="switchTab('dashboard')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-semibold bg-indigo-600 text-white shadow-md shadow-indigo-600/20 transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"/>
+                            </svg>
+                            <span>Accueil & Dashboard</span>
+                        </span>
+                        <span class="w-2 h-2 rounded-full bg-emerald-300 animate-pulse"></span>
+                    </button>
+
+                    <div class="pt-3 px-3 py-1.5 text-[11px] font-bold uppercase tracking-wider text-slate-400">Téléphonie IP</div>
+
+                    <!-- Postes SIP -->
+                    <button type="button" data-tab="extensions" onclick="switchTab('extensions')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-indigo-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 18h.01M8 21h8a2 2 0 002-2V5a2 2 0 00-2-2H8a2 2 0 00-2 2v14a2 2 0 002 2z"/>
+                            </svg>
+                            <span>Postes SIP</span>
+                        </span>
+                        <span id="nav-badge-extensions" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-slate-200 border border-anthracite-700">0</span>
+                    </button>
+
+                    <!-- Groupes (Menu Accordéon) : Groupes de Sonnerie & Groupes d'Extensions -->
+                    <div class="space-y-1">
+                        <button type="button" id="btn-menu-groups" onclick="toggleGroupsMenu()"
+                            class="w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                            <span class="flex items-center gap-3">
+                                <svg class="w-5 h-5 text-cyan-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0z"/>
+                                </svg>
+                                <span>Groupes</span>
+                            </span>
+                            <svg id="arrow-menu-groups" class="w-4 h-4 text-slate-400 transform transition-transform duration-200" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
+                            </svg>
+                        </button>
+
+                        <!-- Sous-menus Groupes de sonnerie & Groupes d'extensions -->
+                        <div id="submenu-groups" class="ml-5 pl-3 border-l border-anthracite-700 space-y-1">
+                            <button type="button" data-tab="groups" onclick="switchTab('groups')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                                <span>• Groupes de sonnerie</span>
+                                <span id="nav-badge-groups" class="px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-slate-200 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                            <button type="button" data-tab="extgroups" onclick="switchTab('extgroups')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                                <span>• Groupes d'extensions</span>
+                                <span id="nav-badge-extgroups" class="px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-cyan-300 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                            <button type="button" data-tab="phonebook" onclick="switchTab('phonebook')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                                <span>• Annuaire d'Entreprise</span>
+                                <span id="nav-badge-phonebook" class="px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-teal-300 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Opérateurs (Menu Accordéon) & Sous-menus Trunks / Routes Sortantes -->
+                    <div class="space-y-1">
+                        <button type="button" id="btn-menu-operators" onclick="toggleOperatorsMenu()"
+                            class="w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                            <span class="flex items-center gap-3">
+                                <svg class="w-5 h-5 text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9"/>
+                                </svg>
+                                <span>Opérateurs</span>
+                            </span>
+                            <svg id="arrow-menu-operators" class="w-4 h-4 text-slate-400 transform transition-transform duration-200" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
+                            </svg>
+                        </button>
+
+                        <!-- Sous-menus Trunks & Routes Sortantes -->
+                        <div id="submenu-operators" class="ml-5 pl-3 border-l border-anthracite-700 space-y-1">
+                            <button type="button" data-tab="trunks" onclick="switchTab('trunks')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                                <span>• Connecteurs Trunks SIP</span>
+                                <span id="nav-badge-trunks" class="px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-slate-200 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                            <button type="button" data-tab="outbound" onclick="switchTab('outbound')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                                <span>• Routes Sortantes</span>
+                                <span id="nav-badge-outbound" class="px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-emerald-300 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Serveurs Vocaux IVR -->
+                    <button type="button" data-tab="ivrs" onclick="switchTab('ivrs')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-amber-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11a7 7 0 01-7 7m0 0a7 7 0 01-7-7m7 7v4m0 0H8m4 0h4m-4-8a3 3 0 01-3-3V5a3 3 0 116 0v6a3 3 0 01-3 3z"/>
+                            </svg>
+                            <span>Serveurs Vocaux (IVR)</span>
+                        </span>
+                        <span id="nav-badge-ivrs" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-slate-200 border border-anthracite-700">0</span>
+                    </button>
+
+                    <!-- Fichiers sons -->
+                    <button type="button" data-tab="sounds" onclick="switchTab('sounds')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-amber-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.536 8.464a5 5 0 010 7.072m2.828-9.9a9 9 0 010 12.728M5.586 15H4a1 1 0 01-1-1v-4a1 1 0 011-1h1.586l4.707-4.707C10.923 3.663 12 4.109 12 5v14c0 .891-1.077 1.337-1.707.707L5.586 15z"/>
+                            </svg>
+                            <span>Fichiers sons</span>
+                        </span>
+                        <span id="nav-badge-sounds" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-amber-300 border border-anthracite-700 font-bold">0</span>
+                    </button>
+
+                    <!-- Codes de Fonctions -->
+                    <button type="button" data-tab="featurecodes" onclick="switchTab('featurecodes')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-indigo-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 20l4-16m2 16l4-16M6 9h14M4 15h14"/>
+                            </svg>
+                            <span>Codes de Fonctions</span>
+                        </span>
+                        <span id="nav-badge-featurecodes" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-indigo-300 border border-anthracite-700 font-bold">*</span>
+                    </button>
+
+                    <div class="pt-3 px-3 py-1.5 text-[11px] font-bold uppercase tracking-wider text-slate-400">Administration</div>
+
+                    <!-- Paramètres SIP & NAT -->
+                    <button type="button" data-tab="sipsettings" onclick="switchTab('sipsettings')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-cyan-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
+                            </svg>
+                            <span>Paramètres SIP & NAT</span>
+                        </span>
+                        <span id="nav-badge-sipsettings" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-cyan-300 border border-anthracite-700 font-bold">NAT</span>
+                    </button>
+
+                    <!-- Certificats SSL / TLS -->
+                    <button type="button" data-tab="certificates" onclick="switchTab('certificates')"
+                        class="tab-btn w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                        <span class="flex items-center gap-3">
+                            <svg class="w-5 h-5 text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                            </svg>
+                            <span>Certificats SSL / TLS</span>
+                        </span>
+                        <span id="nav-badge-certificates" class="px-2 py-0.5 text-xs rounded-full bg-anthracite-800 text-emerald-300 border border-anthracite-700 font-bold">1</span>
+                    </button>
+
+                    <!-- Système (Menu Accordéon) : Paramètres & Fichiers .conf / Sauvegardes & Restauration -->
+                    <div class="space-y-1">
+                        <button type="button" id="btn-menu-system" onclick="toggleSystemMenu()"
+                            class="w-full flex items-center justify-between px-3.5 py-2.5 rounded-xl text-sm font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition">
+                            <span class="flex items-center gap-3">
+                                <svg class="w-5 h-5 text-purple-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z"/>
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z"/>
+                                </svg>
+                                <span>Système</span>
+                            </span>
+                            <svg id="arrow-menu-system" class="w-4 h-4 text-slate-400 transform transition-transform duration-200" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7"/>
+                            </svg>
+                        </button>
+
+                        <!-- Sous-menus Système -->
+                        <div id="submenu-system" class="ml-5 pl-3 border-l border-anthracite-700 space-y-1">
+                            <button type="button" data-tab="system" onclick="switchTab('system')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition text-left">
+                                <span class="truncate">• Paramètres & Fichiers .conf</span>
+                            </button>
+                            <button type="button" data-tab="backups" onclick="switchTab('backups')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition text-left">
+                                <span class="truncate">• Sauvegardes & Restauration</span>
+                                <span id="nav-badge-backups" class="ml-2 shrink-0 px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-purple-300 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                            <button type="button" data-tab="firewall" onclick="switchTab('firewall')"
+                                class="tab-btn w-full flex items-center justify-between px-3 py-1.5 rounded-lg text-xs font-medium text-slate-300 hover:bg-anthracite-800 hover:text-white transition text-left">
+                                <span class="truncate">• Pare-feu & Fail2ban</span>
+                                <span id="nav-badge-firewall" class="ml-2 shrink-0 px-1.5 py-0.2 text-[10px] rounded-full bg-anthracite-800 text-emerald-300 border border-anthracite-700 font-bold">0</span>
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Pied de Sidebar : Infos Serveur Debian & Asterisk PJSIP -->
+            <div class="p-3.5 m-3.5 rounded-xl bg-anthracite-800 border border-anthracite-700 space-y-2 text-xs">
+                <div class="flex items-center justify-between pb-1.5 border-b border-anthracite-700/80">
+                    <span id="sidebar-os-version" class="text-slate-200 font-bold">Debian 13</span>
+                    <span id="sidebar-health-badge" class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">EN LIGNE</span>
+                </div>
+                <div class="space-y-1 text-[11px] text-slate-300">
+                    <div class="flex justify-between items-center">
+                        <span class="text-slate-400">Moteur :</span>
+                        <span id="sidebar-ast-version" class="font-mono text-emerald-400 font-semibold">Asterisk 22 • PJSIP</span>
+                    </div>
+                    <div class="flex justify-between items-center">
+                        <span class="text-slate-400">IP SIP :</span>
+                        <code id="sidebar-ip" class="font-mono text-indigo-300 font-semibold">10.10.175.204</code>
+                    </div>
+                    <div class="flex justify-between items-center">
+                        <span class="text-slate-400">Uptime OS :</span>
+                        <span id="sidebar-uptime" class="font-mono text-slate-200">—</span>
+                    </div>
+                    <div class="flex justify-between items-center">
+                        <span class="text-slate-400">Postes en ligne :</span>
+                        <span id="sidebar-online-phones" class="font-mono text-emerald-400 font-bold">0</span>
+                    </div>
+                </div>
+            </div>
+        </aside>
+
+        <!-- ZONE CENTRALE PLEINE LARGEUR -->
+        <div class="flex-1 flex flex-col min-w-0 w-full">
+
+            <!-- BARRE SUPÉRIEURE -->
+            <header class="sticky top-0 z-20 h-16 bg-anthracite-800/95 backdrop-blur border-b border-anthracite-700 px-4 sm:px-6 lg:px-8 flex items-center justify-between gap-4">
+                <div class="flex items-center gap-3">
+                    <!-- Bouton Hamburger Mobile -->
+                    <button type="button" onclick="toggleMobileSidebar(true)" class="lg:hidden p-2 rounded-lg bg-anthracite-750 text-slate-200 hover:text-white border border-anthracite-700">
+                        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
+                        </svg>
+                    </button>
+                    <div>
+                        <h2 id="page-header-title" class="text-base sm:text-lg font-bold text-white tracking-tight">Tableau de Bord & Supervision Temps Réel</h2>
+                        <p id="last-applied-label" class="text-[11px] text-slate-300 hidden sm:block">Chargement de l'état système...</p>
+                    </div>
+                </div>
+
+                <!-- Boutons d'action globaux -->
+                <div class="flex items-center gap-2.5">
+                    <button id="btn-test-ami" type="button"
+                        class="inline-flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs font-semibold bg-anthracite-750 hover:bg-anthracite-700 text-slate-100 border border-anthracite-600 transition">
+                        <span id="ami-dot" class="w-2 h-2 rounded-full bg-emerald-400"></span>
+                        <span class="hidden sm:inline">Tester AMI</span>
+                    </button>
+
+                    <button id="btn-apply-config" type="button"
+                        class="inline-flex items-center gap-2 px-4 py-2 rounded-xl text-xs sm:text-sm font-semibold bg-emerald-600 hover:bg-emerald-500 active:bg-emerald-700 text-white shadow-lg shadow-emerald-600/25 transition">
+                        <svg id="apply-icon" class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/>
+                        </svg>
+                        <span>Appliquer les configurations</span>
+                    </button>
+
+                    <button id="btn-logout" type="button" title="Se déconnecter (<?= htmlspecialchars($currentUser) ?>)"
+                        class="p-2 rounded-xl bg-anthracite-750 hover:bg-red-500/20 hover:text-red-300 text-slate-300 border border-anthracite-600 transition">
+                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 16l4-4m0 0l-4-4m4 4H7m6 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h4a3 3 0 013 3v1"/>
+                        </svg>
+                    </button>
+                </div>
+            </header>
+
+            <!-- CONTENU PRINCIPAL FLUIDE (100% LARGEUR DISPONIBLE) -->
+            <main class="flex-1 w-full p-4 sm:p-6 lg:p-8 space-y-6 overflow-x-hidden">
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 0 : ACCUEIL & DASHBOARD SUPERVISION TEMPS RÉEL     -->
+                <!-- ========================================================= -->
+                <section id="tab-dashboard" class="tab-panel space-y-6">
+
+                    <!-- LIGNE 1 : 4 CARTES MÉTRIQUES SYSTÈME (CPU, RAM, RÉSEAU, HDD) -->
+                    <div class="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-5">
+
+                        <!-- Carte CPU -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-slate-300">Processeur (CPU)</span>
+                                    <span class="p-2 rounded-lg bg-indigo-500/15 text-indigo-300 border border-indigo-500/30">
+                                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 3v2m6-2v2M9 19v2m6-2v2M5 9H3m2 6H3m18-6h-2m2 6h-2M7 19h10a2 2 0 002-2V7a2 2 0 00-2-2H7a2 2 0 00-2 2v10a2 2 0 002 2zM9 9h6v6H9V9z"/>
+                                        </svg>
+                                    </span>
+                                </div>
+                                <div class="mt-3 flex items-baseline justify-between">
+                                    <div id="metric-cpu-pct" class="text-3xl font-extrabold text-white font-mono">0.0%</div>
+                                    <div id="metric-cpu-cores" class="text-xs text-indigo-300 font-medium">— cœurs</div>
+                                </div>
+                                <div id="metric-cpu-model" class="text-[11px] text-slate-400 truncate mt-1">Debian Linux</div>
+                            </div>
+                            <div class="mt-4">
+                                <div class="w-full h-2.5 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                    <div id="bar-cpu" class="h-full bg-gradient-to-r from-indigo-500 to-cyan-400 transition-all duration-500" style="width: 5%"></div>
+                                </div>
+                                <div class="flex justify-between text-[11px] text-slate-300 mt-2 font-mono">
+                                    <span>Load Average :</span>
+                                    <span id="metric-cpu-load">0.00 / 0.00 / 0.00</span>
+                                </div>
+                            </div>
+                        </div>
+
+                        <!-- Carte Mémoire RAM -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-slate-300">Mémoire Vive (RAM)</span>
+                                    <span class="p-2 rounded-lg bg-emerald-500/15 text-emerald-300 border border-emerald-500/30">
+                                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 7v10c0 2.21 3.582 4 8 4s8-1.79 8-4V7M4 7c0 2.21 3.582 4 8 4s8-1.79 8-4M4 7c0-2.21 3.582-4 8-4s8 1.79 8 4"/>
+                                        </svg>
+                                    </span>
+                                </div>
+                                <div class="mt-3 flex items-baseline justify-between">
+                                    <div id="metric-ram-pct" class="text-3xl font-extrabold text-white font-mono">0.0%</div>
+                                    <div id="metric-ram-used" class="text-xs text-emerald-300 font-mono">0 / 0 Mo</div>
+                                </div>
+                                <div id="metric-ram-free" class="text-[11px] text-slate-400 mt-1">Disponible : — Mo</div>
+                            </div>
+                            <div class="mt-4">
+                                <div class="w-full h-2.5 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                    <div id="bar-ram" class="h-full bg-gradient-to-r from-emerald-500 to-teal-400 transition-all duration-500" style="width: 10%"></div>
+                                </div>
+                                <div class="flex justify-between text-[11px] text-slate-300 mt-2 font-mono">
+                                    <span>Swap Debian :</span>
+                                    <span id="metric-swap">0 / 0 Mo</span>
+                                </div>
+                            </div>
+                        </div>
+
+                        <!-- Carte Réseau -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-slate-300">Réseau SIP & RTP</span>
+                                    <span class="p-2 rounded-lg bg-cyan-500/15 text-cyan-300 border border-cyan-500/30">
+                                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/>
+                                        </svg>
+                                    </span>
+                                </div>
+                                <div class="mt-3 grid grid-cols-2 gap-2">
+                                    <div class="p-2 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                        <div class="text-[10px] text-cyan-300 uppercase font-bold">↓ RX (Entrant)</div>
+                                        <div id="metric-net-rx" class="text-lg font-extrabold text-white font-mono mt-0.5">0.0 Ko/s</div>
+                                    </div>
+                                    <div class="p-2 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                        <div class="text-[10px] text-indigo-300 uppercase font-bold">↑ TX (Sortant)</div>
+                                        <div id="metric-net-tx" class="text-lg font-extrabold text-white font-mono mt-0.5">0.0 Ko/s</div>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="mt-3 pt-2 border-t border-anthracite-700/80 flex justify-between text-[11px] text-slate-300 font-mono">
+                                <span id="metric-net-iface">ens18</span>
+                                <span id="metric-net-totals">Total : ↓ 0 Mo • ↑ 0 Mo</span>
+                            </div>
+                        </div>
+
+                        <!-- Carte Disque HDD / SSD -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-slate-300">Stockage Disque (HDD)</span>
+                                    <span class="p-2 rounded-lg bg-amber-500/15 text-amber-300 border border-amber-500/30">
+                                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 8h14M5 8a2 2 0 110-4h14a2 2 0 110 4M5 8v10a2 2 0 002 2h10a2 2 0 002-2V8m-9 4h4"/>
+                                        </svg>
+                                    </span>
+                                </div>
+                                <div class="mt-3 flex items-baseline justify-between">
+                                    <div id="metric-disk-pct" class="text-3xl font-extrabold text-white font-mono">0.0%</div>
+                                    <div id="metric-disk-used" class="text-xs text-amber-300 font-mono">0 / 0 Go</div>
+                                </div>
+                                <div id="metric-disk-free" class="text-[11px] text-slate-400 mt-1">Espace libre sur / : — Go</div>
+                            </div>
+                            <div class="mt-4">
+                                <div class="w-full h-2.5 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                    <div id="bar-disk" class="h-full bg-gradient-to-r from-amber-500 to-orange-400 transition-all duration-500" style="width: 15%"></div>
+                                </div>
+                                <div class="flex justify-between text-[11px] text-slate-300 mt-2 font-mono">
+                                    <span>Base SQLite :</span>
+                                    <span>/var/www/nexus-pbx</span>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- LIGNE 2 : SUPERVISION SÉCURITÉ, PARE-FEU, FAIL2BAN & STATUT DES SERVICES -->
+                    <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
+
+                        <!-- Carte 1 : État Pare-feu & Fail2ban -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between pb-3 border-b border-anthracite-700/80">
+                                    <div class="flex items-center gap-2.5">
+                                        <span class="p-2 rounded-xl bg-emerald-500/15 text-emerald-400 border border-emerald-500/30">
+                                            <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                                            </svg>
+                                        </span>
+                                        <div>
+                                            <h3 class="text-sm font-bold text-white">Sécurité & Protection Active</h3>
+                                            <p class="text-[11px] text-slate-300">Pare-feu Nginx & Moteur Fail2ban</p>
+                                        </div>
+                                    </div>
+                                    <button type="button" onclick="switchTab('firewall')"
+                                        class="px-2.5 py-1 rounded-lg text-[11px] font-semibold bg-anthracite-950 hover:bg-anthracite-700 text-indigo-300 border border-anthracite-700 transition flex items-center gap-1">
+                                        Configurer
+                                        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7"/></svg>
+                                    </button>
+                                </div>
+
+                                <div class="grid grid-cols-2 gap-3 mt-4">
+                                    <!-- Statut Pare-feu -->
+                                    <div class="p-3 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                        <div class="flex items-center justify-between">
+                                            <span class="text-[10px] text-slate-400 font-bold uppercase">Pare-feu Strict</span>
+                                            <span id="dash-fw-dot" class="w-2 h-2 rounded-full bg-slate-500"></span>
+                                        </div>
+                                        <div id="dash-fw-status" class="text-sm font-extrabold text-white mt-1">Inactif</div>
+                                        <div id="dash-fw-detail" class="text-[10px] text-slate-400 truncate mt-0.5">Filtrage strict non actif</div>
+                                    </div>
+
+                                    <!-- Statut Fail2ban -->
+                                    <div class="p-3 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                        <div class="flex items-center justify-between">
+                                            <span class="text-[10px] text-slate-400 font-bold uppercase">Fail2ban IDS</span>
+                                            <span id="dash-f2b-dot" class="w-2 h-2 rounded-full bg-emerald-400 animate-pulse"></span>
+                                        </div>
+                                        <div id="dash-f2b-status" class="text-sm font-extrabold text-emerald-400 mt-1">Actif</div>
+                                        <div id="dash-f2b-detail" class="text-[10px] text-slate-400 truncate mt-0.5">3 prisons actives</div>
+                                    </div>
+                                </div>
+
+                                <!-- Nombre d'IPs bloquées -->
+                                <div class="mt-3 p-3.5 rounded-xl bg-gradient-to-r from-anthracite-950 via-anthracite-900 to-anthracite-950 border border-anthracite-700 flex items-center justify-between">
+                                    <div>
+                                        <span class="text-xs text-slate-300 font-medium">Adresses IP bannies</span>
+                                        <div class="flex items-baseline gap-2 mt-0.5">
+                                            <span id="dash-banned-count" class="text-2xl font-black text-rose-400 font-mono">0</span>
+                                            <span class="text-[11px] text-slate-400">actuellement</span>
+                                        </div>
+                                    </div>
+                                    <div class="text-right">
+                                        <button type="button" onclick="openSecurityEventsModal()" id="dash-total-blocked-badge" title="Cliquer pour voir le détail des événements de sécurité"
+                                            class="cursor-pointer hover:scale-105 transition transform px-2.5 py-1 rounded-full text-[11px] font-bold bg-amber-500/15 hover:bg-amber-500/25 text-amber-300 border border-amber-500/30 font-mono flex items-center gap-1.5 ml-auto">
+                                            0 bloquées au total
+                                        </button>
+                                        <div id="dash-latest-banned" class="text-[10px] text-slate-400 mt-1 truncate max-w-[140px]">Aucun ban actif</div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="mt-4 pt-3 border-t border-anthracite-700/80 flex items-center justify-between text-xs text-slate-300">
+                                <span class="flex items-center gap-1.5">
+                                    <i class="w-2 h-2 rounded-full bg-emerald-400"></i>
+                                    Protection intrusion
+                                </span>
+                                <span id="dash-client-ip" class="font-mono text-[11px] text-cyan-300">IP client : 127.0.0.1</span>
+                            </div>
+                        </div>
+
+                        <!-- Carte 2 : Graphique Visuel des Menaces & Jails Fail2ban -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between pb-3 border-b border-anthracite-700/80">
+                                    <div>
+                                        <h3 class="text-sm font-bold text-white">Répartition des Menaces (Jails)</h3>
+                                        <p class="text-[11px] text-slate-300">Tentatives d'intrusion interceptées par service</p>
+                                    </div>
+                                    <span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">IDS / IPS</span>
+                                </div>
+
+                                <!-- Graphe / Barres de progression stylisées des Jails -->
+                                <div class="space-y-3 mt-4">
+                                    <!-- Jail Asterisk SIP -->
+                                    <div>
+                                        <div class="flex items-center justify-between text-xs mb-1">
+                                            <span class="flex items-center gap-2 font-medium text-slate-200">
+                                                <i class="w-2.5 h-2.5 rounded-full bg-indigo-400"></i>
+                                                Téléphonie SIP (PJSIP)
+                                            </span>
+                                            <span id="dash-jail-ast-stats" class="text-[11px] font-mono text-indigo-300 font-bold">0 échecs • 0 ban</span>
+                                        </div>
+                                        <div class="w-full h-2 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                            <div id="dash-jail-ast-bar" class="h-full bg-gradient-to-r from-indigo-500 to-cyan-400 transition-all duration-500" style="width: 5%"></div>
+                                        </div>
+                                    </div>
+
+                                    <!-- Jail Nexus Web -->
+                                    <div>
+                                        <div class="flex items-center justify-between text-xs mb-1">
+                                            <span class="flex items-center gap-2 font-medium text-slate-200">
+                                                <i class="w-2.5 h-2.5 rounded-full bg-emerald-400"></i>
+                                                Portail Web & API Admin
+                                            </span>
+                                            <span id="dash-jail-web-stats" class="text-[11px] font-mono text-emerald-300 font-bold">0 échecs • 0 ban</span>
+                                        </div>
+                                        <div class="w-full h-2 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                            <div id="dash-jail-web-bar" class="h-full bg-gradient-to-r from-emerald-500 to-teal-400 transition-all duration-500" style="width: 5%"></div>
+                                        </div>
+                                    </div>
+
+                                    <!-- Jail SSHD -->
+                                    <div>
+                                        <div class="flex items-center justify-between text-xs mb-1">
+                                            <span class="flex items-center gap-2 font-medium text-slate-200">
+                                                <i class="w-2.5 h-2.5 rounded-full bg-amber-400"></i>
+                                                Console Système SSH
+                                            </span>
+                                            <span id="dash-jail-ssh-stats" class="text-[11px] font-mono text-amber-300 font-bold">0 échecs • 0 ban</span>
+                                        </div>
+                                        <div class="w-full h-2 bg-anthracite-950 rounded-full overflow-hidden border border-anthracite-700">
+                                            <div id="dash-jail-ssh-bar" class="h-full bg-gradient-to-r from-amber-500 to-orange-400 transition-all duration-500" style="width: 5%"></div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="mt-4 pt-3 border-t border-anthracite-700/80 flex items-center justify-between text-[11px] text-slate-300">
+                                <span class="font-mono text-slate-400 truncate">/var/log/asterisk/security.log</span>
+                                <button type="button" onclick="openSecurityEventsModal()" class="text-xs font-semibold text-indigo-400 hover:text-indigo-300 transition flex items-center gap-1">
+                                    <span>Voir les détails des attaques</span>
+                                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7"/></svg>
+                                </button>
+                            </div>
+                        </div>
+
+                        <!-- Carte 3 : Statut des Services Système Debian -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between pb-3 border-b border-anthracite-700/80">
+                                    <div>
+                                        <h3 class="text-sm font-bold text-white">Statut des Services Système</h3>
+                                        <p class="text-[11px] text-slate-300">Surveillance temps réel des démons Debian</p>
+                                    </div>
+                                    <span id="dash-services-all-badge" class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">TOUS OPÉRATIONNELS</span>
+                                </div>
+
+                                <div id="dash-services-list" class="divide-y divide-anthracite-700/60 mt-2">
+                                    <!-- Rendu dynamique JS des 5 services -->
+                                </div>
+                            </div>
+
+                            <div class="mt-3 pt-2.5 border-t border-anthracite-700/80 flex items-center justify-between text-xs text-slate-400">
+                                <span>Moteur PBX : <b class="text-slate-200">Asterisk 22</b></span>
+                                <span>Distro : <b class="text-slate-200">Debian Linux</b></span>
+                            </div>
+                        </div>
+
+                    </div>
+
+                    <!-- LIGNE 3 : GRAPHES TEMPS RÉEL (CPU/RAM + TRAFIC RÉSEAU + JAUGE STOCKAGE/PBX) -->
+                    <div class="grid grid-cols-1 xl:grid-cols-3 gap-6">
+
+                        <!-- Graphe 1 : Historique Temps Réel CPU & Mémoire (%) -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div class="flex items-center justify-between mb-3">
+                                <div>
+                                    <h3 class="text-sm font-bold text-white">Historique Charge CPU & RAM (%)</h3>
+                                    <p class="text-[11px] text-slate-300">Actualisation automatique toutes les 3 secondes</p>
+                                </div>
+                                <div class="flex items-center gap-3 text-xs font-medium">
+                                    <span class="flex items-center gap-1.5 text-indigo-300"><i class="w-2.5 h-2.5 rounded-full bg-indigo-400 inline-block"></i>CPU</span>
+                                    <span class="flex items-center gap-1.5 text-emerald-300"><i class="w-2.5 h-2.5 rounded-full bg-emerald-400 inline-block"></i>RAM</span>
+                                </div>
+                            </div>
+                            <div class="relative h-52 w-full bg-anthracite-950 rounded-xl border border-anthracite-700 p-2 overflow-hidden">
+                                <svg id="chart-cpu-ram" viewBox="0 0 500 180" preserveAspectRatio="none" class="w-full h-full"></svg>
+                            </div>
+                        </div>
+
+                        <!-- Graphe 2 : Historique Temps Réel Trafic Réseau RX / TX (Ko/s) -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div class="flex items-center justify-between mb-3">
+                                <div>
+                                    <h3 class="text-sm font-bold text-white">Débit Réseau Temps Réel (Ko/s)</h3>
+                                    <p class="text-[11px] text-slate-300">Flux SIP (5060/5061) & Flux Audio RTP</p>
+                                </div>
+                                <div class="flex items-center gap-3 text-xs font-medium">
+                                    <span class="flex items-center gap-1.5 text-cyan-300"><i class="w-2.5 h-2.5 rounded-full bg-cyan-400 inline-block"></i>RX</span>
+                                    <span class="flex items-center gap-1.5 text-purple-300"><i class="w-2.5 h-2.5 rounded-full bg-purple-400 inline-block"></i>TX</span>
+                                </div>
+                            </div>
+                            <div class="relative h-52 w-full bg-anthracite-950 rounded-xl border border-anthracite-700 p-2 overflow-hidden">
+                                <svg id="chart-network" viewBox="0 0 500 180" preserveAspectRatio="none" class="w-full h-full"></svg>
+                            </div>
+                        </div>
+
+                        <!-- Graphe 3 : Jauges Anneaux (RAM / Disque / Postes SIP Connectés) -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <h3 class="text-sm font-bold text-white">Synthèse Ressources & Téléphonie</h3>
+                                <p class="text-[11px] text-slate-300">État global du serveur Debian & d'Asterisk 22</p>
+                            </div>
+
+                            <div class="grid grid-cols-3 gap-3 my-4">
+                                <!-- Donut CPU -->
+                                <div class="flex flex-col items-center p-3 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                    <svg class="w-20 h-20 -rotate-90" viewBox="0 0 36 36">
+                                        <circle cx="18" cy="18" r="15.5" fill="none" stroke="#2c323f" stroke-width="3.5"></circle>
+                                        <circle id="donut-cpu" cx="18" cy="18" r="15.5" fill="none" stroke="#818cf8" stroke-width="3.5" stroke-dasharray="0, 100" stroke-linecap="round"></circle>
+                                    </svg>
+                                    <span id="donut-cpu-label" class="text-xs font-bold font-mono text-white mt-1.5">0%</span>
+                                    <span class="text-[10px] text-slate-400 uppercase">Charge CPU</span>
+                                </div>
+
+                                <!-- Donut RAM -->
+                                <div class="flex flex-col items-center p-3 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                    <svg class="w-20 h-20 -rotate-90" viewBox="0 0 36 36">
+                                        <circle cx="18" cy="18" r="15.5" fill="none" stroke="#2c323f" stroke-width="3.5"></circle>
+                                        <circle id="donut-ram" cx="18" cy="18" r="15.5" fill="none" stroke="#34d399" stroke-width="3.5" stroke-dasharray="0, 100" stroke-linecap="round"></circle>
+                                    </svg>
+                                    <span id="donut-ram-label" class="text-xs font-bold font-mono text-white mt-1.5">0%</span>
+                                    <span class="text-[10px] text-slate-400 uppercase">Mémoire RAM</span>
+                                </div>
+
+                                <!-- Donut HDD -->
+                                <div class="flex flex-col items-center p-3 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                    <svg class="w-20 h-20 -rotate-90" viewBox="0 0 36 36">
+                                        <circle cx="18" cy="18" r="15.5" fill="none" stroke="#2c323f" stroke-width="3.5"></circle>
+                                        <circle id="donut-disk" cx="18" cy="18" r="15.5" fill="none" stroke="#fbbf24" stroke-width="3.5" stroke-dasharray="0, 100" stroke-linecap="round"></circle>
+                                    </svg>
+                                    <span id="donut-disk-label" class="text-xs font-bold font-mono text-white mt-1.5">0%</span>
+                                    <span class="text-[10px] text-slate-400 uppercase">Disque HDD</span>
+                                </div>
+                            </div>
+
+                            <div class="grid grid-cols-2 gap-3 text-xs">
+                                <div class="px-3.5 py-2.5 rounded-xl bg-anthracite-950 border border-anthracite-700 flex items-center justify-between">
+                                    <span class="text-slate-300">Appels en cours :</span>
+                                    <span id="dash-active-calls" class="font-mono font-bold text-emerald-400 text-sm">0</span>
+                                </div>
+                                <div class="px-3.5 py-2.5 rounded-xl bg-anthracite-950 border border-anthracite-700 flex items-center justify-between">
+                                    <span class="text-slate-300">Postes enregistrés :</span>
+                                    <span id="dash-online-contacts" class="font-mono font-bold text-indigo-300 text-sm">0</span>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- LIGNE 3 : ÉTAT DES TÉLÉPHONES SIP EN DIRECT & RACCOURCIS PBX -->
+                    <div class="grid grid-cols-1 xl:grid-cols-3 gap-6">
+
+                        <!-- Table des Postes SIP et état d'enregistrement PJSIP en direct -->
+                        <div class="xl:col-span-2 bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                            <div class="px-5 py-4 border-b border-anthracite-700 flex flex-wrap items-center justify-between gap-2">
+                                <div>
+                                    <h3 class="text-sm font-bold text-white">État des Téléphones SIP en Temps Réel (PJSIP Contacts)</h3>
+                                    <p class="text-xs text-slate-300">Visualisez instantanément quels téléphones sont enregistrés sur Asterisk et leur latence RTT.</p>
+                                </div>
+                                <button type="button" onclick="openExtensionModal()"
+                                    class="px-3.5 py-1.5 rounded-xl text-xs font-semibold bg-indigo-600 hover:bg-indigo-500 text-white transition">
+                                    + Ajouter un poste
+                                </button>
+                            </div>
+                            <div class="overflow-x-auto">
+                                <table class="w-full text-left border-collapse">
+                                    <thead>
+                                        <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                            <th class="py-3 px-4">Poste</th>
+                                            <th class="py-3 px-4">Nom</th>
+                                            <th class="py-3 px-4">Transport & Sécurité (Réel)</th>
+                                            <th class="py-3 px-4">Statut SIP Temps Réel</th>
+                                            <th class="py-3 px-4">IP & Équipement Détecté</th>
+                                            <th class="py-3 px-4 text-right">Latence RTT</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody id="dashboard-phones-tbody" class="divide-y divide-anthracite-700/60 text-sm"></tbody>
+                                </table>
+                            </div>
+                        </div>
+
+                        <!-- Résumé Architecture PBX & Codes de test -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg flex flex-col justify-between space-y-4">
+                            <div>
+                                <h3 class="text-sm font-bold text-white mb-1">Architecture Téléphonique Active</h3>
+                                <p class="text-xs text-slate-300 mb-4">Vue rapide des objets configurés dans SQLite.</p>
+
+                                <div class="grid grid-cols-2 gap-3">
+                                    <div onclick="switchTab('extensions')" class="cursor-pointer p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 hover:border-indigo-400 transition">
+                                        <div class="text-xs text-slate-300">Postes SIP</div>
+                                        <div id="stat-extensions" class="text-2xl font-extrabold text-white mt-0.5">0</div>
+                                        <div id="stat-extensions-sub" class="text-[11px] text-indigo-300 mt-0.5">0 UDP • 0 TLS</div>
+                                    </div>
+                                    <div onclick="switchTab('groups')" class="cursor-pointer p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 hover:border-cyan-400 transition">
+                                        <div class="text-xs text-slate-300">Groupes d'appel</div>
+                                        <div id="stat-groups" class="text-2xl font-extrabold text-white mt-0.5">0</div>
+                                        <div class="text-[11px] text-cyan-300 mt-0.5">Ring Groups</div>
+                                    </div>
+                                    <div onclick="switchTab('trunks')" class="cursor-pointer p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 hover:border-emerald-400 transition">
+                                        <div class="text-xs text-slate-300">Trunks SIP</div>
+                                        <div id="stat-trunks" class="text-2xl font-extrabold text-white mt-0.5">0</div>
+                                        <div class="text-[11px] text-emerald-300 mt-0.5">Opérateurs VoIP</div>
+                                    </div>
+                                    <div onclick="switchTab('ivrs')" class="cursor-pointer p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 hover:border-amber-400 transition">
+                                        <div class="text-xs text-slate-300">Menus SVI / IVR</div>
+                                        <div id="stat-ivrs" class="text-2xl font-extrabold text-white mt-0.5">0</div>
+                                        <div class="text-[11px] text-amber-300 mt-0.5">Serveurs vocaux</div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs space-y-2">
+                                <div class="font-bold text-white flex items-center justify-between">
+                                    <span>Codes de test audio intégrés</span>
+                                    <span id="stat-health" class="text-[11px] text-emerald-400 font-semibold">OK</span>
+                                </div>
+                                <div class="flex justify-between text-slate-300">
+                                    <span>Test d'écho interactif :</span>
+                                    <code class="text-emerald-300 font-mono font-bold">*43</code>
+                                </div>
+                                <div class="flex justify-between text-slate-300">
+                                    <span>Horloge parlante :</span>
+                                    <code class="text-emerald-300 font-mono font-bold">*60</code>
+                                </div>
+                                <div class="flex justify-between text-slate-300">
+                                    <span>Tester le SVI d'accueil :</span>
+                                    <code class="text-emerald-300 font-mono font-bold">*801</code>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 1 : EXTENSIONS SIP                                 -->
+                <!-- ========================================================= -->
+                <section id="tab-extensions" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Postes Téléphoniques PJSIP</h2>
+                            <p class="text-xs text-slate-300">Gérez vos postes internes (UDP non chiffré) et vos postes nomades distants (TLS + chiffrement média SRTP via Let's Encrypt).</p>
+                        </div>
+                        <button type="button" onclick="openExtensionModal()"
+                            class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-indigo-600 hover:bg-indigo-500 text-white shadow-lg shadow-indigo-600/20 transition">
+                            <span>+ Nouveau Poste SIP</span>
+                        </button>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">Extension</th>
+                                        <th class="py-3.5 px-4">Nom d'affichage</th>
+                                        <th class="py-3.5 px-4">Groupes d'Extensions (Sites)</th>
+                                        <th class="py-3.5 px-4">Statut Enregistrement</th>
+                                        <th class="py-3.5 px-4">Mode de Connexion</th>
+                                        <th class="py-3.5 px-4">Codecs Audio</th>
+                                        <th class="py-3.5 px-4">Secret SIP</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="extensions-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 2A : GROUPES DE SONNERIE (RING GROUPS)             -->
+                <!-- ========================================================= -->
+                <section id="tab-groups" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Groupes de Sonnerie (Ring Groups)</h2>
+                            <p class="text-xs text-slate-300">Objets d'appel entrant avec numéro virtuel (ex: <code class="text-cyan-300">600</code>). Faites sonner plusieurs téléphones en simultané (<code class="text-indigo-300">ringall</code>) ou l'un après l'autre (<code class="text-indigo-300">hunt</code>) avec destination de débordement.</p>
+                        </div>
+                        <button type="button" onclick="openGroupModal()"
+                            class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-indigo-600 hover:bg-indigo-500 text-white shadow-lg shadow-indigo-600/20 transition">
+                            <span>+ Nouveau Groupe de Sonnerie</span>
+                        </button>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">Numéro</th>
+                                        <th class="py-3.5 px-4">Nom du Groupe</th>
+                                        <th class="py-3.5 px-4">Stratégie</th>
+                                        <th class="py-3.5 px-4">Postes Sonnants</th>
+                                        <th class="py-3.5 px-4">Durée / Débordement</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="groups-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 2B : GROUPES D'EXTENSIONS (SITES & DROITS ROUTES)   -->
+                <!-- ========================================================= -->
+                <section id="tab-extgroups" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Groupes d'Extensions (Sites, Services & Droits Sortants)</h2>
+                            <p class="text-xs text-slate-300">Regroupements logiques d'extensions (ex: <code class="text-emerald-300">Groupe Nice</code>, <code class="text-indigo-300">Groupe Paris</code>, <code class="text-cyan-300">Commerciaux</code>) pour gérer en 1 clic leurs droits d'appels sur les <strong>Routes Sortantes</strong>.</p>
+                        </div>
+                        <div class="flex flex-wrap items-center gap-2">
+                            <button type="button" onclick="openExtGroupModal()"
+                                class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-cyan-600 hover:bg-cyan-500 text-white shadow-lg shadow-cyan-600/20 transition">
+                                <span>+ Nouveau Groupe d'Extensions</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">Groupe</th>
+                                        <th class="py-3.5 px-4">Description</th>
+                                        <th class="py-3.5 px-4">Extensions Membres</th>
+                                        <th class="py-3.5 px-4">Routes Sortantes Autorisées</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="extgroups-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 2C : ANNUAIRE D'ENTREPRISE (YEALINK REMOTE XML)    -->
+                <!-- ========================================================= -->
+                <section id="tab-phonebook" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col lg:flex-row lg:items-center justify-between gap-3">
+                        <div>
+                            <div class="flex items-center gap-2">
+                                <h2 class="text-lg font-bold text-white">Annuaire d'Entreprise & Carnet d'Adresses IP Phone</h2>
+                                <span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-teal-500/20 text-teal-300 border border-teal-500/30">Yealink XML</span>
+                            </div>
+                            <p class="text-xs text-slate-300">Répertoire unifié (postes internes & contacts externes) synchronisé automatiquement avec les téléphones IP Yealink via l'API XML <code class="text-teal-300">phonebook.php</code>.</p>
+                        </div>
+                        <div class="flex items-center flex-wrap gap-2">
+                            <button type="button" onclick="openYealinkXmlModal()"
+                                class="inline-flex items-center gap-2 px-3.5 py-2 rounded-xl text-xs sm:text-sm font-semibold bg-teal-600/20 hover:bg-teal-600/30 text-teal-300 border border-teal-500/40 shadow-sm transition">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1"/></svg>
+                                <span>URL XML Annuaire (phonebook.php)</span>
+                            </button>
+                            <button type="button" onclick="syncPhonebookNow()"
+                                class="inline-flex items-center gap-1.5 px-3 py-2 rounded-xl text-xs sm:text-sm font-medium bg-anthracite-800 hover:bg-anthracite-750 text-slate-200 border border-anthracite-700 transition" title="Synchroniser immédiatement avec la liste des extensions">
+                                <svg class="w-4 h-4 text-cyan-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg>
+                                <span>Synchroniser</span>
+                            </button>
+                            <button type="button" onclick="openPhonebookContactModal()"
+                                class="inline-flex items-center gap-2 px-4 py-2 rounded-xl text-xs sm:text-sm font-semibold bg-indigo-600 hover:bg-indigo-500 text-white shadow-lg shadow-indigo-600/20 transition">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/></svg>
+                                <span>Nouveau Contact Externe</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Barre de Recherche & Filtres par Groupe d'Annuaire -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 shadow-lg space-y-3">
+                        <div class="flex flex-col md:flex-row md:items-center justify-between gap-3">
+                            <div class="relative flex-1 max-w-md">
+                                <span class="absolute inset-y-0 left-0 pl-3.5 flex items-center pointer-events-none text-slate-400">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"/></svg>
+                                </span>
+                                <input type="text" id="phonebook-search" oninput="filterPhonebook()" placeholder="Rechercher par nom, numéro de poste, mobile, email..."
+                                    class="w-full pl-10 pr-4 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-indigo-500 transition">
+                            </div>
+                            <div id="phonebook-stats" class="text-xs text-slate-400 font-mono flex items-center gap-3">
+                                <span>Chargement des contacts...</span>
+                            </div>
+                        </div>
+
+                        <!-- Filtres par groupe (Pills dynamiques) -->
+                        <div class="flex items-center gap-1.5 flex-wrap pt-1 border-t border-anthracite-700/60" id="phonebook-group-pills">
+                            <button type="button" onclick="selectPhonebookGroupFilter('all')" class="phonebook-grp-pill active px-3 py-1 rounded-lg text-xs font-semibold bg-indigo-600 text-white transition">
+                                Tous les groupes
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Tableau des contacts d'annuaire -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3 px-4 w-12">Photo</th>
+                                        <th class="py-3 px-4">Nom de Contact</th>
+                                        <th class="py-3 px-4">Poste Interne</th>
+                                        <th class="py-3 px-4">Téléphone Mobile</th>
+                                        <th class="py-3 px-4">Autre Numéro</th>
+                                        <th class="py-3 px-4">Email</th>
+                                        <th class="py-3 px-4">Groupe Annuaire</th>
+                                        <th class="py-3 px-4">Type</th>
+                                        <th class="py-3 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="phonebook-tbody" class="divide-y divide-anthracite-700/60 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 3 : TRUNKS SIP                                     -->
+                <!-- ========================================================= -->
+                <section id="tab-trunks" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Trunks Opérateurs SIP (Configuration PJSIP Avancée)</h2>
+                            <p class="text-xs text-slate-300">Configurez vos connecteurs PJSIP opérateurs et leurs Routes Entrantes. Pour définir l'ordre de sortie et les droits d'appels sortants, ouvrez <button type="button" onclick="switchTab('outbound')" class="text-emerald-300 underline font-semibold">Routes Sortantes</button>.</p>
+                        </div>
+                        <div class="flex items-center gap-2">
+                            <button type="button" onclick="switchTab('outbound')"
+                                class="px-3.5 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-emerald-500/20 hover:bg-emerald-500/30 border border-emerald-500/40 text-emerald-300 transition">
+                                ↗ Gérer les Routes Sortantes
+                            </button>
+                            <button type="button" onclick="openTrunkModal()"
+                                class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-indigo-600 hover:bg-indigo-500 text-white shadow-lg shadow-indigo-600/20 transition">
+                                <span>+ Nouveau Trunk SIP</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">Nom Trunk</th>
+                                        <th class="py-3.5 px-4">Statut PJSIP</th>
+                                        <th class="py-3.5 px-4">Serveur / Proxy</th>
+                                        <th class="py-3.5 px-4">Auth / Identité SIP</th>
+                                        <th class="py-3.5 px-4">Transport & Codecs</th>
+                                        <th class="py-3.5 px-4">Routage Entrant & SDA</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="trunks-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 3B : ROUTES SORTANTES (OUTBOUND ROUTES)            -->
+                <!-- ========================================================= -->
+                <section id="tab-outbound" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Routes Sortantes (Outbound Routes & Cascade de Priorité)</h2>
+                            <p class="text-xs text-slate-300">
+                                Définissez l'ordre d'utilisation de vos routes sortantes (ex: <strong>1. OVH</strong> → <strong>2. Livebox</strong>). Si le premier Trunk est indisponible <strong>ou si le poste/groupe appelant n'a pas les droits sur la première route</strong>, NexusPBX passe automatiquement à la route suivante !
+                            </p>
+                        </div>
+                        <button type="button" onclick="openOutboundRouteModal()"
+                            class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-emerald-600 hover:bg-emerald-500 text-white shadow-lg shadow-emerald-600/20 transition shrink-0">
+                            <span>+ Ajout route sortante</span>
+                        </button>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4 w-28">Ordre</th>
+                                        <th class="py-3.5 px-4">Name (Route)</th>
+                                        <th class="py-3.5 px-4">CID Sortant</th>
+                                        <th class="py-3.5 px-4">Séquence Trunks (Failover)</th>
+                                        <th class="py-3.5 px-4">Droits (Groupes & Postes)</th>
+                                        <th class="py-3.5 px-4">Attributs & Masques</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="outbound-routes-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 4 : SERVEURS VOCAUX (IVR)                          -->
+                <!-- ========================================================= -->
+                <section id="tab-ivrs" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white">Serveurs Vocaux Interactifs (SVI / IVR)</h2>
+                            <p class="text-xs text-slate-300">Créez vos menus vocaux d'accueil avec routage par touches DTMF (0-9, *, #).</p>
+                        </div>
+                        <button type="button" onclick="openIvrModal()"
+                            class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-indigo-600 hover:bg-indigo-500 text-white transition">
+                            <span>+ Nouveau SVI / IVR</span>
+                        </button>
+                    </div>
+
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">SVI / Menu</th>
+                                        <th class="py-3.5 px-4">Annonce Vocale</th>
+                                        <th class="py-3.5 px-4">Num. Directe</th>
+                                        <th class="py-3.5 px-4">Touches DTMF</th>
+                                        <th class="py-3.5 px-4">Sécurité & Échecs</th>
+                                        <th class="py-3.5 px-4">Test Direct</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="ivrs-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 4B : FICHIERS SONS & MÉDIATHÈQUE AUDIO               -->
+                <!-- ========================================================= -->
+                <section id="tab-sounds" class="tab-panel hidden space-y-4">
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                        <div>
+                            <h2 class="text-lg font-bold text-white flex items-center gap-2">
+                                <span class="w-3 h-3 rounded-full bg-amber-400"></span>
+                                <span>Fichiers sons & Musiques d'attente</span>
+                            </h2>
+                            <p class="text-xs text-slate-300">Gérez vos musiques d'attente (MoH), annonces d'accueil, menus SVI et messages de congestion classés par site et par usage.</p>
+                        </div>
+                        <div class="flex flex-wrap items-center gap-2">
+                            <button type="button" onclick="openSoundSitesModal()"
+                                class="inline-flex items-center gap-2 px-3.5 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-anthracite-750 hover:bg-anthracite-700 text-slate-200 border border-anthracite-600 transition">
+                                <svg class="w-4 h-4 text-slate-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10"/>
+                                </svg>
+                                <span>Gérer les catégories de sites</span>
+                            </button>
+                            <button type="button" onclick="openSoundModal()"
+                                class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl text-xs sm:text-sm font-semibold bg-gradient-to-r from-amber-600 to-amber-500 hover:from-amber-500 hover:to-amber-400 text-white shadow-lg shadow-amber-600/20 transition">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
+                                </svg>
+                                <span>Téléverser un fichier son</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Encart dédié : Musique d'attente générale par défaut du PBX -->
+                    <div class="p-4 rounded-2xl bg-anthracite-800 border border-amber-500/30 flex flex-col md:flex-row md:items-center justify-between gap-4 shadow-lg">
+                        <div class="space-y-0.5">
+                            <div class="text-xs font-bold uppercase tracking-wider text-amber-300">Musique d'attente générale par défaut (MoH)</div>
+                            <p class="text-xs text-slate-300">Définit la musique diffusée à tous les correspondants mis en garde sur le standard (sauf surcharge sur une route ou un poste spécifique).</p>
+                        </div>
+                        <div class="flex items-center gap-2">
+                            <select id="global-default-moh-select" class="px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-600 text-xs text-white focus:outline-none focus:border-amber-500 min-w-[240px]"></select>
+                            <button type="button" onclick="applyDefaultMohFromSelect()" class="px-4 py-2 rounded-xl bg-amber-600 hover:bg-amber-500 text-white text-xs font-semibold whitespace-nowrap transition">
+                                Définir par défaut
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Barre de filtres par Site et par Usage -->
+                    <div class="p-3.5 rounded-2xl bg-anthracite-800 border border-anthracite-700 flex flex-wrap items-center justify-between gap-3">
+                        <div class="flex flex-wrap items-center gap-2">
+                            <span class="text-xs font-semibold text-slate-400 mr-1">Filtrer par :</span>
+
+                            <!-- Filtre Site / Contexte -->
+                            <div class="relative">
+                                <select id="filter-sound-site" onchange="renderSoundsTable()"
+                                    class="bg-anthracite-900 border border-anthracite-600 rounded-lg px-3 py-1.5 text-xs text-slate-200 focus:outline-none focus:border-amber-500">
+                                    <option value="all">Tous les sites</option>
+                                    <option value="Global">Global</option>
+                                    <option value="Site Nice">Site Nice</option>
+                                    <option value="Site Paris">Site Paris</option>
+                                </select>
+                            </div>
+
+                            <!-- Filtre Usage / Type -->
+                            <div class="relative">
+                                <select id="filter-sound-usage" onchange="renderSoundsTable()"
+                                    class="bg-anthracite-900 border border-anthracite-600 rounded-lg px-3 py-1.5 text-xs text-slate-200 focus:outline-none focus:border-amber-500">
+                                    <option value="all">Tous les usages</option>
+                                    <option value="moh">Musique d'attente (MoH)</option>
+                                    <option value="announcement">Annonce d'accueil / Info</option>
+                                    <option value="ivr">Menu SVI / Interactif</option>
+                                    <option value="congestion">Ligne occupée / Congestion</option>
+                                    <option value="custom">Autre / Personnalisé</option>
+                                </select>
+                            </div>
+                        </div>
+
+                        <!-- Recherche textuelle -->
+                        <div class="w-full sm:w-64">
+                            <input type="text" id="filter-sound-search" oninput="renderSoundsTable()" placeholder="Rechercher un son ou code..."
+                                class="w-full bg-anthracite-950 border border-anthracite-600 rounded-lg px-3 py-1.5 text-xs text-white placeholder-slate-500 focus:outline-none focus:border-amber-500">
+                        </div>
+                    </div>
+
+                    <!-- Tableau des fichiers sons -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/60">
+                                        <th class="py-3.5 px-4">Nom & Description</th>
+                                        <th class="py-3.5 px-4">Catégorie de site</th>
+                                        <th class="py-3.5 px-4">Usage</th>
+                                        <th class="py-3.5 px-4 min-w-[200px]">Écoute audio</th>
+                                        <th class="py-3.5 px-4">Format & Durée</th>
+                                        <th class="py-3.5 px-4">Référence Asterisk</th>
+                                        <th class="py-3.5 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="sounds-tbody" class="divide-y divide-anthracite-700/70 text-sm"></tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 5 : SYSTÈME DEBIAN, SETTINGS & FICHIERS .CONF      -->
+                <!-- ========================================================= -->
+                <section id="tab-system" class="tab-panel hidden space-y-6">
+                    <div class="grid grid-cols-1 xl:grid-cols-2 gap-6">
+
+                        <!-- Formulaire Paramètres Globaux -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg">
+                            <h3 class="text-base font-bold text-white mb-1">Paramètres Globaux SIP, TLS & AMI</h3>
+                            <p class="text-xs text-slate-300 mb-5">Stockés dans la table <code class="text-indigo-300">settings</code> de SQLite et utilisés lors de la génération PJSIP.</p>
+
+                            <form id="settings-form" class="space-y-4">
+                                <!-- Identité & Logo de l'Exploitant -->
+                                <input type="file" id="company-logo-file-input" accept="image/png,image/svg+xml,image/jpeg,image/webp,image/gif" class="hidden" onchange="handleCompanyLogoUpload(this)">
+                                <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3.5">
+                                    <div class="flex items-center justify-between pb-2 border-b border-anthracite-700/60">
+                                        <div>
+                                            <span class="text-xs font-bold uppercase tracking-wider text-emerald-300">Logo & Marque Blanche Exploitant</span>
+                                            <p class="text-[11px] text-slate-400">Affiché sous NexusPBX dans le menu et sur l'écran d'accueil</p>
+                                        </div>
+                                        <div class="flex items-center gap-2">
+                                            <button type="button" onclick="triggerCompanyLogoPicker()" class="px-3 py-1.5 rounded-lg bg-indigo-600 hover:bg-indigo-500 text-xs text-white font-semibold transition shadow-sm">
+                                                Importer un Logo
+                                            </button>
+                                            <button type="button" onclick="clearCompanyLogo()" class="px-2.5 py-1.5 rounded-lg bg-anthracite-800 hover:bg-red-500/20 border border-anthracite-700 text-xs text-slate-300 hover:text-red-300 transition">
+                                                Effacer
+                                            </button>
+                                        </div>
+                                    </div>
+                                    <div class="flex items-center gap-4">
+                                        <!-- Aperçu actuel du logo -->
+                                        <div id="settings-company-preview-slot" class="w-32 h-14 rounded-lg bg-anthracite-900 border border-dashed border-anthracite-700 flex items-center justify-center p-2 shrink-0">
+                                            <img id="settings-company-preview-img" src="" alt="Aperçu Logo" class="max-h-11 max-w-full object-contain hidden">
+                                            <span id="settings-company-preview-empty" class="text-[10px] text-slate-500 italic text-center">Aucun logo configuré</span>
+                                        </div>
+                                        <div class="flex-1">
+                                            <label class="block text-xs font-medium text-slate-200 mb-1">Nom de l'exploitant / entreprise</label>
+                                            <input type="text" name="company_name" placeholder="ex: Groupe Télécom & Réseaux SAS"
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white">
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Domaine SIP / Nom PBX</label>
+                                        <input type="text" name="domain" required
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Domaine Let's Encrypt (TLS)</label>
+                                        <input type="text" name="letsencrypt_domain" placeholder="ex: sip.mondomaine.fr"
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Réseau Local (CIDR NAT)</label>
+                                        <input type="text" name="local_net" placeholder="10.10.0.0/16"
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">IP Publique Externe (NAT)</label>
+                                        <input type="text" name="external_ip" placeholder="ex: 203.0.113.10"
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Port SIP UDP (Interne)</label>
+                                        <input type="number" name="udp_port" required
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Port SIP TLS (Distant Chiffré)</label>
+                                        <input type="number" name="tls_port" required
+                                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                    </div>
+                                    <div class="sm:col-span-2">
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Langue des invites & annonces vocales (Asterisk)</label>
+                                        <select name="system_language" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:ring-2 focus:ring-indigo-500">
+                                            <option value="fr">Français (fr) - Voix officielle francophone June / Asterisk FR</option>
+                                            <option value="en">English (en) - Allison / Asterisk Core Sounds EN</option>
+                                        </select>
+                                        <p class="text-[11px] text-slate-400 mt-1">Définit la langue audio des invites Asterisk : messagerie vocale (*97 / *98), Ne-pas-déranger (*78/*79), horloge parlante (*60) et annonces système.</p>
+                                    </div>
+                                </div>
+
+                                <div class="pt-3 border-t border-anthracite-700">
+                                    <h4 class="text-xs font-semibold uppercase tracking-wider text-indigo-300 mb-3">Connexion Asterisk Manager Interface (AMI)</h4>
+                                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                                        <div>
+                                            <label class="block text-xs font-medium text-slate-200 mb-1">Hôte AMI</label>
+                                            <input type="text" name="ami_host" required
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                        </div>
+                                        <div>
+                                            <label class="block text-xs font-medium text-slate-200 mb-1">Port AMI</label>
+                                            <input type="number" name="ami_port" required
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                        </div>
+                                        <div>
+                                            <label class="block text-xs font-medium text-slate-200 mb-1">Utilisateur AMI</label>
+                                            <input type="text" name="ami_user" required
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                        </div>
+                                        <div>
+                                            <label class="block text-xs font-medium text-slate-200 mb-1">Secret AMI</label>
+                                            <input type="text" name="ami_secret" required
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="pt-3 border-t border-anthracite-700">
+                                    <label class="block text-xs font-medium text-slate-200 mb-1">Nouveau mot de passe Admin Web (optionnel)</label>
+                                    <input type="password" name="new_admin_password" placeholder="Laisser vide pour conserver le mot de passe actuel"
+                                        class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                </div>
+
+                                <div class="pt-2 flex justify-end">
+                                    <button type="submit"
+                                        class="px-5 py-2.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-sm font-semibold shadow-lg shadow-indigo-600/20 transition">
+                                        Enregistrer les paramètres
+                                    </button>
+                                </div>
+                            </form>
+                        </div>
+
+                        <!-- Diagnostic Système Debian -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg flex flex-col justify-between">
+                            <div>
+                                <div class="flex items-center justify-between mb-1">
+                                    <h3 class="text-base font-bold text-white">Diagnostic & Permissions Debian</h3>
+                                    <button type="button" onclick="loadState()" class="text-xs text-indigo-300 hover:text-indigo-200 font-semibold">
+                                        Actualiser
+                                    </button>
+                                </div>
+                                <p class="text-xs text-slate-300 mb-5">Vérification automatique de l'environnement Debian, des droits <code class="text-indigo-300">asterisk:asterisk</code> et du socket AMI.</p>
+
+                                <div id="diagnostics-list" class="space-y-3"></div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Prévisualisation en direct des fichiers natifs Asterisk -->
+                    <div class="grid grid-cols-1 xl:grid-cols-2 gap-6">
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                            <div class="px-4 py-3 bg-anthracite-950 border-b border-anthracite-700 flex items-center justify-between">
+                                <span class="text-xs font-mono font-semibold text-indigo-300">/etc/asterisk/pjsip.custom.conf</span>
+                                <span class="text-[11px] text-slate-400">Généré depuis SQLite</span>
+                            </div>
+                            <pre id="preview-pjsip" class="p-4 text-xs font-mono text-slate-200 overflow-x-auto max-h-96 leading-relaxed"></pre>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                            <div class="px-4 py-3 bg-anthracite-950 border-b border-anthracite-700 flex items-center justify-between">
+                                <span class="text-xs font-mono font-semibold text-emerald-300">/etc/asterisk/extensions.custom.conf</span>
+                                <span class="text-[11px] text-slate-400">Dialplan natif</span>
+                            </div>
+                            <pre id="preview-extensions" class="p-4 text-xs font-mono text-slate-200 overflow-x-auto max-h-96 leading-relaxed"></pre>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg xl:col-span-2">
+                            <div class="px-4 py-3 bg-anthracite-950 border-b border-anthracite-700 flex items-center justify-between">
+                                <span class="text-xs font-mono font-semibold text-amber-300">/etc/asterisk/voicemail.custom.conf</span>
+                                <span class="text-[11px] text-slate-400">Boîtes vocales Asterisk</span>
+                            </div>
+                            <pre id="preview-voicemail" class="p-4 text-xs font-mono text-slate-200 overflow-x-auto max-h-64 leading-relaxed"></pre>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET : SAUVEGARDES & RESTAURATION (DISASTER RECOVERY)   -->
+                <!-- ========================================================= -->
+                <section id="tab-backups" class="tab-panel hidden space-y-6">
+                    <!-- En-tête -->
+                    <div class="flex flex-col md:flex-row md:items-center justify-between gap-4 bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg">
+                        <div>
+                            <div class="flex items-center gap-3">
+                                <div class="w-10 h-10 rounded-xl bg-purple-500/20 border border-purple-400/30 flex items-center justify-center text-purple-300 shadow-inner">
+                                    <svg class="w-5 h-5 text-purple-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 7H5a2 2 0 00-2 2v9a2 2 0 002 2h14a2 2 0 002-2V9a2 2 0 00-2-2h-3m-1 4l-3 3m0 0l-3-3m3 3V4"/>
+                                    </svg>
+                                </div>
+                                <div>
+                                    <div class="flex items-center gap-2.5">
+                                        <h2 class="text-xl font-bold text-white tracking-tight">Sauvegardes & Restauration Système</h2>
+                                        <span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-purple-500/20 text-purple-300 border border-purple-500/30">Disaster Recovery</span>
+                                    </div>
+                                    <p class="text-xs text-slate-300 mt-0.5">Archive complète : Base de données SQLite, sons, messageries vocales, clés TLS et configurations Asterisk.</p>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="flex items-center gap-2.5 flex-wrap">
+                            <input type="file" id="backup-upload-input" accept=".tar.gz,.tgz" class="hidden" onchange="handleBackupUpload(this)">
+                            <button type="button" onclick="triggerBackupUpload()"
+                                class="inline-flex items-center gap-2 px-3.5 py-2.5 rounded-xl bg-anthracite-900 hover:bg-anthracite-750 border border-anthracite-600 text-xs font-semibold text-slate-200 hover:text-white transition shadow-sm">
+                                <svg class="w-4 h-4 text-purple-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"/>
+                                </svg>
+                                <span>Téléverser & Restaurer (.tar.gz)</span>
+                            </button>
+                            <button type="button" id="btn-create-backup-now" onclick="createBackupNow()"
+                                class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl bg-purple-600 hover:bg-purple-500 active:bg-purple-700 text-xs font-bold text-white transition shadow-lg shadow-purple-600/25">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
+                                </svg>
+                                <span id="btn-create-backup-label">Créer une Sauvegarde Immédiate</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Cartes de statut rapide -->
+                    <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-indigo-500/10 border border-indigo-500/20 flex items-center justify-center text-indigo-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Dernière Sauvegarde</div>
+                                <div id="backup-stat-last-run" class="text-sm font-bold text-white truncate">—</div>
+                            </div>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-emerald-500/10 border border-emerald-500/20 flex items-center justify-center text-emerald-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Destination Sauvegardes</div>
+                                <div id="backup-stat-storage" class="text-sm font-bold text-emerald-400 truncate">Stockage Local</div>
+                            </div>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-cyan-500/10 border border-cyan-500/20 flex items-center justify-center text-cyan-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 7v10c0 2 1 3 3 3h10c2 0 3-1 3-3V7M4 7c0-2 1-3 3-3h10c2 0 3 1 3 3M4 7h16"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Sauvegardes Disponibles</div>
+                                <div id="backup-stat-count" class="text-sm font-bold text-white truncate">0 archive(s)</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Tableau des sauvegardes & Formulaire de planification -->
+                    <div class="grid grid-cols-1 xl:grid-cols-3 gap-6">
+                        <!-- Liste des sauvegardes disponibles (2 colonnes sur grand écran) -->
+                        <div class="xl:col-span-2 bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-4">
+                            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                <div>
+                                    <h3 class="text-base font-bold text-white">Archives de Sauvegarde Disponibles</h3>
+                                    <p class="text-xs text-slate-300">Sauvegardes prêtes pour téléchargement ou restauration complète en 1 clic.</p>
+                                </div>
+                                <button type="button" onclick="loadBackups()" class="p-2 rounded-lg bg-anthracite-950 border border-anthracite-700 hover:text-white text-slate-300 transition" title="Actualiser la liste">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/>
+                                    </svg>
+                                </button>
+                            </div>
+
+                            <!-- Tableau -->
+                            <div class="overflow-x-auto">
+                                <table class="w-full text-left text-xs">
+                                    <thead class="uppercase bg-anthracite-950 text-slate-400 font-semibold border-b border-anthracite-700">
+                                        <tr>
+                                            <th class="px-4 py-3">Archive & Version</th>
+                                            <th class="px-4 py-3">Date</th>
+                                            <th class="px-4 py-3">Taille</th>
+                                            <th class="px-4 py-3">Emplacement</th>
+                                            <th class="px-4 py-3 text-right">Actions</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody id="backups-table-body" class="divide-y divide-anthracite-700/70 text-slate-200">
+                                        <tr>
+                                            <td colspan="5" class="px-4 py-8 text-center text-slate-400">Chargement des sauvegardes...</td>
+                                        </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                        </div>
+
+                        <!-- Paramètres Sauvegardes Automatiques & Distante SSH -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-5">
+                            <div>
+                                <h3 class="text-base font-bold text-white mb-1">Configuration & Automatisation</h3>
+                                <p class="text-xs text-slate-300">Planification des sauvegardes et synchronisation distante SSH.</p>
+                            </div>
+
+                            <form id="backup-settings-form" class="space-y-4">
+                                <!-- Activer sauvegarde auto -->
+                                <div class="flex items-center justify-between p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                    <div>
+                                        <div class="text-xs font-bold text-white">Sauvegarde Automatique</div>
+                                        <div class="text-[11px] text-slate-400">Exécution programmée périodique</div>
+                                    </div>
+                                    <label class="relative inline-flex items-center cursor-pointer">
+                                        <input type="checkbox" name="backup_auto_enabled" id="backup_auto_enabled" value="1" class="sr-only peer">
+                                        <div class="w-11 h-6 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-purple-600"></div>
+                                    </label>
+                                </div>
+
+                                <div class="grid grid-cols-2 gap-3">
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Fréquence</label>
+                                        <select name="backup_frequency" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white">
+                                            <option value="hourly">Toutes les heures</option>
+                                            <option value="6h">Toutes les 6 heures</option>
+                                            <option value="12h">Toutes les 12 heures</option>
+                                            <option value="daily" selected>Tous les jours (Quotidien)</option>
+                                            <option value="weekly">Toutes les semaines</option>
+                                        </select>
+                                    </div>
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Rétention (Max)</label>
+                                        <select name="backup_retention" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white">
+                                            <option value="3">3 sauvegardes</option>
+                                            <option value="7" selected>7 sauvegardes</option>
+                                            <option value="14">14 sauvegardes</option>
+                                            <option value="30">30 sauvegardes</option>
+                                        </select>
+                                    </div>
+                                </div>
+
+                                <!-- Emplacement : Local vs Distant SSH -->
+                                <div>
+                                    <label class="block text-xs font-medium text-slate-200 mb-1.5">Type de Stockage</label>
+                                    <div class="grid grid-cols-2 gap-2">
+                                        <label class="flex items-center gap-2 p-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 cursor-pointer hover:border-purple-500/50 transition">
+                                            <input type="radio" name="backup_storage_type" value="local" checked onchange="toggleSshBackupFields(false)" class="text-purple-600 focus:ring-purple-500">
+                                            <span class="text-xs font-medium text-slate-200">Local (Système)</span>
+                                        </label>
+                                        <label class="flex items-center gap-2 p-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 cursor-pointer hover:border-purple-500/50 transition">
+                                            <input type="radio" name="backup_storage_type" value="ssh" onchange="toggleSshBackupFields(true)" class="text-purple-600 focus:ring-purple-500">
+                                            <span class="text-xs font-medium text-slate-200">Distant (SSH / SFTP)</span>
+                                        </label>
+                                    </div>
+                                    <p class="text-[10px] text-slate-400 mt-1">Le stockage distant SSH désactive la conservation locale et transfère les archives vers votre serveur externe.</p>
+                                </div>
+
+                                <!-- Champs de configuration SSH Distant -->
+                                <div id="backup-ssh-fields" class="hidden p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                                    <div class="flex items-center justify-between pb-1 border-b border-anthracite-700/60">
+                                        <span class="text-xs font-bold uppercase tracking-wider text-purple-300">Paramètres SSH Distant</span>
+                                        <button type="button" onclick="testSshBackupConnection()" class="px-2.5 py-1 rounded text-[11px] font-semibold bg-purple-600/20 hover:bg-purple-600/30 text-purple-300 border border-purple-500/30 transition">
+                                            Tester la Connexion
+                                        </button>
+                                    </div>
+                                    <div class="grid grid-cols-3 gap-2">
+                                        <div class="col-span-2">
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Hôte / IP Distante</label>
+                                            <input type="text" name="backup_ssh_host" placeholder="ex: 192.168.1.50 ou backup.serveur.fr"
+                                                class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                        </div>
+                                        <div>
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Port</label>
+                                            <input type="number" name="backup_ssh_port" value="22"
+                                                class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                        </div>
+                                    </div>
+                                    <div class="grid grid-cols-2 gap-2">
+                                        <div>
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Utilisateur SSH</label>
+                                            <input type="text" name="backup_ssh_user" placeholder="root ou backupuser"
+                                                class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                        </div>
+                                        <div>
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Mot de Passe SSH</label>
+                                            <input type="password" name="backup_ssh_password" placeholder="••••••••"
+                                                class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                                        </div>
+                                    </div>
+                                    <div>
+                                        <label class="block text-[11px] font-medium text-slate-300 mb-1">Dossier Distant sur le Serveur</label>
+                                        <input type="text" name="backup_ssh_remote_path" value="/backups/nexus"
+                                            class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                                    </div>
+                                </div>
+
+                                <button type="submit"
+                                    class="w-full py-2.5 px-4 rounded-xl bg-purple-600 hover:bg-purple-500 active:bg-purple-700 text-xs font-bold text-white transition shadow-lg shadow-purple-600/20">
+                                    Enregistrer la Configuration
+                                </button>
+                            </form>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET : PARE-FEU & SÉCURITÉ (FAIL2BAN & NFTABLES)        -->
+                <!-- ========================================================= -->
+                <section id="tab-firewall" class="tab-panel hidden space-y-6">
+                    <!-- En-tête -->
+                    <div class="flex flex-col md:flex-row md:items-center justify-between gap-4 bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg">
+                        <div>
+                            <div class="flex items-center gap-3">
+                                <div class="w-10 h-10 rounded-xl bg-emerald-500/20 border border-emerald-400/30 flex items-center justify-center text-emerald-300 shadow-inner">
+                                    <svg class="w-5 h-5 text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                                    </svg>
+                                </div>
+                                <div>
+                                    <div class="flex items-center gap-2.5">
+                                        <h2 class="text-xl font-bold text-white tracking-tight">Pare-feu & Sécurité Réseau</h2>
+                                        <span class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">NFTables & Fail2ban</span>
+                                    </div>
+                                    <p class="text-xs text-slate-300 mt-0.5">Surveillance active des flux SIP/PJSIP, de la console SSH et protection anti-brute force de l'interface d'administration.</p>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="flex items-center gap-2.5 flex-wrap">
+                            <button type="button" onclick="loadFirewallStatus()"
+                                class="inline-flex items-center gap-2 px-3.5 py-2.5 rounded-xl bg-anthracite-900 hover:bg-anthracite-750 border border-anthracite-600 text-xs font-semibold text-slate-200 hover:text-white transition shadow-sm">
+                                <svg class="w-4 h-4 text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/>
+                                </svg>
+                                <span>Actualiser le Statut</span>
+                            </button>
+                            <button type="button" onclick="whitelistMyIp()"
+                                class="inline-flex items-center gap-2 px-4 py-2.5 rounded-xl bg-emerald-600 hover:bg-emerald-500 active:bg-emerald-700 text-xs font-bold text-white transition shadow-lg shadow-emerald-600/25">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
+                                </svg>
+                                <span>Ajouter mon IP à la Liste Blanche</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Cartes de statut rapide -->
+                    <div class="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-4 gap-4">
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-emerald-500/10 border border-emerald-500/20 flex items-center justify-center text-emerald-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Moteur Fail2ban</div>
+                                <div id="fw-stat-engine" class="text-sm font-bold text-emerald-400 truncate">En ligne (Actif)</div>
+                            </div>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-indigo-500/10 border border-indigo-500/20 flex items-center justify-center text-indigo-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 5a2 2 0 012-2h3.28a1 1 0 01.948.684l1.498 4.493a1 1 0 01-.502 1.21l-2.257 1.13a11.042 11.042 0 005.516 5.516l1.13-2.257a1 1 0 011.21-.502l4.493 1.498a1 1 0 01.684.949V19a2 2 0 01-2 2h-1C9.716 21 3 14.284 3 6V5z"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Jail Asterisk SIP</div>
+                                <div id="fw-stat-sip-jail" class="text-sm font-bold text-white truncate">Surveillance PJSIP</div>
+                            </div>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-purple-500/10 border border-purple-500/20 flex items-center justify-center text-purple-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Jail Web Admin & SSH</div>
+                                <div id="fw-stat-web-jail" class="text-sm font-bold text-white truncate">Protégé (Max 3 essais)</div>
+                            </div>
+                        </div>
+
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-4 flex items-center gap-3.5">
+                            <div class="w-10 h-10 rounded-xl bg-rose-500/10 border border-rose-500/20 flex items-center justify-center text-rose-400 shrink-0">
+                                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636"/>
+                                </svg>
+                            </div>
+                            <div class="min-w-0">
+                                <div class="text-[11px] font-semibold uppercase tracking-wider text-slate-400">Adresses IP Bannies</div>
+                                <div id="fw-stat-banned-count" class="text-sm font-bold text-emerald-400 truncate">0 bannie(s)</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Grille principale : IPs Bannies & Paramétrage -->
+                    <div class="grid grid-cols-1 xl:grid-cols-3 gap-6">
+                        <!-- Colonne Gauche : Liste des IPs Bannies (2 colonnes) -->
+                        <div class="xl:col-span-2 space-y-6">
+                            <!-- Tableau des IPs bannies -->
+                            <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-4">
+                                <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                    <div>
+                                        <h3 class="text-base font-bold text-white">Adresses IP Actuellement Bannies</h3>
+                                        <p class="text-xs text-slate-300">Trafic immédiatement bloqué au niveau du pare-feu NFTables.</p>
+                                    </div>
+                                    <button type="button" onclick="loadFirewallStatus()" class="p-2 rounded-lg bg-anthracite-950 border border-anthracite-700 hover:text-white text-slate-300 transition" title="Rafraîchir">
+                                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/>
+                                        </svg>
+                                    </button>
+                                </div>
+
+                                <div class="overflow-x-auto">
+                                    <table class="w-full text-left text-xs">
+                                        <thead class="uppercase bg-anthracite-950 text-slate-400 font-semibold border-b border-anthracite-700">
+                                            <tr>
+                                                <th class="px-4 py-3">Adresse IP</th>
+                                                <th class="px-4 py-3">Règle / Service Attaqué</th>
+                                                <th class="px-4 py-3">Statut Pare-feu</th>
+                                                <th class="px-4 py-3 text-right">Action</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="firewall-banned-table-body" class="divide-y divide-anthracite-700/70 text-slate-200">
+                                            <tr>
+                                                <td colspan="4" class="px-4 py-8 text-center text-slate-400">Chargement des données de sécurité...</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+
+                            <!-- Bloc Bannissement Manuel Rapide -->
+                            <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg">
+                                <h4 class="text-xs font-bold uppercase tracking-wider text-rose-300 mb-2">Bannissement Manuel d'une IP Suspecte</h4>
+                                <form id="form-manual-ban" class="flex flex-col sm:flex-row items-center gap-3">
+                                    <input type="text" id="manual-ban-ip" placeholder="ex: 198.51.100.25" required
+                                        class="flex-1 w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono">
+                                    <select id="manual-ban-jail" class="w-full sm:w-48 px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white">
+                                        <option value="asterisk">Téléphonie SIP</option>
+                                        <option value="nexus-web">Interface Web Admin</option>
+                                        <option value="sshd">Console SSH</option>
+                                    </select>
+                                    <button type="submit"
+                                        class="w-full sm:w-auto px-4 py-2 rounded-lg bg-rose-600 hover:bg-rose-500 text-xs font-bold text-white transition whitespace-nowrap shadow-sm">
+                                        Bloquer cette IP
+                                    </button>
+                                </form>
+                            </div>
+                        </div>
+
+                        <!-- Colonne Droite : Formulaire Configuration Pare-feu & Ports -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-5">
+                            <div>
+                                <h3 class="text-base font-bold text-white mb-1">Configuration Sécurité & Ports</h3>
+                                <p class="text-xs text-slate-300">Séparation du port Let's Encrypt et personnalisation du port d'administration.</p>
+                            </div>
+
+                            <form id="firewall-settings-form" class="space-y-4">
+                                <!-- Ports d'accès Web & Isolation Certbot -->
+                                <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-indigo-300">Ports Web & Isolation Certbot</span>
+                                    
+                                    <div>
+                                        <label class="block text-xs font-medium text-slate-200 mb-1">Port HTTPS Administration NexusPBX</label>
+                                        <div class="flex items-center gap-2">
+                                            <input type="number" name="admin_https_port" id="admin_https_port" value="8443" min="1" max="65535" required
+                                                class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                                            <span class="text-xs text-slate-400 whitespace-nowrap">(Défaut : 8443)</span>
+                                        </div>
+                                        <p class="text-[10px] text-slate-400 mt-1">L'accès Web sécurisé écoute sur ce port (ex: https://ip-du-pbx:8443).</p>
+                                    </div>
+
+                                    <!-- Mode Strict Port 80 (Certbot uniquement) -->
+                                    <div class="pt-2 border-t border-anthracite-700/60 flex items-start justify-between gap-3">
+                                        <div>
+                                            <div class="text-xs font-bold text-white">Mode Strict Certbot (Port 80)</div>
+                                            <p class="text-[11px] text-slate-400 leading-tight">Le port 80 sert UNIQUEMENT aux validations Let's Encrypt (`/.well-known/acme-challenge/`). Tout le reste renvoie 404.</p>
+                                        </div>
+                                        <label class="relative inline-flex items-center cursor-pointer shrink-0 mt-0.5">
+                                            <input type="checkbox" name="certbot_strict_port80" id="certbot_strict_port80" value="1" class="sr-only peer">
+                                            <div class="w-11 h-6 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-emerald-600"></div>
+                                        </label>
+                                    </div>
+
+                                    <!-- Activation Globale Pare-feu & Filtrage -->
+                                    <div class="pt-2 border-t border-anthracite-700/60 flex items-start justify-between gap-3">
+                                        <div>
+                                            <div class="text-xs font-bold text-white">Activer le Pare-feu & Filtrage Réseau</div>
+                                            <p class="text-[11px] text-slate-400 leading-tight">Active l'isolation des ports, l'inspection des flux et la protection active NexusPBX.</p>
+                                        </div>
+                                        <label class="relative inline-flex items-center cursor-pointer shrink-0 mt-0.5">
+                                            <input type="checkbox" name="firewall_enabled" id="firewall_enabled" value="1" class="sr-only peer">
+                                            <div class="w-11 h-6 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-emerald-600"></div>
+                                        </label>
+                                    </div>
+                                </div>
+
+                                <!-- Paramètres Fail2ban SIP -->
+                                <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                                    <span class="text-xs font-bold uppercase tracking-wider text-cyan-300">Protection SIP & Téléphonie (PJSIP)</span>
+                                    
+                                    <div class="grid grid-cols-2 gap-2.5">
+                                        <div>
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Max échecs SIP</label>
+                                            <select name="fail2ban_sip_maxretry" class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                                <option value="2">2 tentatives</option>
+                                                <option value="3" selected>3 tentatives</option>
+                                                <option value="5">5 tentatives</option>
+                                            </select>
+                                        </div>
+                                        <div>
+                                            <label class="block text-[11px] font-medium text-slate-300 mb-1">Durée du ban</label>
+                                            <select name="fail2ban_sip_bantime" class="w-full px-2.5 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                                <option value="3600" selected>1 heure</option>
+                                                <option value="43200">12 heures</option>
+                                                <option value="86400">24 heures</option>
+                                                <option value="604800">7 jours</option>
+                                            </select>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <!-- Liste Blanche Permanente (IgnoreIP) -->
+                                <div>
+                                    <div class="flex items-center justify-between mb-1">
+                                        <label class="block text-xs font-medium text-slate-200">Liste Blanche Permanente (IgnoreIP)</label>
+                                        <button type="button" onclick="whitelistMyIp()" class="text-[10px] text-emerald-400 hover:text-emerald-300 font-semibold underline">
+                                            + Mon IP
+                                        </button>
+                                    </div>
+                                    <textarea name="fail2ban_whitelist_ips" id="fail2ban_whitelist_ips" rows="3"
+                                        placeholder="127.0.0.1/8 10.0.0.0/8 192.168.0.0/16 82.122.84.60"
+                                        class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono leading-relaxed"></textarea>
+                                    <p class="text-[10px] text-slate-400 mt-1">Séparez les adresses ou sous-réseaux CIDR par un espace. Ces adresses ne seront jamais bannies par le pare-feu.</p>
+                                </div>
+
+                                <button type="submit" id="btn-save-firewall-settings"
+                                    class="w-full py-2.5 px-4 rounded-xl bg-emerald-600 hover:bg-emerald-500 active:bg-emerald-700 text-xs font-bold text-white transition shadow-lg shadow-emerald-600/20">
+                                    Enregistrer & Appliquer les Règles
+                                </button>
+                            </form>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 5 : CODES DE FONCTIONS & SERVICES TÉLÉPHONIQUES    -->
+                <!-- ========================================================= -->
+                <section id="tab-featurecodes" class="tab-panel hidden space-y-6">
+                    <!-- En-tête -->
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+                        <div>
+                            <div class="flex items-center gap-2.5">
+                                <div class="w-8 h-8 rounded-xl bg-indigo-500/20 text-indigo-400 flex items-center justify-center font-bold">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 20l4-16m2 16l4-16M6 9h14M4 15h14"/>
+                                    </svg>
+                                </div>
+                                <h2 class="text-lg font-bold text-white">Codes de Fonctions & Services Téléphoniques</h2>
+                            </div>
+                            <p class="text-xs text-slate-300 mt-1">Codes verticaux Asterisk pour piloter vos renvois d'appels, le mode Ne-pas-Déranger, les boîtes vocales, la liste noire et l'interception d'appels.</p>
+                        </div>
+                        <div class="flex items-center gap-2">
+                            <button type="button" onclick="resetFeatureCodes()"
+                                class="px-3.5 py-2 rounded-xl bg-anthracite-800 hover:bg-anthracite-700 border border-anthracite-700 text-slate-300 hover:text-white font-semibold text-xs flex items-center gap-1.5 transition">
+                                <span>↺ Réinitialiser valeurs FreePBX</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Guide d'interception & Touches BLF Yealink -->
+                    <div class="bg-gradient-to-r from-indigo-950/60 to-anthracite-800 border border-indigo-500/30 rounded-2xl p-5 shadow-lg space-y-3">
+                        <div class="flex items-center justify-between">
+                            <div class="flex items-center gap-2.5">
+                                <span class="flex h-3 w-3 relative">
+                                    <span class="animate-ping absolute inline-flex h-full w-full rounded-full bg-emerald-400 opacity-75"></span>
+                                    <span class="relative inline-flex rounded-full h-3 w-3 bg-emerald-500"></span>
+                                </span>
+                                <h3 class="text-sm font-bold text-white">Touches de Ligne BLF & Interception d'Appel sur Postes Yealink</h3>
+                            </div>
+                            <span class="px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-indigo-500/20 text-indigo-300 border border-indigo-500/40">FreePBX Compatible</span>
+                        </div>
+                        <p class="text-xs text-slate-300 leading-relaxed">
+                            NexusPBX génère automatiquement les <strong>hints</strong> Asterisk pour surveiller l'état en direct de vos téléphones (<span class="text-emerald-400 font-semibold">Vert</span> = libre, <span class="text-rose-400 font-semibold animate-pulse">Rouge clignotant</span> = sonnerie en cours, <span class="text-rose-500 font-semibold">Rouge fixe</span> = en communication).
+                        </p>
+                        <div class="p-3 bg-anthracite-950/80 rounded-xl border border-anthracite-700/80 text-xs space-y-2">
+                            <div class="font-semibold text-slate-200">Pour configurer une touche de surveillance et récupération d'appel sur votre Yealink (Dsskey / Line Key) :</div>
+                            <div class="grid grid-cols-2 sm:grid-cols-5 gap-2 text-[11px] font-mono pt-1">
+                                <div class="bg-anthracite-900 p-2 rounded-lg border border-anthracite-700"><span class="text-slate-400 block text-[10px] uppercase font-sans">Type</span><strong class="text-white">BLF</strong></div>
+                                <div class="bg-anthracite-900 p-2 rounded-lg border border-anthracite-700"><span class="text-slate-400 block text-[10px] uppercase font-sans">Valeur (Value)</span><strong class="text-cyan-400">101</strong> (ou n° poste)</div>
+                                <div class="bg-anthracite-900 p-2 rounded-lg border border-anthracite-700"><span class="text-slate-400 block text-[10px] uppercase font-sans">Étiquette (Label)</span><strong class="text-white">Maurice</strong></div>
+                                <div class="bg-anthracite-900 p-2 rounded-lg border border-anthracite-700"><span class="text-slate-400 block text-[10px] uppercase font-sans">Ligne (Line)</span><strong class="text-white">Line 1</strong></div>
+                                <div class="bg-anthracite-900 p-2 rounded-lg border border-indigo-500/40 bg-indigo-950/30"><span class="text-indigo-300 block text-[10px] uppercase font-sans">Extension (Pickup)</span><strong class="text-indigo-300 font-bold">**</strong></div>
+                            </div>
+                            <div class="text-[11px] text-slate-400 pt-1">
+                                💡 Quand le poste surveillé sonne, sa touche clignote : un simple appui dessus intercepte l'appel immédiatement via le préfixe <code class="text-indigo-300">**</code> !
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Filtres par catégorie -->
+                    <div class="flex items-center gap-2 overflow-x-auto pb-1" id="feature-codes-filters">
+                        <button type="button" onclick="filterFeatureCodes('all')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-indigo-600 text-white transition" data-category="all">Tous (<span id="fc-count-all">0</span>)</button>
+                        <button type="button" onclick="filterFeatureCodes('forward')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="forward">Renvois d'appels</button>
+                        <button type="button" onclick="filterFeatureCodes('pickup')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="pickup">Supervision & BLF</button>
+                        <button type="button" onclick="filterFeatureCodes('dnd')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="dnd">Ne-pas-Déranger</button>
+                        <button type="button" onclick="filterFeatureCodes('voicemail')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="voicemail">Messagerie Vocale</button>
+                        <button type="button" onclick="filterFeatureCodes('security')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="security">Sécurité & Blacklist</button>
+                        <button type="button" onclick="filterFeatureCodes('tools')" class="fc-filter-btn px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-800 text-slate-300 hover:text-white transition" data-category="tools">Outils & Tests</button>
+                    </div>
+
+                    <!-- Tableau des codes de fonction -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left text-xs text-slate-300">
+                                <thead class="bg-anthracite-950 text-slate-400 uppercase text-[10px] tracking-wider border-b border-anthracite-700">
+                                    <tr>
+                                        <th class="py-3 px-4 font-semibold">Code / Raccourci</th>
+                                        <th class="py-3 px-4 font-semibold">Fonction & Service</th>
+                                        <th class="py-3 px-4 font-semibold hidden sm:table-cell">Description & Modalités</th>
+                                        <th class="py-3 px-4 font-semibold">Catégorie</th>
+                                        <th class="py-3 px-4 font-semibold text-center">État</th>
+                                        <th class="py-3 px-4 font-semibold text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="feature-codes-table-body" class="divide-y divide-anthracite-700/60">
+                                    <!-- Rempli dynamiquement par renderFeatureCodes() -->
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 5B : PARAMÈTRES SIP GLOBAUX & TRAVERSÉE NAT        -->
+                <!-- ========================================================= -->
+                <section id="tab-sipsettings" class="tab-panel hidden space-y-6">
+                    <!-- En-tête -->
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+                        <div>
+                            <div class="flex items-center gap-2.5">
+                                <div class="w-8 h-8 rounded-xl bg-cyan-500/20 text-cyan-400 flex items-center justify-center font-bold">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/>
+                                    </svg>
+                                </div>
+                                <h2 class="text-lg font-bold text-white">Paramètres SIP Globaux & Traversée NAT</h2>
+                            </div>
+                            <p class="text-xs text-slate-300 mt-1">Configurez l'adresse externe (IP ou DNS dynamique FQDN), la redirection des ports NAT et la plage de ports audio RTP pour garantir une voix bidirectionnelle parfaite sans coupure.</p>
+                        </div>
+                    </div>
+
+                    <form id="form-sip-settings" class="space-y-6">
+                        <!-- 1. Configuration NAT & Hôte Public -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-4">
+                            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                <div class="flex items-center gap-2">
+                                    <span class="w-2.5 h-2.5 rounded-full bg-cyan-400"></span>
+                                    <h3 class="text-sm font-bold text-white">Traversée NAT & Détection d'Adresse Publique (WAN)</h3>
+                                </div>
+                                <span class="px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-cyan-500/20 text-cyan-300 border border-cyan-500/30">PJSIP Transports</span>
+                            </div>
+
+                            <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
+                                <!-- Adresse Externe / FQDN -->
+                                <div class="space-y-2">
+                                    <div class="flex items-center justify-between">
+                                        <label class="block text-xs font-semibold text-slate-200">Adresse Publique ou Nom de Domaine (FQDN / DDNS) *</label>
+                                        <button type="button" onclick="detectPublicIp()" id="btn-detect-ip"
+                                            class="text-[11px] text-cyan-400 hover:text-cyan-300 flex items-center gap-1 font-semibold transition">
+                                            <span id="spinner-detect-ip" class="hidden animate-spin">↻</span>
+                                            <span>🔍 Détecter l'IP publique</span>
+                                        </button>
+                                    </div>
+                                    <input type="text" id="sip-external-ip" name="external_ip" placeholder="ex: sip.sorcier-research.com ou 82.122.84.60"
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-cyan-500 focus:outline-none">
+                                    <p class="text-[11px] text-slate-400 leading-relaxed">
+                                        Si votre IP est dynamique, renseignez un <strong>nom de domaine FQDN / DynDNS</strong> (ex: <code>sip.mondomaine.fr</code>) pour ne jamais perdre vos téléphones distants lors d'un renouvellement de bail IP par votre opérateur.
+                                    </p>
+                                </div>
+
+                                <!-- Réseaux Locaux (Local Networks) -->
+                                <div class="space-y-2">
+                                    <div class="flex items-center justify-between">
+                                        <label class="block text-xs font-semibold text-slate-200">Réseaux Locaux (Local Networks - CIDR) *</label>
+                                        <button type="button" onclick="addLocalNetworkField()"
+                                            class="text-[11px] text-emerald-400 hover:text-emerald-300 font-semibold flex items-center gap-1 transition">
+                                            <span>➕ Ajouter un réseau local</span>
+                                        </button>
+                                    </div>
+                                    <div id="local-networks-container" class="space-y-2 max-h-48 overflow-y-auto pr-1"></div>
+                                    <p class="text-[11px] text-slate-400 leading-relaxed">
+                                        Sous-réseaux privés LAN. Quand un téléphone appelle depuis l'un de ces réseaux, Asterisk transmet son IP locale privée sans appliquer la translation NAT (évite le hairpinning).
+                                    </p>
+                                </div>
+                            </div>
+                        </div>
+
+                        <!-- 2. Ports d'Écoute Internes vs Ports Externes NAT -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-4">
+                            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                <div class="flex items-center gap-2">
+                                    <span class="w-2.5 h-2.5 rounded-full bg-indigo-400"></span>
+                                    <h3 class="text-sm font-bold text-white">Ports d'Écoute Internes & Redirection de Ports (Port Forwarding Box / Routeur)</h3>
+                                </div>
+                                <span class="px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">Signaling Ports</span>
+                            </div>
+
+                            <p class="text-xs text-slate-300 leading-relaxed">
+                                Si vous effectuez une translation de port sur votre routeur (ex: port public <code>7788</code> redirigé vers le <code>5060</code> interne de votre PBX), renseignez le port externe. Asterisk annoncera automatiquement ce port externe dans ses paquets SIP.
+                            </p>
+
+                            <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                                <!-- Transport UDP -->
+                                <div class="p-4 rounded-xl bg-anthracite-950/80 border border-anthracite-700/80 space-y-3">
+                                    <div class="flex items-center justify-between">
+                                        <span class="text-xs font-bold text-slate-200">Transport UDP (Standard)</span>
+                                        <span class="text-[10px] font-mono text-slate-400">[transport-udp]</span>
+                                    </div>
+                                    <div class="grid grid-cols-2 gap-3">
+                                        <div>
+                                            <label class="block text-[11px] text-slate-400 mb-1">Port d'écoute interne</label>
+                                            <input type="number" id="sip-udp-port" name="udp_port" value="5060" min="1024" max="65535" required
+                                                class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-indigo-500 focus:outline-none">
+                                        </div>
+                                        <div>
+                                            <label class="block text-[11px] text-slate-400 mb-1">Port externe NAT (WAN)</label>
+                                            <input type="number" id="sip-external-udp-port" name="external_udp_port" placeholder="ex: 7788" min="0" max="65535"
+                                                class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-indigo-500 focus:outline-none">
+                                        </div>
+                                    </div>
+                                    <div class="text-[10px] text-slate-500">Laissez le port externe vide ou à 0 s'il est identique au port interne.</div>
+                                </div>
+
+                                <!-- Transport TLS -->
+                                <div class="p-4 rounded-xl bg-anthracite-950/80 border border-anthracite-700/80 space-y-3">
+                                    <div class="flex items-center justify-between">
+                                        <span class="text-xs font-bold text-slate-200">Transport TLS (Sécurisé)</span>
+                                        <span class="text-[10px] font-mono text-slate-400">[transport-tls]</span>
+                                    </div>
+                                    <div class="grid grid-cols-2 gap-3">
+                                        <div>
+                                            <label class="block text-[11px] text-slate-400 mb-1">Port d'écoute interne</label>
+                                            <input type="number" id="sip-tls-port" name="tls_port" value="5061" min="1024" max="65535" required
+                                                class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                        </div>
+                                        <div>
+                                            <label class="block text-[11px] text-slate-400 mb-1">Port externe NAT (WAN)</label>
+                                            <input type="number" id="sip-external-tls-port" name="external_tls_port" placeholder="ex: 7789" min="0" max="65535"
+                                                class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                        </div>
+                                    </div>
+                                    <div class="text-[10px] text-slate-500">Laissez le port externe vide ou à 0 s'il est identique au port interne.</div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <!-- 3. Flux Média Audio (RTP Settings) -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-4">
+                            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                <div class="flex items-center gap-2">
+                                    <span class="w-2.5 h-2.5 rounded-full bg-emerald-400"></span>
+                                    <h3 class="text-sm font-bold text-white">Plage de Ports Audio RTP & Protection de Flux</h3>
+                                </div>
+                                <span class="px-2.5 py-0.5 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">/etc/asterisk/rtp.conf</span>
+                            </div>
+
+                            <div class="grid grid-cols-1 md:grid-cols-4 gap-4">
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">Port RTP Début (Start) *</label>
+                                    <input type="number" id="sip-rtp-start" name="rtp_start" value="10000" min="1024" max="65530" required
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                </div>
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">Port RTP Fin (End) *</label>
+                                    <input type="number" id="sip-rtp-end" name="rtp_end" value="20000" min="1028" max="65535" required
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                </div>
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">Strict RTP *</label>
+                                    <select id="sip-rtp-strict" name="rtp_strict"
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                        <option value="1">Oui (Recommandé - Anti-spoofing)</option>
+                                        <option value="0">Non</option>
+                                    </select>
+                                </div>
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">RTP Checksums *</label>
+                                    <select id="sip-rtp-checksums" name="rtp_checksums"
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                        <option value="1">Oui (Validation intégrité)</option>
+                                        <option value="0">Non</option>
+                                    </select>
+                                </div>
+                            </div>
+
+                            <div class="grid grid-cols-1 md:grid-cols-2 gap-4 pt-2">
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">RTP Keepalive (secondes)</label>
+                                    <input type="number" id="sip-rtp-keepalive" name="rtp_keepalive" value="15" min="0" max="120"
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                    <p class="text-[11px] text-slate-400 mt-1">Envoie des paquets silencieux réguliers pour maintenir le port NAT ouvert sur les routeurs stricts.</p>
+                                </div>
+                                <div>
+                                    <label class="block text-xs font-semibold text-slate-200 mb-1">RTP Timeout (secondes)</label>
+                                    <input type="number" id="sip-rtp-timeout" name="rtp_timeout" value="30" min="5" max="300"
+                                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                                    <p class="text-[11px] text-slate-400 mt-1">Durée avant coupure si aucun flux voix n'est reçu (raccroché distant brutal).</p>
+                                </div>
+                            </div>
+                        </div>
+
+                        <!-- 4. Sécurité & Appels Anonymes -->
+                        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-6 shadow-lg space-y-3">
+                            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                                <div class="flex items-center gap-2">
+                                    <span class="w-2.5 h-2.5 rounded-full bg-rose-400"></span>
+                                    <h3 class="text-sm font-bold text-white">Sécurité SIP & Filtrage des Requêtes Anonymes</h3>
+                                </div>
+                            </div>
+                            <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+                                <div class="space-y-1">
+                                    <div class="text-xs font-semibold text-slate-200">Permettre les appels SIP anonymes / non authentifiés (Guest SIP)</div>
+                                    <p class="text-[11px] text-slate-400">
+                                        Recommandé : <strong>Non</strong>. Empêche les robots et scanners automatisés d'Internet de faire sonner vos téléphones ou d'utiliser vos lignes sortantes.
+                                    </p>
+                                </div>
+                                <select id="sip-allow-anonymous" name="allow_anonymous_sip"
+                                    class="px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white focus:ring-2 focus:ring-rose-500 focus:outline-none shrink-0">
+                                    <option value="0">Non (Sécurisé - Bloquer les anonymes)</option>
+                                    <option value="1">Oui (Tolérer les flux SIP invités)</option>
+                                </select>
+                            </div>
+                        </div>
+
+                        <div class="flex justify-end pt-2">
+                            <button type="submit" id="btn-save-sip-settings"
+                                class="px-6 py-2.5 rounded-xl bg-cyan-600 hover:bg-cyan-500 text-white font-semibold text-xs flex items-center gap-2 shadow-lg shadow-cyan-600/20 transition">
+                                <span id="spinner-save-sip-settings" class="hidden animate-spin">↻</span>
+                                <span>Enregistrer & Appliquer les Paramètres SIP & NAT</span>
+                            </button>
+                        </div>
+                    </form>
+                </section>
+
+                <!-- ========================================================= -->
+                <!-- ONGLET 6 : CERTIFICATS SSL / TLS (SIGNALISATION & RTP)    -->
+                <!-- ========================================================= -->
+                <section id="tab-certificates" class="tab-panel hidden space-y-6">
+                    <!-- En-tête avec Actions -->
+                    <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+                        <div>
+                            <div class="flex items-center gap-2.5">
+                                <div class="w-8 h-8 rounded-xl bg-emerald-500/20 text-emerald-400 flex items-center justify-center font-bold">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                                    </svg>
+                                </div>
+                                <h2 class="text-lg font-bold text-white">Gestionnaire de Certificats SSL / TLS & Chiffrement</h2>
+                            </div>
+                            <p class="text-xs text-slate-300 mt-1">Générez des certificats Let's Encrypt automatisés ou importez vos certificats d'entreprise (DigiCert, Sectigo, OVH). Le certificat actif sécurise la signalisation SIP TLS (5061) et les communications audio chiffrées (SRTP / DTLS).</p>
+                        </div>
+                        <div class="flex items-center gap-2.5 flex-wrap">
+                            <button type="button" onclick="openLetsEncryptModal()"
+                                class="px-3.5 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-500 text-white font-semibold text-xs flex items-center gap-2 shadow-lg shadow-emerald-600/20 transition">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/>
+                                </svg>
+                                <span>+ Générer via Let's Encrypt</span>
+                            </button>
+                            <button type="button" onclick="openCustomCertModal()"
+                                class="px-3.5 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-600 text-slate-200 border border-anthracite-600 font-semibold text-xs flex items-center gap-2 transition">
+                                <svg class="w-4 h-4 text-cyan-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"/>
+                                </svg>
+                                <span>+ Importer un Certificat (Custom / DigiCert)</span>
+                            </button>
+                        </div>
+                    </div>
+
+                    <!-- Carte Résumé : Certificat Actif en Production -->
+                    <div id="active-cert-banner" class="rounded-2xl p-5 border border-emerald-500/40 bg-gradient-to-r from-emerald-950/40 via-anthracite-800 to-anthracite-900 shadow-xl relative overflow-hidden">
+                        <div class="absolute -right-6 -bottom-6 w-32 h-32 rounded-full bg-emerald-500/5 blur-2xl pointer-events-none"></div>
+                        <div class="flex flex-col lg:flex-row lg:items-center justify-between gap-4">
+                            <div class="flex items-start gap-4">
+                                <div class="w-12 h-12 rounded-2xl bg-emerald-500/20 border border-emerald-500/40 flex items-center justify-center text-emerald-400 shrink-0 shadow-inner">
+                                    <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                                    </svg>
+                                </div>
+                                <div>
+                                    <div class="flex items-center gap-2.5 flex-wrap">
+                                        <span class="px-2 py-0.5 rounded-full text-[10px] font-bold uppercase tracking-wider bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">Certificat Actif en Production</span>
+                                        <span id="active-cert-type-badge" class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-anthracite-700 text-slate-300 border border-anthracite-600">Auto-signé Système</span>
+                                    </div>
+                                    <h3 id="active-cert-name" class="text-base sm:text-lg font-bold text-white mt-1">Certificat Auto-signé Système</h3>
+                                    <p class="text-xs text-slate-300 font-mono mt-0.5 flex items-center gap-2">
+                                        <span>FQDN / CN :</span>
+                                        <span id="active-cert-domain" class="text-emerald-300 font-bold">pbx.local</span>
+                                        <span class="text-slate-500">•</span>
+                                        <span>Émetteur :</span>
+                                        <span id="active-cert-issuer" class="text-slate-200">NexusPBX</span>
+                                    </p>
+                                </div>
+                            </div>
+
+                            <!-- Pôles de sécurité protégés -->
+                            <div class="flex items-center gap-3 flex-wrap">
+                                <div class="px-3 py-2 rounded-xl bg-anthracite-900/80 border border-anthracite-700 text-center">
+                                    <div class="text-[10px] text-slate-400 font-semibold uppercase">Signalisation</div>
+                                    <div class="text-xs font-bold text-emerald-400 mt-0.5">TLS 5061</div>
+                                </div>
+                                <div class="px-3 py-2 rounded-xl bg-anthracite-900/80 border border-anthracite-700 text-center">
+                                    <div class="text-[10px] text-slate-400 font-semibold uppercase">Voix Audio</div>
+                                    <div class="text-xs font-bold text-emerald-400 mt-0.5">SRTP / DTLS</div>
+                                </div>
+                                <div class="px-3 py-2 rounded-xl bg-anthracite-900/80 border border-anthracite-700 text-center">
+                                    <div class="text-[10px] text-slate-400 font-semibold uppercase">Validité</div>
+                                    <div id="active-cert-days" class="text-xs font-bold text-emerald-400 mt-0.5">3648 j restants</div>
+                                </div>
+                                <div id="active-cert-renew-wrapper" class="hidden">
+                                    <button type="button" id="btn-renew-active-cert" onclick="renewCertificateFromBanner()"
+                                        class="px-3 py-2 rounded-xl bg-emerald-600/30 hover:bg-emerald-600 text-emerald-300 hover:text-white border border-emerald-500/40 text-xs font-bold transition">
+                                        ↻ Renouveler
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Paramètres de Sécurité Transport TLS & Mutual TLS (mTLS) -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl p-5 shadow-lg">
+                        <div class="flex flex-col md:flex-row md:items-center justify-between gap-4">
+                            <div class="space-y-1">
+                                <div class="flex items-center gap-2">
+                                    <span class="w-2.5 h-2.5 rounded-full bg-cyan-400"></span>
+                                    <h3 class="text-sm font-bold text-white">Politique de Vérification Client TLS (Mutual TLS / mTLS)</h3>
+                                    <span id="badge-mtls-status" class="px-2 py-0.5 rounded-full text-[10px] font-bold bg-anthracite-700 text-slate-300 border border-anthracite-600">Désactivé (Standard)</span>
+                                </div>
+                                <p class="text-xs text-slate-300 max-w-3xl leading-relaxed">
+                                    Définit la directive PJSIP <code>verify_client</code> sur le transport TLS (port 5061). 
+                                    En mode standard, le combiné (Yealink) valide le serveur PBX et s'authentifie par identifiant / mot de passe SIP dans le tunnel crypté. En mode Mutual TLS strict, Asterisk exige en plus un certificat client X.509 installé sur chaque téléphone.
+                                </p>
+                            </div>
+                            <div class="flex items-center gap-3 shrink-0">
+                                <select id="select-tls-verify-client"
+                                    class="px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white focus:ring-2 focus:ring-cyan-500 focus:outline-none">
+                                    <option value="0">Désactivé (Standard - Recommandé)</option>
+                                    <option value="1">Activé (Strict - Certificat client requis)</option>
+                                </select>
+                                <button type="button" onclick="saveTlsSecurityPolicy()"
+                                    class="px-4 py-2 rounded-xl bg-cyan-600 hover:bg-cyan-500 text-white font-semibold text-xs shadow-md shadow-cyan-600/20 transition">
+                                    Appliquer
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Tableau des Certificats Installés -->
+                    <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl overflow-hidden shadow-lg">
+                        <div class="px-6 py-4 bg-anthracite-950/60 border-b border-anthracite-700 flex items-center justify-between">
+                            <div>
+                                <h3 class="text-sm font-bold text-white">Magasin de Certificats SSL / TLS</h3>
+                                <p class="text-xs text-slate-400">Tous les certificats enregistrés sur cette instance NexusPBX.</p>
+                            </div>
+                            <span id="certs-count-badge" class="px-2.5 py-0.5 text-xs rounded-full bg-anthracite-800 text-slate-300 border border-anthracite-700 font-bold">1 certificat</span>
+                        </div>
+
+                        <div class="overflow-x-auto">
+                            <table class="w-full text-left border-collapse">
+                                <thead>
+                                    <tr class="bg-anthracite-950/80 text-[11px] font-semibold uppercase text-slate-400 border-b border-anthracite-700">
+                                        <th class="py-3 px-4">Nom & Label</th>
+                                        <th class="py-3 px-4">Type</th>
+                                        <th class="py-3 px-4">Domaine Principal & SAN</th>
+                                        <th class="py-3 px-4">Émetteur (Issuer)</th>
+                                        <th class="py-3 px-4">Échéance & Validité</th>
+                                        <th class="py-3 px-4 text-center">Utilisation</th>
+                                        <th class="py-3 px-4 text-right">Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="certificates-tbody" class="divide-y divide-anthracite-700/60 text-xs"></tbody>
+                            </table>
+                        </div>
+                    </div>
+
+                    <!-- Fiches d'aide & Bonnes pratiques TLS / SRTP -->
+                    <div class="grid grid-cols-1 md:grid-cols-3 gap-4 text-xs">
+                        <div class="bg-anthracite-800/80 border border-anthracite-700 rounded-xl p-4 space-y-1.5">
+                            <div class="flex items-center gap-2 text-emerald-400 font-bold">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/></svg>
+                                <span>Signalisation Chiffrée (SIP TLS)</span>
+                            </div>
+                            <p class="text-slate-300 leading-relaxed">Le port 5061 écoute en TLS 1.2/1.3. Vos téléphones distants et softphones (MicroSIP, Linphone, Yealink, Fanvil) échangent leurs identifiants de manière totalement cryptée contre toute interception.</p>
+                        </div>
+                        <div class="bg-anthracite-800/80 border border-anthracite-700 rounded-xl p-4 space-y-1.5">
+                            <div class="flex items-center gap-2 text-cyan-400 font-bold">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11a7 7 0 01-7 7m0 0a7 7 0 01-7-7m7 7v4m0 0H8m4 0h4m-4-8a3 3 0 100-6 3 3 0 000 6z"/></svg>
+                                <span>Communications Audio (SRTP)</span>
+                            </div>
+                            <p class="text-slate-300 leading-relaxed">Les flux voix RTP sont chiffrés avec la suite cryptographique SDES / DTLS. Même en cas de capture réseau (Wireshark), aucune conversation n'est audible.</p>
+                        </div>
+                        <div class="bg-anthracite-800/80 border border-anthracite-700 rounded-xl p-4 space-y-1.5">
+                            <div class="flex items-center gap-2 text-amber-400 font-bold">
+                                <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg>
+                                <span>Renouvellement sans coupure</span>
+                            </div>
+                            <p class="text-slate-300 leading-relaxed">Les certificats Let's Encrypt sont renouvelables en 1 clic ou automatiquement. Asterisk et Nginx rechargent les certificats en mémoire sans couper les appels en cours.</p>
+                        </div>
+                    </div>
+                </section>
+
+            </main>
+        </div>
+    </div>
+
+    <!-- MODALE CRUD EXTENSION SIP -->
+    <div id="modal-extension" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/70 backdrop-blur-sm p-3 sm:p-4">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-2xl w-full p-6 shadow-2xl max-h-[90vh] overflow-y-auto">
+            <div class="flex items-center justify-between mb-4">
+                <h3 id="modal-extension-title" class="text-base font-bold text-white">Nouveau Poste SIP</h3>
+                <button type="button" onclick="closeModal('modal-extension')" class="text-slate-300 hover:text-white">✕</button>
+            </div>
+
+            <!-- ONGLETS DE NAVIGATION DANS LA MODALE -->
+            <div class="flex items-center gap-2 border-b border-anthracite-700 pb-2 mb-4">
+                <button type="button" id="tab-btn-ext-general" onclick="switchExtModalTab('general')"
+                    class="px-3 py-1.5 rounded-lg text-xs font-bold transition bg-indigo-600 text-white">
+                    ⚙️ Général & SIP
+                </button>
+                <button type="button" id="tab-btn-ext-voicemail" onclick="switchExtModalTab('voicemail')"
+                    class="px-3 py-1.5 rounded-lg text-xs font-semibold transition text-slate-300 hover:text-white hover:bg-anthracite-700 flex items-center gap-1.5">
+                    <span>📟 Messagerie Vocale</span>
+                    <span id="badge-ext-vm-status" class="w-2 h-2 rounded-full bg-slate-500"></span>
+                </button>
+            </div>
+
+            <form id="form-extension" class="space-y-4">
+                <input type="hidden" name="id">
+
+                <!-- ONGLET 1 : GÉNÉRAL & SIP -->
+                <div id="tab-panel-ext-general" class="space-y-4">
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Numéro d'extension</label>
+                            <input type="text" name="extension" placeholder="ex: 103" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Nom d'affichage (CallerID)</label>
+                            <input type="text" name="name" placeholder="ex: Comptabilité" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                        </div>
+                    </div>
+
+                    <div>
+                        <div class="flex items-center justify-between mb-1">
+                            <label class="text-xs font-medium text-slate-200">Secret SIP (Mot de passe)</label>
+                            <button type="button" onclick="generateRandomSecret()" class="text-xs text-indigo-300 hover:text-indigo-200 font-semibold">
+                                Générer un secret fort
+                            </button>
+                        </div>
+                        <input type="text" name="secret" required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                    </div>
+
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-2">Profil de connexion & Sécurité</label>
+                        <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                            <label class="flex items-start gap-3 p-3 rounded-xl bg-anthracite-950 border border-anthracite-700 cursor-pointer hover:border-indigo-400">
+                                <input type="radio" name="transport" value="udp" checked onchange="syncEncryptionToggle(this.value)" class="mt-1">
+                                <div>
+                                    <div class="text-xs font-bold text-white">Interne LAN (UDP)</div>
+                                    <div class="text-[11px] text-slate-300">Téléphones IP de bureau sur réseau local non chiffré.</div>
+                                </div>
+                            </label>
+                            <label class="flex items-start gap-3 p-3 rounded-xl bg-anthracite-950 border border-anthracite-700 cursor-pointer hover:border-emerald-400">
+                                <input type="radio" name="transport" value="tls" onchange="syncEncryptionToggle(this.value)" class="mt-1">
+                                <div>
+                                    <div class="text-xs font-bold text-emerald-300">Distant (TLS + SRTP)</div>
+                                    <div class="text-[11px] text-slate-300">Télétravail / 4G chiffré via certificat TLS.</div>
+                                </div>
+                            </label>
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4 items-center">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Codecs autorisés</label>
+                            <input type="text" name="codecs" value="alaw,ulaw,g722,opus" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Contacts simultanés max (AOR)</label>
+                            <input type="number" name="max_contacts" value="2" min="1" max="10" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                        </div>
+                    </div>
+
+                    <div class="space-y-1.5 pt-1">
+                        <label class="block text-xs font-semibold text-slate-200">Chiffrement Média Audio (SRTP / SDES)</label>
+                        <select id="ext-encryption" name="encryption"
+                            class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-white focus:ring-2 focus:ring-indigo-500 focus:outline-none">
+                            <option value="1">Optionnel / Négociable (Recommandé - Chiffre en SRTP si supporté, sinon RTP)</option>
+                            <option value="2">Obligatoire / Forcé (SRTP Strict - Rejette l'appel si non chiffré)</option>
+                            <option value="0">Désactivé (RTP standard en clair sans chiffrement audio)</option>
+                        </select>
+                        <p class="text-[11px] text-slate-400">Le mode optionnel négocie le SRTP automatiquement tout en évitant les échecs d'appels si le Yealink a le SRTP désactivé.</p>
+                    </div>
+
+                    <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-2">
+                        <div class="flex items-center justify-between">
+                            <span class="text-xs font-bold text-cyan-300">Appartenance aux Groupes d'Extensions (Sites & Droits)</span>
+                            <span class="text-[11px] text-slate-400">ex: Nice, Paris, Commerciaux...</span>
+                        </div>
+                        <div id="extension-groups-checkboxes" class="grid grid-cols-1 sm:grid-cols-2 gap-2 max-h-32 overflow-y-auto"></div>
+                    </div>
+                </div>
+
+                <!-- ONGLET 2 : MESSAGERIE VOCALE (VOICEMAIL) -->
+                <div id="tab-panel-ext-voicemail" class="hidden space-y-4">
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 flex items-center justify-between">
+                        <div>
+                            <div class="text-sm font-bold text-white flex items-center gap-2">
+                                <span>Activer la boîte vocale</span>
+                                <span class="px-2 py-0.5 rounded text-[10px] font-semibold bg-amber-500/20 text-amber-300 border border-amber-500/30">Voicemail</span>
+                            </div>
+                            <p class="text-xs text-slate-300 mt-0.5">Enregistre les messages vocaux des correspondants en cas de non-réponse, occupé ou DND.</p>
+                        </div>
+                        <label class="relative inline-flex items-center cursor-pointer">
+                            <input type="checkbox" name="voicemail_enabled" id="ext-voicemail-enabled" value="1" onchange="syncVoicemailToggle(this.checked)" class="sr-only peer">
+                            <div class="w-11 h-6 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-slate-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-amber-500"></div>
+                        </label>
+                    </div>
+
+                    <div id="voicemail-details-container" class="space-y-4">
+                        <!-- Configuration du mot de passe / code PIN -->
+                        <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                            <label class="block text-xs font-bold uppercase tracking-wider text-amber-300">Code PIN de la boîte vocale</label>
+                            <div class="space-y-2">
+                                <label class="flex items-start gap-3 p-3 rounded-xl bg-anthracite-900 border border-anthracite-700 cursor-pointer hover:border-amber-400">
+                                    <input type="radio" name="pin_mode" value="manual" checked onchange="syncPinMode(this.value)" class="mt-1 text-amber-500">
+                                    <div class="flex-1">
+                                        <div class="text-xs font-bold text-white">Définir un code PIN fixe maintenant</div>
+                                        <div class="text-[11px] text-slate-300">Code numérique de consultation (ex: depuis un autre poste ou l'extérieur via *98).</div>
+                                        <div id="pin-input-box" class="mt-2">
+                                            <input type="text" name="voicemail_pin" placeholder="ex: 1234 (chiffres)" pattern="[0-9]*" inputmode="numeric"
+                                                class="w-48 px-3 py-1.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm font-mono text-white">
+                                        </div>
+                                    </div>
+                                </label>
+                                <label class="flex items-start gap-3 p-3 rounded-xl bg-anthracite-900 border border-anthracite-700 cursor-pointer hover:border-amber-400">
+                                    <input type="radio" name="pin_mode" value="first_call" onchange="syncPinMode(this.value)" class="mt-1 text-amber-500">
+                                    <div>
+                                        <div class="text-xs font-bold text-amber-300">Choisir au premier appel (*97) - Assistant guidé</div>
+                                        <div class="text-[11px] text-slate-300">Au 1er appel vers sa boîte (*97), Asterisk invitera vocalement l'utilisateur à choisir son code PIN, puis à enregistrer son nom et son message d'accueil personnalisé.</div>
+                                    </div>
+                                </label>
+                            </div>
+                            <input type="hidden" name="force_pin_change" id="ext-force-pin-change" value="0">
+                        </div>
+
+                        <!-- Paramètres de sonnerie et accès direct -->
+                        <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                            <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                <label class="block text-xs font-bold text-white mb-1">Temps de sonnerie avant boîte</label>
+                                <p class="text-[11px] text-slate-300 mb-2">Durée d'appel avant routage vers la messagerie.</p>
+                                <div class="flex items-center gap-2">
+                                    <input type="number" name="ring_time" value="20" min="5" max="120" required
+                                        class="w-24 px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm font-mono text-white">
+                                    <span class="text-xs text-slate-300">secondes (défaut: 20s)</span>
+                                </div>
+                            </div>
+
+                            <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                                <label class="block text-xs font-bold text-white mb-1">Accès combiné (*97)</label>
+                                <p class="text-[11px] text-slate-300 mb-2">Comportement lors de l'appel depuis son propre poste.</p>
+                                <label class="flex items-center gap-2 cursor-pointer mt-1">
+                                    <input type="checkbox" name="voicemail_skip_pin" id="ext-skip-pin" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600 text-indigo-500">
+                                    <span class="text-xs text-white">Accès direct sans PIN depuis son poste</span>
+                                </label>
+                                <span class="text-[10px] text-slate-400 block mt-1">(Si décoché, le mot de passe est exigé même depuis son combiné)</span>
+                            </div>
+                        </div>
+
+                        <!-- Notifications Email -->
+                        <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                            <div class="flex items-center justify-between">
+                                <span class="text-xs font-bold uppercase tracking-wider text-indigo-300">Notification par Email (Voicemail to Email)</span>
+                                <span class="text-[11px] text-slate-400">Optionnel</span>
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Adresse email destinataire</label>
+                                <input type="email" name="voicemail_email" placeholder="utilisateur@societe.com"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white">
+                            </div>
+                            <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 pt-1">
+                                <label class="flex items-center gap-2 cursor-pointer">
+                                    <input type="checkbox" name="voicemail_attach" id="ext-vm-attach" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600 text-indigo-500">
+                                    <span class="text-xs text-slate-200">Joindre le message audio (.wav) à l'email</span>
+                                </label>
+                                <label class="flex items-center gap-2 cursor-pointer">
+                                    <input type="checkbox" name="voicemail_delete" id="ext-vm-delete" value="1" class="rounded bg-anthracite-900 border-anthracite-600 text-indigo-500">
+                                    <span class="text-xs text-slate-200">Supprimer de la boîte après envoi email</span>
+                                </label>
+                            </div>
+                        </div>
+
+                        <!-- Indicateur MWI Yealink -->
+                        <div class="p-3 rounded-xl bg-emerald-500/10 border border-emerald-500/30 flex items-start gap-2.5">
+                            <span class="text-base">💡</span>
+                            <div class="text-xs text-emerald-200">
+                                <strong class="font-bold">Notification MWI automatique :</strong>
+                                Le voyant LED rouge et l'enveloppe clignoteront sur votre téléphone Yealink dès qu'un message vocal est reçu.
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end gap-2">
+                    <button type="button" onclick="closeModal('modal-extension')" class="px-4 py-2 rounded-xl bg-anthracite-700 text-slate-200 text-xs font-semibold">Annuler</button>
+                    <button type="submit" class="px-4 py-2 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold">Enregistrer le poste</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+
+    <!-- MODALE CRUD GROUPE DE SONNERIE (RING GROUP) -->
+    <div id="modal-group" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl w-[94vw] max-w-4xl p-6 shadow-2xl my-auto">
+            <div class="flex items-center justify-between pb-3 mb-4 border-b border-anthracite-700">
+                <div>
+                    <h3 id="modal-group-title" class="text-base sm:text-lg font-bold text-white">Groupe de Sonnerie (Ring Group)</h3>
+                    <p class="text-xs text-slate-300">Numéro virtuel d'appel entrant avec stratégie de sonnerie et destination de débordement.</p>
+                </div>
+                <button type="button" onclick="closeModal('modal-group')" class="text-slate-300 hover:text-white text-lg">✕</button>
+            </div>
+            <form id="form-group" class="space-y-4">
+                <input type="hidden" name="id">
+                <div class="grid grid-cols-1 sm:grid-cols-4 gap-4">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Numéro d'appel du groupe *</label>
+                        <input type="text" name="extension" placeholder="ex: 600" required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                    </div>
+                    <div class="sm:col-span-2">
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Nom du groupe * <span class="text-slate-400">(ex: Support Général, Accueil)</span></label>
+                        <input type="text" name="name" placeholder="ex: Support Général" required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Temps sonnerie (sec)</label>
+                        <input type="number" name="ring_time" value="20" min="5" max="120" required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                    </div>
+                </div>
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Stratégie de sonnerie</label>
+                        <select name="strategy" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                            <option value="ringall">ringall (Tous les postes du groupe en même temps)</option>
+                            <option value="hunt">hunt (Séquentiel poste par poste)</option>
+                        </select>
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Destination si non-réponse (Débordement)</label>
+                        <select id="group-failover-select" name="failover_dest" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white"></select>
+                    </div>
+                </div>
+
+                <!-- Sélection Double Liste Interactive : Postes Sonnants -->
+                <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                    <div class="flex items-center justify-between">
+                        <span class="text-xs font-bold uppercase tracking-wider text-cyan-300">Postes à faire sonner (Cliquez pour inclure / retirer)</span>
+                        <div class="flex gap-2">
+                            <button type="button" onclick="groupTransferAllExtensions(true)" class="px-2.5 py-1 rounded-lg bg-emerald-500/15 hover:bg-emerald-500/25 border border-emerald-500/30 text-[11px] font-semibold text-emerald-300">← Tout inclure</button>
+                            <button type="button" onclick="groupTransferAllExtensions(false)" class="px-2.5 py-1 rounded-lg bg-anthracite-800 hover:bg-anthracite-700 border border-anthracite-600 text-[11px] font-semibold text-slate-300">Tout retirer →</button>
+                        </div>
+                    </div>
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                        <div class="p-3 rounded-xl bg-anthracite-900 border border-emerald-500/30 min-h-[130px]">
+                            <div class="text-xs font-bold text-emerald-300 mb-2 flex items-center justify-between">
+                                <span>✓ Postes Membres qui sonnent</span>
+                                <span id="group-selected-count" class="px-2 py-0.2 rounded-full bg-emerald-500/20 text-[10px]">0</span>
+                            </div>
+                            <div id="group-members-allowed-box" class="flex flex-wrap gap-1.5"></div>
+                        </div>
+                        <div class="p-3 rounded-xl bg-anthracite-900 border border-anthracite-700 min-h-[130px]">
+                            <div class="text-xs font-bold text-slate-400 mb-2 flex items-center justify-between">
+                                <span>Postes Disponibles</span>
+                                <span id="group-unselected-count" class="px-2 py-0.2 rounded-full bg-anthracite-800 text-[10px]">0</span>
+                            </div>
+                            <div id="group-members-blocked-box" class="flex flex-wrap gap-1.5"></div>
+                        </div>
+                    </div>
+                    <div id="group-members-checkboxes" class="hidden"></div>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end gap-2">
+                    <button type="button" onclick="closeModal('modal-group')" class="px-4 py-2 rounded-xl bg-anthracite-700 text-slate-200 text-xs font-semibold">Annuler</button>
+                    <button type="submit" class="px-4 py-2 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold">Enregistrer le groupe de sonnerie</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+
+    <!-- MODALE CRUD GROUPE D'EXTENSIONS (SITES & DROITS ROUTES SORTANTES) -->
+    <div id="modal-extgroup" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl w-[94vw] max-w-4xl p-6 shadow-2xl my-auto">
+            <div class="flex items-center justify-between pb-3 mb-4 border-b border-anthracite-700">
+                <div>
+                    <h3 id="modal-extgroup-title" class="text-base sm:text-lg font-bold text-white">Groupe d'Extensions (Sites & Droits)</h3>
+                    <p class="text-xs text-slate-300">Regroupement sans numéro d'appel. Sert à autoriser ou bloquer ce groupe sur les Routes Sortantes (ex: OVH, Livebox...).</p>
+                </div>
+                <button type="button" onclick="closeModal('modal-extgroup')" class="text-slate-300 hover:text-white text-lg">✕</button>
+            </div>
+            <form id="form-extgroup" class="space-y-4">
+                <input type="hidden" name="id">
+                <div class="grid grid-cols-1 sm:grid-cols-12 gap-4">
+                    <div class="sm:col-span-6">
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Nom du Groupe * <span class="text-slate-400">(ex: Groupe Nice, Groupe Paris)</span></label>
+                        <input type="text" name="name" placeholder="ex: Groupe Nice" required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-bold">
+                    </div>
+                    <div class="sm:col-span-6">
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Description / Emplacement</label>
+                        <input type="text" name="description" placeholder="ex: Site de Nice - Sortie Livebox"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                    </div>
+                </div>
+
+                <!-- Double liste interactive pour affecter les membres au Groupe d'Extensions -->
+                <div class="p-4 rounded-xl bg-anthracite-950 border border-cyan-500/40 space-y-3">
+                    <div class="flex items-center justify-between">
+                        <span class="text-xs font-bold uppercase tracking-wider text-cyan-300">Extensions rattachées à ce groupe (Cliquez pour ajouter/retirer)</span>
+                        <div class="flex gap-2">
+                            <button type="button" onclick="extGroupTransferAll(true)" class="px-2.5 py-1 rounded-lg bg-cyan-500/15 hover:bg-cyan-500/25 border border-cyan-500/30 text-[11px] font-semibold text-cyan-300">← Tout ajouter</button>
+                            <button type="button" onclick="extGroupTransferAll(false)" class="px-2.5 py-1 rounded-lg bg-anthracite-800 hover:bg-anthracite-700 border border-anthracite-600 text-[11px] font-semibold text-slate-300">Tout retirer →</button>
+                        </div>
+                    </div>
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                        <div class="p-3 rounded-xl bg-anthracite-900 border border-cyan-500/40 min-h-[140px]">
+                            <div class="text-xs font-bold text-cyan-300 mb-2 flex items-center justify-between">
+                                <span>✓ Extensions membres de ce groupe</span>
+                                <span id="extgroup-selected-count" class="px-2 py-0.2 rounded-full bg-cyan-500/20 text-[10px]">0</span>
+                            </div>
+                            <div id="extgroup-members-allowed-box" class="flex flex-wrap gap-1.5"></div>
+                        </div>
+                        <div class="p-3 rounded-xl bg-anthracite-900 border border-anthracite-700 min-h-[140px]">
+                            <div class="text-xs font-bold text-slate-400 mb-2 flex items-center justify-between">
+                                <span>Autres extensions</span>
+                                <span id="extgroup-unselected-count" class="px-2 py-0.2 rounded-full bg-anthracite-800 text-[10px]">0</span>
+                            </div>
+                            <div id="extgroup-members-blocked-box" class="flex flex-wrap gap-1.5"></div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end gap-2">
+                    <button type="button" onclick="closeModal('modal-extgroup')" class="px-4 py-2 rounded-xl bg-anthracite-700 text-slate-200 text-xs font-semibold">Annuler</button>
+                    <button type="submit" class="px-4 py-2 rounded-xl bg-cyan-600 hover:bg-cyan-500 text-white text-xs font-semibold">Enregistrer le groupe d'extensions</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+
+    <!-- MODALE CRUD ROUTE SORTANTE (OUTBOUND ROUTE : TRUNK SEQUENCE, DIAL PATTERNS, EXTENSION & GROUP ROUTING) -->
+    <div id="modal-outbound" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-2 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl w-[96vw] max-w-[1380px] p-5 sm:p-7 shadow-2xl my-auto max-h-[94vh] flex flex-col">
+            <div class="flex flex-wrap items-center justify-between gap-3 pb-4 border-b border-anthracite-700">
+                <div>
+                    <h3 id="modal-outbound-title" class="text-base sm:text-lg font-bold text-white">Éditer la Route Sortante</h3>
+                    <p class="text-xs text-slate-300">Configurez la séquence de Trunks, les masques de numérotation (Dial Patterns) et les Groupes / Postes autorisés à utiliser cette route.</p>
+                </div>
+                <button type="button" onclick="closeModal('modal-outbound')" class="text-slate-300 hover:text-white p-1 text-lg">✕</button>
+            </div>
+
+            <!-- Onglets de la modale Route Sortante (comme sur tes captures) -->
+            <div class="flex flex-wrap gap-1 pt-3 border-b border-anthracite-700">
+                <button type="button" data-ob-tab="settings" onclick="switchOutboundModalTab('settings')"
+                    class="ob-tab-btn px-4 py-2 text-xs font-bold rounded-t-xl bg-indigo-600 text-white transition">
+                    1. Route Settings & Séquence Trunks
+                </button>
+                <button type="button" data-ob-tab="patterns" onclick="switchOutboundModalTab('patterns')"
+                    class="ob-tab-btn px-4 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-emerald-300 hover:text-white transition flex items-center gap-1.5">
+                    <span>2. Dial Patterns (Masques de numérotation)</span>
+                    <span id="ob-patterns-count-badge" class="px-1.5 py-0.2 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">0</span>
+                </button>
+                <button type="button" data-ob-tab="permissions" onclick="switchOutboundModalTab('permissions')"
+                    class="ob-tab-btn px-4 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-cyan-300 hover:text-white transition flex items-center gap-1.5">
+                    <span>3. Paramètres complémentaires & Droits (Groupes & Postes)</span>
+                </button>
+            </div>
+
+            <form id="form-outbound" class="flex-1 overflow-y-auto py-4 space-y-4 pr-1">
+                <input type="hidden" name="id">
+
+                <!-- ONGLET 1 : ROUTE SETTINGS & SÉQUENCE TRUNKS -->
+                <div id="ob-panel-settings" class="ob-subpanel space-y-4">
+                    <div class="grid grid-cols-1 sm:grid-cols-12 gap-4">
+                        <div class="sm:col-span-4">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Nom de la Route * <span class="text-slate-400">(ex: OVH, Livebox, Emergency)</span></label>
+                            <input type="text" name="name" placeholder="ex: OVH" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-semibold">
+                        </div>
+                        <div class="sm:col-span-5">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Route CID <span class="text-slate-400">(CallerID Sortant affiché)</span></label>
+                            <input type="text" name="outbound_callerid" placeholder="ex: Sytelis Consulting <0422560185>"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div class="sm:col-span-3">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Ordre de Priorité *</label>
+                            <input type="number" name="priority" value="1" min="1" max="999" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4 p-4 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1.5">Remplacer le CID du poste <span class="text-slate-400">(Override Extension)</span></label>
+                            <div class="inline-flex rounded-lg bg-anthracite-900 p-1 border border-anthracite-700">
+                                <label class="cursor-pointer">
+                                    <input type="radio" name="override_ext_cid" value="1" class="peer hidden">
+                                    <span class="px-3 py-1 rounded-md text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white transition inline-block">Oui</span>
+                                </label>
+                                <label class="cursor-pointer">
+                                    <input type="radio" name="override_ext_cid" value="0" checked class="peer hidden">
+                                    <span class="px-3 py-1 rounded-md text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white transition inline-block">Non</span>
+                                </label>
+                            </div>
+                        </div>
+
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1.5">Route Type <span class="text-slate-400">(Profil de la route)</span></label>
+                            <div class="inline-flex rounded-lg bg-anthracite-900 p-1 border border-anthracite-700">
+                                <label class="cursor-pointer">
+                                    <input type="radio" name="route_type" value="normal" checked class="peer hidden">
+                                    <span class="px-2.5 py-1 rounded-md text-xs font-semibold text-slate-300 peer-checked:bg-indigo-600 peer-checked:text-white transition inline-block">Standard</span>
+                                </label>
+                                <label class="cursor-pointer">
+                                    <input type="radio" name="route_type" value="emergency" class="peer hidden">
+                                    <span class="px-2.5 py-1 rounded-md text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white transition inline-block">🚑 Urgence</span>
+                                </label>
+                                <label class="cursor-pointer">
+                                    <input type="radio" name="route_type" value="intracompany" class="peer hidden">
+                                    <span class="px-2.5 py-1 rounded-md text-xs font-semibold text-slate-300 peer-checked:bg-cyan-600 peer-checked:text-white transition inline-block">🏢 Intra-Company</span>
+                                </label>
+                            </div>
+                        </div>
+
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Mot de Passe de la Route <span class="text-slate-400">(PIN optionnel)</span></label>
+                            <input type="text" name="route_password" placeholder="Vide = sans code PIN"
+                                class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                        </div>
+                    </div>
+
+                    <!-- TRUNK SEQUENCE FOR MATCHED ROUTES -->
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-indigo-500/40 space-y-3">
+                        <div class="flex flex-wrap items-center justify-between gap-2">
+                            <div>
+                                <div class="text-xs font-bold uppercase tracking-wider text-indigo-300">Trunk Sequence for Matched Routes (Ordre des Trunks à utiliser)</div>
+                                <p class="text-[11px] text-slate-300">
+                                    Choisissez un ou plusieurs Trunks par ordre de priorité (ex: <strong>1. ovh-telecom</strong> puis <strong>2. livebox</strong>). Si le 1er Trunk est indisponible ou occupé, l'appel bascule automatiquement sur le Trunk suivant !
+                                </p>
+                            </div>
+                            <button type="button" onclick="addOutboundTrunkSeqRow()"
+                                class="px-3 py-1.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold transition">
+                                + Ajouter un Trunk de secours
+                            </button>
+                        </div>
+
+                        <div id="ob-trunk-seq-container" class="space-y-2"></div>
+                    </div>
+
+                    <!-- COMPORTEMENT DE CASCADE, CONGESTION & MUSIQUE D'ATTENTE -->
+                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4 p-4 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                        <div class="flex flex-col justify-center">
+                            <label class="flex items-start gap-2.5 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="continue_next_route" value="1" checked class="mt-0.5 rounded bg-anthracite-900 border-anthracite-600">
+                                <div>
+                                    <div class="font-bold text-emerald-300">Cascade vers route suivante</div>
+                                    <div class="text-[11px] text-slate-400">Si poste non autorisé ou Trunks indisponibles, passe à la route suivante.</div>
+                                </div>
+                            </label>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">🎵 Musique d'attente (MoH)</label>
+                            <select id="ob-musicclass-select" name="moh_class" class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white"></select>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Destination sur Congestion <span class="text-slate-400">(Échec total)</span></label>
+                            <select id="ob-congestion-dest-select" name="congestion_dest" class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white"></select>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- ONGLET 2 : DIAL PATTERNS (MASQUES DE NUMÉROTATION) -->
+                <div id="ob-panel-patterns" class="ob-subpanel hidden space-y-4">
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-emerald-500/30 space-y-3">
+                        <div class="flex flex-wrap items-center justify-between gap-2">
+                            <div>
+                                <div class="text-xs font-bold uppercase tracking-wider text-emerald-300">🪄 Masques de numérotation pré-définis (1 clic)</div>
+                                <p class="text-[11px] text-slate-300">Ajoutez instantanément les masques standards ou créez vos propres règles <code class="text-indigo-300">(prepend) + préfixe | [match pattern / ID appelant]</code>.</p>
+                            </div>
+                            <button type="button" onclick="addOutboundPatternRow()"
+                                class="px-3.5 py-1.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-bold transition">
+                                + Ajouter une ligne de masque
+                            </button>
+                        </div>
+
+                        <div class="flex flex-wrap gap-2 pt-1">
+                            <button type="button" onclick="applyOutboundPatternPreset('fr_national')"
+                                class="px-3 py-1.5 rounded-lg bg-anthracite-900 hover:bg-emerald-500/20 border border-anthracite-600 hover:border-emerald-500/40 text-xs font-semibold text-emerald-300 transition">
+                                🇫🇷 Fixes & Mobiles France (0[1-59].. & 0[67]..)
+                            </button>
+                            <button type="button" onclick="applyOutboundPatternPreset('fr_free')"
+                                class="px-3 py-1.5 rounded-lg bg-anthracite-900 hover:bg-emerald-500/20 border border-anthracite-600 hover:border-emerald-500/40 text-xs font-semibold text-cyan-300 transition">
+                                🟢 Numéros Verts / Gratuits (080[0-9]XXXXXX)
+                            </button>
+                            <button type="button" onclick="applyOutboundPatternPreset('fr_emergency')"
+                                class="px-3 py-1.5 rounded-lg bg-anthracite-900 hover:bg-amber-500/20 border border-anthracite-600 hover:border-amber-500/40 text-xs font-semibold text-amber-300 transition">
+                                🚑 Numéros d'Urgence (15, 17, 18, 112, 114)
+                            </button>
+                            <button type="button" onclick="applyOutboundPatternPreset('international')"
+                                class="px-3 py-1.5 rounded-lg bg-anthracite-900 hover:bg-indigo-500/20 border border-anthracite-600 hover:border-indigo-500/40 text-xs font-semibold text-indigo-300 transition">
+                                🌍 International (00. & +X.)
+                            </button>
+                            <button type="button" onclick="applyOutboundPatternPreset('all')"
+                                class="px-3 py-1.5 rounded-lg bg-anthracite-900 hover:bg-purple-500/20 border border-anthracite-600 hover:border-purple-500/40 text-xs font-semibold text-purple-300 transition">
+                                ⭐ Tout autoriser (X.)
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="rounded-xl border border-anthracite-700 overflow-hidden bg-anthracite-900">
+                        <div class="grid grid-cols-12 gap-2 px-4 py-2.5 bg-anthracite-950 border-b border-anthracite-700 text-[11px] font-bold uppercase tracking-wider text-slate-300">
+                            <div class="col-span-2">( Prepend )</div>
+                            <div class="col-span-2">Préfixe |</div>
+                            <div class="col-span-5">[ Match Pattern (Masque appelé) *</div>
+                            <div class="col-span-2">/ ID Appelant ]</div>
+                            <div class="col-span-1 text-right">Actions</div>
+                        </div>
+                        <div id="ob-patterns-container" class="divide-y divide-anthracite-700/60 max-h-[360px] overflow-y-auto"></div>
+                    </div>
+                </div>
+
+                <!-- ONGLET 3 : PARAMÈTRES COMPLÉMENTAIRES & DROITS (GROUPES & POSTES AUTORISÉS) -->
+                <div id="ob-panel-permissions" class="ob-subpanel hidden space-y-4">
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-4 p-4 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1.5">Enregistrer l'appel</label>
+                            <div class="inline-flex rounded-lg bg-anthracite-900 p-1 border border-anthracite-700 flex-wrap gap-1">
+                                <label class="cursor-pointer"><input type="radio" name="record_mode" value="force" class="peer hidden"><span class="px-2.5 py-1 rounded text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white inline-block">Forcer</span></label>
+                                <label class="cursor-pointer"><input type="radio" name="record_mode" value="yes" class="peer hidden"><span class="px-2.5 py-1 rounded text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white inline-block">Oui</span></label>
+                                <label class="cursor-pointer"><input type="radio" name="record_mode" value="dontcare" checked class="peer hidden"><span class="px-2.5 py-1 rounded text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white inline-block">Peu importe</span></label>
+                                <label class="cursor-pointer"><input type="radio" name="record_mode" value="no" class="peer hidden"><span class="px-2.5 py-1 rounded text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white inline-block">Non</span></label>
+                                <label class="cursor-pointer"><input type="radio" name="record_mode" value="never" class="peer hidden"><span class="px-2.5 py-1 rounded text-xs font-semibold text-slate-300 peer-checked:bg-emerald-600 peer-checked:text-white inline-block">Jamais</span></label>
+                            </div>
+                        </div>
+
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1.5">Contrôle des Droits d'utilisation de la Route</label>
+                            <div class="flex flex-col gap-1.5 text-xs">
+                                <label class="flex items-center gap-2 cursor-pointer">
+                                    <input type="radio" name="permission_mode" value="all" checked onchange="toggleOutboundPermissionMode(this.value)">
+                                    <span class="text-white font-semibold">Tous les postes et groupes sont autorisés</span>
+                                </label>
+                                <label class="flex items-center gap-2 cursor-pointer">
+                                    <input type="radio" name="permission_mode" value="restricted" onchange="toggleOutboundPermissionMode(this.value)">
+                                    <span class="text-cyan-300 font-semibold">Restreindre aux Groupes (ex: Nice, Paris) et/ou Postes sélectionnés ci-dessous</span>
+                                </label>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div id="ob-permissions-details" class="space-y-4">
+                        <!-- 1. SÉLECTION DES GROUPES D'EXTENSIONS AUTORISÉS (EX: GROUPE NICE, GROUPE PARIS) -->
+                        <div class="p-4 rounded-xl bg-anthracite-950 border border-cyan-500/40 space-y-3">
+                            <div class="flex flex-wrap items-center justify-between gap-2">
+                                <div>
+                                    <div class="text-xs font-bold uppercase tracking-wider text-cyan-300">👥 Groupes d'Extensions Autorisés (ex: Groupe Nice, Groupe Paris)</div>
+                                    <p class="text-[11px] text-slate-300">Tous les postes rattachés à un groupe d'extensions coché ci-dessous auront le droit d'appeler via cette route sortante.</p>
+                                </div>
+                                <button type="button" onclick="closeModal('modal-outbound'); switchTab('extgroups'); openExtGroupModal();"
+                                    class="px-3 py-1 rounded-lg bg-cyan-500/15 hover:bg-cyan-500/25 border border-cyan-500/30 text-cyan-300 text-xs font-semibold transition">
+                                    + Créer / Gérer les Groupes d'Extensions
+                                </button>
+                            </div>
+                            <div id="ob-allowed-groups-container" class="grid grid-cols-1 sm:grid-cols-3 gap-2.5"></div>
+                        </div>
+
+                        <!-- 2. EXTENSION ROUTING (ALLOWED EXTENSIONS <-> BLOCKED EXTENSIONS COMME SUR LA CAPTURE 4) -->
+                        <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                            <div class="flex flex-wrap items-center justify-between gap-2">
+                                <div>
+                                    <div class="text-xs font-bold uppercase tracking-wider text-emerald-300">📱 Extension Routing (Postes individuels Autorisés ↔ Bloqués)</div>
+                                    <p class="text-[11px] text-slate-300">Cliquez sur un poste pour le déplacer entre <strong>Allowed Extensions</strong> et <strong>Blocked Extensions</strong>. Si un poste est bloqué ici, l'appel passera automatiquement à la Route Sortante suivante.</p>
+                                </div>
+                            </div>
+
+                            <div class="grid grid-cols-1 lg:grid-cols-11 gap-3 items-center">
+                                <!-- Allowed Extensions -->
+                                <div class="lg:col-span-5 p-3.5 rounded-xl bg-anthracite-900 border border-emerald-500/40 min-h-[180px]">
+                                    <div class="text-xs font-bold text-emerald-300 mb-2.5 flex items-center justify-between">
+                                        <span>Allowed Extensions (Postes Autorisés)</span>
+                                        <span id="ob-allowed-exts-count" class="px-2 py-0.5 rounded-full bg-emerald-500/20 text-[10px]">0</span>
+                                    </div>
+                                    <div id="ob-allowed-exts-box" class="flex flex-wrap gap-2"></div>
+                                </div>
+
+                                <!-- Boutons centraux ← ↔ → -->
+                                <div class="lg:col-span-1 flex lg:flex-col items-center justify-center gap-2">
+                                    <button type="button" onclick="obTransferExtensions('all_allow')" title="Autoriser tous les postes"
+                                        class="px-3 py-1.5 rounded-lg bg-emerald-500/20 hover:bg-emerald-500/30 border border-emerald-500/40 text-emerald-300 font-bold text-xs">←</button>
+                                    <button type="button" onclick="obTransferExtensions('invert')" title="Inverser Autorisés / Bloqués"
+                                        class="px-3 py-1.5 rounded-lg bg-anthracite-800 hover:bg-anthracite-700 border border-anthracite-600 text-slate-200 font-bold text-xs">↔</button>
+                                    <button type="button" onclick="obTransferExtensions('all_block')" title="Bloquer tous les postes individuels"
+                                        class="px-3 py-1.5 rounded-lg bg-amber-500/20 hover:bg-amber-500/30 border border-amber-500/40 text-amber-300 font-bold text-xs">→</button>
+                                </div>
+
+                                <!-- Blocked Extensions -->
+                                <div class="lg:col-span-5 p-3.5 rounded-xl bg-anthracite-900 border border-anthracite-700 min-h-[180px]">
+                                    <div class="text-xs font-bold text-slate-300 mb-2.5 flex items-center justify-between">
+                                        <span>Blocked Extensions (Non autorisés sur cette route)</span>
+                                        <span id="ob-blocked-exts-count" class="px-2 py-0.5 rounded-full bg-anthracite-800 text-[10px]">0</span>
+                                    </div>
+                                    <div id="ob-blocked-exts-box" class="flex flex-wrap gap-2"></div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-4 border-t border-anthracite-700 flex items-center justify-between">
+                    <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                        <input type="checkbox" name="enabled" value="1" checked class="rounded bg-anthracite-950 border-anthracite-600">
+                        <span>Route Sortante active dans le Dialplan</span>
+                    </label>
+                    <div class="flex gap-2">
+                        <button type="button" onclick="closeModal('modal-outbound')" class="px-4 py-2 rounded-xl bg-anthracite-700 text-slate-200 text-xs font-semibold">Annuler</button>
+                        <button type="submit" class="px-5 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-500 text-white text-xs font-semibold shadow-lg shadow-emerald-600/20">Soumettre & Enregistrer la Route</button>
+                    </div>
+                </div>
+            </form>
+        </div>
+    </div>
+
+
+    <!-- MODALE CRUD TRUNK SIP (CONFIGURATION PJSIP COMPLÈTE) -->
+    <div id="modal-trunk" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-2 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl w-[96vw] max-w-[1380px] p-5 sm:p-7 shadow-2xl my-auto max-h-[94vh] flex flex-col">
+            <div class="flex flex-wrap items-center justify-between gap-3 pb-4 border-b border-anthracite-700">
+                <div>
+                    <h3 id="modal-trunk-title" class="text-base sm:text-lg font-bold text-white">Configuration Complète Trunk SIP / PJSIP Universel</h3>
+                    <p class="text-xs text-slate-300">Compatible avec tous les opérateurs SIP, SBC, passerelles RNIS/FXO et interconnexions IP (50 paramètres PJSIP natifs).</p>
+                </div>
+                <button type="button" onclick="closeModal('modal-trunk')" class="text-slate-300 hover:text-white p-1 text-lg">✕</button>
+            </div>
+
+            <!-- Architectures PJSIP universelles (sans écraser les serveurs) + Convertisseur FreePBX -->
+            <div class="py-3 border-b border-anthracite-700/80 flex flex-wrap items-center justify-between gap-2 text-xs">
+                <div class="flex flex-wrap items-center gap-1.5">
+                    <span class="text-slate-300 font-semibold mr-1">Architecture PJSIP :</span>
+                    <button type="button" onclick="applyTrunkArchitecture('register_auth')" class="px-2.5 py-1 rounded-lg bg-anthracite-950 hover:bg-indigo-600/30 border border-anthracite-600 text-indigo-300 font-medium transition">
+                        Trunk avec Enregistrement (REGISTER + Auth)
+                    </button>
+                    <button type="button" onclick="applyTrunkArchitecture('ip_peering')" class="px-2.5 py-1 rounded-lg bg-anthracite-950 hover:bg-indigo-600/30 border border-anthracite-600 text-purple-300 font-medium transition">
+                        Peering IP / SBC / Passerelle (Sans REGISTER)
+                    </button>
+                    <button type="button" onclick="applyTrunkArchitecture('tls_srtp')" class="px-2.5 py-1 rounded-lg bg-anthracite-950 hover:bg-indigo-600/30 border border-anthracite-600 text-cyan-300 font-medium transition">
+                        Trunk Sécurisé (TLS 5061 + SRTP)
+                    </button>
+                </div>
+                <button type="button" onclick="toggleFreePbxImporter()"
+                    class="px-3 py-1 rounded-lg bg-emerald-500/20 hover:bg-emerald-500/30 border border-emerald-500/40 text-emerald-300 font-semibold transition">
+                    Coller depuis FreePBX / Register String
+                </button>
+            </div>
+
+            <!-- Convertisseur FreePBX caché par défaut -->
+            <div id="freepbx-importer-box" class="hidden my-2 p-3.5 rounded-xl bg-anthracite-950 border border-emerald-500/40 space-y-2">
+                <div class="flex items-center justify-between">
+                    <span class="text-xs font-bold text-emerald-300">Convertisseur automatique FreePBX / chan_sip → PJSIP</span>
+                    <button type="button" onclick="toggleFreePbxImporter()" class="text-xs text-slate-400 hover:text-white">Fermer</button>
+                </div>
+                <p class="text-[11px] text-slate-300">
+                    Collez votre <strong>Register String</strong> (<code class="text-indigo-300">user:secret@host:port/did</code>) ou vos <strong>PEER Details FreePBX</strong> (<code class="text-indigo-300">host=... username=... secret=... context=...</code>) :
+                </p>
+                <textarea id="freepbx-paste-input" rows="3" placeholder="user:secret@sip.operateur.com:5060/num&#10;ou&#10;host=sip.operateur.com&#10;username=mon_user&#10;secret=mon_secret&#10;context=from-pstn-toheader"
+                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono"></textarea>
+                <div class="flex justify-end">
+                    <button type="button" onclick="parseFreePbxConfig()"
+                        class="px-3.5 py-1.5 rounded-lg bg-emerald-600 hover:bg-emerald-500 text-white text-xs font-semibold">
+                        Analyser & Remplir les champs PJSIP
+                    </button>
+                </div>
+            </div>
+
+            <!-- Sous-onglets de la modale Trunk -->
+            <div class="flex flex-wrap gap-1 pt-3 border-b border-anthracite-700">
+                <button type="button" data-trunk-tab="general" onclick="switchTrunkModalTab('general')"
+                    class="trunk-tab-btn px-3.5 py-2 text-xs font-bold rounded-t-xl bg-indigo-600 text-white transition">
+                    1. Serveur & Auth SIP
+                </button>
+                <button type="button" data-trunk-tab="inbound" onclick="switchTrunkModalTab('inbound')"
+                    class="trunk-tab-btn px-3.5 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-emerald-300 hover:text-white transition flex items-center gap-1.5">
+                    <span>2. Routes Entrantes & Filtrage ID Appelant</span>
+                    <span id="trunk-inbound-rules-badge" class="px-1.5 py-0.2 rounded-full text-[10px] font-bold bg-emerald-500/20 text-emerald-300 border border-emerald-500/30">0</span>
+                </button>
+                <button type="button" data-trunk-tab="identity" onclick="switchTrunkModalTab('identity')"
+                    class="trunk-tab-btn px-3.5 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-slate-300 hover:text-white transition">
+                    3. Registration & Identité SIP (From / PAI / Diversion)
+                </button>
+                <button type="button" data-trunk-tab="media" onclick="switchTrunkModalTab('media')"
+                    class="trunk-tab-btn px-3.5 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-slate-300 hover:text-white transition">
+                    4. Codecs, NAT, Timers, T.38 & Identify IP
+                </button>
+                <button type="button" data-trunk-tab="routing" onclick="switchTrunkModalTab('routing')"
+                    class="trunk-tab-btn px-3.5 py-2 text-xs font-semibold rounded-t-xl bg-anthracite-950 text-slate-300 hover:text-white transition">
+                    5. Directives PJSIP Brutes
+                </button>
+            </div>
+
+            <form id="form-trunk" class="flex-1 overflow-y-auto py-4 space-y-4 pr-1">
+                <input type="hidden" name="id">
+
+                <!-- SOUS-ONGLET 1 : SERVEUR, AUTHENTIFICATION & ROUTAGE DIRECT -->
+                <div id="trunk-panel-general" class="trunk-subpanel space-y-4">
+                    <div class="grid grid-cols-1 sm:grid-cols-4 gap-4">
+                        <div class="sm:col-span-1">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Nom du Trunk * <span class="text-slate-400">(ID PJSIP)</span></label>
+                            <input type="text" name="name" placeholder="ex: mon-trunk-sip" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div class="sm:col-span-2">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Serveur SIP / SBC / Passerelle * <span class="text-slate-400">(Host / IP)</span></label>
+                            <input type="text" name="host" placeholder="ex: sbc.operateur.net ou 192.168.1.250" required oninput="syncTrunkHostDomain(this.value)"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div class="sm:col-span-1">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Port SIP * <span class="text-slate-400">(Port)</span></label>
+                            <input type="number" name="port" value="5060" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                    </div>
+
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-4">
+                        <div class="flex flex-wrap items-center justify-between gap-2">
+                            <span class="text-xs font-bold uppercase tracking-wider text-indigo-300">Mode d'Authentification SIP</span>
+                            <div class="flex items-center gap-4 text-xs">
+                                <label class="flex items-center gap-1.5 cursor-pointer">
+                                    <input type="radio" name="auth_mode" value="userpass" checked onchange="toggleTrunkAuthFields(this.value)">
+                                    <span class="text-white font-medium">Identifiants (Username / Secret)</span>
+                                </label>
+                                <label class="flex items-center gap-1.5 cursor-pointer">
+                                    <input type="radio" name="auth_mode" value="ip" onchange="toggleTrunkAuthFields(this.value)">
+                                    <span class="text-slate-300 font-medium">Peering par IP (Sans mot de passe)</span>
+                                </label>
+                            </div>
+                        </div>
+
+                        <div id="trunk-auth-fields" class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Identifiant / Numéro SIP <span class="text-slate-400">(Username)</span></label>
+                                <input type="text" name="username" placeholder="ex: 0033422560185"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Secret / Mot de passe SIP <span class="text-slate-400">(Password)</span></label>
+                                <input type="text" name="secret" placeholder="Secret SIP"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Auth Username <span class="text-slate-400">(Si différent du Username)</span></label>
+                                <input type="text" name="auth_username" placeholder="Vide = utilise Username"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Routage Entrant & Sortant (Assisté + 100% Libre) -->
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                        <div class="flex flex-wrap items-center justify-between gap-2">
+                            <span class="text-xs font-bold uppercase tracking-wider text-emerald-300">Destination Entrante par Défaut & Contexte Dialplan</span>
+                            <button type="button" onclick="switchTrunkModalTab('inbound')"
+                                class="px-3 py-1 rounded-lg bg-emerald-500/20 hover:bg-emerald-500/30 border border-emerald-500/40 text-xs font-semibold text-emerald-300 transition">
+                                Gérer les Routes Entrantes par ID Appelant / Anti-Spam →
+                            </button>
+                        </div>
+                        <div class="grid grid-cols-1 sm:grid-cols-3 gap-4 items-end">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Aide à la sélection (Poste / Groupe / SVI)</label>
+                                <select id="trunk-inbound-select" onchange="syncInboundDestSelect(this.value)"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white">
+                                </select>
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Cible entrante par défaut <span class="text-slate-400">(Si aucune règle ne matche)</span></label>
+                                <input type="text" name="inbound_dest" value="101" placeholder="ex: 101, ext-101, grp-600, ivr-accueil"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Contexte Dialplan (<code class="text-indigo-300">context</code>)</label>
+                                <input type="text" name="context" list="trunk-context-suggestions" value="from-pstn-toheader" placeholder="from-pstn-toheader ou from-external"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                                <datalist id="trunk-context-suggestions">
+                                    <option value="from-pstn-toheader">Lit le numéro SDA dans l'en-tête SIP To: (Style FreePBX / OVH / Trunk DID)</option>
+                                    <option value="from-external">Lit le numéro dans l'URI INVITE standard</option>
+                                    <option value="from-internal">Interconnexion PBX de confiance (Accès interne direct)</option>
+                                </datalist>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-4 gap-4 items-end">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Protocole Transport</label>
+                            <select name="transport" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                <option value="udp">UDP (Standard 5060)</option>
+                                <option value="tcp">TCP (Fiable 5060)</option>
+                                <option value="tls">TLS (Chiffré 5061)</option>
+                            </select>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Outbound Proxy (<code class="text-indigo-300">outbound_proxy</code>)</label>
+                            <input type="text" name="outbound_proxy" placeholder="sip:proxy.op.net:5060\;lr"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Préfixe / Règle Sortante</label>
+                            <input type="text" name="outbound_prefix" placeholder="Vide = direct, X. = tout, ou ex: 9"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div class="h-[40px] flex items-center">
+                            <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="enabled" value="1" checked class="rounded bg-anthracite-950 border-anthracite-600">
+                                <span><strong>Trunk Actif</strong></span>
+                            </label>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- SOUS-ONGLET 2 : ROUTES ENTRANTES & FILTRAGE PAR ID APPELANT (INBOUND ROUTES) -->
+                <div id="trunk-panel-inbound" class="trunk-subpanel hidden space-y-4">
+                    <!-- Musique d'attente spécifique à ce Trunk -->
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-amber-500/30 flex flex-col md:flex-row md:items-center justify-between gap-3 shadow-lg">
+                        <div class="space-y-0.5">
+                            <label class="block text-xs font-bold text-white flex items-center gap-2">
+                                <span class="w-2.5 h-2.5 rounded-full bg-amber-400"></span>
+                                <span>Musique d'attente (MoH) spécifique à ce Trunk</span>
+                            </label>
+                            <p class="text-[11px] text-slate-300">
+                                Permet de substituer la musique globale par une musique dédiée à ce Trunk lors de la mise en garde (Hold) ou du transfert d'appels.
+                            </p>
+                        </div>
+                        <div class="min-w-[280px]">
+                            <select name="moh_sound_id" id="trunk-moh-sound-id"
+                                class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-xs text-white focus:outline-none focus:border-amber-500 font-medium">
+                                <option value="0">🌐 Hériter de la musique générale par défaut</option>
+                            </select>
+                        </div>
+                    </div>
+
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                        <div class="flex flex-wrap items-center justify-between gap-3">
+                            <div>
+                                <div class="text-sm font-bold text-white flex items-center gap-2">
+                                    <span>Routes Entrantes & Filtrage par ID Appelant (Inbound Routes)</span>
+                                </div>
+                                <p class="text-xs text-slate-300">
+                                    Redirigez ou bloquez les appels entrants de ce Trunk en fonction de <strong>qui appelle (ID Appelant / CallerID)</strong>. Les motifs commençant par <code class="text-indigo-300">_0</code> bloquent automatiquement les formats <code class="text-indigo-300">0...</code>, <code class="text-indigo-300">0033...</code> et <code class="text-indigo-300">+33...</code>.
+                                </p>
+                            </div>
+                            <div class="flex flex-wrap items-center gap-2">
+                                <button type="button" onclick="addArcepSpamBlockPreset()"
+                                    class="px-3 py-1.5 rounded-xl bg-amber-500/20 hover:bg-amber-500/30 border border-amber-500/40 text-xs font-semibold text-amber-300 transition">
+                                    🛡️ + Ajouter Pack Blocage Démarchage (0162, 0163, 0270, 0377, 0424, 0568, 0948...)
+                                </button>
+                                <button type="button" onclick="addTrunkInboundRouteRow('Any', 'Any', 'Nouvelle règle', 'ext-101', true)"
+                                    class="px-3.5 py-1.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-xs font-semibold text-white shadow-md shadow-indigo-600/20 transition">
+                                    + Ajouter une Règle Entrante
+                                </button>
+                            </div>
+                        </div>
+
+                        <!-- Barre de filtre rapide dans les règles -->
+                        <div class="flex flex-wrap items-center justify-between gap-2 pt-1">
+                            <input type="text" id="inbound-routes-filter" oninput="filterInboundRoutesRows(this.value)"
+                                placeholder="🔍 Filtrer vos règles (ex: 0162, Block, VIP, Issy, Occupation...)"
+                                class="w-full sm:w-96 px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                            <div class="text-[11px] text-slate-400">
+                                Syntaxe Asterisk : <code class="text-indigo-300">Any</code> = Tous • <code class="text-indigo-300">_0162XXXXXX</code> = Plage 0162 • <code class="text-indigo-300">0612345678</code> = Numéro exact
+                            </div>
+                        </div>
+
+                        <!-- Tableau des Routes Entrantes (ID Appelant, Description, Destination, Horaires & Actions) -->
+                        <div class="border border-anthracite-700 rounded-xl overflow-hidden bg-anthracite-900">
+                            <div class="grid grid-cols-12 gap-3 px-4 py-2.5 bg-anthracite-950 border-b border-anthracite-700 text-[11px] font-bold uppercase tracking-wider text-slate-300">
+                                <div class="col-span-3">ID Appelant</div>
+                                <div class="col-span-3">Description</div>
+                                <div class="col-span-4">Destination (Si ouvert)</div>
+                                <div class="col-span-2 text-right">Horaires & Actions</div>
+                            </div>
+                            <div id="trunk-did-container" class="divide-y divide-anthracite-700/70 max-h-[44vh] overflow-y-auto"></div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- SOUS-ONGLET 2 : ENREGISTREMENT (REGISTRATION) & IDENTITÉ SIP -->
+                <div id="trunk-panel-identity" class="trunk-subpanel hidden space-y-4">
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-4">
+                        <div class="flex flex-wrap items-center justify-between gap-2">
+                            <span class="text-xs font-bold uppercase tracking-wider text-emerald-300">Paramètres d'Enregistrement SIP (<code class="text-emerald-300">[type = registration]</code>)</span>
+                            <div class="flex items-center gap-4">
+                                <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                    <input type="checkbox" name="register" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                                    <span>Activer <code class="text-emerald-300">registration</code> (Envoi SIP REGISTER)</span>
+                                </label>
+                                <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                    <input type="checkbox" name="line_support" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                                    <span>Activer <code class="text-indigo-300">line = yes</code> (Matching entrant auto)</span>
+                                </label>
+                            </div>
+                        </div>
+
+                        <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Contact User (<code class="text-indigo-300">contact_user</code>)</label>
+                                <input type="text" name="contact_user" placeholder="Extension/SDA reçue ou vide"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Expiration REGISTER (<code class="text-indigo-300">expiration</code>)</label>
+                                <input type="number" name="expiration" value="3600" min="60" max="86400"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Intervalle de relance (<code class="text-indigo-300">retry_interval</code>)</label>
+                                <input type="number" name="retry_interval" value="60" min="10" max="3600"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                        </div>
+
+                        <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Tentatives Max (<code class="text-indigo-300">max_retries</code>)</label>
+                                <input type="number" name="max_retries" value="10000" min="0" max="1000000"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Relance sur 403 Forbidden (<code class="text-indigo-300">forbidden_retry_interval</code>)</label>
+                                <input type="number" name="forbidden_retry_interval" value="600" min="0" max="86400"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Relance Erreur Fatale (<code class="text-indigo-300">fatal_retry_interval</code>)</label>
+                                <input type="number" name="fatal_retry_interval" value="0" min="0" max="86400"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                        </div>
+
+                        <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Server URI personnalisée (<code class="text-indigo-300">server_uri</code> — auto si vide)</label>
+                                <input type="text" name="server_uri" placeholder="Auto : sip:hote:port"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">Client URI personnalisée (<code class="text-indigo-300">client_uri</code> — auto si vide)</label>
+                                <input type="text" name="client_uri" placeholder="Auto : sip:username@from_domain:port"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white font-mono">
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-4">
+                        <span class="text-xs font-bold uppercase tracking-wider text-indigo-300 block">En-têtes SIP, Domaine & Présentation du Numéro (CallerID / PAI / RPID / Diversion)</span>
+                        <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">From User (<code class="text-indigo-300">from_user</code>)</label>
+                                <input type="text" name="from_user" placeholder="Vide = utilise Username"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">From Domain (<code class="text-indigo-300">from_domain</code>)</label>
+                                <input type="text" name="from_domain" placeholder="Vide = utilise le Serveur SIP (Host)"
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                            <div>
+                                <label class="block text-xs font-medium text-slate-200 mb-1">CallerID Sortant Forcé (<code class="text-indigo-300">callerid</code>)</label>
+                                <input type="text" name="outbound_callerid" placeholder='ex: "Entreprise" <+33422560185>'
+                                    class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-sm text-white font-mono">
+                            </div>
+                        </div>
+
+                        <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 pt-1">
+                            <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="send_pai" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                                <span>Envoyer <strong>P-Asserted-Identity</strong> (<code class="text-indigo-300">send_pai = yes</code>)</span>
+                            </label>
+                            <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="send_rpid" value="1" class="rounded bg-anthracite-900 border-anthracite-600">
+                                <span>Envoyer <strong>Remote-Party-ID</strong> (<code class="text-indigo-300">send_rpid = yes</code>)</span>
+                            </label>
+                            <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="send_diversion" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                                <span>Envoyer l'en-tête <strong>Diversion</strong> lors des transferts (<code class="text-indigo-300">send_diversion = yes</code>)</span>
+                            </label>
+                            <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                                <input type="checkbox" name="trust_id_inbound" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                                <span>Accepter l'identité entrante PAI/RPID (<code class="text-indigo-300">trust_id_inbound = yes</code>)</span>
+                            </label>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- SOUS-ONGLET 3 : CODECS, NAT, TIMERS, FAX T.38 & PEERING IP (IDENTIFY) -->
+                <div id="trunk-panel-media" class="trunk-subpanel hidden space-y-4">
+                    <div class="grid grid-cols-1 sm:grid-cols-4 gap-4">
+                        <div class="sm:col-span-2">
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Codecs Audio autorisés (ordre de priorité)</label>
+                            <input type="text" name="codecs" value="alaw,ulaw,g722" required
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Mode DTMF (<code class="text-indigo-300">dtmf_mode</code>)</label>
+                            <select name="dtmf_mode" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                <option value="rfc4733">RFC4733 (RTP Payload)</option>
+                                <option value="auto">Auto</option>
+                                <option value="inband">Inband (Audio G.711)</option>
+                                <option value="info">SIP INFO</option>
+                            </select>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Chiffrement Média (<code class="text-indigo-300">media_encryption</code>)</label>
+                            <select name="media_encryption" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                <option value="no">Non chiffré (RTP Standard)</option>
+                                <option value="sdes">SRTP (SDES)</option>
+                                <option value="dtls">DTLS-SRTP</option>
+                            </select>
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Ping SIP OPTIONS (<code class="text-indigo-300">qualify_frequency</code> sec)</label>
+                            <input type="number" name="qualify_frequency" value="60" min="0" max="3600"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Keepalive RTP (<code class="text-indigo-300">rtp_keepalive</code> sec)</label>
+                            <input type="number" name="rtp_keepalive" value="15" min="0" max="3600"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Canaux simultanés max (0 = illimité)</label>
+                            <input type="number" name="max_channels" value="0" min="0" max="500"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">SIP Session Timers (<code class="text-indigo-300">timers</code>)</label>
+                            <select name="timers" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                <option value="yes">yes (Standard RFC 4028)</option>
+                                <option value="no">no (Désactiver si coupure à 15 min)</option>
+                                <option value="required">required (Exiger Session Timers)</option>
+                                <option value="always">always (Forcer Session Timers)</option>
+                            </select>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Support Fax T.38 UDPTL (<code class="text-indigo-300">t38_udptl</code>)</label>
+                            <select name="t38_udptl" class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white">
+                                <option value="no">no (Désactivé / Audio G.711)</option>
+                                <option value="yes">yes (Activer T.38 + Redundancy)</option>
+                                <option value="nat">nat (Activer T.38 avec NAT)</option>
+                            </select>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">Langue Audio (<code class="text-indigo-300">language</code>)</label>
+                            <input type="text" name="language" value="fr" placeholder="fr, en, es..."
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono">
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 sm:grid-cols-2 gap-3 p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                        <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                            <input type="checkbox" name="nat_symmetric" value="1" checked class="rounded bg-anthracite-900 border-anthracite-600">
+                            <span><strong>Traversée NAT complète</strong> (<code class="text-indigo-300">rtp_symmetric</code> + <code class="text-indigo-300">force_rport</code> + <code class="text-indigo-300">rewrite_contact</code>)</span>
+                        </label>
+                        <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                            <input type="checkbox" name="direct_media" value="1" class="rounded bg-anthracite-900 border-anthracite-600">
+                            <span>Autoriser Direct Media RTP (<code class="text-indigo-300">direct_media = yes</code>)</span>
+                        </label>
+                        <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                            <input type="checkbox" name="inband_progress" value="1" class="rounded bg-anthracite-900 border-anthracite-600">
+                            <span>Audio Early Media 183 (<code class="text-indigo-300">inband_progress = yes</code>)</span>
+                        </label>
+                        <label class="flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+                            <input type="checkbox" name="fax_detect" value="1" class="rounded bg-anthracite-900 border-anthracite-600">
+                            <span>Détection tonalité Fax CNG (<code class="text-indigo-300">fax_detect = yes</code>)</span>
+                        </label>
+                    </div>
+
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">
+                            Adresses IP / Sous-réseaux CIDR de l'opérateur pour <code class="text-indigo-300">[type = identify]</code> (séparés par virgule)
+                        </label>
+                        <input type="text" name="match_ips" placeholder="Vide = utilise l'hôte SIP automatiquement. Exemple : 91.121.129.0/24, 212.83.128.0/19"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono">
+                        <p class="text-[11px] text-slate-400 mt-1">Indispensable pour les opérateurs ou SBC qui envoient les appels entrants depuis plusieurs adresses IP distinctes.</p>
+                    </div>
+                </div>
+
+                <!-- SOUS-ONGLET 5 : DIRECTIVES PJSIP NATIVES -->
+                <div id="trunk-panel-routing" class="trunk-subpanel hidden space-y-4">
+                    <div class="p-3 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-slate-300">
+                        Injectez ici toute directive PJSIP brute supplémentaire (<code class="text-indigo-300">clé = valeur</code>) dans chacune des sections générées pour ce Trunk.
+                    </div>
+
+                    <!-- Surcharges PJSIP libres sur les 3 sections PJSIP -->
+                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">
+                                Directives <code class="text-indigo-300">[endpoint]</code> libres
+                            </label>
+                            <textarea name="custom_endpoint_params" rows="4" placeholder="clé = valeur&#10;ex:&#10;100rel = yes&#10;Trust_id_outbound = yes"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono"></textarea>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">
+                                Directives <code class="text-emerald-300">[registration]</code> libres
+                            </label>
+                            <textarea name="custom_reg_params" rows="4" placeholder="clé = valeur&#10;ex:&#10;support_path = yes&#10;security_negotiation = no"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono"></textarea>
+                        </div>
+                        <div>
+                            <label class="block text-xs font-medium text-slate-200 mb-1">
+                                Directives <code class="text-amber-300">[aor]</code> libres
+                            </label>
+                            <textarea name="custom_aor_params" rows="4" placeholder="clé = valeur&#10;ex:&#10;qualify_timeout = 3.0&#10;support_path = yes"
+                                class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs text-white font-mono"></textarea>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-4 border-t border-anthracite-700 flex items-center justify-between gap-2">
+                    <span class="text-[11px] text-slate-400">Pensez à cliquer sur « Appliquer les configurations » après sauvegarde.</span>
+                    <div class="flex gap-2">
+                        <button type="button" onclick="closeModal('modal-trunk')" class="px-4 py-2 rounded-xl bg-anthracite-700 text-slate-200 text-xs font-semibold">Annuler</button>
+                        <button type="submit" class="px-5 py-2 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold shadow-lg shadow-indigo-600/25">Enregistrer le Trunk PJSIP</button>
+                    </div>
+                </div>
+            </form>
+        </div>
+    </div>
+
+
+    <!-- MODALE CRUD SVI / IVR -->
+    <div id="modal-ivr" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-4xl w-full p-6 shadow-2xl space-y-5 my-auto max-h-[94vh] overflow-y-auto">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div class="flex items-center gap-2.5">
+                    <div class="w-8 h-8 rounded-xl bg-indigo-500/20 text-indigo-400 flex items-center justify-center font-bold text-sm">
+                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11a7 7 0 01-7 7m0 0a7 7 0 01-7-7m7 7v4m0 0H8m4 0h4m-4-8a3 3 0 100-6 3 3 0 000 6z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3 id="modal-ivr-title" class="text-base sm:text-lg font-bold text-white">Serveur Vocal Interactif (SVI / IVR)</h3>
+                        <p class="text-[11px] text-slate-400">Configurez le message vocal d'accueil, le routage des touches DTMF et la tolérance aux erreurs.</p>
+                    </div>
+                </div>
+                <button type="button" onclick="closeModal('modal-ivr')" class="text-slate-400 hover:text-white p-1.5 rounded-lg hover:bg-anthracite-700 transition">✕</button>
+            </div>
+
+            <form id="form-ivr" class="space-y-6">
+                <input type="hidden" name="id">
+
+                <!-- SECTION 1 : Paramètres Généraux & Annonce Vocale -->
+                <div class="p-4 rounded-xl bg-anthracite-900/60 border border-anthracite-700/80 space-y-4">
+                    <div class="flex items-center gap-2 text-xs font-bold uppercase tracking-wider text-indigo-400">
+                        <span class="w-2 h-2 rounded-full bg-indigo-500"></span>
+                        <span>1. Informations Générales & Message d'Accueil</span>
+                    </div>
+
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                        <div>
+                            <label class="block text-xs font-semibold text-slate-200 mb-1">
+                                Nom du SVI <span class="text-indigo-400">*</span>
+                            </label>
+                            <input type="text" name="name" placeholder="ivr-accueil" required
+                                class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono focus:outline-none focus:border-indigo-500">
+                            <p class="text-[11px] text-slate-400 mt-1">Identifiant unique du menu (ex: ivr-accueil, ivr-support, ivr-nuit).</p>
+                        </div>
+
+                        <div>
+                            <label class="block text-xs font-semibold text-slate-200 mb-1">
+                                Description
+                            </label>
+                            <input type="text" name="description" placeholder="Standard principal jour"
+                                class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-indigo-500">
+                            <p class="text-[11px] text-slate-400 mt-1">Libellé explicatif pour les administrateurs.</p>
+                        </div>
+                    </div>
+
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-4 pt-1">
+                        <div>
+                            <div class="flex items-center justify-between mb-1">
+                                <label class="block text-xs font-semibold text-slate-200">
+                                    Message Audio d'Accueil (Annonce) <span class="text-indigo-400">*</span>
+                                </label>
+                                <button type="button" onclick="closeModal('modal-ivr'); openSoundModal();" class="text-[11px] text-amber-400 hover:text-amber-300 font-medium">+ Téléverser un son</button>
+                            </div>
+                            <select name="audio_file" id="ivr-audio-select" required
+                                class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-indigo-500">
+                            </select>
+                            <p class="text-[11px] text-slate-400 mt-1">Message vocal d'accueil joué à l'appelant énonçant les choix.</p>
+                        </div>
+
+                        <div class="flex flex-col justify-center">
+                            <div class="p-3 rounded-xl bg-anthracite-950/70 border border-anthracite-700 flex items-center justify-between gap-3">
+                                <div>
+                                    <div class="text-xs font-semibold text-white">Numérotation Directe des Postes</div>
+                                    <div class="text-[11px] text-slate-400">Autorise l'appelant à composer directement un poste interne (101, 102...) pendant l'annonce.</div>
+                                </div>
+                                <label class="relative inline-flex items-center cursor-pointer flex-shrink-0">
+                                    <input type="checkbox" name="direct_dial" id="ivr-direct-dial-checkbox" value="1" class="sr-only peer" checked>
+                                    <div class="w-11 h-6 bg-anthracite-700 peer-focus:outline-none rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-indigo-600"></div>
+                                </label>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- SECTION 2 : Touches DTMF & Choix des Destinations -->
+                <div class="p-4 rounded-xl bg-anthracite-900/60 border border-anthracite-700/80 space-y-3">
+                    <div class="flex items-center justify-between">
+                        <div class="flex items-center gap-2 text-xs font-bold uppercase tracking-wider text-indigo-400">
+                            <span class="w-2 h-2 rounded-full bg-indigo-500"></span>
+                            <span>2. Touches DTMF & Aiguillage des Choix</span>
+                        </div>
+                        <button type="button" onclick="addIvrOptionRow('', '')"
+                            class="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-xs font-semibold bg-indigo-600 hover:bg-indigo-500 text-white transition">
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4"/>
+                            </svg>
+                            <span>Ajouter une touche</span>
+                        </button>
+                    </div>
+                    <p class="text-[11px] text-slate-400">Définissez l'action exécutée lorsque l'appelant appuie sur une touche de son téléphone (0-9, *, #).</p>
+
+                    <div id="ivr-options-container" class="space-y-2.5 max-h-60 overflow-y-auto pr-1"></div>
+                </div>
+
+                <!-- SECTION 3 : Sécurité & Gestion des Échecs (Invalid & Timeout) -->
+                <div class="p-4 rounded-xl bg-anthracite-900/60 border border-anthracite-700/80 space-y-4">
+                    <div class="flex items-center gap-2 text-xs font-bold uppercase tracking-wider text-amber-400">
+                        <span class="w-2 h-2 rounded-full bg-amber-400"></span>
+                        <span>3. Sécurité & Gestion des Échecs (Erreurs & Non-Réponse)</span>
+                    </div>
+
+                    <div class="grid grid-cols-1 md:grid-cols-2 gap-5">
+                        <!-- Colonne Choix Invalide -->
+                        <div class="p-3.5 rounded-xl bg-anthracite-950/60 border border-anthracite-700 space-y-3">
+                            <div class="text-xs font-bold text-white flex items-center gap-1.5">
+                                <span class="text-red-400">⚠️</span> En cas de Touche Invalide
+                            </div>
+
+                            <div>
+                                <label class="block text-[11px] font-semibold text-slate-300 mb-1">Nombre d'essais max avant échec</label>
+                                <input type="number" name="invalid_retries" value="3" min="1" max="10" required
+                                    class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                            </div>
+
+                            <div>
+                                <label class="block text-[11px] font-semibold text-slate-300 mb-1">Message d'erreur vocal</label>
+                                <select name="invalid_sound_id" id="ivr-invalid-sound-select"
+                                    class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </select>
+                            </div>
+
+                            <div>
+                                <label class="block text-[11px] font-semibold text-slate-300 mb-1">Destination d'échec finale</label>
+                                <select name="invalid_dest" id="ivr-invalid-dest-select"
+                                    class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </select>
+                            </div>
+                        </div>
+
+                        <!-- Colonne Expiration / Timeout -->
+                        <div class="p-3.5 rounded-xl bg-anthracite-950/60 border border-anthracite-700 space-y-3">
+                            <div class="text-xs font-bold text-white flex items-center gap-1.5">
+                                <span class="text-amber-400">⏱️</span> En cas de Timeout (Aucune touche pressée)
+                            </div>
+
+                            <div class="grid grid-cols-2 gap-2">
+                                <div>
+                                    <label class="block text-[11px] font-semibold text-slate-300 mb-1">Délai d'attente (sec)</label>
+                                    <input type="number" name="timeout" value="5" min="2" max="60" required
+                                        class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </div>
+                                <div>
+                                    <label class="block text-[11px] font-semibold text-slate-300 mb-1">Répétitions max</label>
+                                    <input type="number" name="timeout_retries" value="2" min="1" max="10" required
+                                        class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </div>
+                            </div>
+
+                            <div>
+                                <label class="block text-[11px] font-semibold text-slate-300 mb-1">Message de relance (optionnel)</label>
+                                <select name="timeout_sound_id" id="ivr-timeout-sound-select"
+                                    class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </select>
+                            </div>
+
+                            <div>
+                                <label class="block text-[11px] font-semibold text-slate-300 mb-1">Destination d'échec finale</label>
+                                <select name="timeout_dest" id="ivr-timeout-dest-select"
+                                    class="w-full px-3 py-1.5 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white">
+                                </select>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-4 border-t border-anthracite-700 flex items-center justify-between gap-3">
+                    <span class="text-[11px] text-slate-400">Le dialplan Asterisk et la recharge PJSIP sont générés automatiquement à la validation.</span>
+                    <div class="flex gap-2">
+                        <button type="button" onclick="closeModal('modal-ivr')" class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-650 text-slate-200 text-xs font-semibold transition">Annuler</button>
+                        <button type="submit" class="px-5 py-2 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold shadow-lg shadow-indigo-600/25 transition">Enregistrer le SVI</button>
+                    </div>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- ========================================================= -->
+    <!-- MODALE : TÉLÉVERSEMENT & ÉDITION FICHIER SON              -->
+    <!-- ========================================================= -->
+    <div id="modal-sound" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-xl w-full p-6 shadow-2xl space-y-4 my-auto">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div class="flex items-center gap-2">
+                    <span class="w-2.5 h-2.5 rounded-full bg-amber-400"></span>
+                    <h3 id="modal-sound-title" class="text-base sm:text-lg font-bold text-white">Ajouter un Fichier Son</h3>
+                </div>
+                <button type="button" onclick="closeModal('modal-sound')" class="text-slate-400 hover:text-white p-1">✕</button>
+            </div>
+
+            <form id="form-sound" class="space-y-4" enctype="multipart/form-data">
+                <input type="hidden" name="id">
+
+                <!-- 1. Catégorie de Site & Type d'usage -->
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3.5">
+                    <div>
+                        <div class="flex items-center justify-between mb-1">
+                            <label class="block text-xs font-semibold text-slate-300">
+                                Catégorie de site <span class="text-amber-400">*</span>
+                            </label>
+                            <button type="button" onclick="closeModal('modal-sound'); openSoundSitesModal();" class="text-[11px] text-amber-400 hover:text-amber-300 font-medium">+ Gérer les sites</button>
+                        </div>
+                        <select name="site_category" id="sound-input-site" required
+                            class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-amber-500">
+                        </select>
+                        <p class="text-[10px] text-slate-400 mt-1">Associe ce son à un site physique ou contexte client.</p>
+                    </div>
+
+                    <div>
+                        <label class="block text-xs font-semibold text-slate-300 mb-1">
+                            Type d'usage <span class="text-amber-400">*</span>
+                        </label>
+                        <select name="usage_type" id="sound-input-usage" required
+                            class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-amber-500">
+                            <option value="announcement">Annonce d'accueil / Info</option>
+                            <option value="moh">Musique d'attente (MoH)</option>
+                            <option value="ivr">Menu SVI / Guide interactif</option>
+                            <option value="congestion">Ligne occupée / Congestion</option>
+                            <option value="custom">Autre / Personnalisé</option>
+                        </select>
+                        <p class="text-[10px] text-slate-400 mt-1">Détermine l'utilisation dans les routes, SVI et trunks.</p>
+                    </div>
+                </div>
+
+                <!-- 2. Nom du fichier son & Description -->
+                <div class="space-y-3">
+                    <div>
+                        <label class="block text-xs font-semibold text-slate-300 mb-1">
+                            Nom du fichier son <span class="text-amber-400">*</span>
+                        </label>
+                        <input type="text" name="name" id="sound-input-name" placeholder="ex: Message Accueil Standard" required
+                            class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-amber-500">
+                    </div>
+
+                    <div>
+                        <label class="block text-xs font-semibold text-slate-300 mb-1">
+                            Description
+                        </label>
+                        <input type="text" name="description" id="sound-input-desc" placeholder="ex: Diffusé aux correspondants externes lors des heures ouvrées"
+                            class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-sm text-slate-200 focus:outline-none focus:border-amber-500">
+                    </div>
+                </div>
+
+                <!-- 3. Fichier audio source (Upload) -->
+                <div id="sound-file-upload-block" class="space-y-1.5">
+                    <label class="block text-xs font-semibold text-slate-300">
+                        Fichier audio source (.wav, .mp3, .ogg, .m4a) <span class="text-amber-400">*</span>
+                    </label>
+                    <div class="relative border-2 border-dashed border-anthracite-600 hover:border-amber-500/70 rounded-xl p-4 text-center transition bg-anthracite-950/60 cursor-pointer"
+                         onclick="document.getElementById('sound-audio-file-input').click()">
+                        <input type="file" id="sound-audio-file-input" name="audio_file" accept="audio/*,.wav,.mp3,.ogg,.m4a,.flac" class="hidden"
+                               onchange="handleSoundFileSelected(this)">
+                        <div id="sound-upload-placeholder" class="space-y-1 text-slate-400">
+                            <svg class="w-7 h-7 mx-auto text-amber-400/80" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"/>
+                            </svg>
+                            <div class="text-xs font-semibold text-slate-200">Cliquez pour choisir un fichier audio ou glissez-le ici</div>
+                            <div class="text-[10px] text-slate-500">Converti automatiquement en WAV PCM 8kHz 16-bit + G.711a pour Asterisk</div>
+                        </div>
+                        <div id="sound-upload-preview" class="hidden space-y-1">
+                            <div class="text-xs font-bold text-emerald-400" id="sound-upload-filename">fichier.wav</div>
+                            <div class="text-[10px] text-slate-400" id="sound-upload-filesize">0 KB</div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end gap-2.5">
+                    <button type="button" onclick="closeModal('modal-sound')" class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-650 text-slate-200 text-xs font-semibold transition">
+                        Annuler
+                    </button>
+                    <button type="submit" id="btn-submit-sound" class="px-5 py-2 rounded-xl bg-gradient-to-r from-amber-600 to-amber-500 hover:from-amber-500 hover:to-amber-400 text-white text-xs font-semibold shadow-md shadow-amber-600/20 transition">
+                        Téléverser & Enregistrer
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- ========================================================= -->
+    <!-- MODALE : GESTION DES CATÉGORIES DE SITES                  -->
+    <!-- ========================================================= -->
+    <div id="modal-sound-sites" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-2xl w-full p-6 shadow-2xl space-y-5 my-auto">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div>
+                    <h3 class="text-base sm:text-lg font-bold text-white">Gestion des Catégories de Sites</h3>
+                    <p class="text-xs text-slate-300">Créez, renommez ou supprimez vos sites (Nice, Paris, etc.) pour organiser vos annonces et musiques d'attente.</p>
+                </div>
+                <button type="button" onclick="closeModal('modal-sound-sites')" class="text-slate-400 hover:text-white p-1">✕</button>
+            </div>
+
+            <!-- Formulaire d'ajout / modification de site -->
+            <form id="form-sound-site" class="p-4 rounded-xl bg-anthracite-950 border border-anthracite-700 space-y-3">
+                <input type="hidden" name="id" id="sound-site-id">
+                <div class="grid grid-cols-1 sm:grid-cols-12 gap-3">
+                    <div class="sm:col-span-5">
+                        <label class="block text-xs font-semibold text-slate-300 mb-1">Nom du site *</label>
+                        <input type="text" name="name" id="sound-site-name" placeholder="ex: Site Nice, Site Paris..." required
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white focus:outline-none focus:border-indigo-500">
+                    </div>
+                    <div class="sm:col-span-5">
+                        <label class="block text-xs font-semibold text-slate-300 mb-1">Description</label>
+                        <input type="text" name="description" id="sound-site-desc" placeholder="ex: Bureau régional PACA"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-900 border border-anthracite-700 text-xs text-white focus:outline-none focus:border-indigo-500">
+                    </div>
+                    <div class="sm:col-span-2 flex items-end">
+                        <button type="submit" id="btn-save-sound-site" class="w-full px-3 py-2 rounded-lg bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold transition">
+                            Enregistrer
+                        </button>
+                    </div>
+                </div>
+            </form>
+
+            <!-- Tableau des catégories existantes -->
+            <div class="border border-anthracite-700 rounded-xl overflow-hidden">
+                <table class="w-full text-left border-collapse">
+                    <thead>
+                        <tr class="bg-anthracite-950 text-[11px] font-semibold uppercase text-slate-400 border-b border-anthracite-700">
+                            <th class="py-2.5 px-4">Nom du site</th>
+                            <th class="py-2.5 px-4">Description</th>
+                            <th class="py-2.5 px-4">Fichiers associés</th>
+                            <th class="py-2.5 px-4 text-right">Actions</th>
+                        </tr>
+                    </thead>
+                    <tbody id="sound-sites-tbody" class="divide-y divide-anthracite-700/60 text-xs"></tbody>
+                </table>
+            </div>
+
+            <div class="pt-2 flex justify-end">
+                <button type="button" onclick="closeModal('modal-sound-sites')" class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-600 text-slate-200 text-xs font-semibold transition">
+                    Fermer
+                </button>
+            </div>
+        </div>
+    </div>
+
+    <!-- ========================================================= -->
+    <!-- MODALE : GÉNÉRATION LET'S ENCRYPT                         -->
+    <!-- ========================================================= -->
+    <div id="modal-cert-letsencrypt" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/80 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-xl w-full p-6 shadow-2xl space-y-5 my-auto">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div class="flex items-center gap-3">
+                    <div class="w-10 h-10 rounded-xl bg-emerald-500/20 text-emerald-400 flex items-center justify-center font-bold">
+                        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3 class="text-base sm:text-lg font-bold text-white">Générer avec Let's Encrypt</h3>
+                        <p class="text-xs text-slate-300">Émission automatique d'un certificat TLS gratuit via protocole ACME HTTP-01.</p>
+                    </div>
+                </div>
+                <button type="button" onclick="closeModal('modal-cert-letsencrypt')" class="text-slate-400 hover:text-white p-1">✕</button>
+            </div>
+
+            <form id="form-cert-letsencrypt" class="space-y-4">
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Nom / Label du certificat</label>
+                    <input type="text" name="name" placeholder="ex: Let's Encrypt PBX Principal"
+                        class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-white text-xs focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                </div>
+
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Nom de Domaine FQDN *</label>
+                    <input type="text" name="domain" required placeholder="ex: pbx.mondomaine.fr"
+                        class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-white text-xs font-mono focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                    <p class="text-[11px] text-slate-400 mt-1">Le domaine doit impérativement pointer vers l'adresse IP publique de ce serveur (Enregistrement DNS A) et le port 80 doit être ouvert.</p>
+                </div>
+
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Email de l'Administrateur *</label>
+                    <input type="email" name="email" required placeholder="ex: admin@mondomaine.fr"
+                        class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-white text-xs focus:ring-2 focus:ring-emerald-500 focus:outline-none">
+                    <p class="text-[11px] text-slate-400 mt-1">Utilisé par l'autorité Let's Encrypt pour les rappels de renouvellement et alertes de sécurité.</p>
+                </div>
+
+                <div class="space-y-2 pt-2 border-t border-anthracite-700/60">
+                    <label class="flex items-center gap-2.5 cursor-pointer text-xs text-slate-200">
+                        <input type="checkbox" name="is_default" value="1" checked class="w-4 h-4 rounded text-emerald-600 bg-anthracite-900 border-anthracite-700 focus:ring-emerald-500">
+                        <span class="font-semibold text-emerald-300">Activer immédiatement par défaut pour Asterisk PJSIP TLS & SRTP</span>
+                    </label>
+
+                    <label class="flex items-center gap-2.5 cursor-pointer text-xs text-slate-400">
+                        <input type="checkbox" name="staging" value="1" class="w-4 h-4 rounded text-amber-600 bg-anthracite-900 border-anthracite-700 focus:ring-amber-500">
+                        <span>Mode test Staging (recommandé pour tester sans consommer les quotas Let's Encrypt)</span>
+                    </label>
+                </div>
+
+                <div id="letsencrypt-msg-box" class="hidden p-3 rounded-xl text-xs font-mono whitespace-pre-wrap leading-relaxed max-h-40 overflow-y-auto"></div>
+
+                <div class="pt-3 flex justify-end gap-3 border-t border-anthracite-700">
+                    <button type="button" onclick="closeModal('modal-cert-letsencrypt')"
+                        class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-600 text-slate-200 text-xs font-semibold transition">
+                        Annuler
+                    </button>
+                    <button type="submit" id="btn-submit-letsencrypt"
+                        class="px-5 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-500 text-white text-xs font-semibold flex items-center gap-2 shadow-lg shadow-emerald-600/20 transition">
+                        <span id="spinner-letsencrypt" class="hidden animate-spin">↻</span>
+                        <span id="btn-text-letsencrypt">Lancer l'émission ACME</span>
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- ========================================================= -->
+    <!-- MODALE : IMPORT CERTIFICAT PERSONNALISÉ (DIGICERT, ETC.)  -->
+    <!-- ========================================================= -->
+    <div id="modal-cert-custom" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/80 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-800 border border-anthracite-700 rounded-2xl max-w-2xl w-full p-6 shadow-2xl space-y-5 my-auto">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div class="flex items-center gap-3">
+                    <div class="w-10 h-10 rounded-xl bg-cyan-500/20 text-cyan-400 flex items-center justify-center font-bold">
+                        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3 class="text-base sm:text-lg font-bold text-white">Importer un Certificat SSL / TLS</h3>
+                        <p class="text-xs text-slate-300">Compatible avec DigiCert, Sectigo, OVH, Comodo, Certificats Wildcard (*.domaine.fr).</p>
+                    </div>
+                </div>
+                <button type="button" onclick="closeModal('modal-cert-custom')" class="text-slate-400 hover:text-white p-1">✕</button>
+            </div>
+
+            <form id="form-cert-custom" class="space-y-4" enctype="multipart/form-data">
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Nom / Description du certificat</label>
+                    <input type="text" name="name" placeholder="ex: DigiCert Wildcard SIP 2026"
+                        class="w-full px-3 py-2 rounded-xl bg-anthracite-900 border border-anthracite-700 text-white text-xs focus:ring-2 focus:ring-cyan-500 focus:outline-none">
+                </div>
+
+                <!-- Certificat Public -->
+                <div class="space-y-1.5">
+                    <div class="flex items-center justify-between">
+                        <label class="block text-xs font-medium text-slate-300">Certificat Public (.crt / .pem) *</label>
+                        <input type="file" id="file-cert-custom" name="cert_file" accept=".crt,.pem,.cer" class="text-[11px] text-slate-400 file:mr-2 file:py-1 file:px-2 file:rounded-lg file:border-0 file:text-[10px] file:bg-anthracite-700 file:text-slate-200 hover:file:bg-anthracite-600 cursor-pointer">
+                    </div>
+                    <textarea name="cert_pem" id="textarea-cert-pem" rows="4" placeholder="-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----"
+                        class="w-full p-2.5 rounded-xl bg-anthracite-900 border border-anthracite-700 text-slate-200 text-xs font-mono focus:ring-2 focus:ring-cyan-500 focus:outline-none"></textarea>
+                </div>
+
+                <!-- Clé Privée -->
+                <div class="space-y-1.5">
+                    <div class="flex items-center justify-between">
+                        <label class="block text-xs font-medium text-slate-300">Clé Privée (.key / RSA / EC) *</label>
+                        <input type="file" id="file-key-custom" name="key_file" accept=".key,.pem" class="text-[11px] text-slate-400 file:mr-2 file:py-1 file:px-2 file:rounded-lg file:border-0 file:text-[10px] file:bg-anthracite-700 file:text-slate-200 hover:file:bg-anthracite-600 cursor-pointer">
+                    </div>
+                    <textarea name="key_pem" id="textarea-key-pem" rows="4" placeholder="-----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----"
+                        class="w-full p-2.5 rounded-xl bg-anthracite-900 border border-anthracite-700 text-slate-200 text-xs font-mono focus:ring-2 focus:ring-cyan-500 focus:outline-none"></textarea>
+                </div>
+
+                <!-- Chaîne Intermédiaire (Optionnelle) -->
+                <div class="space-y-1.5">
+                    <div class="flex items-center justify-between">
+                        <label class="block text-xs font-medium text-slate-300">Chaîne Intermédiaire / CA Bundle (Optionnel)</label>
+                        <input type="file" id="file-chain-custom" name="chain_file" accept=".crt,.pem,.ca-bundle" class="text-[11px] text-slate-400 file:mr-2 file:py-1 file:px-2 file:rounded-lg file:border-0 file:text-[10px] file:bg-anthracite-700 file:text-slate-200 hover:file:bg-anthracite-600 cursor-pointer">
+                    </div>
+                    <textarea name="chain_pem" id="textarea-chain-pem" rows="3" placeholder="-----BEGIN CERTIFICATE----- (CA Intermédiaire) ... -----END CERTIFICATE-----"
+                        class="w-full p-2.5 rounded-xl bg-anthracite-900 border border-anthracite-700 text-slate-200 text-xs font-mono focus:ring-2 focus:ring-cyan-500 focus:outline-none"></textarea>
+                </div>
+
+                <div class="pt-2 border-t border-anthracite-700/60">
+                    <label class="flex items-center gap-2.5 cursor-pointer text-xs text-slate-200">
+                        <input type="checkbox" name="is_default" value="1" checked class="w-4 h-4 rounded text-cyan-600 bg-anthracite-900 border-anthracite-700 focus:ring-cyan-500">
+                        <span class="font-semibold text-cyan-300">Activer immédiatement par défaut pour le transport PJSIP TLS (5061)</span>
+                    </label>
+                </div>
+
+                <div id="custom-cert-msg-box" class="hidden p-3 rounded-xl text-xs font-mono whitespace-pre-wrap leading-relaxed max-h-40 overflow-y-auto"></div>
+
+                <div class="pt-3 flex justify-end gap-3 border-t border-anthracite-700">
+                    <button type="button" onclick="closeModal('modal-cert-custom')"
+                        class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-600 text-slate-200 text-xs font-semibold transition">
+                        Annuler
+                    </button>
+                    <button type="submit" id="btn-submit-custom-cert"
+                        class="px-5 py-2 rounded-xl bg-cyan-600 hover:bg-cyan-500 text-white text-xs font-semibold flex items-center gap-2 shadow-lg shadow-cyan-600/20 transition">
+                        <span id="spinner-custom-cert" class="hidden animate-spin">↻</span>
+                        <span>Vérifier la Clé & Enregistrer</span>
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- Modal Édition d'un Code de Fonction -->
+    <div id="modal-edit-feature-code" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/80 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="relative w-full max-w-md rounded-2xl bg-anthracite-800 border border-anthracite-700 shadow-2xl p-6 space-y-4">
+            <div class="flex items-center justify-between pb-3 border-b border-anthracite-700">
+                <div class="flex items-center gap-2.5">
+                    <div class="w-8 h-8 rounded-xl bg-indigo-500/20 text-indigo-400 flex items-center justify-center font-bold">
+                        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3 class="text-sm font-bold text-white">Personnaliser le Code de Fonction</h3>
+                        <div id="modal-fc-service-name" class="text-[11px] text-slate-400">Service</div>
+                    </div>
+                </div>
+                <button type="button" onclick="closeModal('modal-edit-feature-code')" class="text-slate-400 hover:text-white p-1">✕</button>
+            </div>
+
+            <form id="form-edit-feature-code" class="space-y-4">
+                <input type="hidden" id="edit-fc-id" name="id">
+
+                <div>
+                    <label class="block text-xs font-medium text-slate-300 mb-1">Code / Préfixe de composition *</label>
+                    <input type="text" id="edit-fc-code" name="code" required
+                        class="w-full px-3 py-2 rounded-xl bg-anthracite-950 border border-anthracite-700 text-white font-mono text-sm focus:ring-2 focus:ring-indigo-500 focus:outline-none">
+                    <p class="text-[11px] text-slate-400 mt-1">Généralement commence par <code class="text-indigo-300">*</code> ou <code class="text-indigo-300">**</code> (ex: <code class="text-indigo-300">*72</code>, <code class="text-indigo-300">**</code>).</p>
+                </div>
+
+                <div class="p-3 bg-anthracite-950 rounded-xl border border-anthracite-700/60 text-xs text-slate-300">
+                    <div class="text-[10px] uppercase font-bold text-slate-400">Code standard recommandé</div>
+                    <div id="modal-fc-default-code" class="font-mono text-cyan-400 text-sm mt-0.5">*72</div>
+                </div>
+
+                <div class="pt-3 flex justify-end gap-3 border-t border-anthracite-700">
+                    <button type="button" onclick="closeModal('modal-edit-feature-code')"
+                        class="px-4 py-2 rounded-xl bg-anthracite-700 hover:bg-anthracite-600 text-slate-200 text-xs font-semibold transition">
+                        Annuler
+                    </button>
+                    <button type="submit" id="btn-submit-edit-fc"
+                        class="px-5 py-2 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-semibold flex items-center gap-2 shadow-lg shadow-indigo-600/20 transition">
+                        <span id="spinner-edit-fc" class="hidden animate-spin">↻</span>
+                        <span>Enregistrer & Recharger</span>
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- MODAL : JOURNAL DES ÉVÉNEMENTS DE SÉCURITÉ ET ATTAQUES -->
+    <div id="modal-security-events" class="fixed inset-0 z-50 flex items-center justify-center bg-black/70 backdrop-blur-sm hidden p-4">
+        <div class="bg-anthracite-900 border border-anthracite-700 rounded-2xl w-full max-w-4xl max-h-[85vh] flex flex-col shadow-2xl overflow-hidden animate-fade-in">
+            <div class="px-6 py-4 border-b border-anthracite-700 flex items-center justify-between bg-anthracite-800">
+                <div class="flex items-center gap-3">
+                    <span class="p-2 rounded-xl bg-rose-500/15 text-rose-400 border border-rose-500/30">
+                        <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"/>
+                        </svg>
+                    </span>
+                    <div>
+                        <h3 class="text-base font-bold text-white">Journal des Tentatives d'Intrusion Interceptées</h3>
+                        <p class="text-xs text-slate-300">Événements de sécurité extraits en temps réel depuis Asterisk & Fail2ban</p>
+                    </div>
+                </div>
+                <button type="button" onclick="closeModal('modal-security-events')" class="text-slate-400 hover:text-white text-xl p-1 transition">✕</button>
+            </div>
+
+            <div class="p-6 overflow-y-auto flex-1 space-y-4">
+                <div class="p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700 text-xs text-slate-300 flex items-center justify-between">
+                    <div>
+                        <b class="text-white">Fonctionnement du filtre :</b>
+                        <span>Fail2ban analyse les échecs d'authentification SIP (mauvais mot de passe ou tentative de scan) et bannit temporairement l'IP source au bout de 3 tentatives.</span>
+                    </div>
+                    <span class="px-2.5 py-1 rounded-full text-[10px] font-bold bg-emerald-500/15 text-emerald-300 border border-emerald-500/30 whitespace-nowrap ml-3">Actif</span>
+                </div>
+
+                <div class="overflow-x-auto rounded-xl border border-anthracite-700">
+                    <table class="w-full text-left border-collapse text-xs">
+                        <thead>
+                            <tr class="border-b border-anthracite-700 text-[11px] font-semibold uppercase tracking-wider text-slate-300 bg-anthracite-950/80">
+                                <th class="py-2.5 px-3">Date / Heure</th>
+                                <th class="py-2.5 px-3">Service</th>
+                                <th class="py-2.5 px-3">Type d'incident</th>
+                                <th class="py-2.5 px-3">Poste / Compte visé</th>
+                                <th class="py-2.5 px-3">Adresse IP Source</th>
+                            </tr>
+                        </thead>
+                        <tbody id="security-events-tbody" class="divide-y divide-anthracite-800 bg-anthracite-950/40">
+                        </tbody>
+                    </table>
+                    <div id="security-events-empty" class="hidden p-8 text-center text-slate-400 text-xs">
+                        Aucun événement de sécurité ou tentative suspecte détectée récemment.
+                    </div>
+                </div>
+            </div>
+
+            <div class="px-6 py-3.5 border-t border-anthracite-700 flex justify-between items-center bg-anthracite-800/80">
+                <span class="text-[11px] text-slate-400 font-mono">Fichier source : /var/log/asterisk/security.log</span>
+                <div class="flex gap-2">
+                    <button type="button" onclick="clearSecurityLog()" class="px-3 py-1.5 rounded-xl text-xs font-semibold bg-rose-600/20 hover:bg-rose-600/30 text-rose-300 border border-rose-500/30 transition flex items-center gap-1.5">
+                        <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"/></svg>
+                        Vider le journal
+                    </button>
+                    <button type="button" onclick="openSecurityEventsModal()" class="px-3 py-1.5 rounded-xl text-xs font-semibold bg-anthracite-700 hover:bg-anthracite-600 text-white transition flex items-center gap-1.5">
+                        <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg>
+                        Rafraîchir
+                    </button>
+                    <button type="button" onclick="closeModal('modal-security-events')" class="px-4 py-1.5 rounded-xl text-xs font-semibold bg-indigo-600 hover:bg-indigo-500 text-white transition">
+                        Fermer
+                    </button>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <!-- ===================================================================== -->
+    <!-- MODAL : CONTACT ANNUAIRE (INTERNE / EXTERNE)                          -->
+    <!-- ===================================================================== -->
+    <div id="modal-phonebook-contact" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-900 border border-anthracite-700 rounded-2xl w-full max-w-lg shadow-2xl overflow-hidden my-6">
+            <div class="px-6 py-4 border-b border-anthracite-700/80 flex items-center justify-between bg-anthracite-800">
+                <div class="flex items-center gap-2">
+                    <span class="w-2.5 h-2.5 rounded-full bg-teal-400"></span>
+                    <h3 id="modal-phonebook-title" class="text-base font-bold text-white">Nouveau Contact Annuaire</h3>
+                </div>
+                <button type="button" onclick="closeModal('modal-phonebook-contact')" class="text-slate-400 hover:text-white transition">
+                    <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/></svg>
+                </button>
+            </div>
+
+            <form id="form-phonebook-contact" onsubmit="savePhonebookContact(event)" class="p-6 space-y-4">
+                <input type="hidden" name="id" value="">
+                <input type="hidden" name="extension_id" value="">
+                <input type="hidden" name="is_internal" value="0">
+                <input type="hidden" name="photo_url" id="phonebook-input-photo-url" value="">
+
+                <!-- Photo / Avatar preview & Upload -->
+                <div class="flex items-center gap-4 p-3.5 rounded-xl bg-anthracite-950 border border-anthracite-700">
+                    <div id="phonebook-avatar-preview" class="w-14 h-14 rounded-full bg-teal-600/30 border border-teal-500/40 text-teal-300 flex items-center justify-center font-bold text-lg overflow-hidden shrink-0 shadow-inner">
+                        ?
+                    </div>
+                    <div class="flex-1 space-y-1">
+                        <label class="block text-xs font-semibold text-slate-200">Photo / Avatar du Contact</label>
+                        <p class="text-[11px] text-slate-400">Affiché sur l'interface et sur les téléphones Yealink écran couleur (T54W, T57W...).</p>
+                        <div class="flex items-center gap-2 pt-1">
+                            <label class="px-3 py-1 rounded-lg text-xs font-medium bg-anthracite-800 hover:bg-anthracite-750 text-slate-200 border border-anthracite-600 cursor-pointer transition">
+                                <span>Choisir une photo...</span>
+                                <input type="file" id="phonebook-photo-file" accept="image/jpeg,image/png,image/webp" onchange="uploadContactPhoto(this)" class="hidden">
+                            </label>
+                            <button type="button" id="phonebook-btn-clear-photo" onclick="clearContactPhoto()" class="text-xs text-rose-400 hover:text-rose-300 hidden">
+                                Supprimer
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Nom d'affichage -->
+                <div>
+                    <label class="block text-xs font-medium text-slate-200 mb-1">Nom d'affichage <span class="text-rose-400">*</span></label>
+                    <input type="text" name="display_name" required placeholder="Ex: Jean Dupont, Service Client, Taxi..."
+                        class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-teal-500">
+                </div>
+
+                <!-- Numéros de téléphone (Ligne 1 : Poste Interne & Mobile) -->
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Numéro Poste Interne</label>
+                        <input type="text" name="internal_number" placeholder="Ex: 101, 200..."
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono focus:outline-none focus:border-teal-500">
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Téléphone Mobile</label>
+                        <input type="text" name="mobile_number" placeholder="Ex: 06 12 34 56 78"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono focus:outline-none focus:border-teal-500">
+                    </div>
+                </div>
+
+                <!-- Numéros de téléphone (Ligne 2 : Autre Numéro & Email) -->
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Autre Numéro / Ligne Directe</label>
+                        <input type="text" name="other_number" placeholder="Ex: 01 23 45 67 89"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white font-mono focus:outline-none focus:border-teal-500">
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-200 mb-1">Adresse Email</label>
+                        <input type="email" name="email" placeholder="contact@domaine.fr"
+                            class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-teal-500">
+                    </div>
+                </div>
+
+                <!-- Groupe d'Annuaire -->
+                <div>
+                    <label class="block text-xs font-medium text-slate-200 mb-1">Groupe d'Annuaire <span class="text-rose-400">*</span></label>
+                    <input type="text" name="group_name" id="phonebook-input-group" list="phonebook-groups-datalist" required placeholder="Ex: Issy-Les-Moulineaux, Groupe Nice, Direction..."
+                        class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-teal-500">
+                    <datalist id="phonebook-groups-datalist"></datalist>
+                    <p class="text-[11px] text-slate-400 mt-1">Ce nom de groupe correspond au paramètre <code class="text-teal-300">?cgroup=...</code> dans l'URL Yealink.</p>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end gap-2">
+                    <button type="button" onclick="closeModal('modal-phonebook-contact')" class="px-4 py-2 rounded-xl text-xs font-medium bg-anthracite-800 hover:bg-anthracite-700 text-slate-300 transition">
+                        Annuler
+                    </button>
+                    <button type="submit" class="px-4 py-2 rounded-xl text-xs font-bold bg-teal-600 hover:bg-teal-500 text-white shadow-lg shadow-teal-600/20 transition">
+                        Enregistrer le Contact
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <!-- ===================================================================== -->
+    <!-- MODAL : URL XML YEALINK REMOTE PHONEBOOK (cm_to_yl_ab.php)            -->
+    <!-- ===================================================================== -->
+    <div id="modal-yealink-xml" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/75 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-900 border border-anthracite-700 rounded-2xl w-full max-w-2xl shadow-2xl overflow-hidden my-6">
+            <div class="px-6 py-4 border-b border-anthracite-700/80 flex items-center justify-between bg-anthracite-800">
+                <div class="flex items-center gap-2">
+                    <span class="w-2.5 h-2.5 rounded-full bg-teal-400"></span>
+                    <h3 class="text-base font-bold text-white">URL XML Téléphones IP (<code class="text-teal-300 font-mono">phonebook.php</code>)</h3>
+                </div>
+                <button type="button" onclick="closeModal('modal-yealink-xml')" class="text-slate-400 hover:text-white transition">
+                    <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/></svg>
+                </button>
+            </div>
+
+            <div class="p-6 space-y-4">
+                <div class="p-4 rounded-xl bg-teal-500/10 border border-teal-500/20 text-xs text-teal-200 space-y-1">
+                    <div class="font-bold flex items-center gap-1.5">
+                        <svg class="w-4 h-4 text-teal-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>
+                        Comment configurer votre téléphone Yealink ?
+                    </div>
+                    <p class="text-slate-300">Dans l'interface web de votre Yealink (ex: T54W, T46S, DECT W60/W70), rendez-vous dans le menu :</p>
+                    <p class="font-mono text-teal-300 bg-anthracite-950/60 px-2 py-1 rounded">Directory &gt; Remote Phonebook &gt; Phonebook URL</p>
+                    <p class="text-slate-300">Collez simplement l'URL correspondant au groupe souhaité ci-dessous. Le téléphone téléchargera et mettra à jour l'annuaire automatiquement.</p>
+                </div>
+
+                <!-- Sélecteur de Groupe -->
+                <div>
+                    <label class="block text-xs font-semibold text-slate-200 mb-1">Sélectionner le Groupe d'Annuaire</label>
+                    <select id="yealink-modal-group-select" onchange="updateYealinkXmlUrls()"
+                        class="w-full px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-sm text-white focus:outline-none focus:border-teal-500">
+                        <option value="all">Tous les groupes (Annuaire complet de l'entreprise)</option>
+                    </select>
+                </div>
+
+                <!-- URL 1 : Port 8080 (Format FreePBX classique HTTP) -->
+                <div class="space-y-1">
+                    <div class="flex items-center justify-between text-xs">
+                        <span class="font-semibold text-white flex items-center gap-1.5">
+                            <span class="w-2 h-2 rounded-full bg-emerald-400"></span>
+                            <span>URL Recommandée (HTTP Port 8080 - Compatible tout Yealink)</span>
+                        </span>
+                        <span class="text-[10px] text-emerald-400 font-mono font-bold">Sans certificat SSL requis</span>
+                    </div>
+                    <div class="flex items-center gap-2">
+                        <input type="text" id="yealink-url-8080" readonly
+                            class="flex-1 px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs font-mono text-teal-300 select-all">
+                        <button type="button" onclick="copyYealinkUrl('yealink-url-8080', this)"
+                            class="px-3.5 py-2 rounded-lg text-xs font-bold bg-teal-600 hover:bg-teal-500 text-white transition shrink-0 flex items-center gap-1">
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 5H6a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2v-1M8 5a2 2 0 002 2h2a2 2 0 002-2M8 5a2 2 0 012-2h2a2 2 0 012 2m0 0h2a2 2 0 012 2v3m2 4H10m0 0l3-3m-3 3l3 3"/></svg>
+                            <span>Copier</span>
+                        </button>
+                    </div>
+                </div>
+
+                <!-- Info Mode Strict Port 80 -->
+                <div class="p-2.5 rounded-lg bg-emerald-500/10 border border-emerald-500/20 text-[11px] text-emerald-300 flex items-center gap-2">
+                    <svg class="w-4 h-4 shrink-0 text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>
+                    <span><strong>Sécurité :</strong> Le port 80 standard est réservé aux challenges Let's Encrypt Certbot. L'annuaire XML pour vos postes IP est servi sur le port dédié <strong>8080</strong> ou en <strong>HTTPS</strong> via <code class="text-teal-300 font-mono">phonebook.php</code>.</span>
+                </div>
+
+                <!-- URL 2 : Port 8443 / 443 HTTPS Chiffré -->
+                <div class="space-y-1">
+                    <div class="flex items-center justify-between text-xs">
+                        <span class="font-semibold text-slate-300 flex items-center gap-1.5">
+                            <span class="w-2 h-2 rounded-full bg-indigo-400"></span>
+                            <span>URL Chiffrée (HTTPS Port 8443 / 443)</span>
+                        </span>
+                        <span class="text-[10px] text-slate-400 font-mono">Nécessite certificat approuvé par le poste</span>
+                    </div>
+                    <div class="flex items-center gap-2">
+                        <input type="text" id="yealink-url-https" readonly
+                            class="flex-1 px-3 py-2 rounded-lg bg-anthracite-950 border border-anthracite-700 text-xs font-mono text-slate-300 select-all">
+                        <button type="button" onclick="copyYealinkUrl('yealink-url-https', this)"
+                            class="px-3.5 py-2 rounded-lg text-xs font-semibold bg-anthracite-800 hover:bg-anthracite-750 text-slate-200 border border-anthracite-600 transition shrink-0">
+                            Copier
+                        </button>
+                    </div>
+                </div>
+
+                <!-- Aperçu en direct du XML généré -->
+                <div class="space-y-1 pt-2 border-t border-anthracite-700/80">
+                    <div class="flex items-center justify-between text-xs">
+                        <span class="font-semibold text-slate-300">Aperçu en Direct du Flux XML Yealink</span>
+                        <a id="yealink-open-browser-btn" href="#" target="_blank" class="text-teal-400 hover:text-teal-300 text-[11px] underline">
+                            Ouvrir dans le navigateur ↗
+                        </a>
+                    </div>
+                    <pre id="yealink-xml-preview" class="p-3 rounded-xl bg-anthracite-950 border border-anthracite-700 font-mono text-[11px] text-teal-300 overflow-x-auto max-h-48 whitespace-pre-wrap select-all">Chargement du flux XML...</pre>
+                </div>
+
+                <div class="pt-3 border-t border-anthracite-700 flex justify-end">
+                    <button type="button" onclick="closeModal('modal-yealink-xml')" class="px-5 py-2 rounded-xl text-xs font-bold bg-indigo-600 hover:bg-indigo-500 text-white transition">
+                        Fermer
+                    </button>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <script src="/assets/app.js?v=<?= filemtime(__DIR__ . '/assets/app.js') ?>"></script>
+</body>
+</html>
diff --git a/public/phonebook.php b/public/phonebook.php
new file mode 100644
index 0000000..5038539
--- /dev/null
+++ b/public/phonebook.php
@@ -0,0 +1,43 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * NexusPBX - Annuaire Téléphonique Remote XML pour Téléphones IP (Yealink, Fanvil, Grandstream, Snom...)
+ *
+ * Utilisation :
+ *   http://<PBX_IP>:8080/phonebook.php?group=Issy-Les-Moulineaux
+ *   http://<PBX_IP>:8080/phonebook.php?group=all
+ */
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/PhonebookManager.php';
+
+header('Content-Type: text/xml; charset=utf-8');
+header('Cache-Control: no-cache, no-store, must-revalidate');
+header('Pragma: no-cache');
+header('Expires: 0');
+
+try {
+    $db = App\Database::getConnection();
+
+    // Support de ?group= et rétro-compatibilité avec ?cgroup= (FreePBX)
+    $group = 'all';
+    if (!empty($_GET['group'])) {
+        $group = trim((string)$_GET['group']);
+    } elseif (!empty($_GET['cgroup'])) {
+        $group = trim((string)$_GET['cgroup']);
+    }
+
+    // Génération du flux XML Yealink IP Phone
+    echo App\PhonebookManager::renderYealinkXml($db, $group);
+} catch (\Throwable $e) {
+    // Si une erreur survient, on renvoie un XML d'annuaire valide vide avec le message d'erreur
+    $errMsg = htmlspecialchars($e->getMessage(), ENT_XML1, 'UTF-8');
+    echo <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<YealinkIPPhoneDirectory>
+  <Title>Erreur Annuaire</Title>
+  <!-- Erreur: {$errMsg} -->
+</YealinkIPPhoneDirectory>
+XML;
+}
diff --git a/scripts/nexus-firewall b/scripts/nexus-firewall
new file mode 100755
index 0000000..55326d1
--- /dev/null
+++ b/scripts/nexus-firewall
@@ -0,0 +1,79 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/FirewallManager.php';
+
+use App\Database;
+use App\FirewallManager;
+
+$cmd = strtolower($argv[1] ?? 'status');
+
+switch ($cmd) {
+    case 'status':
+        $st = FirewallManager::getStatus(true);
+        $settings = $st['settings'];
+        echo "=== Statut Pare-feu & Sécurité NexusPBX ===\n";
+        echo "• Service Fail2ban       : " . ($st['is_running'] ? "\033[32mACTIF (En ligne)\033[0m" : "\033[31mARRÊTÉ\033[0m") . "\n";
+        echo "• Pare-feu & Filtrage    : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
+        echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
+        echo "• Port HTTPS Admin       : " . ($settings['admin_https_port'] ?? 8443) . "\n";
+        echo "• Total IPs Bannies      : " . $st['total_banned'] . "\n";
+        if (!empty($st['banned_ips'])) {
+            echo "\nListe des IPs bannies :\n";
+            foreach ($st['banned_ips'] as $b) {
+                echo "  - {$b['ip']} (Prison: {$b['jail']} - {$b['jail_label']})\n";
+            }
+        }
+        echo "===========================================\n";
+        break;
+
+    case 'on':
+    case 'enable':
+        $db = Database::getConnection();
+        $db->exec("UPDATE settings SET firewall_enabled = 1, certbot_strict_port80 = 1 WHERE id = 1");
+        shell_exec('systemctl start fail2ban 2>&1');
+        $settings = FirewallManager::getSettings();
+        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 1);
+        @unlink('/tmp/nexus_fw_status_cache.json');
+        echo "\033[32m[OK] Pare-feu NexusPBX activé avec succès (Mode Strict + Fail2ban démarré).\033[0m\n";
+        break;
+
+    case 'off':
+    case 'disable':
+        $db = Database::getConnection();
+        $db->exec("UPDATE settings SET firewall_enabled = 0, certbot_strict_port80 = 0 WHERE id = 1");
+        shell_exec('systemctl stop fail2ban 2>&1');
+        $settings = FirewallManager::getSettings();
+        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 0);
+        @unlink('/tmp/nexus_fw_status_cache.json');
+        echo "\033[33m[OK] Pare-feu NexusPBX désactivé (Mode normal + Fail2ban arrêté).\033[0m\n";
+        break;
+
+    case 'unban':
+        $ip = $argv[2] ?? '';
+        if (!$ip) {
+            echo "Usage: nexus-firewall unban <ip>\n";
+            exit(1);
+        }
+        $res = FirewallManager::unbanIp($ip, 'all');
+        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
+        break;
+
+    case 'ban':
+        $ip = $argv[2] ?? '';
+        $jail = $argv[3] ?? 'asterisk';
+        if (!$ip) {
+            echo "Usage: nexus-firewall ban <ip> [jail]\n";
+            exit(1);
+        }
+        $res = FirewallManager::banIp($ip, $jail);
+        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
+        break;
+
+    default:
+        echo "Usage: nexus-firewall [status|on|off|ban <ip>|unban <ip>]\n";
+        exit(1);
+}
+
diff --git a/scripts/nexus_autobackup.php b/scripts/nexus_autobackup.php
new file mode 100755
index 0000000..6c4c674
--- /dev/null
+++ b/scripts/nexus_autobackup.php
@@ -0,0 +1,23 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Script d'automatisation des sauvegardes périodiques NexusPBX
+ * Exécuté automatiquement par cron (ex: toutes les heures ou selon la fréquence programmée)
+ */
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/ConfigGenerator.php';
+require_once __DIR__ . '/../src/AmiClient.php';
+require_once __DIR__ . '/../src/BackupManager.php';
+
+use App\BackupManager;
+
+try {
+    $result = BackupManager::runAutoBackupCron();
+    echo date('[Y-m-d H:i:s] ') . "NexusPBX Backup Cron: " . json_encode($result, JSON_UNESCAPED_SLASHES) . "\n";
+} catch (Throwable $e) {
+    echo date('[Y-m-d H:i:s] ') . "NexusPBX Backup Cron ERROR: " . $e->getMessage() . "\n";
+    exit(1);
+}
+
diff --git a/scripts/setup-debian.sh b/scripts/setup-debian.sh
new file mode 100755
index 0000000..78653fd
--- /dev/null
+++ b/scripts/setup-debian.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "=== Configuration Debian pour NexusPBX ==="
+
+# 1. Ajout de www-data au groupe asterisk
+usermod -aG asterisk www-data
+
+# 2. Création d'un certificat TLS local de secours pour PJSIP TLS (port 5061)
+mkdir -p /etc/asterisk/keys
+if [ ! -f /etc/asterisk/keys/asterisk.crt ]; then
+    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout /etc/asterisk/keys/asterisk.key \
+        -out /etc/asterisk/keys/asterisk.crt \
+        -subj "/C=FR/ST=IDF/L=Paris/O=NexusPBX/CN=pbx.local" 2>/dev/null
+fi
+
+# 3. Configuration de l'AMI (/etc/asterisk/manager.conf) sur 127.0.0.1:5038
+cat << 'EOF' > /etc/asterisk/manager.conf
+[general]
+enabled = yes
+port = 5038
+bindaddr = 127.0.0.1
+displayconnects = no
+timestampevents = yes
+
+[pbxgui]
+secret = AsteriskAmi2026!
+deny = 0.0.0.0/0.0.0.0
+permit = 127.0.0.1/255.255.255.0
+read = all
+write = all
+EOF
+
+# 4. Fichiers .custom.conf initiaux et inclusions dans pjsip.conf et extensions.conf
+touch /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
+
+if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf; then
+    printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
+fi
+
+if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf; then
+    printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
+fi
+
+# 5. Permissions Debian strictes pour asterisk:asterisk et accès groupe www-data
+chown -R asterisk:asterisk /etc/asterisk
+chmod 2775 /etc/asterisk
+chmod 2750 /etc/asterisk/keys
+chmod 0640 /etc/asterisk/keys/asterisk.key /etc/asterisk/keys/asterisk.crt
+chmod 0660 /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
+chmod 0664 /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf
+chmod 0640 /etc/asterisk/manager.conf
+
+# 6. Permissions du projet Web et des répertoires de stockage / sauvegardes
+mkdir -p /var/www/nexus-pbx/storage/backups
+mkdir -p /var/www/nexus-pbx/storage/system_backups
+mkdir -p /var/www/nexus-pbx/storage/sounds
+mkdir -p /var/lib/asterisk/sounds/custom
+mkdir -p /var/spool/asterisk/voicemail/default
+
+chown -R www-data:asterisk /var/www/nexus-pbx
+chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds
+chown -R asterisk:asterisk /var/lib/asterisk/sounds /var/spool/asterisk/voicemail
+chmod -R g+rwX /var/lib/asterisk/sounds /var/spool/asterisk/voicemail
+
+# Configuration du cron pour sauvegardes automatiques NexusPBX
+cat << 'EOF' > /etc/cron.d/nexus-backup
+# Sauvegardes programmées automatiques NexusPBX
+*/10 * * * * www-data /usr/bin/php /var/www/nexus-pbx/scripts/nexus_autobackup.php >> /var/log/nexus_backup.log 2>&1
+EOF
+chmod 0644 /etc/cron.d/nexus-backup
+touch /var/log/nexus_backup.log && chown www-data:asterisk /var/log/nexus_backup.log && chmod 664 /var/log/nexus_backup.log
+
+# 7. Configuration du VirtualHost Nginx (Port 80)
+PHP_SOCK=$(find /run/php/ -name "php*-fpm.sock" | head -n 1)
+if [ -z "$PHP_SOCK" ]; then
+    PHP_SOCK="/run/php/php8.4-fpm.sock"
+fi
+
+cat << EOF > /etc/nginx/sites-available/nexus-pbx
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    root /var/www/nexus-pbx/public;
+    index index.php;
+
+    access_log /var/log/nginx/nexus-pbx.access.log;
+    error_log  /var/log/nginx/nexus-pbx.error.log;
+
+    location / {
+        try_files \$uri \$uri/ /index.php?\$query_string;
+    }
+
+    location ~ \.php\$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF
+
+chown root:asterisk /etc/nginx/sites-available/nexus-pbx
+chmod 664 /etc/nginx/sites-available/nexus-pbx
+rm -f /etc/nginx/sites-enabled/default
+ln -sf /etc/nginx/sites-available/nexus-pbx /etc/nginx/sites-enabled/nexus-pbx
+
+# 8. Redémarrage des services Debian
+systemctl restart php8.4-fpm
+nginx -t && systemctl restart nginx
+systemctl restart asterisk
+
+echo "=== Déploiement NexusPBX terminé avec succès ==="
diff --git a/scripts/setup-nexus.sh b/scripts/setup-nexus.sh
new file mode 120000
index 0000000..36547bd
--- /dev/null
+++ b/scripts/setup-nexus.sh
@@ -0,0 +1 @@
+setup-debian.sh
\ No newline at end of file
diff --git a/scripts/voicemail_pass_sync.php b/scripts/voicemail_pass_sync.php
new file mode 100755
index 0000000..b3968bf
--- /dev/null
+++ b/scripts/voicemail_pass_sync.php
@@ -0,0 +1,29 @@
+<?php
+declare(strict_types=1);
+
+// Arguments transmis par Asterisk externpassnotify : <context> <mailbox> <newpassword>
+$context = $argv[1] ?? 'default';
+$mailbox = trim((string)($argv[2] ?? ''));
+$newPass = trim((string)($argv[3] ?? ''));
+
+if ($mailbox === '' || $newPass === '') {
+    exit(0);
+}
+
+require_once __DIR__ . '/../src/Database.php';
+
+try {
+    $db = \App\Database::getConnection();
+    $stmt = $db->prepare('
+        UPDATE extensions 
+        SET voicemail_pin = :pin, force_pin_change = 0 
+        WHERE extension = :ext
+    ');
+    $stmt->execute([
+        ':pin' => $newPass,
+        ':ext' => $mailbox,
+    ]);
+} catch (\Throwable $e) {
+    error_log("[voicemail_pass_sync] Erreur synchronisation PIN : " . $e->getMessage());
+}
+
diff --git a/src/AmiClient.php b/src/AmiClient.php
new file mode 100644
index 0000000..7165035
--- /dev/null
+++ b/src/AmiClient.php
@@ -0,0 +1,227 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use RuntimeException;
+
+class AmiClient
+{
+    public function __construct(
+        private string $host,
+        private int $port,
+        private string $username,
+        private string $secret,
+        private int $timeout = 3
+    ) {}
+
+    public static function fromDatabase(PDO $db): self
+    {
+        $row = $db->query('SELECT ami_host, ami_port, ami_user, ami_secret FROM settings WHERE id = 1')->fetch();
+        return new self(
+            (string)($row['ami_host'] ?? '127.0.0.1'),
+            (int)($row['ami_port'] ?? 5038),
+            (string)($row['ami_user'] ?? 'pbxgui'),
+            (string)($row['ami_secret'] ?? 'AsteriskAmi2026!')
+        );
+    }
+
+    /**
+     * Teste la connexion et l'authentification AMI
+     */
+    public function testConnection(): array
+    {
+        $fp = $this->connectAndLogin($banner);
+        $versionOutput = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'core show version',
+        ]);
+        $this->logoff($fp);
+
+        return [
+            'connected' => true,
+            'banner'    => trim($banner),
+            'version'   => $this->extractCommandOutput($versionOutput),
+        ];
+    }
+
+    /**
+     * Recharge à chaud l'ensemble des modules PJSIP, force le Re-Register SIP immédiat des Trunks, et recharge le Dialplan via AMI
+     */
+    public function reloadPjsipAndDialplan(): array
+    {
+        $fp = $this->connectAndLogin($banner);
+
+        // Recharge l'intégralité de la pile PJSIP (res_pjsip.so, res_pjsip_outbound_registration.so, res_pjsip_endpoint_identifier_ip.so, etc.)
+        $pjsipRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'pjsip reload',
+        ]);
+
+        // Force l'envoi immédiat d'une requête SIP REGISTER vers tous les opérateurs (reprend immédiatement la main si un autre PBX était enregistré)
+        $regRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'pjsip send register *all',
+        ]);
+
+        // Recharge le dialplan (extensions.conf / extensions.custom.conf)
+        $dialplanRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'dialplan reload',
+        ]);
+
+        // Recharge les classes de musique d'attente (musiconhold.conf)
+        $mohRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'moh reload',
+        ]);
+
+        // Recharge le module RTP (plages de ports rtpstart/rtpend & NAT)
+        $rtpRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'module reload res_rtp_asterisk.so',
+        ]);
+
+        // Recharge les touches en cours d'appel (features.conf : transferts ##, *2, etc.)
+        $featuresRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'module reload features',
+        ]);
+
+        // Recharge la messagerie vocale (voicemail.conf & voicemail.custom.conf)
+        $voicemailRes = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'voicemail reload',
+        ]);
+
+        $this->logoff($fp);
+
+        // Laisse 1.25s au scheduler PJSIP (1s) + registrar opérateur (OVH) pour répondre 200 OK avant le rafraîchissement de l'état UI
+        usleep(1250000);
+
+        return [
+            'banner'   => trim($banner),
+            'pjsip'    => $this->extractCommandOutput($pjsipRes),
+            'register' => $this->extractCommandOutput($regRes),
+            'dialplan' => $this->extractCommandOutput($dialplanRes),
+            'moh'      => $this->extractCommandOutput($mohRes),
+        ];
+    }
+
+    /**
+     * Force l'envoi immédiat d'un paquet SIP REGISTER sur un trunk précis ou tous les trunks (*all)
+     */
+    public function forceRegister(string $regObject = '*all'): string
+    {
+        $fp = $this->connectAndLogin($banner);
+        $raw = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => 'pjsip send register ' . $regObject,
+        ]);
+        $this->logoff($fp);
+        usleep(1250000);
+        return $this->extractCommandOutput($raw);
+    }
+
+    /**
+     * Exécute une commande CLI Asterisk via AMI (ex: "pjsip show endpoints")
+     */
+    public function runCommand(string $cliCommand): string
+    {
+        $fp = $this->connectAndLogin($banner);
+        $raw = $this->sendAction($fp, [
+            'Action'  => 'Command',
+            'Command' => $cliCommand,
+        ]);
+        $this->logoff($fp);
+        return $this->extractCommandOutput($raw);
+    }
+
+    /**
+     * @return resource
+     */
+    private function connectAndLogin(?string &$banner = null)
+    {
+        $errno  = 0;
+        $errstr = '';
+        $fp = @fsockopen($this->host, $this->port, $errno, $errstr, $this->timeout);
+        if (!$fp) {
+            throw new RuntimeException("Connexion socket AMI refusée sur {$this->host}:{$this->port} ({$errstr} [{$errno}]). Vérifiez qu'Asterisk et manager.conf sont actifs.");
+        }
+
+        stream_set_timeout($fp, $this->timeout);
+        $banner = (string)fgets($fp, 1024);
+
+        $loginResp = $this->sendAction($fp, [
+            'Action'   => 'Login',
+            'Username' => $this->username,
+            'Secret'   => $this->secret,
+            'Events'   => 'off',
+        ]);
+
+        if (!preg_match('/Response:\s*Success/i', $loginResp)) {
+            fclose($fp);
+            throw new RuntimeException("Échec d'authentification AMI pour l'utilisateur '{$this->username}' sur {$this->host}:{$this->port}.");
+        }
+
+        return $fp;
+    }
+
+    /**
+     * @param resource $fp
+     */
+    private function sendAction($fp, array $headers): string
+    {
+        $packet = '';
+        foreach ($headers as $k => $v) {
+            $packet .= "{$k}: {$v}\r\n";
+        }
+        $packet .= "\r\n";
+
+        fwrite($fp, $packet);
+
+        $response = '';
+        while (!feof($fp)) {
+            $line = fgets($fp, 4096);
+            if ($line === false) {
+                break;
+            }
+            $response .= $line;
+            if (str_ends_with($response, "\r\n\r\n") || str_ends_with($response, "\n\n")) {
+                break;
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * @param resource $fp
+     */
+    private function logoff($fp): void
+    {
+        @fwrite($fp, "Action: Logoff\r\n\r\n");
+        @fclose($fp);
+    }
+
+    private function extractCommandOutput(string $raw): string
+    {
+        $lines = preg_split('/\r?\n/', trim($raw)) ?: [];
+        $clean = [];
+        foreach ($lines as $line) {
+            if (preg_match('/^(Response|Privilege|ActionID|Message):/i', $line)) {
+                continue;
+            }
+            if (str_starts_with($line, 'Output:')) {
+                $val = ltrim(substr($line, 7));
+                if ($val !== '') {
+                    $clean[] = $val;
+                }
+            } elseif ($line !== '--END COMMAND--') {
+                $clean[] = $line;
+            }
+        }
+        return trim(implode("\n", $clean));
+    }
+}
diff --git a/src/Auth.php b/src/Auth.php
new file mode 100644
index 0000000..522b61e
--- /dev/null
+++ b/src/Auth.php
@@ -0,0 +1,81 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+
+class Auth
+{
+    public static function startSession(): void
+    {
+        if (session_status() === PHP_SESSION_NONE) {
+            $sessName = isset($_COOKIE['ASTERISK_PBX_SESS']) && !isset($_COOKIE['NEXUSPBX_SESS'])
+                ? 'ASTERISK_PBX_SESS'
+                : 'NEXUSPBX_SESS';
+            session_name($sessName);
+            session_start([
+                'cookie_httponly' => true,
+                'cookie_samesite' => 'Lax',
+            ]);
+        }
+    }
+
+    public static function isAuthenticated(): bool
+    {
+        self::startSession();
+        return !empty($_SESSION['user_id']) && !empty($_SESSION['username']);
+    }
+
+    public static function getUsername(): string
+    {
+        self::startSession();
+        return (string)($_SESSION['username'] ?? '');
+    }
+
+    public static function login(PDO $db, string $username, string $password): bool
+    {
+        self::startSession();
+        $stmt = $db->prepare('SELECT id, username, password_hash FROM users WHERE username = :u LIMIT 1');
+        $stmt->execute([':u' => trim($username)]);
+        $user = $stmt->fetch();
+
+        if ($user && password_verify($password, $user['password_hash'])) {
+            session_regenerate_id(true);
+            $_SESSION['user_id']  = (int)$user['id'];
+            $_SESSION['username'] = $user['username'];
+            return true;
+        }
+
+        return false;
+    }
+
+    public static function logout(): void
+    {
+        self::startSession();
+        $_SESSION = [];
+        if (ini_get('session.use_cookies')) {
+            $params = session_get_cookie_params();
+            setcookie(
+                session_name(),
+                '',
+                time() - 42000,
+                $params['path'],
+                $params['domain'],
+                $params['secure'],
+                $params['httponly']
+            );
+        }
+        session_destroy();
+    }
+
+    public static function updatePassword(PDO $db, string $username, string $newPassword): void
+    {
+        $stmt = $db->prepare('UPDATE users SET password_hash = :p WHERE username = :u');
+        $stmt->execute([
+            ':p' => password_hash($newPassword, PASSWORD_DEFAULT),
+            ':u' => $username,
+        ]);
+    }
+}
+
diff --git a/src/BackupManager.php b/src/BackupManager.php
new file mode 100644
index 0000000..86efad4
--- /dev/null
+++ b/src/BackupManager.php
@@ -0,0 +1,879 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use Exception;
+use RuntimeException;
+use InvalidArgumentException;
+
+class BackupManager
+{
+    public const BACKUP_DIR = '/var/www/nexus-pbx/storage/system_backups';
+    public const VERSION = '1.2.0';
+
+    /**
+     * Initialise le répertoire des sauvegardes.
+     */
+    public static function initDirectory(): void
+    {
+        if (!is_dir(self::BACKUP_DIR)) {
+            @mkdir(self::BACKUP_DIR, 0775, true);
+        }
+        @chown(self::BACKUP_DIR, 'www-data');
+        @chgrp(self::BACKUP_DIR, 'asterisk');
+        @chmod(self::BACKUP_DIR, 02775);
+    }
+
+    /**
+     * Récupère les paramètres de sauvegarde depuis SQLite.
+     */
+    public static function getBackupSettings(): array
+    {
+        $db = Database::getConnection();
+        $stmt = $db->query("SELECT 
+            backup_auto_enabled, backup_frequency, backup_retention, backup_storage_type,
+            backup_ssh_host, backup_ssh_port, backup_ssh_user, backup_ssh_auth_type,
+            backup_ssh_password, backup_ssh_remote_path, backup_last_run, backup_last_status
+            FROM settings WHERE id = 1");
+        $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+        if (!$row) {
+            return [
+                'backup_auto_enabled' => 0,
+                'backup_frequency' => 'daily',
+                'backup_retention' => 7,
+                'backup_storage_type' => 'local',
+                'backup_ssh_host' => '',
+                'backup_ssh_port' => 22,
+                'backup_ssh_user' => '',
+                'backup_ssh_auth_type' => 'password',
+                'backup_ssh_password' => '',
+                'backup_ssh_remote_path' => '/backups/nexus',
+                'backup_last_run' => null,
+                'backup_last_status' => '',
+            ];
+        }
+
+        return [
+            'backup_auto_enabled' => (int)($row['backup_auto_enabled'] ?? 0),
+            'backup_frequency' => (string)($row['backup_frequency'] ?? 'daily'),
+            'backup_retention' => (int)($row['backup_retention'] ?? 7),
+            'backup_storage_type' => (string)($row['backup_storage_type'] ?? 'local'),
+            'backup_ssh_host' => (string)($row['backup_ssh_host'] ?? ''),
+            'backup_ssh_port' => (int)($row['backup_ssh_port'] ?? 22),
+            'backup_ssh_user' => (string)($row['backup_ssh_user'] ?? ''),
+            'backup_ssh_auth_type' => (string)($row['backup_ssh_auth_type'] ?? 'password'),
+            'backup_ssh_password' => (string)($row['backup_ssh_password'] ?? ''),
+            'backup_ssh_remote_path' => (string)($row['backup_ssh_remote_path'] ?? '/backups/nexus'),
+            'backup_last_run' => $row['backup_last_run'] ?? null,
+            'backup_last_status' => (string)($row['backup_last_status'] ?? ''),
+        ];
+    }
+
+    /**
+     * Sauvegarde les paramètres de configuration des backups.
+     */
+    public static function saveBackupSettings(array $data): void
+    {
+        $db = Database::getConnection();
+
+        $autoEnabled = !empty($data['backup_auto_enabled']) ? 1 : 0;
+        $frequency = in_array($data['backup_frequency'] ?? '', ['hourly', '6h', '12h', 'daily', 'weekly'], true)
+            ? $data['backup_frequency']
+            : 'daily';
+        $retention = max(1, min(60, (int)($data['backup_retention'] ?? 7)));
+        $storageType = ($data['backup_storage_type'] ?? 'local') === 'ssh' ? 'ssh' : 'local';
+        $sshHost = trim((string)($data['backup_ssh_host'] ?? ''));
+        $sshPort = max(1, min(65535, (int)($data['backup_ssh_port'] ?? 22)));
+        $sshUser = trim((string)($data['backup_ssh_user'] ?? ''));
+        $sshAuthType = ($data['backup_ssh_auth_type'] ?? 'password') === 'key' ? 'key' : 'password';
+        $sshPassword = (string)($data['backup_ssh_password'] ?? '');
+        $sshRemotePath = trim((string)($data['backup_ssh_remote_path'] ?? '/backups/nexus'));
+        if ($sshRemotePath === '') {
+            $sshRemotePath = '/backups/nexus';
+        }
+
+        $stmt = $db->prepare("UPDATE settings SET
+            backup_auto_enabled = :auto,
+            backup_frequency = :freq,
+            backup_retention = :ret,
+            backup_storage_type = :stype,
+            backup_ssh_host = :shost,
+            backup_ssh_port = :sport,
+            backup_ssh_user = :suser,
+            backup_ssh_auth_type = :sauth,
+            backup_ssh_password = :spass,
+            backup_ssh_remote_path = :spath,
+            updated_at = CURRENT_TIMESTAMP
+            WHERE id = 1");
+
+        $stmt->execute([
+            ':auto' => $autoEnabled,
+            ':freq' => $frequency,
+            ':ret' => $retention,
+            ':stype' => $storageType,
+            ':shost' => $sshHost,
+            ':sport' => $sshPort,
+            ':suser' => $sshUser,
+            ':sauth' => $sshAuthType,
+            ':spass' => $sshPassword,
+            ':spath' => $sshRemotePath,
+        ]);
+    }
+
+    /**
+     * Teste la connexion SSH avec les identifiants fournis.
+     */
+    public static function testSshConnection(array $cfg): array
+    {
+        $host = trim((string)($cfg['backup_ssh_host'] ?? ''));
+        $port = (int)($cfg['backup_ssh_port'] ?? 22);
+        $user = trim((string)($cfg['backup_ssh_user'] ?? ''));
+        $authType = ($cfg['backup_ssh_auth_type'] ?? 'password') === 'key' ? 'key' : 'password';
+        $password = (string)($cfg['backup_ssh_password'] ?? '');
+        $remotePath = trim((string)($cfg['backup_ssh_remote_path'] ?? '/backups/nexus'));
+
+        if ($host === '' || $user === '') {
+            throw new InvalidArgumentException("L'hôte SSH et l'utilisateur distant sont obligatoires.");
+        }
+
+        if ($authType === 'password' && $password === '') {
+            throw new InvalidArgumentException("Le mot de passe SSH est obligatoire.");
+        }
+
+        $remoteDirEsc = escapeshellarg($remotePath);
+        $testCmd = "mkdir -p {$remoteDirEsc} && touch {$remoteDirEsc}/.nexus_test && rm -f {$remoteDirEsc}/.nexus_test && echo 'NEXUS_SSH_OK'";
+
+        $result = self::runSshCommand($host, $port, $user, $authType, $password, $testCmd);
+
+        if ($result['exit_code'] !== 0 || !str_contains($result['output'], 'NEXUS_SSH_OK')) {
+            $err = trim($result['error'] ?: $result['output']);
+            return [
+                'success' => false,
+                'message' => "Échec de connexion SSH ou dossier distant non accessible : " . ($err ?: 'Erreur inconnue (code ' . $result['exit_code'] . ')'),
+            ];
+        }
+
+        return [
+            'success' => true,
+            'message' => "Connexion SSH réussie ! Dossier distant '{$remotePath}' accessible et prêt pour les sauvegardes.",
+        ];
+    }
+
+    /**
+     * Crée une archive de sauvegarde complète (Base de données SQLite, sons, messageries, certs, confs).
+     *
+     * @param string $source 'manual' ou 'cron'
+     * @return array
+     */
+    public static function createBackup(string $source = 'manual'): array
+    {
+        self::initDirectory();
+        $settings = self::getBackupSettings();
+        $db = Database::getConnection();
+
+        // 1. Checkpoint WAL SQLite pour garantir l'intégrité absolue de la base
+        try {
+            $db->exec("PRAGMA wal_checkpoint(TRUNCATE)");
+        } catch (Exception $e) {
+            // Ignorer si échec temporaire
+        }
+
+        $timestamp = date('Ymd_His');
+        $filename = "nexus_backup_v" . self::VERSION . "_{$timestamp}.tar.gz";
+        $localArchivePath = self::BACKUP_DIR . '/' . $filename;
+
+        // 2. Préparation du dossier de staging
+        $stageDir = '/tmp/nexus_stage_' . uniqid() . '_' . $timestamp;
+        if (!mkdir($stageDir, 0700, true)) {
+            throw new RuntimeException("Impossible de créer le répertoire temporaire de staging : {$stageDir}");
+        }
+
+        $manifestFiles = [];
+
+        try {
+            // A. Copie de la base SQLite
+            $dbSource = Database::getDatabasePath();
+            if (file_exists($dbSource)) {
+                $dbDest = $stageDir . '/database.sqlite';
+                copy($dbSource, $dbDest);
+                $manifestFiles['database.sqlite'] = [
+                    'size' => filesize($dbDest),
+                    'md5' => md5_file($dbDest),
+                ];
+            }
+
+            // B. Copie des fichiers sons d'accueil et musiques personnalisées
+            // /var/www/nexus-pbx/storage/sounds/
+            $storageSounds = '/var/www/nexus-pbx/storage/sounds';
+            if (is_dir($storageSounds)) {
+                $destSounds = $stageDir . '/storage_sounds';
+                mkdir($destSounds, 0755, true);
+                exec("rsync -a " . escapeshellarg($storageSounds . '/') . " " . escapeshellarg($destSounds . '/'));
+                $manifestFiles['storage_sounds'] = ['count' => count(glob($destSounds . '/*'))];
+            }
+
+            // /var/lib/asterisk/sounds/custom/
+            $astSoundsCustom = '/var/lib/asterisk/sounds/custom';
+            if (is_dir($astSoundsCustom)) {
+                $destAstSounds = $stageDir . '/asterisk_sounds_custom';
+                mkdir($destAstSounds, 0755, true);
+                exec("rsync -a " . escapeshellarg($astSoundsCustom . '/') . " " . escapeshellarg($destAstSounds . '/'));
+                $manifestFiles['asterisk_sounds_custom'] = ['count' => count(glob($destAstSounds . '/*'))];
+            }
+
+            // C. Spool Voicemail (Messages vocaux, salutations personnalisées, secrets/pins)
+            $voicemailSpool = '/var/spool/asterisk/voicemail/default';
+            if (is_dir($voicemailSpool)) {
+                $destVm = $stageDir . '/voicemail_default';
+                mkdir($destVm, 0755, true);
+                exec("rsync -a " . escapeshellarg($voicemailSpool . '/') . " " . escapeshellarg($destVm . '/'));
+                $manifestFiles['voicemail_default'] = ['count' => count(glob($destVm . '/*'))];
+            }
+
+            // D. Certificats SSL / TLS personnalisés
+            $storageCerts = '/var/www/nexus-pbx/storage/certs';
+            if (is_dir($storageCerts)) {
+                $destCerts = $stageDir . '/storage_certs';
+                mkdir($destCerts, 0700, true);
+                exec("rsync -a " . escapeshellarg($storageCerts . '/') . " " . escapeshellarg($destCerts . '/'));
+                $manifestFiles['storage_certs'] = ['count' => count(glob($destCerts . '/*'))];
+            }
+            $astKeys = '/etc/asterisk/keys';
+            if (is_dir($astKeys)) {
+                $destAstKeys = $stageDir . '/asterisk_keys';
+                mkdir($destAstKeys, 0700, true);
+                exec("rsync -a " . escapeshellarg($astKeys . '/') . " " . escapeshellarg($destAstKeys . '/'));
+                $manifestFiles['asterisk_keys'] = ['count' => count(glob($destAstKeys . '/*'))];
+            }
+
+            // E. Fichiers Asterisk Custom (.conf)
+            $destConfs = $stageDir . '/asterisk_custom_conf';
+            mkdir($destConfs, 0755, true);
+            foreach (glob('/etc/asterisk/*.custom.conf') as $customConf) {
+                copy($customConf, $destConfs . '/' . basename($customConf));
+            }
+            $manifestFiles['asterisk_custom_conf'] = ['count' => count(glob($destConfs . '/*'))];
+
+            // F. Création du Manifeste
+            $manifest = [
+                'nexus_version' => self::VERSION,
+                'created_at' => date('c'),
+                'timestamp' => time(),
+                'filename' => $filename,
+                'source' => $source,
+                'storage_type' => $settings['backup_storage_type'],
+                'hostname' => php_uname('n'),
+                'os' => php_uname('s') . ' ' . php_uname('r'),
+                'php_version' => PHP_VERSION,
+                'components' => $manifestFiles,
+            ];
+            file_put_contents($stageDir . '/manifest.json', json_encode($manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+
+            // G. Compression en .tar.gz
+            $tarCmd = "tar -czf " . escapeshellarg($localArchivePath) . " -C " . escapeshellarg($stageDir) . " .";
+            exec($tarCmd, $tarOut, $tarCode);
+            if ($tarCode !== 0 || !file_exists($localArchivePath)) {
+                throw new RuntimeException("Échec de la création de l'archive tar.gz (code {$tarCode}).");
+            }
+
+            @chown($localArchivePath, 'www-data');
+            @chgrp($localArchivePath, 'asterisk');
+            @chmod($localArchivePath, 0664);
+
+            $fileSize = filesize($localArchivePath);
+
+            // 3. Gestion du stockage distant SSH si configuré
+            $storageType = $settings['backup_storage_type'];
+            $remoteSuccess = false;
+
+            if ($storageType === 'ssh') {
+                $remotePath = rtrim($settings['backup_ssh_remote_path'], '/');
+                $transferResult = self::transferToSsh($localArchivePath, $filename, $settings);
+                if (!$transferResult['success']) {
+                    throw new RuntimeException("Échec du transfert distant SSH : " . $transferResult['message']);
+                }
+                $remoteSuccess = true;
+
+                // L'utilisateur demande que la sauvegarde distante désactive la sauvegarde locale
+                // On supprime donc l'archive locale pour ne pas encombrer le disque local
+                @unlink($localArchivePath);
+
+                // Pruning des sauvegardes distantes
+                self::pruneRemoteBackups($settings);
+            } else {
+                // Pruning des sauvegardes locales selon la rétention
+                self::pruneLocalBackups($settings['backup_retention']);
+            }
+
+            // 4. Mettre à jour le statut dans la DB
+            $db->prepare("UPDATE settings SET 
+                backup_last_run = :now, 
+                backup_last_status = :status 
+                WHERE id = 1")->execute([
+                ':now' => date('Y-m-d H:i:s'),
+                ':status' => 'Succès (' . ($storageType === 'ssh' ? 'Distant SSH' : 'Local') . ' - ' . self::formatBytes($fileSize) . ')',
+            ]);
+
+            return [
+                'success' => true,
+                'filename' => $filename,
+                'storage_type' => $storageType,
+                'size' => $fileSize,
+                'size_formatted' => self::formatBytes($fileSize),
+                'created_at' => date('d/m/Y H:i:s'),
+                'manifest' => $manifest,
+            ];
+        } finally {
+            // Nettoyage impératif du dossier staging
+            self::removeDirRecursive($stageDir);
+        }
+    }
+
+    /**
+     * Liste toutes les sauvegardes disponibles (locales ou distantes).
+     */
+    public static function listBackups(): array
+    {
+        self::initDirectory();
+        $settings = self::getBackupSettings();
+        $backups = [];
+
+        // 1. Sauvegardes locales
+        $localFiles = glob(self::BACKUP_DIR . '/*.tar.gz') ?: [];
+        foreach ($localFiles as $file) {
+            $name = basename($file);
+            $size = filesize($file);
+            $mtime = filemtime($file);
+
+            // Tenter de lire le manifest depuis l'archive sans l'extraire entièrement
+            $manifest = self::readManifestFromTar($file);
+
+            $backups[] = [
+                'filename' => $name,
+                'storage_type' => 'local',
+                'size' => $size,
+                'size_formatted' => self::formatBytes($size),
+                'timestamp' => $mtime,
+                'date_formatted' => date('d/m/Y H:i:s', $mtime),
+                'version' => $manifest['nexus_version'] ?? self::VERSION,
+                'source' => $manifest['source'] ?? 'local',
+                'is_local' => true,
+            ];
+        }
+
+        // 2. Sauvegardes distantes SSH (si stockage distant SSH configuré)
+        if ($settings['backup_storage_type'] === 'ssh' && !empty($settings['backup_ssh_host'])) {
+            $remoteBackups = self::listRemoteBackups($settings);
+            foreach ($remoteBackups as $rb) {
+                $backups[] = $rb;
+            }
+        }
+
+        // Trier par date décroissante (plus récent au plus ancien)
+        usort($backups, fn($a, $b) => $b['timestamp'] <=> $a['timestamp']);
+
+        return $backups;
+    }
+
+    /**
+     * Supprime une sauvegarde (locale ou distante).
+     */
+    public static function deleteBackup(string $filename): bool
+    {
+        $filename = basename($filename);
+        if ($filename === '' || !str_ends_with($filename, '.tar.gz')) {
+            throw new InvalidArgumentException("Nom de fichier de sauvegarde invalide.");
+        }
+
+        $localPath = self::BACKUP_DIR . '/' . $filename;
+        if (file_exists($localPath)) {
+            return @unlink($localPath);
+        }
+
+        // Si non présent en local, vérifier distant SSH
+        $settings = self::getBackupSettings();
+        if ($settings['backup_storage_type'] === 'ssh' && !empty($settings['backup_ssh_host'])) {
+            $remoteFile = rtrim($settings['backup_ssh_remote_path'], '/') . '/' . $filename;
+            $res = self::runSshCommand(
+                $settings['backup_ssh_host'],
+                $settings['backup_ssh_port'],
+                $settings['backup_ssh_user'],
+                $settings['backup_ssh_auth_type'],
+                $settings['backup_ssh_password'],
+                "rm -f " . escapeshellarg($remoteFile)
+            );
+            return $res['exit_code'] === 0;
+        }
+
+        return false;
+    }
+
+    /**
+     * Télécharge une sauvegarde (si distante, la rapatrie temporairement pour la streamer).
+     */
+    public static function downloadBackup(string $filename): void
+    {
+        $filename = basename($filename);
+        if ($filename === '' || !str_ends_with($filename, '.tar.gz')) {
+            http_response_code(400);
+            die("Nom de sauvegarde invalide.");
+        }
+
+        $localPath = self::BACKUP_DIR . '/' . $filename;
+        $tempDownload = false;
+
+        if (!file_exists($localPath)) {
+            // Rapatriement depuis SSH
+            $settings = self::getBackupSettings();
+            if ($settings['backup_storage_type'] !== 'ssh' || empty($settings['backup_ssh_host'])) {
+                http_response_code(404);
+                die("Sauvegarde introuvable.");
+            }
+
+            $localPath = '/tmp/' . uniqid('dl_') . '_' . $filename;
+            $remoteFile = rtrim($settings['backup_ssh_remote_path'], '/') . '/' . $filename;
+            $fetchRes = self::fetchFromSsh($remoteFile, $localPath, $settings);
+            if (!$fetchRes['success'] || !file_exists($localPath)) {
+                http_response_code(502);
+                die("Impossible de récupérer la sauvegarde distante : " . $fetchRes['message']);
+            }
+            $tempDownload = true;
+        }
+
+        if (ob_get_level()) {
+            ob_end_clean();
+        }
+
+        header('Content-Description: File Transfer');
+        header('Content-Type: application/gzip');
+        header('Content-Disposition: attachment; filename="' . $filename . '"');
+        header('Expires: 0');
+        header('Cache-Control: must-revalidate');
+        header('Pragma: public');
+        header('Content-Length: ' . filesize($localPath));
+        readfile($localPath);
+
+        if ($tempDownload) {
+            @unlink($localPath);
+        }
+        exit;
+    }
+
+    /**
+     * Restaure une sauvegarde complète du système PBX en un seul clic !
+     *
+     * @param string $archivePath Chemin absolu du fichier .tar.gz (déjà présent ou uploadé)
+     * @return array
+     */
+    public static function restoreBackup(string $archivePath): array
+    {
+        if (!file_exists($archivePath) || !is_readable($archivePath)) {
+            throw new RuntimeException("Fichier d'archive introuvable ou inaccessible.");
+        }
+
+        // 1. Vérifier la validité de l'archive tar.gz
+        exec("tar -tzf " . escapeshellarg($archivePath) . " 2>&1", $tarList, $testCode);
+        if ($testCode !== 0) {
+            throw new RuntimeException("L'archive fournie est corrompue ou n'est pas un fichier tar.gz valide.");
+        }
+
+        $stageDir = '/tmp/nexus_restore_' . uniqid();
+        if (!mkdir($stageDir, 0700, true)) {
+            throw new RuntimeException("Impossible de créer le dossier de décompression.");
+        }
+
+        try {
+            // 2. Extraction complète dans le dossier de staging
+            exec("tar -xzf " . escapeshellarg($archivePath) . " -C " . escapeshellarg($stageDir), $extOut, $extCode);
+            if ($extCode !== 0) {
+                throw new RuntimeException("Échec de décompression de l'archive de sauvegarde.");
+            }
+
+            // 3. Vérification du manifest et de la base de données SQLite
+            $manifestPath = $stageDir . '/manifest.json';
+            $dbPath = $stageDir . '/database.sqlite';
+
+            if (!file_exists($dbPath)) {
+                throw new RuntimeException("L'archive ne contient pas de base de données NexusPBX (database.sqlite). Restauration annulée.");
+            }
+
+            $manifest = [];
+            if (file_exists($manifestPath)) {
+                $manifest = json_decode((string)file_get_contents($manifestPath), true) ?: [];
+            }
+
+            // 4. Sécurité : Création d'un backup de précaution de la base actuelle
+            $currentDb = Database::getDatabasePath();
+            if (file_exists($currentDb)) {
+                @copy($currentDb, $currentDb . '.prerestore.' . date('Ymd_His'));
+            }
+
+            // 5. Restauration de la Base de données SQLite
+            // Remplacer la base SQLite
+            copy($dbPath, $currentDb);
+            @chown($currentDb, 'www-data');
+            @chgrp($currentDb, 'asterisk');
+            @chmod($currentDb, 0660);
+
+            // Supprimer d'éventuels fichiers WAL/SHM résiduels de l'ancienne base
+            if (file_exists($currentDb . '-wal')) {
+                @unlink($currentDb . '-wal');
+            }
+            if (file_exists($currentDb . '-shm')) {
+                @unlink($currentDb . '-shm');
+            }
+
+            // 6. Restauration des fichiers sons (NexusPBX & Asterisk)
+            if (is_dir($stageDir . '/storage_sounds')) {
+                $destSounds = '/var/www/nexus-pbx/storage/sounds';
+                @mkdir($destSounds, 0775, true);
+                exec("rsync -a --delete " . escapeshellarg($stageDir . '/storage_sounds/') . " " . escapeshellarg($destSounds . '/'));
+                @chown($destSounds, 'www-data');
+                @chgrp($destSounds, 'asterisk');
+                exec("chown -R www-data:asterisk " . escapeshellarg($destSounds));
+                exec("chmod -R 775 " . escapeshellarg($destSounds));
+            }
+
+            if (is_dir($stageDir . '/asterisk_sounds_custom')) {
+                $destAstSounds = '/var/lib/asterisk/sounds/custom';
+                @mkdir($destAstSounds, 0775, true);
+                exec("rsync -a " . escapeshellarg($stageDir . '/asterisk_sounds_custom/') . " " . escapeshellarg($destAstSounds . '/'));
+                exec("chown -R asterisk:asterisk " . escapeshellarg($destAstSounds));
+                exec("chmod -R 775 " . escapeshellarg($destAstSounds));
+            }
+
+            // 7. Restauration de la boîte vocale (Voicemail Spool & Greetings)
+            if (is_dir($stageDir . '/voicemail_default')) {
+                $destVm = '/var/spool/asterisk/voicemail/default';
+                @mkdir($destVm, 0775, true);
+                exec("rsync -a " . escapeshellarg($stageDir . '/voicemail_default/') . " " . escapeshellarg($destVm . '/'));
+                exec("chown -R asterisk:asterisk /var/spool/asterisk/voicemail");
+                exec("chmod -R g+rwX /var/spool/asterisk/voicemail");
+            }
+
+            // 8. Restauration des certificats TLS
+            if (is_dir($stageDir . '/storage_certs')) {
+                $destCerts = '/var/www/nexus-pbx/storage/certs';
+                @mkdir($destCerts, 0750, true);
+                exec("rsync -a " . escapeshellarg($stageDir . '/storage_certs/') . " " . escapeshellarg($destCerts . '/'));
+                exec("chown -R www-data:asterisk " . escapeshellarg($destCerts));
+            }
+            if (is_dir($stageDir . '/asterisk_keys')) {
+                $destKeys = '/etc/asterisk/keys';
+                @mkdir($destKeys, 0750, true);
+                exec("rsync -a " . escapeshellarg($stageDir . '/asterisk_keys/') . " " . escapeshellarg($destKeys . '/'));
+                exec("chown -R asterisk:asterisk " . escapeshellarg($destKeys));
+            }
+
+            // 9. Restauration des fichiers custom Asterisk (.conf)
+            if (is_dir($stageDir . '/asterisk_custom_conf')) {
+                foreach (glob($stageDir . '/asterisk_custom_conf/*.custom.conf') as $cf) {
+                    copy($cf, '/etc/asterisk/' . basename($cf));
+                    @chown('/etc/asterisk/' . basename($cf), 'asterisk');
+                    @chgrp('/etc/asterisk/' . basename($cf), 'asterisk');
+                    @chmod('/etc/asterisk/' . basename($cf), 0664);
+                }
+            }
+
+            // 10. Régénération intégrale des configurations Asterisk avec la nouvelle base restaurée
+            Database::resetConnection();
+            $dbFresh = Database::getConnection(true);
+            $generator = new ConfigGenerator($dbFresh);
+            $generator->writeAllConfigs();
+
+            // 11. Rechargement du moteur Asterisk via AMI
+            try {
+                $ami = AmiClient::fromDatabase($dbFresh);
+                $reloadRes = $ami->reloadPjsipAndDialplan();
+            } catch (Exception $e) {
+                $reloadRes = ['success' => false, 'error' => $e->getMessage()];
+            }
+
+            return [
+                'success' => true,
+                'message' => 'Restauration complète effectuée avec succès ! Base de données réintégrée, fichiers audio, messageries vocales et configurations Asterisk rechargées.',
+                'reload_success' => $reloadRes['success'] ?? false,
+                'manifest' => $manifest,
+            ];
+        } finally {
+            self::removeDirRecursive($stageDir);
+        }
+    }
+
+    /**
+     * Exécute le script cron de sauvegarde automatique périodique.
+     */
+    public static function runAutoBackupCron(): array
+    {
+        $settings = self::getBackupSettings();
+        if (empty($settings['backup_auto_enabled'])) {
+            return ['status' => 'skipped', 'message' => 'Sauvegardes automatiques désactivées.'];
+        }
+
+        $freq = $settings['backup_frequency'];
+        $lastRun = $settings['backup_last_run'] ? strtotime($settings['backup_last_run']) : 0;
+        $now = time();
+
+        $intervals = [
+            'hourly' => 3600,
+            '6h' => 6 * 3600,
+            '12h' => 12 * 3600,
+            'daily' => 24 * 3600,
+            'weekly' => 7 * 24 * 3600,
+        ];
+
+        $intervalSeconds = $intervals[$freq] ?? 86400;
+
+        // Marge de tolérance de 5 minutes
+        if (($now - $lastRun) < ($intervalSeconds - 300)) {
+            return [
+                'status' => 'skipped',
+                'message' => "Sauvegarde automatique non requise actuellement (dernière exécutée il y a " . round(($now - $lastRun) / 60) . " min, fréquence: {$freq}).",
+            ];
+        }
+
+        return self::createBackup('cron');
+    }
+
+    // =========================================================================
+    // MÉTHODES PRIVÉES / UTILITAIRES
+    // =========================================================================
+
+    private static function runSshCommand(string $host, int $port, string $user, string $authType, string $password, string $cmd): array
+    {
+        $sshOptions = "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8 -p " . (int)$port;
+        $target = escapeshellarg("{$user}@{$host}");
+
+        if ($authType === 'password') {
+            $fullCmd = "sshpass -p " . escapeshellarg($password) . " ssh {$sshOptions} {$target} " . escapeshellarg($cmd);
+        } else {
+            $fullCmd = "ssh {$sshOptions} {$target} " . escapeshellarg($cmd);
+        }
+
+        $descriptors = [
+            0 => ['pipe', 'r'],
+            1 => ['pipe', 'w'],
+            2 => ['pipe', 'w'],
+        ];
+
+        $proc = proc_open($fullCmd, $descriptors, $pipes);
+        if (!is_resource($proc)) {
+            return ['exit_code' => 1, 'output' => '', 'error' => "Impossible de lancer le processus SSH."];
+        }
+
+        fclose($pipes[0]);
+        $output = stream_get_contents($pipes[1]);
+        fclose($pipes[1]);
+        $error = stream_get_contents($pipes[2]);
+        fclose($pipes[2]);
+
+        $exitCode = proc_close($proc);
+
+        return [
+            'exit_code' => $exitCode,
+            'output' => (string)$output,
+            'error' => (string)$error,
+        ];
+    }
+
+    private static function transferToSsh(string $localFile, string $filename, array $cfg): array
+    {
+        $host = $cfg['backup_ssh_host'];
+        $port = (int)$cfg['backup_ssh_port'];
+        $user = $cfg['backup_ssh_user'];
+        $authType = $cfg['backup_ssh_auth_type'];
+        $password = $cfg['backup_ssh_password'];
+        $remotePath = rtrim($cfg['backup_ssh_remote_path'], '/');
+
+        // S'assurer que le dossier distant existe
+        self::runSshCommand($host, $port, $user, $authType, $password, "mkdir -p " . escapeshellarg($remotePath));
+
+        $scpOptions = "-P " . (int)$port . " -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10";
+        $dest = escapeshellarg("{$user}@{$host}:{$remotePath}/{$filename}");
+        $src = escapeshellarg($localFile);
+
+        if ($authType === 'password') {
+            $scpCmd = "sshpass -p " . escapeshellarg($password) . " scp {$scpOptions} {$src} {$dest}";
+        } else {
+            $scpCmd = "scp {$scpOptions} {$src} {$dest}";
+        }
+
+        exec($scpCmd . " 2>&1", $output, $code);
+        if ($code !== 0) {
+            return [
+                'success' => false,
+                'message' => implode("\n", $output) ?: "Erreur SCP (code {$code})",
+            ];
+        }
+
+        return ['success' => true];
+    }
+
+    private static function fetchFromSsh(string $remoteFile, string $localDest, array $cfg): array
+    {
+        $host = $cfg['backup_ssh_host'];
+        $port = (int)$cfg['backup_ssh_port'];
+        $user = $cfg['backup_ssh_user'];
+        $authType = $cfg['backup_ssh_auth_type'];
+        $password = $cfg['backup_ssh_password'];
+
+        $scpOptions = "-P " . (int)$port . " -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10";
+        $src = escapeshellarg("{$user}@{$host}:{$remoteFile}");
+        $dest = escapeshellarg($localDest);
+
+        if ($authType === 'password') {
+            $scpCmd = "sshpass -p " . escapeshellarg($password) . " scp {$scpOptions} {$src} {$dest}";
+        } else {
+            $scpCmd = "scp {$scpOptions} {$src} {$dest}";
+        }
+
+        exec($scpCmd . " 2>&1", $output, $code);
+        if ($code !== 0) {
+            return [
+                'success' => false,
+                'message' => implode("\n", $output) ?: "Erreur récupération SCP (code {$code})",
+            ];
+        }
+
+        return ['success' => true];
+    }
+
+    private static function listRemoteBackups(array $cfg): array
+    {
+        $host = $cfg['backup_ssh_host'];
+        $port = (int)$cfg['backup_ssh_port'];
+        $user = $cfg['backup_ssh_user'];
+        $authType = $cfg['backup_ssh_auth_type'];
+        $password = $cfg['backup_ssh_password'];
+        $remotePath = rtrim($cfg['backup_ssh_remote_path'], '/');
+
+        $listCmd = "ls -l --time-style=+%s " . escapeshellarg($remotePath) . "/*.tar.gz 2>/dev/null";
+        $res = self::runSshCommand($host, $port, $user, $authType, $password, $listCmd);
+
+        $results = [];
+        if ($res['exit_code'] === 0 && !empty($res['output'])) {
+            $lines = explode("\n", trim($res['output']));
+            foreach ($lines as $line) {
+                // Format attendu: -rw-r--r-- 1 user group 12345 1698888888 /path/nexus_backup_v1.2.0_20261101_180000.tar.gz
+                $parts = preg_split('/\s+/', trim($line));
+                if (count($parts) >= 7) {
+                    $size = (int)$parts[4];
+                    $timestamp = (int)$parts[5];
+                    $fullPath = $parts[6];
+                    $name = basename($fullPath);
+
+                    if (str_ends_with($name, '.tar.gz')) {
+                        $results[] = [
+                            'filename' => $name,
+                            'storage_type' => 'ssh',
+                            'size' => $size,
+                            'size_formatted' => self::formatBytes($size),
+                            'timestamp' => $timestamp > 0 ? $timestamp : time(),
+                            'date_formatted' => date('d/m/Y H:i:s', $timestamp > 0 ? $timestamp : time()),
+                            'version' => self::VERSION,
+                            'source' => 'distant (SSH)',
+                            'is_local' => false,
+                        ];
+                    }
+                }
+            }
+        }
+
+        return $results;
+    }
+
+    private static function pruneLocalBackups(int $retention): void
+    {
+        if ($retention <= 0) {
+            return;
+        }
+
+        $files = glob(self::BACKUP_DIR . '/*.tar.gz') ?: [];
+        if (count($files) <= $retention) {
+            return;
+        }
+
+        // Trier par date décroissante
+        usort($files, fn($a, $b) => filemtime($b) <=> filemtime($a));
+
+        // Supprimer ceux au-delà du quota de rétention
+        $toDelete = array_slice($files, $retention);
+        foreach ($toDelete as $f) {
+            @unlink($f);
+        }
+    }
+
+    private static function pruneRemoteBackups(array $cfg): void
+    {
+        $retention = (int)($cfg['backup_retention'] ?? 7);
+        if ($retention <= 0) {
+            return;
+        }
+
+        $remotePath = rtrim($cfg['backup_ssh_remote_path'], '/');
+        // Script shell distant pour supprimer les fichiers les plus anciens au-delà de N
+        $pruneCmd = "cd " . escapeshellarg($remotePath) . " && ls -t *.tar.gz 2>/dev/null | tail -n +" . ($retention + 1) . " | xargs -r rm -f";
+        self::runSshCommand(
+            $cfg['backup_ssh_host'],
+            $cfg['backup_ssh_port'],
+            $cfg['backup_ssh_user'],
+            $cfg['backup_ssh_auth_type'],
+            $cfg['backup_ssh_password'],
+            $pruneCmd
+        );
+    }
+
+    private static function readManifestFromTar(string $tarGzPath): ?array
+    {
+        // Lire manifest.json sans tout décompresser
+        $cmd = "tar -xzOf " . escapeshellarg($tarGzPath) . " ./manifest.json 2>/dev/null || tar -xzOf " . escapeshellarg($tarGzPath) . " manifest.json 2>/dev/null";
+        $json = shell_exec($cmd);
+        if ($json) {
+            $parsed = json_decode($json, true);
+            if (is_array($parsed)) {
+                return $parsed;
+            }
+        }
+        return null;
+    }
+
+    private static function formatBytes(int $bytes): string
+    {
+        if ($bytes >= 1073741824) {
+            return number_format($bytes / 1073741824, 2) . ' Go';
+        }
+        if ($bytes >= 1048576) {
+            return number_format($bytes / 1048576, 2) . ' Mo';
+        }
+        if ($bytes >= 1024) {
+            return number_format($bytes / 1024, 1) . ' Ko';
+        }
+        return $bytes . ' B';
+    }
+
+    private static function removeDirRecursive(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        $items = scandir($dir);
+        if ($items === false) {
+            return;
+        }
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir . '/' . $item;
+            if (is_dir($path)) {
+                self::removeDirRecursive($path);
+            } else {
+                @unlink($path);
+            }
+        }
+        @rmdir($dir);
+    }
+}
diff --git a/src/CertificateManager.php b/src/CertificateManager.php
new file mode 100644
index 0000000..c59e7f8
--- /dev/null
+++ b/src/CertificateManager.php
@@ -0,0 +1,522 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use InvalidArgumentException;
+use RuntimeException;
+
+class CertificateManager
+{
+    public const KEYS_BASE_DIR = '/etc/asterisk/keys';
+    public const WEBROOT_DIR   = '/var/www/nexus-pbx/public';
+
+    /**
+     * Récupère la liste de tous les certificats avec recalcul dynamique de l'expiration.
+     */
+    public static function getAll(PDO $db): array
+    {
+        $certs = $db->query('SELECT * FROM certificates ORDER BY is_default DESC, id DESC')->fetchAll();
+        $now = time();
+
+        foreach ($certs as &$c) {
+            $validTo = !empty($c['valid_to']) ? strtotime($c['valid_to']) : null;
+            if ($validTo) {
+                $days = (int)round(($validTo - $now) / 86400);
+                $c['days_remaining'] = $days;
+                if ($days < 0) {
+                    $c['status'] = 'expired';
+                } elseif ($days <= 15) {
+                    $c['status'] = 'expiring_soon';
+                } else {
+                    $c['status'] = 'valid';
+                }
+            }
+        }
+        unset($c);
+
+        return $certs;
+    }
+
+    /**
+     * Récupère un certificat par son ID.
+     */
+    public static function getById(PDO $db, int $id): ?array
+    {
+        $stmt = $db->prepare('SELECT * FROM certificates WHERE id = :id');
+        $stmt->execute([':id' => $id]);
+        $cert = $stmt->fetch();
+        return $cert ?: null;
+    }
+
+    /**
+     * Récupère le certificat actif par défaut pour Asterisk PJSIP TLS et WebRTC.
+     */
+    public static function getDefault(PDO $db): ?array
+    {
+        $stmt = $db->query('SELECT * FROM certificates WHERE is_default = 1 LIMIT 1');
+        $cert = $stmt->fetch();
+        if (!$cert) {
+            $stmt = $db->query('SELECT * FROM certificates ORDER BY id ASC LIMIT 1');
+            $cert = $stmt->fetch();
+        }
+        return $cert ?: null;
+    }
+
+    /**
+     * Analyse et extrait les métadonnées d'un certificat au format PEM.
+     */
+    public static function parseCertPem(string $certPem): array
+    {
+        $certPem = trim($certPem);
+        if ($certPem === '' || !str_contains($certPem, '-----BEGIN CERTIFICATE-----')) {
+            throw new InvalidArgumentException("Format de certificat invalide : aucun bloc '-----BEGIN CERTIFICATE-----' trouvé.");
+        }
+
+        $parsed = @openssl_x509_parse($certPem, true);
+        if ($parsed === false) {
+            $parsed = @openssl_x509_parse($certPem, false);
+        }
+        if ($parsed === false) {
+            throw new InvalidArgumentException("Impossible d'analyser le certificat X.509 fourni (fichier corrompu ou format non supporté).");
+        }
+
+        $domain = $parsed['subject']['CN'] ?? ($parsed['subject']['commonName'] ?? '');
+        $altNames = [];
+        if (!empty($parsed['extensions']['subjectAltName'])) {
+            $sanRaw = $parsed['extensions']['subjectAltName'];
+            $parts = explode(',', $sanRaw);
+            foreach ($parts as $p) {
+                $p = trim($p);
+                if (str_starts_with($p, 'DNS:')) {
+                    $altNames[] = substr($p, 4);
+                } elseif (str_starts_with($p, 'IP Address:')) {
+                    $altNames[] = substr($p, 11);
+                }
+            }
+        }
+
+        if ($domain === '' && !empty($altNames)) {
+            $domain = $altNames[0];
+        }
+
+        $issuer = $parsed['issuer']['O'] ?? ($parsed['issuer']['organizationName'] ?? ($parsed['issuer']['CN'] ?? ($parsed['issuer']['commonName'] ?? 'Inconnu')));
+        $validFrom = !empty($parsed['validFrom_time_t']) ? date('Y-m-d H:i:s', $parsed['validFrom_time_t']) : null;
+        $validTo = !empty($parsed['validTo_time_t']) ? date('Y-m-d H:i:s', $parsed['validTo_time_t']) : null;
+        $daysRemaining = !empty($parsed['validTo_time_t']) ? (int)round(($parsed['validTo_time_t'] - time()) / 86400) : 0;
+
+        return [
+            'domain'         => $domain ?: 'domaine-inconnu',
+            'alt_names'      => implode(', ', $altNames),
+            'issuer'         => $issuer,
+            'valid_from'     => $validFrom,
+            'valid_to'       => $validTo,
+            'days_remaining' => $daysRemaining,
+            'status'         => ($daysRemaining > 15) ? 'valid' : (($daysRemaining >= 0) ? 'expiring_soon' : 'expired'),
+        ];
+    }
+
+    /**
+     * Valide qu'une clé privée correspond bien au certificat public.
+     */
+    public static function validateKeyPair(string $certPem, string $keyPem, ?string $passphrase = null): bool
+    {
+        $certPem = trim($certPem);
+        $keyPem  = trim($keyPem);
+
+        if ($keyPem === '' || (!str_contains($keyPem, 'KEY-----') && !str_contains($keyPem, 'BEGIN RSA PRIVATE KEY'))) {
+            throw new InvalidArgumentException("Format de clé privée invalide : aucun bloc clé privée PEM détecté.");
+        }
+
+        $privKeyResource = openssl_pkey_get_private($keyPem, $passphrase ?? '');
+        if ($privKeyResource === false) {
+            throw new InvalidArgumentException("La clé privée est invalide ou chiffrée avec une phrase secrète non renseignée.");
+        }
+
+        $match = openssl_x509_check_private_key($certPem, $privKeyResource);
+        if (!$match) {
+            throw new InvalidArgumentException("Incohérence de paire de clés : la clé privée fournie NE CORRESPOND PAS au certificat public.");
+        }
+
+        return true;
+    }
+
+    /**
+     * Enregistre un certificat importé manuellement (DigiCert, Sectigo, OVH, etc.).
+     */
+    public static function saveCustomCert(
+        PDO $db,
+        string $name,
+        string $certPem,
+        string $keyPem,
+        string $chainPem = '',
+        bool $makeDefault = false
+    ): array {
+        $meta = self::parseCertPem($certPem);
+        self::validateKeyPair($certPem, $keyPem);
+
+        $name = trim($name);
+        if ($name === '') {
+            $name = 'Certificat ' . $meta['domain'];
+        }
+
+        $chainPem = trim($chainPem);
+        $fullchainPem = ($chainPem !== '') ? ($certPem . "\n" . $chainPem) : $certPem;
+
+        // Insertion en base pour obtenir l'ID
+        $stmt = $db->prepare('INSERT INTO certificates (
+            name, type, primary_domain, alt_names, issuer, valid_from, valid_to, days_remaining,
+            cert_path, key_path, chain_path, fullchain_path, email, auto_renew, is_default, status
+        ) VALUES (
+            :name, :type, :domain, :alt_names, :issuer, :valid_from, :valid_to, :days_rem,
+            "", "", "", "", :email, 0, 0, :status
+        )');
+
+        $stmt->execute([
+            ':name'       => $name,
+            ':type'       => 'custom',
+            ':domain'     => $meta['domain'],
+            ':alt_names'  => $meta['alt_names'],
+            ':issuer'     => $meta['issuer'],
+            ':valid_from' => $meta['valid_from'],
+            ':valid_to'   => $meta['valid_to'],
+            ':days_rem'   => $meta['days_remaining'],
+            ':email'      => '',
+            ':status'     => $meta['status'],
+        ]);
+
+        $certId = (int)$db->lastInsertId();
+        $targetDir = self::KEYS_BASE_DIR . '/cert_' . $certId;
+        if (!is_dir($targetDir)) {
+            mkdir($targetDir, 0770, true);
+        }
+
+        $certPath      = $targetDir . '/cert.pem';
+        $keyPath       = $targetDir . '/privkey.pem';
+        $chainPath     = ($chainPem !== '') ? $targetDir . '/chain.pem' : '';
+        $fullchainPath = $targetDir . '/fullchain.pem';
+
+        file_put_contents($certPath, $certPem . "\n");
+        file_put_contents($keyPath, $keyPem . "\n");
+        if ($chainPem !== '') {
+            file_put_contents($chainPath, $chainPem . "\n");
+        }
+        file_put_contents($fullchainPath, $fullchainPem . "\n");
+
+        self::secureKeyPermissions($targetDir);
+
+        $upd = $db->prepare('UPDATE certificates SET
+            cert_path = :cp,
+            key_path = :kp,
+            chain_path = :chp,
+            fullchain_path = :fcp
+            WHERE id = :id');
+        $upd->execute([
+            ':cp'  => $certPath,
+            ':kp'  => $keyPath,
+            ':chp' => $chainPath,
+            ':fcp' => $fullchainPath,
+            ':id'  => $certId,
+        ]);
+
+        if ($makeDefault) {
+            self::setDefault($db, $certId);
+        }
+
+        return self::getById($db, $certId);
+    }
+
+    /**
+     * Génère un certificat SSL automatique via Let's Encrypt (Certbot HTTP-01 Webroot).
+     */
+    public static function requestLetsEncrypt(
+        PDO $db,
+        string $name,
+        string $domain,
+        string $email,
+        bool $makeDefault = true,
+        bool $staging = false
+    ): array {
+        $domain = strtolower(trim($domain));
+        $email  = trim($email);
+
+        if (!preg_match('/^([a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/i', $domain)) {
+            throw new InvalidArgumentException("Le nom de domaine '{$domain}' est invalide.");
+        }
+
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            throw new InvalidArgumentException("L'adresse email '{$email}' est invalide.");
+        }
+
+        $name = trim($name);
+        if ($name === '') {
+            $name = "Let's Encrypt - " . $domain;
+        }
+
+        $challengeDir = self::WEBROOT_DIR . '/.well-known/acme-challenge';
+        if (!is_dir($challengeDir)) {
+            mkdir($challengeDir, 0775, true);
+        }
+
+        $escDomain  = escapeshellarg($domain);
+        $escEmail   = escapeshellarg($email);
+        $escWebroot = escapeshellarg(self::WEBROOT_DIR);
+
+        $stagingFlag = $staging ? '--test-cert' : '';
+
+        // Exécution de Certbot webroot non-interactive
+        $cmd = "certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring {$stagingFlag} 2>&1";
+
+        $output = [];
+        $exitCode = 0;
+        exec($cmd, $output, $exitCode);
+        $outputStr = implode("\n", $output);
+
+        if ($exitCode !== 0) {
+            throw new RuntimeException("Échec de la génération Let's Encrypt (Code: {$exitCode}) :\n" . $outputStr);
+        }
+
+        $liveDir = "/etc/letsencrypt/live/{$domain}";
+        $liveCert      = $liveDir . '/cert.pem';
+        $liveKey       = $liveDir . '/privkey.pem';
+        $liveChain     = $liveDir . '/chain.pem';
+        $liveFullchain = $liveDir . '/fullchain.pem';
+
+        if (!file_exists($liveFullchain) || !file_exists($liveKey)) {
+            throw new RuntimeException("Certbot a terminé mais les fichiers de certificat n'ont pas été trouvés dans {$liveDir}.");
+        }
+
+        $certPem = file_get_contents($liveCert);
+        $meta = self::parseCertPem($certPem);
+
+        // Insertion en base
+        $stmt = $db->prepare('INSERT INTO certificates (
+            name, type, primary_domain, alt_names, issuer, valid_from, valid_to, days_remaining,
+            cert_path, key_path, chain_path, fullchain_path, email, auto_renew, is_default, status
+        ) VALUES (
+            :name, :type, :domain, :alt_names, :issuer, :valid_from, :valid_to, :days_rem,
+            "", "", "", "", :email, 1, 0, :status
+        )');
+
+        $stmt->execute([
+            ':name'       => $name,
+            ':type'       => 'letsencrypt',
+            ':domain'     => $domain,
+            ':alt_names'  => $meta['alt_names'],
+            ':issuer'     => "Let's Encrypt",
+            ':valid_from' => $meta['valid_from'],
+            ':valid_to'   => $meta['valid_to'],
+            ':days_rem'   => $meta['days_remaining'],
+            ':email'      => $email,
+            ':status'     => $meta['status'],
+        ]);
+
+        $certId = (int)$db->lastInsertId();
+        $targetDir = self::KEYS_BASE_DIR . '/cert_' . $certId;
+        if (!is_dir($targetDir)) {
+            mkdir($targetDir, 0770, true);
+        }
+
+        $certPath      = $targetDir . '/cert.pem';
+        $keyPath       = $targetDir . '/privkey.pem';
+        $chainPath     = $targetDir . '/chain.pem';
+        $fullchainPath = $targetDir . '/fullchain.pem';
+
+        copy($liveCert, $certPath);
+        copy($liveKey, $keyPath);
+        copy($liveChain, $chainPath);
+        copy($liveFullchain, $fullchainPath);
+
+        self::secureKeyPermissions($targetDir);
+
+        $upd = $db->prepare('UPDATE certificates SET
+            cert_path = :cp,
+            key_path = :kp,
+            chain_path = :chp,
+            fullchain_path = :fcp
+            WHERE id = :id');
+        $upd->execute([
+            ':cp'  => $certPath,
+            ':kp'  => $keyPath,
+            ':chp' => $chainPath,
+            ':fcp' => $fullchainPath,
+            ':id'  => $certId,
+        ]);
+
+        if ($makeDefault) {
+            self::setDefault($db, $certId);
+        }
+
+        return self::getById($db, $certId);
+    }
+
+    /**
+     * Définit le certificat actif par défaut.
+     */
+    public static function setDefault(PDO $db, int $id): bool
+    {
+        $cert = self::getById($db, $id);
+        if (!$cert) {
+            throw new InvalidArgumentException("Certificat introuvable (ID: {$id}).");
+        }
+
+        $db->beginTransaction();
+        try {
+            $db->exec('UPDATE certificates SET is_default = 0');
+            $stmt = $db->prepare('UPDATE certificates SET is_default = 1 WHERE id = :id');
+            $stmt->execute([':id' => $id]);
+            $db->commit();
+        } catch (\Throwable $e) {
+            $db->rollBack();
+            throw $e;
+        }
+
+        // Synchronisation des fichiers actifs pour Nginx et Asterisk
+        $activeCertFile = self::KEYS_BASE_DIR . '/active_cert.crt';
+        $activeKeyFile  = self::KEYS_BASE_DIR . '/active_key.key';
+
+        $sourceCert = !empty($cert['fullchain_path']) && file_exists($cert['fullchain_path'])
+            ? $cert['fullchain_path']
+            : $cert['cert_path'];
+        $sourceKey  = $cert['key_path'];
+
+        if (file_exists($sourceCert) && file_exists($sourceKey)) {
+            @copy($sourceCert, $activeCertFile);
+            @copy($sourceKey, $activeKeyFile);
+            @chmod($activeCertFile, 0640);
+            @chmod($activeKeyFile, 0640);
+            @chgrp($activeCertFile, 'asterisk');
+            @chgrp($activeKeyFile, 'asterisk');
+        }
+
+        return true;
+    }
+
+    /**
+     * Supprime un certificat.
+     */
+    public static function delete(PDO $db, int $id): bool
+    {
+        $cert = self::getById($db, $id);
+        if (!$cert) {
+            throw new InvalidArgumentException("Certificat introuvable (ID: {$id}).");
+        }
+
+        $totalCerts = (int)$db->query('SELECT COUNT(*) FROM certificates')->fetchColumn();
+        if ($totalCerts <= 1) {
+            throw new RuntimeException("Impossible de supprimer le dernier certificat de la plateforme.");
+        }
+
+        if ((int)$cert['is_default'] === 1) {
+            throw new RuntimeException("Ce certificat est actuellement actif par défaut. Veuillez d'abord activer un autre certificat.");
+        }
+
+        $targetDir = self::KEYS_BASE_DIR . '/cert_' . $id;
+        if (is_dir($targetDir)) {
+            $files = glob($targetDir . '/*');
+            foreach ($files as $f) {
+                if (is_file($f)) {
+                    @unlink($f);
+                }
+            }
+            @rmdir($targetDir);
+        }
+
+        $stmt = $db->prepare('DELETE FROM certificates WHERE id = :id');
+        return $stmt->execute([':id' => $id]);
+    }
+
+    /**
+     * Renouvelle un certificat Let's Encrypt.
+     */
+    public static function renew(PDO $db, int $id): array
+    {
+        $cert = self::getById($db, $id);
+        if (!$cert) {
+            throw new InvalidArgumentException("Certificat introuvable (ID: {$id}).");
+        }
+
+        if ($cert['type'] !== 'letsencrypt') {
+            throw new InvalidArgumentException("Seuls les certificats gérés par Let's Encrypt peuvent être renouvelés automatiquement. Pour les certificats personnalisés, importez la nouvelle version.");
+        }
+
+        $domain = $cert['primary_domain'];
+        $escDomain = escapeshellarg($domain);
+
+        $cmd = "certbot renew --cert-name {$escDomain} --force-renewal 2>&1";
+        $output = [];
+        $exitCode = 0;
+        exec($cmd, $output, $exitCode);
+        $outputStr = implode("\n", $output);
+
+        if ($exitCode !== 0) {
+            throw new RuntimeException("Échec du renouvellement Certbot (Code: {$exitCode}) :\n" . $outputStr);
+        }
+
+        $liveDir = "/etc/letsencrypt/live/{$domain}";
+        $liveCert      = $liveDir . '/cert.pem';
+        $liveKey       = $liveDir . '/privkey.pem';
+        $liveChain     = $liveDir . '/chain.pem';
+        $liveFullchain = $liveDir . '/fullchain.pem';
+
+        if (file_exists($liveCert)) {
+            $certPem = file_get_contents($liveCert);
+            $meta = self::parseCertPem($certPem);
+
+            $targetDir = self::KEYS_BASE_DIR . '/cert_' . $id;
+            if (!is_dir($targetDir)) {
+                mkdir($targetDir, 0770, true);
+            }
+
+            copy($liveCert, $targetDir . '/cert.pem');
+            copy($liveKey, $targetDir . '/privkey.pem');
+            copy($liveChain, $targetDir . '/chain.pem');
+            copy($liveFullchain, $targetDir . '/fullchain.pem');
+
+            self::secureKeyPermissions($targetDir);
+
+            $upd = $db->prepare('UPDATE certificates SET
+                valid_from = :vf,
+                valid_to = :vt,
+                days_remaining = :dr,
+                status = :st,
+                updated_at = CURRENT_TIMESTAMP
+                WHERE id = :id');
+            $upd->execute([
+                ':vf' => $meta['valid_from'],
+                ':vt' => $meta['valid_to'],
+                ':dr' => $meta['days_remaining'],
+                ':st' => $meta['status'],
+                ':id' => $id,
+            ]);
+
+            if ((int)$cert['is_default'] === 1) {
+                self::setDefault($db, $id);
+            }
+        }
+
+        return self::getById($db, $id);
+    }
+
+    /**
+     * Applique les permissions sécurisées pour Asterisk.
+     */
+    private static function secureKeyPermissions(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+
+        @chmod($dir, 0770);
+        @chgrp($dir, 'asterisk');
+
+        $files = glob($dir . '/*');
+        foreach ($files as $f) {
+            if (is_file($f)) {
+                @chmod($f, 0640);
+                @chgrp($f, 'asterisk');
+            }
+        }
+    }
+}
diff --git a/src/ConfigGenerator.php b/src/ConfigGenerator.php
new file mode 100644
index 0000000..be4432c
--- /dev/null
+++ b/src/ConfigGenerator.php
@@ -0,0 +1,1936 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use RuntimeException;
+
+require_once __DIR__ . '/SystemChecker.php';
+
+class ConfigGenerator
+{
+    public const PJSIP_CONF_PATH      = '/etc/asterisk/pjsip.custom.conf';
+    public const EXTENSIONS_CONF_PATH = '/etc/asterisk/extensions.custom.conf';
+    public const MOH_CONF_PATH        = '/etc/asterisk/musiconhold.custom.conf';
+    public const RTP_CONF_PATH        = '/etc/asterisk/rtp.conf';
+    public const FEATURES_CONF_PATH   = '/etc/asterisk/features.conf';
+    public const VOICEMAIL_CONF_PATH  = '/etc/asterisk/voicemail.custom.conf';
+    public const BACKUP_DIR           = __DIR__ . '/../storage/backups';
+
+    public function __construct(private PDO $db) {}
+
+    /**
+     * Génère le contenu complet de /etc/asterisk/pjsip.custom.conf
+     */
+    public function generatePjsipConf(): string
+    {
+        $settings   = $this->db->query('SELECT * FROM settings WHERE id = 1')->fetch() ?: [];
+        $extensions = $this->db->query('SELECT * FROM extensions WHERE enabled = 1 ORDER BY extension ASC')->fetchAll();
+        $trunks     = $this->db->query('SELECT * FROM trunks WHERE enabled = 1 ORDER BY id ASC')->fetchAll();
+        $mohSounds  = $this->db->query("SELECT id, slug, name FROM sounds WHERE usage_type = 'moh'")->fetchAll();
+        $mohMap     = [];
+        foreach ($mohSounds as $ms) {
+            $mohMap[(int)$ms['id']] = $ms;
+        }
+
+        $date     = date('Y-m-d H:i:s');
+        $udpPort    = (int)($settings['udp_port'] ?? 5060);
+        $tlsPort    = (int)($settings['tls_port'] ?? 5061);
+        $extUdpPort = (int)($settings['external_udp_port'] ?? 0);
+        $extTlsPort = (int)($settings['external_tls_port'] ?? 0);
+        $leDomain   = trim((string)($settings['letsencrypt_domain'] ?? ''));
+        $extHost    = trim((string)($settings['external_ip'] ?? ''));
+
+        // Multi-réseaux locaux (Local Networks)
+        $localNetworks = json_decode((string)($settings['local_networks_json'] ?? '[]'), true) ?: [];
+        if (empty($localNetworks)) {
+            $rawNet = trim((string)($settings['local_net'] ?? ''));
+            if ($rawNet !== '') {
+                $localNetworks = [$rawNet];
+            }
+        }
+
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; FICHIER GÉNÉRÉ AUTOMATIQUEMENT PAR NEXUSPBX ($date)";
+        $lines[] = "; NE PAS MODIFIER MANUELLEMENT - SOURCE UNIQUE DE VÉRITÉ : SQLITE";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "";
+
+        // 1. Transport UDP (Postes internes LAN & Trunks standards)
+        $lines[] = "; --- TRANSPORT UDP (LAN / INTERNE) ---";
+        $lines[] = "[transport-udp]";
+        $lines[] = "type = transport";
+        $lines[] = "protocol = udp";
+        $lines[] = "bind = 0.0.0.0:{$udpPort}";
+        $lines[] = "symmetric_transport = yes";
+        foreach ($localNetworks as $net) {
+            $net = trim((string)$net);
+            if ($net !== '') {
+                $lines[] = "local_net = {$net}";
+            }
+        }
+        if ($extHost !== '') {
+            $lines[] = "external_media_address = {$extHost}";
+            $lines[] = "external_signaling_address = {$extHost}";
+            if ($extUdpPort > 0) {
+                $lines[] = "external_signaling_port = {$extUdpPort}";
+            }
+        }
+        $lines[] = "allow_reload = no";
+        $lines[] = "";
+
+        // 1b. Transport TCP (Trunks opérateurs TCP)
+        $lines[] = "; --- TRANSPORT TCP (OPÉRATEURS / TRUNKS TCP) ---";
+        $lines[] = "[transport-tcp]";
+        $lines[] = "type = transport";
+        $lines[] = "protocol = tcp";
+        $lines[] = "bind = 0.0.0.0:{$udpPort}";
+        $lines[] = "symmetric_transport = yes";
+        foreach ($localNetworks as $net) {
+            $net = trim((string)$net);
+            if ($net !== '') {
+                $lines[] = "local_net = {$net}";
+            }
+        }
+        if ($extHost !== '') {
+            $lines[] = "external_media_address = {$extHost}";
+            $lines[] = "external_signaling_address = {$extHost}";
+            if ($extUdpPort > 0) {
+                $lines[] = "external_signaling_port = {$extUdpPort}";
+            }
+        }
+        $lines[] = "allow_reload = no";
+        $lines[] = "";
+
+        // 2. Transport TLS (Certificat sélectionné dans le Gestionnaire SSL / TLS)
+        $activeCert = null;
+        try {
+            $stmt = $this->db->query("SELECT * FROM certificates WHERE is_default = 1 LIMIT 1");
+            $activeCert = $stmt->fetch();
+        } catch (\Throwable) {
+            $activeCert = null;
+        }
+
+        $certPath = "/etc/asterisk/keys/asterisk.crt";
+        $keyPath  = "/etc/asterisk/keys/asterisk.key";
+        $caPath   = "";
+
+        if ($activeCert) {
+            $candidateCert = !empty($activeCert['fullchain_path']) && file_exists($activeCert['fullchain_path'])
+                ? $activeCert['fullchain_path']
+                : ($activeCert['cert_path'] ?? '');
+            $candidateKey  = $activeCert['key_path'] ?? '';
+            $candidateCa   = $activeCert['chain_path'] ?? '';
+
+            if (file_exists($candidateCert) && file_exists($candidateKey)) {
+                $certPath = $candidateCert;
+                $keyPath  = $candidateKey;
+                if (!empty($candidateCa) && file_exists($candidateCa)) {
+                    $caPath = $candidateCa;
+                }
+            }
+        } elseif ($leDomain !== '' && file_exists("/etc/letsencrypt/live/{$leDomain}/fullchain.pem")) {
+            $certPath = "/etc/letsencrypt/live/{$leDomain}/fullchain.pem";
+            $keyPath  = "/etc/letsencrypt/live/{$leDomain}/privkey.pem";
+        }
+
+        $hasTlsCerts = (file_exists($certPath) && file_exists($keyPath));
+
+        $lines[] = "; --- TRANSPORT TLS (SIGNALISATION SIP SÉCURISÉE PORT {$tlsPort}) ---";
+        $verifyClient = (!empty($settings['tls_verify_client']) && (int)$settings['tls_verify_client'] === 1) ? 'yes' : 'no';
+        $lines[] = "[transport-tls]";
+        $lines[] = "type = transport";
+        $lines[] = "protocol = tls";
+        $lines[] = "bind = 0.0.0.0:{$tlsPort}";
+        $lines[] = "symmetric_transport = yes";
+        $lines[] = "cert_file = {$certPath}";
+        $lines[] = "priv_key_file = {$keyPath}";
+        if ($caPath !== '') {
+            $lines[] = "ca_list_file = {$caPath}";
+        }
+        $lines[] = "method = tlsv1_2";
+        $lines[] = "verify_client = {$verifyClient}";
+        $lines[] = "verify_server = no";
+        foreach ($localNetworks as $net) {
+            $net = trim((string)$net);
+            if ($net !== '') {
+                $lines[] = "local_net = {$net}";
+            }
+        }
+        if ($extHost !== '') {
+            $lines[] = "external_media_address = {$extHost}";
+            $lines[] = "external_signaling_address = {$extHost}";
+            if ($extTlsPort > 0) {
+                $lines[] = "external_signaling_port = {$extTlsPort}";
+            }
+        }
+        $lines[] = "allow_reload = no";
+        $lines[] = "";
+
+        // 3. Extensions (Postes téléphoniques hybrides UDP vs TLS+SRTP)
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; POSTES TÉLÉPHONIQUES (EXTENSIONS)";
+        $lines[] = "; ===========================================================================";
+        foreach ($extensions as $ext) {
+            $num         = trim((string)$ext['extension']);
+            $name        = str_replace('"', '', trim((string)$ext['name']));
+            $secret      = trim((string)$ext['secret']);
+            $wantsTls    = ($ext['transport'] === 'tls');
+            $transport   = ($wantsTls && $hasTlsCerts) ? 'transport-tls' : 'transport-udp';
+            $encMode     = (int)($ext['encryption'] ?? 0);
+            if ($wantsTls && $encMode === 0) {
+                $encMode = 1; // Sécurisation par défaut si transport TLS
+            }
+            $codecs      = array_filter(array_map('trim', explode(',', (string)$ext['codecs'])));
+            $maxContacts = max(1, (int)$ext['max_contacts']);
+            $modeLabel   = ($encMode === 2) ? 'SRTP FORCÉ' : (($encMode === 1) ? 'SRTP OPTIONNEL' : 'RTP CLAIR');
+
+            $sysLang = trim((string)($settings['system_language'] ?? 'fr')) ?: 'fr';
+            $hasVm   = !empty($ext['voicemail_enabled']);
+
+            $lines[] = "; --- Poste {$num} : {$name} [{$modeLabel}] ---";
+            $lines[] = "[{$num}]";
+            $lines[] = "type = endpoint";
+            $lines[] = "context = from-internal";
+            $lines[] = "subscribe_context = from-internal";
+            $lines[] = "auth = {$num}-auth";
+            $lines[] = "aors = {$num}";
+            $lines[] = "callerid = \"{$name}\" <{$num}>";
+            $lines[] = "disallow = all";
+            foreach ($codecs as $codec) {
+                $lines[] = "allow = {$codec}";
+            }
+            $lines[] = "dtmf_mode = rfc4733";
+            $lines[] = "rtp_symmetric = yes";
+            $lines[] = "force_rport = yes";
+            $lines[] = "rewrite_contact = yes";
+            $lines[] = "direct_media = no";
+            if ($wantsTls && $hasTlsCerts) {
+                // Verrouillage strict du transport TLS : refuse le repli sur UDP
+                $lines[] = "transport = transport-tls";
+                $lines[] = "media_use_received_transport = no";
+            } else {
+                $lines[] = "media_use_received_transport = yes";
+            }
+            $lines[] = "named_call_group = default";
+            $lines[] = "named_pickup_group = default";
+            $lines[] = "notify_early_inuse_ringing = yes";
+            if ($encMode === 2) {
+                $lines[] = "media_encryption = sdes";
+                $lines[] = "media_encryption_optimistic = no";
+                $lines[] = "srtp_tag_32 = yes";
+            } elseif ($encMode === 1) {
+                $lines[] = "media_encryption = sdes";
+                $lines[] = "media_encryption_optimistic = yes";
+                $lines[] = "srtp_tag_32 = yes";
+            } else {
+                $lines[] = "media_encryption = no";
+            }
+            $lines[] = "language = {$sysLang}";
+            if ($hasVm) {
+                $lines[] = "mailboxes = {$num}@default";
+                $lines[] = "voicemail_extension = *97";
+            }
+            $lines[] = "moh_suggest = default";
+            $lines[] = "";
+
+            $lines[] = "[{$num}-auth]";
+            $lines[] = "type = auth";
+            $lines[] = "auth_type = userpass";
+            $lines[] = "username = {$num}";
+            $lines[] = "password = {$secret}";
+            $lines[] = "";
+
+            $lines[] = "[{$num}]";
+            $lines[] = "type = aor";
+            $lines[] = "max_contacts = {$maxContacts}";
+            $lines[] = "remove_existing = yes";
+            $lines[] = "qualify_frequency = 30";
+            if ($hasVm) {
+                $lines[] = "mailboxes = {$num}@default";
+            }
+            $lines[] = "";
+        }
+
+        // 4. Trunks SIP (Opérateurs entrants / sortants - Configuration PJSIP complète)
+        if (!empty($trunks)) {
+            $lines[] = "; ===========================================================================";
+            $lines[] = "; TRUNKS OPÉRATEURS SIP (CONFIGURATION AVANCÉE)";
+            $lines[] = "; ===========================================================================";
+            foreach ($trunks as $trunk) {
+                $slug          = $this->slugify($trunk['name']);
+                $host          = trim((string)$trunk['host']);
+                $port          = (int)($trunk['port'] ?? 5060);
+                $outboundProxy = trim((string)($trunk['outbound_proxy'] ?? ''));
+                $authMode      = trim((string)($trunk['auth_mode'] ?? 'userpass'));
+                $username      = trim((string)($trunk['username'] ?? ''));
+                $authUsername  = trim((string)($trunk['auth_username'] ?? '')) ?: $username;
+                $secret        = trim((string)($trunk['secret'] ?? ''));
+                $trProto       = strtolower(trim((string)($trunk['transport'] ?? 'udp')));
+                if ($trProto === 'tls' && $hasTlsCerts) {
+                    $transport = 'transport-tls';
+                } elseif ($trProto === 'tcp') {
+                    $transport = 'transport-tcp';
+                } else {
+                    $transport = 'transport-udp';
+                }
+
+                $context       = trim((string)($trunk['context'] ?? 'from-external')) ?: 'from-external';
+                $fromUser      = trim((string)($trunk['from_user'] ?? '')) ?: $username;
+                $fromDomain    = trim((string)($trunk['from_domain'] ?? '')) ?: $host;
+                $callerId      = trim((string)($trunk['outbound_callerid'] ?? ''));
+                $sendPai       = ((int)($trunk['send_pai'] ?? 1) === 1) ? 'yes' : 'no';
+                $sendRpid      = ((int)($trunk['send_rpid'] ?? 0) === 1) ? 'yes' : 'no';
+                $sendDiversion = ((int)($trunk['send_diversion'] ?? 1) === 1) ? 'yes' : 'no';
+                $trustInbound  = ((int)($trunk['trust_id_inbound'] ?? 1) === 1) ? 'yes' : 'no';
+                $dtmfMode      = trim((string)($trunk['dtmf_mode'] ?? 'rfc4733')) ?: 'rfc4733';
+                $mediaEnc      = trim((string)($trunk['media_encryption'] ?? 'no')) ?: 'no';
+                $natSym        = ((int)($trunk['nat_symmetric'] ?? 1) === 1) ? 'yes' : 'no';
+                $directMedia   = ((int)($trunk['direct_media'] ?? 0) === 1) ? 'yes' : 'no';
+                $qualifyFreq   = max(0, (int)($trunk['qualify_frequency'] ?? 60));
+                $timers        = trim((string)($trunk['timers'] ?? 'yes')) ?: 'yes';
+                $language      = trim((string)($trunk['language'] ?? 'fr')) ?: 'fr';
+                $rtpKeepalive  = max(0, (int)($trunk['rtp_keepalive'] ?? 15));
+                $t38Udptl      = trim((string)($trunk['t38_udptl'] ?? 'no')) ?: 'no';
+                $faxDetect     = ((int)($trunk['fax_detect'] ?? 0) === 1) ? 'yes' : 'no';
+                $inbandProg    = ((int)($trunk['inband_progress'] ?? 0) === 1) ? 'yes' : 'no';
+                $codecs        = array_filter(array_map('trim', explode(',', (string)($trunk['codecs'] ?? 'alaw,ulaw'))));
+                $hasAuth       = ($authMode !== 'ip' && $username !== '' && $secret !== '');
+
+                $lines[] = "; --- Trunk : {$trunk['name']} ({$host}:{$port} [{$trProto}]) ---";
+                $lines[] = "[trunk-{$slug}]";
+                $lines[] = "type = endpoint";
+                $lines[] = "context = {$context}";
+                $lines[] = "transport = {$transport}";
+                if ($hasAuth) {
+                    $lines[] = "outbound_auth = trunk-{$slug}-auth";
+                }
+                $lines[] = "aors = trunk-{$slug}";
+                if ($outboundProxy !== '') {
+                    $lines[] = "outbound_proxy = {$outboundProxy}";
+                }
+                if ($callerId !== '') {
+                    $lines[] = "callerid = {$callerId}";
+                }
+                $lines[] = "disallow = all";
+                foreach ($codecs as $codec) {
+                    $lines[] = "allow = {$codec}";
+                }
+                $lines[] = "dtmf_mode = {$dtmfMode}";
+                $lines[] = "rtp_symmetric = {$natSym}";
+                $lines[] = "force_rport = {$natSym}";
+                $lines[] = "rewrite_contact = {$natSym}";
+                $lines[] = "direct_media = {$directMedia}";
+                $lines[] = "media_encryption = {$mediaEnc}";
+                $lines[] = "send_pai = {$sendPai}";
+                $lines[] = "send_rpid = {$sendRpid}";
+                $lines[] = "send_diversion = {$sendDiversion}";
+                $lines[] = "trust_id_inbound = {$trustInbound}";
+                $lines[] = "timers = {$timers}";
+                if ($rtpKeepalive > 0) {
+                    $lines[] = "rtp_keepalive = {$rtpKeepalive}";
+                }
+                if ($t38Udptl !== 'no') {
+                    $lines[] = "t38_udptl = {$t38Udptl}";
+                    $lines[] = "t38_udptl_ec = redundancy";
+                }
+                if ($faxDetect === 'yes') {
+                    $lines[] = "fax_detect = yes";
+                }
+                if ($inbandProg === 'yes') {
+                    $lines[] = "inband_progress = yes";
+                }
+                if ($fromUser !== '') {
+                    $lines[] = "from_user = {$fromUser}";
+                }
+                if ($fromDomain !== '') {
+                    $lines[] = "from_domain = {$fromDomain}";
+                }
+                $lines[] = "language = {$language}";
+
+                $mohSoundId = (int)($trunk['moh_sound_id'] ?? 0);
+                $trunkMohClass = ($mohSoundId > 0 && isset($mohMap[$mohSoundId]))
+                    ? 'moh-sound-' . $mohMap[$mohSoundId]['slug']
+                    : 'default';
+                $lines[] = "moh_suggest = {$trunkMohClass}";
+
+                // Directives PJSIP additionnelles personnalisées sur l'endpoint
+                $customParams = trim((string)($trunk['custom_endpoint_params'] ?? ''));
+                if ($customParams !== '') {
+                    foreach (preg_split('/\r?\n/', $customParams) ?: [] as $cpLine) {
+                        $cpLine = trim($cpLine);
+                        if ($cpLine !== '' && !str_starts_with($cpLine, '[') && str_contains($cpLine, '=')) {
+                            $lines[] = $cpLine;
+                        }
+                    }
+                }
+                $lines[] = "";
+
+                // Section AOR du Trunk (nommée trunk-$slug)
+                $lines[] = "[trunk-{$slug}]";
+                $lines[] = "type = aor";
+                $lines[] = "contact = sip:{$host}:{$port}";
+                $lines[] = "qualify_frequency = {$qualifyFreq}";
+                if ($outboundProxy !== '') {
+                    $lines[] = "outbound_proxy = {$outboundProxy}";
+                }
+                $customAor = trim((string)($trunk['custom_aor_params'] ?? ''));
+                if ($customAor !== '') {
+                    foreach (preg_split('/\r?\n/', $customAor) ?: [] as $caLine) {
+                        $caLine = trim($caLine);
+                        if ($caLine !== '' && !str_starts_with($caLine, '[') && str_contains($caLine, '=')) {
+                            $lines[] = $caLine;
+                        }
+                    }
+                }
+                $lines[] = "";
+
+                // Section Auth du Trunk
+                if ($hasAuth) {
+                    $lines[] = "[trunk-{$slug}-auth]";
+                    $lines[] = "type = auth";
+                    $lines[] = "auth_type = userpass";
+                    $lines[] = "username = {$authUsername}";
+                    $lines[] = "password = {$secret}";
+                    $lines[] = "";
+                }
+
+                // Section Registration du Trunk
+                if ((int)($trunk['register'] ?? 1) === 1 && $hasAuth) {
+                    $serverUri     = trim((string)($trunk['server_uri'] ?? '')) ?: "sip:{$host}:{$port}";
+                    $clientUri     = trim((string)($trunk['client_uri'] ?? '')) ?: "sip:{$username}@{$fromDomain}:{$port}";
+                    $contactUser   = trim((string)($trunk['contact_user'] ?? ''));
+                    $retryInterval = max(10, (int)($trunk['retry_interval'] ?? 60));
+                    $maxRetries    = max(0, (int)($trunk['max_retries'] ?? 10000));
+                    $forbiddenInt  = max(0, (int)($trunk['forbidden_retry_interval'] ?? 600));
+                    $fatalInt      = max(0, (int)($trunk['fatal_retry_interval'] ?? 0));
+                    $expiration    = max(60, (int)($trunk['expiration'] ?? 3600));
+                    $lineSupport   = ((int)($trunk['line_support'] ?? 1) === 1);
+
+                    $lines[] = "[trunk-{$slug}-reg]";
+                    $lines[] = "type = registration";
+                    $lines[] = "transport = {$transport}";
+                    $lines[] = "outbound_auth = trunk-{$slug}-auth";
+                    $lines[] = "server_uri = {$serverUri}";
+                    $lines[] = "client_uri = {$clientUri}";
+                    if ($contactUser !== '') {
+                        $lines[] = "contact_user = {$contactUser}";
+                    }
+                    if ($outboundProxy !== '') {
+                        $lines[] = "outbound_proxy = {$outboundProxy}";
+                    }
+                    $lines[] = "retry_interval = {$retryInterval}";
+                    $lines[] = "max_retries = {$maxRetries}";
+                    $lines[] = "forbidden_retry_interval = {$forbiddenInt}";
+                    $lines[] = "fatal_retry_interval = {$fatalInt}";
+                    $lines[] = "expiration = {$expiration}";
+                    $lines[] = "auth_rejection_permanent = no";
+                    $lines[] = "max_random_initial_delay = 0";
+                    if ($lineSupport) {
+                        $lines[] = "line = yes";
+                        $lines[] = "endpoint = trunk-{$slug}";
+                    }
+                    $customReg = trim((string)($trunk['custom_reg_params'] ?? ''));
+                    if ($customReg !== '') {
+                        foreach (preg_split('/\r?\n/', $customReg) ?: [] as $crLine) {
+                            $crLine = trim($crLine);
+                            if ($crLine !== '' && !str_starts_with($crLine, '[') && str_contains($crLine, '=')) {
+                                $lines[] = $crLine;
+                            }
+                        }
+                    }
+                    $lines[] = "";
+                }
+
+                // Section Identify (Reconnaissance d'IPs / sous-réseaux opérateur)
+                $matchIpsRaw = trim((string)($trunk['match_ips'] ?? ''));
+                $matchList   = $matchIpsRaw !== ''
+                    ? array_filter(array_map('trim', preg_split('/[\s,;]+/', $matchIpsRaw) ?: []))
+                    : [$host];
+
+                $lines[] = "[trunk-{$slug}-identify]";
+                $lines[] = "type = identify";
+                $lines[] = "endpoint = trunk-{$slug}";
+                foreach ($matchList as $mIp) {
+                    $lines[] = "match = {$mIp}";
+                }
+                $lines[] = "";
+            }
+        }
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    /**
+     * Génère le contenu complet de /etc/asterisk/extensions.custom.conf (Dialplan)
+     */
+    public function generateExtensionsConf(): string
+    {
+        $settings       = $this->db->query('SELECT * FROM settings WHERE id = 1')->fetch() ?: [];
+        $sysLang        = trim((string)($settings['system_language'] ?? 'fr')) ?: 'fr';
+        $extensions     = $this->db->query('SELECT * FROM extensions WHERE enabled = 1 ORDER BY extension ASC')->fetchAll();
+        $groups         = $this->db->query('SELECT * FROM groups ORDER BY extension ASC')->fetchAll();
+        $extGroups      = $this->db->query('SELECT * FROM extension_groups ORDER BY id ASC')->fetchAll();
+        $trunks         = $this->db->query('SELECT * FROM trunks WHERE enabled = 1 ORDER BY id ASC')->fetchAll();
+        $ivrs           = $this->db->query('SELECT * FROM ivrs ORDER BY name ASC')->fetchAll();
+        $outboundRoutes = $this->db->query('SELECT * FROM outbound_routes WHERE enabled = 1 ORDER BY priority ASC, id ASC')->fetchAll();
+        $mohSounds      = $this->db->query("SELECT id, slug, name FROM sounds WHERE usage_type = 'moh'")->fetchAll();
+        $mohSoundsMap   = [];
+        foreach ($mohSounds as $ms) {
+            $mohSoundsMap[(int)$ms['id']] = $ms;
+        }
+
+        $date = date('Y-m-d H:i:s');
+
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; DIALPLAN GÉNÉRÉ AUTOMATIQUEMENT PAR NEXUSPBX ($date)";
+        $lines[] = "; NE PAS MODIFIER MANUELLEMENT - SOURCE UNIQUE DE VÉRITÉ : SQLITE";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "";
+
+        // 1. Contexte [from-internal]
+        $lines[] = "[from-internal]";
+
+        // Récupération des codes de fonctions actifs depuis la base SQLite
+        $fcMap = [];
+        try {
+            $fcRows = $this->db->query("SELECT feature_key, code, enabled FROM feature_codes")->fetchAll();
+            foreach ($fcRows as $r) {
+                if ((int)$r['enabled'] === 1) {
+                    $fcMap[$r['feature_key']] = trim($r['code']);
+                }
+            }
+        } catch (\Throwable) {
+            $fcMap = [];
+        }
+
+        // Hints pour supervision d'état & Touches BLF Yealink (Vert=Libre, Rouge clignotant=Sonne, Rouge fixe=Occupé/DND)
+        $lines[] = "; --- Hints de supervision d'état (Presence, DND & Touches BLF Yealink) ---";
+        foreach ($extensions as $ext) {
+            $num = trim((string)$ext['extension']);
+            $lines[] = "exten => {$num},hint,PJSIP/{$num}&Custom:DND{$num}";
+            $lines[] = "exten => *76{$num},hint,Custom:DND{$num}";
+        }
+        $lines[] = "";
+
+        // Interception d'appel (Call Pickup)
+        $blfPrefix = $fcMap['pickup_blf'] ?? '**';
+        $groupCode = $fcMap['pickup_group'] ?? '*8';
+
+        $lines[] = "; --- Interception d'appel (Call Pickup & Touches BLF Yealink) ---";
+        if ($blfPrefix !== '') {
+            $lines[] = "exten => _{$blfPrefix}.,1,NoOp(Interception d'appel dirigee BLF vers \${EXTEN:" . strlen($blfPrefix) . "})";
+            $lines[] = " same => n,Pickup(\${EXTEN:" . strlen($blfPrefix) . "}@from-internal)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($groupCode !== '') {
+            $lines[] = "exten => _{$groupCode}.,1,NoOp(Interception d'appel dirigee vers \${EXTEN:" . strlen($groupCode) . "})";
+            $lines[] = " same => n,Pickup(\${EXTEN:" . strlen($groupCode) . "}@from-internal)";
+            $lines[] = " same => n,Hangup()";
+
+            $lines[] = "exten => {$groupCode},1,NoOp(Interception d'appel de groupe)";
+            $lines[] = " same => n,Pickup()";
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // Ne Pas Déranger (DND)
+        $dndOn  = $fcMap['dnd_activate'] ?? '*78';
+        $dndOff = $fcMap['dnd_deactivate'] ?? '*79';
+        $dndTog = $fcMap['dnd_toggle'] ?? '*76';
+
+        $lines[] = "; --- Mode Ne Pas Déranger (DND) ---";
+        if ($dndOn !== '') {
+            $dndOnLen = strlen($dndOn);
+            $lines[] = "exten => {$dndOn},1,NoOp(Activation DND pour \${CALLERID(num)})";
+            $lines[] = " same => n,Set(DB(DND/\${CALLERID(num)})=YES)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${CALLERID(num)})=BUSY)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "exten => _{$dndOn}.,1,NoOp(Activation DND pour extension \${EXTEN:{$dndOnLen}})";
+            $lines[] = " same => n,Set(DB(DND/\${EXTEN:{$dndOnLen}})=YES)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${EXTEN:{$dndOnLen}})=BUSY)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($dndOff !== '') {
+            $dndOffLen = strlen($dndOff);
+            $lines[] = "exten => {$dndOff},1,NoOp(Desactivation DND pour \${CALLERID(num)})";
+            $lines[] = " same => n,Set(DB(DND/\${CALLERID(num)})=)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${CALLERID(num)})=NOT_INUSE)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "exten => _{$dndOff}.,1,NoOp(Desactivation DND pour extension \${EXTEN:{$dndOffLen}})";
+            $lines[] = " same => n,Set(DB(DND/\${EXTEN:{$dndOffLen}})=)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${EXTEN:{$dndOffLen}})=NOT_INUSE)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($dndTog !== '') {
+            $dndTogLen = strlen($dndTog);
+            $lines[] = "exten => {$dndTog},1,NoOp(Toggle DND pour \${CALLERID(num)})";
+            $lines[] = " same => n,GotoIf(\$[\"\${DB(DND/\${CALLERID(num)})}\" = \"YES\"]?dnd_turn_off:dnd_turn_on)";
+            $lines[] = " same => n(dnd_turn_on),Set(DB(DND/\${CALLERID(num)})=YES)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${CALLERID(num)})=BUSY)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(dnd_turn_off),Set(DB(DND/\${CALLERID(num)})=)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${CALLERID(num)})=NOT_INUSE)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "exten => _{$dndTog}.,1,NoOp(Toggle DND pour extension \${EXTEN:{$dndTogLen}})";
+            $lines[] = " same => n,GotoIf(\$[\"\${DB(DND/\${EXTEN:{$dndTogLen}})}\" = \"YES\"]?dnd_ext_off:dnd_ext_on)";
+            $lines[] = " same => n(dnd_ext_on),Set(DB(DND/\${EXTEN:{$dndTogLen}})=YES)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${EXTEN:{$dndTogLen}})=BUSY)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(dnd_ext_off),Set(DB(DND/\${EXTEN:{$dndTogLen}})=)";
+            $lines[] = " same => n,Set(DEVICE_STATE(Custom:DND\${EXTEN:{$dndTogLen}})=NOT_INUSE)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Playback(do-not-disturb)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // Renvois d'appels
+        $cfOn   = $fcMap['cf_activate'] ?? '*72';
+        $cfOff  = $fcMap['cf_deactivate'] ?? '*73';
+        $cfuOn  = $fcMap['cfu_activate'] ?? '*52';
+        $cfuOff = $fcMap['cfu_deactivate'] ?? '*53';
+
+        $lines[] = "; --- Gestion des Renvois d'Appels ---";
+        if ($cfOn !== '') {
+            $lines[] = "exten => _{$cfOn}.,1,NoOp(Renvoi inconditionnel vers \${EXTEN:" . strlen($cfOn) . "})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(CF/\${CALLERID(num)})=\${EXTEN:" . strlen($cfOn) . "})";
+            $lines[] = " same => n,Playback(call-fwd-unconditional)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+
+            $lines[] = "exten => {$cfOn},1,NoOp(Renvoi inconditionnel interactif)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Read(targetNum,vm-enter-num-to-call,15,,,5)";
+            $lines[] = " same => n,GotoIf(\$[\"\${targetNum}\" = \"\"]?cf_abort)";
+            $lines[] = " same => n,Set(DB(CF/\${CALLERID(num)})=\${targetNum})";
+            $lines[] = " same => n,Playback(call-fwd-unconditional)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(cf_abort),Playback(cancelled)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($cfOff !== '') {
+            $lines[] = "exten => {$cfOff},1,NoOp(Desactivation Renvoi inconditionnel)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(CF/\${CALLERID(num)})=)";
+            $lines[] = " same => n,Playback(call-fwd-unconditional)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($cfuOn !== '') {
+            $lines[] = "exten => _{$cfuOn}.,1,NoOp(Renvoi indisponible vers \${EXTEN:" . strlen($cfuOn) . "})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(CFU/\${CALLERID(num)})=\${EXTEN:" . strlen($cfuOn) . "})";
+            $lines[] = " same => n,Playback(call-fwd-no-ans)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+
+            $lines[] = "exten => {$cfuOn},1,NoOp(Renvoi indisponible interactif)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Read(targetNum,vm-enter-num-to-call,15,,,5)";
+            $lines[] = " same => n,GotoIf(\$[\"\${targetNum}\" = \"\"]?cfu_abort)";
+            $lines[] = " same => n,Set(DB(CFU/\${CALLERID(num)})=\${targetNum})";
+            $lines[] = " same => n,Playback(call-fwd-no-ans)";
+            $lines[] = " same => n,Playback(activated)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(cfu_abort),Playback(cancelled)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($cfuOff !== '') {
+            $lines[] = "exten => {$cfuOff},1,NoOp(Desactivation Renvoi indisponible)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(CFU/\${CALLERID(num)})=)";
+            $lines[] = " same => n,Playback(call-fwd-no-ans)";
+            $lines[] = " same => n,Playback(de-activated)";
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // Sécurité & Liste Noire (Blacklist)
+        $blAdd  = $fcMap['blacklist_add'] ?? '*30';
+        $blRem  = $fcMap['blacklist_remove'] ?? '*31';
+        $blLast = $fcMap['blacklist_last'] ?? '*32';
+
+        $lines[] = "; --- Sécurité & Filtrage Liste Noire (Blacklist) ---";
+        if ($blAdd !== '') {
+            $lines[] = "exten => _{$blAdd}.,1,NoOp(Ajout a la blacklist \${EXTEN:" . strlen($blAdd) . "})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(blacklist/\${EXTEN:" . strlen($blAdd) . "})=1)";
+            $lines[] = " same => n,Playback(num-was-successfully)";
+            $lines[] = " same => n,Playback(added)";
+            $lines[] = " same => n,Hangup()";
+
+            $lines[] = "exten => {$blAdd},1,NoOp(Ajout a la blacklist interactif)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Read(targetNum,enter-num-blacklist,15,,,5)";
+            $lines[] = " same => n,GotoIf(\$[\"\${targetNum}\" = \"\"]?bl_abort)";
+            $lines[] = " same => n,Set(DB(blacklist/\${targetNum})=1)";
+            $lines[] = " same => n,Playback(num-was-successfully)";
+            $lines[] = " same => n,Playback(added)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(bl_abort),Playback(cancelled)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($blRem !== '') {
+            $lines[] = "exten => _{$blRem}.,1,NoOp(Retrait de la blacklist \${EXTEN:" . strlen($blRem) . "})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(DB(blacklist/\${EXTEN:" . strlen($blRem) . "})=)";
+            $lines[] = " same => n,Playback(num-was-successfully)";
+            $lines[] = " same => n,Playback(removed)";
+            $lines[] = " same => n,Hangup()";
+
+            $lines[] = "exten => {$blRem},1,NoOp(Retrait de la blacklist interactif)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Read(targetNum,entr-num-rmv-blklist,15,,,5)";
+            $lines[] = " same => n,GotoIf(\$[\"\${targetNum}\" = \"\"]?blrem_abort)";
+            $lines[] = " same => n,Set(DB(blacklist/\${targetNum})=)";
+            $lines[] = " same => n,Playback(num-was-successfully)";
+            $lines[] = " same => n,Playback(removed)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(blrem_abort),Playback(cancelled)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($blLast !== '') {
+            $lines[] = "exten => {$blLast},1,NoOp(Blacklist dernier appelant)";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(lastCaller=\${DB(LASTCALLER/\${CALLERID(num)})})";
+            $lines[] = " same => n,GotoIf(\$[\"\${lastCaller}\" = \"\"]?bllast_abort)";
+            $lines[] = " same => n,Set(DB(blacklist/\${lastCaller})=1)";
+            $lines[] = " same => n,Playback(num-was-successfully)";
+            $lines[] = " same => n,Playback(added)";
+            $lines[] = " same => n,Hangup()";
+            $lines[] = " same => n(bllast_abort),Playback(cancelled)";
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // Outils & Messagerie
+        $vmDirect  = $fcMap['voicemail_direct'] ?? '*97';
+        $vmGeneral = $fcMap['voicemail_general'] ?? '*98';
+        $spkExten  = $fcMap['speak_exten'] ?? '*65';
+        $lastCall  = $fcMap['last_caller'] ?? '*69';
+        $echoCode  = $fcMap['echo_test'] ?? '*43';
+        $clockCode = $fcMap['speaking_clock'] ?? '*60';
+        $mohCode   = $fcMap['moh_test'] ?? '*44';
+
+        $lines[] = "; --- Messagerie Vocale & Utilitaires ---";
+        if ($vmDirect !== '') {
+            $lines[] = "exten => {$vmDirect},1,NoOp(Messagerie Vocale Directe - \${CALLERID(num)})";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,GotoIf(\$[\"\${VM_INFO(\${CALLERID(num)}@default,exists)}\" = \"1\"]?vm_ok:vm_none)";
+            $lines[] = " same => n(vm_ok),Goto(from-vm-direct,\${CALLERID(num)},1)";
+            $lines[] = " same => n(vm_none),NoOp(Aucune boite vocale active pour \${CALLERID(num)})";
+            $lines[] = " same => n,Playback(vm-incorrect-mailbox)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($vmGeneral !== '') {
+            $lines[] = "exten => {$vmGeneral},1,NoOp(Messagerie Vocale Générale)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,VoiceMailMain(@default)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($spkExten !== '') {
+            $lines[] = "exten => {$spkExten},1,NoOp(Speak your extension)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Playback(your)";
+            $lines[] = " same => n,Playback(extension)";
+            $lines[] = " same => n,Playback(number)";
+            $lines[] = " same => n,Playback(is)";
+            $lines[] = " same => n,SayDigits(\${CALLERID(num)})";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($lastCall !== '') {
+            $lines[] = "exten => {$lastCall},1,NoOp(Dernier appelant reçu)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(lastCaller=\${DB(LASTCALLER/\${CALLERID(num)})})";
+            $lines[] = " same => n,GotoIf(\$[\"\${lastCaller}\" = \"\"]?nolast)";
+            $lines[] = " same => n,Playback(telephone-number)";
+            $lines[] = " same => n,SayDigits(\${lastCaller})";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Goto(from-internal,\${lastCaller},1)";
+            $lines[] = " same => n(nolast),Playback(cannot-complete-as-dialed)";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($echoCode !== '') {
+            $lines[] = "exten => {$echoCode},1,NoOp(Test Echo Audio)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Playback(demo-echotest)";
+            $lines[] = " same => n,Echo()";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($clockCode !== '') {
+            $lines[] = "exten => {$clockCode},1,NoOp(Horloge Parlante / Test Audio)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,SayUnixTime()";
+            $lines[] = " same => n,Hangup()";
+        }
+        if ($mohCode !== '') {
+            $lines[] = "exten => {$mohCode},1,NoOp(Test Musique d'Attente MoH par defaut)";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,MusicOnHold(default)";
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // Appels entre postes internes & Gestion Renvois / DND / Voicemail
+        $lines[] = "; --- Appels entre postes internes & Gestion Renvois / DND / Voicemail ---";
+        foreach ($extensions as $ext) {
+            $num     = trim((string)$ext['extension']);
+            $name    = str_replace('"', '', trim((string)$ext['name']));
+            $ringSec = max(5, min(120, (int)($ext['ring_time'] ?? 20)));
+            $hasVm   = !empty($ext['voicemail_enabled']);
+
+            $lines[] = "exten => {$num},1,NoOp(Appel interne vers {$num} - {$name})";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
+            $lines[] = " same => n,Set(DB(LASTCALLER/{$num})=\${CALLERID(num)})";
+            $lines[] = " same => n,GotoIf(\$[\"\${DB(DND/{$num})}\" = \"YES\"]?dnd_{$num})";
+            $lines[] = " same => n,GotoIf(\$[\"\${DB(CF/{$num})}\" != \"\"]?cf_{$num})";
+            $lines[] = " same => n,Dial(PJSIP/{$num},{$ringSec},tTkK)";
+            $lines[] = " same => n,GotoIf(\$[\"\${DB(CFU/{$num})}\" != \"\"]?cfu_{$num})";
+            if ($hasVm) {
+                $lines[] = " same => n,GotoIf(\$[\"\${DIALSTATUS}\" = \"BUSY\"]?busy_vm_{$num})";
+                $lines[] = " same => n,GotoIf(\$[\"\${DIALSTATUS}\" = \"NOANSWER\" | \"\${DIALSTATUS}\" = \"CHANUNAVAIL\" | \"\${DIALSTATUS}\" = \"CONGESTION\"]?unavail_vm_{$num})";
+                $lines[] = " same => n,Hangup()";
+                $lines[] = " same => n(busy_vm_{$num}),VoiceMail({$num}@default,b)";
+                $lines[] = " same => n,Hangup()";
+                $lines[] = " same => n(unavail_vm_{$num}),VoiceMail({$num}@default,u)";
+                $lines[] = " same => n,Hangup()";
+            } else {
+                $lines[] = " same => n,Hangup()";
+            }
+            $lines[] = " same => n(dnd_{$num}),NoOp(Poste {$num} en mode Ne Pas Deranger DND)";
+            if ($hasVm) {
+                $lines[] = " same => n,VoiceMail({$num}@default,b)";
+                $lines[] = " same => n,Hangup()";
+            } else {
+                $lines[] = " same => n,Playtones(busy)";
+                $lines[] = " same => n,Busy(3)";
+                $lines[] = " same => n,Hangup()";
+            }
+            $lines[] = " same => n(cf_{$num}),NoOp(Poste {$num} renvoi inconditionnel vers \${DB(CF/{$num})})";
+            $lines[] = " same => n,Goto(from-internal,\${DB(CF/{$num})},1)";
+            $lines[] = " same => n(cfu_{$num}),NoOp(Poste {$num} indisponible, renvoi vers \${DB(CFU/{$num})})";
+            $lines[] = " same => n,Goto(from-internal,\${DB(CFU/{$num})},1)";
+            $lines[] = "";
+        }
+
+        // Groupes d'appel (Ring Groups)
+        if (!empty($groups)) {
+            $lines[] = "; --- Groupes d'appel (Ring Groups) ---";
+            foreach ($groups as $grp) {
+                $gExt     = trim((string)$grp['extension']);
+                $gName    = str_replace('"', '', trim((string)$grp['name']));
+                $strategy = $grp['strategy'];
+                $ringTime = max(5, (int)$grp['ring_time']);
+                $members  = json_decode((string)$grp['members'], true) ?: [];
+                $members  = array_values(array_filter(array_map('trim', $members)));
+                $failover = trim((string)$grp['failover_dest']);
+
+                $lines[] = "exten => {$gExt},1,NoOp(Groupe {$gExt} - {$gName} [{$strategy}])";
+                if (empty($members)) {
+                    $lines[] = " same => n,Hangup()";
+                } elseif ($strategy === 'hunt') {
+                    // Sonnerie séquentielle poste par poste
+                    foreach ($members as $m) {
+                        $lines[] = " same => n,Dial(PJSIP/{$m},{$ringTime},tT)";
+                    }
+                    $lines[] = " same => n," . $this->buildDestinationDialplan($failover);
+                } else {
+                    // ringall (simultané)
+                    $dialStr = implode('&', array_map(fn($m) => "PJSIP/{$m}", $members));
+                    $lines[] = " same => n,Dial({$dialStr},{$ringTime},tT)";
+                    $lines[] = " same => n," . $this->buildDestinationDialplan($failover);
+                }
+                $lines[] = " same => n,Hangup()";
+                $lines[] = "";
+            }
+        }
+
+        // Accès direct aux IVR depuis l'interne via *8 + id
+        if (!empty($ivrs)) {
+            $lines[] = "; --- Test direct des SVI/IVR depuis l'interne ---";
+            foreach ($ivrs as $ivr) {
+                $ivrSlug = $this->slugify($ivr['name']);
+                $testCode = '*8' . str_pad((string)$ivr['id'], 2, '0', STR_PAD_LEFT);
+                $lines[] = "exten => {$testCode},1,NoOp(Test SVI {$ivr['name']})";
+                $lines[] = " same => n,Goto(ivr-{$ivrSlug},s,1)";
+            }
+            $lines[] = "";
+        }
+
+        // 1b. Sortie vers l'extérieur : UNIQUEMENT via les Routes Sortantes actives
+        // Si aucune route sortante active n'existe ou n'autorise le poste, aucun appel externe ne peut sortir !
+        if (!empty($outboundRoutes)) {
+            $lines[] = "; --- Inclusion du moteur de Routes Sortantes (Outbound Routes) ---";
+            $lines[] = "include => outbound-allroutes";
+            $lines[] = "";
+        } else {
+            $lines[] = "; --- Aucune Route Sortante active : appels externes verrouilles ---";
+            $lines[] = "; Creez et activez au moins une Route Sortante dans l'onglet 'Routes Sortantes' pour autoriser les appels vers l'exterieur.";
+            $lines[] = "";
+        }
+
+        // 1b. Contextes [outbound-allroutes] & Sous-routines [sub-outroute-{id}]
+        if (!empty($outboundRoutes)) {
+            // Indexation des membres des Groupes d'extensions (Sites / Droits de routes : Nice, Paris...)
+            $groupMembersMap = [];
+            foreach ($extGroups as $eg) {
+                $egId   = (string)$eg['id'];
+                $egName = trim((string)$eg['name']);
+                $mList  = json_decode((string)$eg['members'], true) ?: [];
+                $mList  = array_values(array_filter(array_map('trim', $mList)));
+                $groupMembersMap[$egId]   = $mList;
+                $groupMembersMap[$egName] = $mList;
+            }
+            // Compatibilité avec les ring groups
+            foreach ($groups as $grp) {
+                $gExt  = trim((string)$grp['extension']);
+                $gName = trim((string)$grp['name']);
+                $mList = json_decode((string)$grp['members'], true) ?: [];
+                $mList = array_values(array_filter(array_map('trim', $mList)));
+                if (!isset($groupMembersMap[$gExt])) $groupMembersMap[$gExt] = $mList;
+                if (!isset($groupMembersMap[$gName])) $groupMembersMap[$gName] = $mList;
+            }
+
+            // Indexation des Trunks actifs
+            $trunkByName = [];
+            foreach ($trunks as $t) {
+                $trunkByName[trim((string)$t['name'])] = $t;
+                $trunkByName['trunk-' . $this->slugify($t['name'])] = $t;
+            }
+
+            $patternDispatches = [];
+            $subroutineBlocks  = [];
+
+            foreach ($outboundRoutes as $rIdx => $route) {
+                $rId         = (int)$route['id'];
+                $rPriority   = (int)($route['priority'] ?? ($rIdx + 1));
+                $rName       = preg_replace('/[^a-zA-Z0-9 _\-]/', '', trim((string)$route['name'])) ?: "Route-{$rId}";
+                $rCid        = trim((string)($route['outbound_callerid'] ?? ''));
+                $overrideCid = ((int)($route['override_ext_cid'] ?? 0) === 1);
+                $rPass       = preg_replace('/[^0-9*#]/', '', trim((string)($route['route_password'] ?? '')));
+                $rType       = trim((string)($route['route_type'] ?? 'normal'));
+                $permMode    = trim((string)($route['permission_mode'] ?? 'all'));
+                $contNext    = ((int)($route['continue_next_route'] ?? 1) === 1);
+                $congDest    = trim((string)($route['congestion_dest'] ?? 'terminate-congestion')) ?: 'terminate-congestion';
+                $rMohClass   = preg_replace('/[^a-zA-Z0-9_\-]/', '', trim((string)($route['moh_class'] ?? 'default'))) ?: 'default';
+
+                $trunkSeq    = json_decode((string)($route['trunk_sequence_json'] ?? '[]'), true) ?: [];
+                $dialPats    = json_decode((string)($route['dial_patterns_json'] ?? '[]'), true) ?: [];
+                $allowGrps   = json_decode((string)($route['allowed_groups_json'] ?? '[]'), true) ?: [];
+                $allowExts   = json_decode((string)($route['allowed_extensions_json'] ?? '[]'), true) ?: [];
+
+                // Enregistrement des patterns de cette route dans l'ordonnanceur global
+                foreach ($dialPats as $pat) {
+                    if (!is_array($pat)) {
+                        continue;
+                    }
+                    $prepend    = preg_replace('/[^0-9*#+]/', '', trim((string)($pat['prepend'] ?? '')));
+                    $prefix     = preg_replace('/[^0-9*#+]/', '', trim((string)($pat['prefix'] ?? '')));
+                    $matchRaw   = ltrim(trim((string)($pat['match_pattern'] ?? '')), '_');
+                    $matchRaw   = preg_replace('/[^0-9XZN.*#+\[\]\-!]/i', '', $matchRaw);
+                    $patCid     = preg_replace('/[^0-9XZN.*#+\[\]\-]/i', '', ltrim(trim((string)($pat['callerid'] ?? '')), '_'));
+
+                    if ($matchRaw === '') {
+                        continue;
+                    }
+
+                    $combined = $prefix . $matchRaw;
+                    $needsUnderscore = (bool)preg_match('/[XZN\[\].!]/i', $combined);
+                    $astExten = ($needsUnderscore ? '_' : '') . $combined;
+
+                    $patternDispatches[$astExten][] = [
+                        'route_id'   => $rId,
+                        'route_name' => $rName,
+                        'priority'   => $rPriority,
+                        'prepend'    => $prepend,
+                        'prefix_len' => strlen($prefix),
+                        'callerid'   => $patCid,
+                        'cong_dest'  => $congDest,
+                    ];
+                }
+
+                // Construction de la sous-routine [sub-outroute-{id}]
+                $sub = [];
+                $sub[] = "; --- Sous-routine Route Sortante #{$rPriority} : {$rName} (Type: {$rType}) ---";
+                $sub[] = "[sub-outroute-{$rId}]";
+                $sub[] = "exten => s,1,NoOp(Evaluation Route Sortante #{$rPriority} [{$rName}] -> Numero=\${ARG1} | Poste=\${CALLERID(num)})";
+                $sub[] = " same => n,Set(OUTNUM=\${ARG1})";
+                $sub[] = " same => n,Set(CHANNEL(musicclass)={$rMohClass})";
+                $sub[] = " same => n,Set(__MOHCLASS={$rMohClass})";
+
+                // 1. Contrôle des droits d'accès (Groupes Autorisés ex: Nice/Paris + Postes Autorisés)
+                if ($permMode === 'restricted') {
+                    $effectiveExts = [];
+                    foreach ($allowExts as $ae) {
+                        $ae = preg_replace('/[^0-9a-zA-Z_-]/', '', trim((string)$ae));
+                        if ($ae !== '') {
+                            $effectiveExts[$ae] = true;
+                        }
+                    }
+                    foreach ($allowGrps as $ag) {
+                        $agKey = trim((string)$ag);
+                        foreach ($groupMembersMap[$agKey] ?? [] as $gm) {
+                            $gm = preg_replace('/[^0-9a-zA-Z_-]/', '', trim((string)$gm));
+                            if ($gm !== '') {
+                                $effectiveExts[$gm] = true;
+                            }
+                        }
+                    }
+
+                    $allowedList = array_keys($effectiveExts);
+                    if (empty($allowedList)) {
+                        $sub[] = " same => n,NoOp(Route [{$rName}] restreinte sans aucun poste autorise -> Passage a la route suivante)";
+                        $sub[] = " same => n,Return()";
+                    } else {
+                        $regexStr = '^(' . implode('|', $allowedList) . ')$';
+                        $sub[] = " same => n,GotoIf(\$[\${REGEX(\"{$regexStr}\" \${CALLERID(num)})} = 1]?auth_ok)";
+                        $sub[] = " same => n,NoOp(Poste \${CALLERID(num)} non autorise sur la route [{$rName}] -> Passage a la route sortante suivante)";
+                        $sub[] = " same => n,Return()";
+                        $sub[] = " same => n(auth_ok),NoOp(Droits valides pour le poste \${CALLERID(num)} sur [{$rName}])";
+                    }
+                }
+
+                // 2. Mot de passe / Code PIN éventuel sur la route
+                if ($rPass !== '') {
+                    $sub[] = " same => n,Authenticate({$rPass})";
+                }
+
+                // 3. Positionnement du CallerID Sortant de la route
+                if ($rCid !== '') {
+                    $sub[] = " same => n,Set(CALLERID(all)={$rCid})";
+                }
+
+                // 4. Séquence de Trunks avec bascule automatique (Failover)
+                $validTrunkCount = 0;
+                foreach ($trunkSeq as $tSeqName) {
+                    $tKey = trim((string)$tSeqName);
+                    if ($tKey === '') {
+                        continue;
+                    }
+                    $tObj = $trunkByName[$tKey] ?? null;
+                    $tSlug = $tObj ? $this->slugify($tObj['name']) : $this->slugify($tKey);
+                    $tFallbackCid = $tObj ? trim((string)($tObj['outbound_callerid'] ?? '')) : '';
+
+                    if ($rCid === '' && $tFallbackCid !== '' && $overrideCid) {
+                        $sub[] = " same => n,Set(CALLERID(all)={$tFallbackCid})";
+                    }
+
+                    $validTrunkCount++;
+                    $sub[] = " same => n,NoOp(Route [{$rName}] - Tentative Trunk #{$validTrunkCount} [trunk-{$tSlug}] vers \${OUTNUM})";
+                    $sub[] = " same => n,Dial(PJSIP/\${OUTNUM}@trunk-{$tSlug},60,tT)";
+                    $sub[] = " same => n,GotoIf(\$[\"\${DIALSTATUS}\" = \"ANSWER\" | \"\${DIALSTATUS}\" = \"BUSY\" | \"\${DIALSTATUS}\" = \"NOANSWER\" | \"\${DIALSTATUS}\" = \"CANCEL\"]?call_done)";
+                    $sub[] = " same => n,NoOp(Trunk [trunk-{$tSlug}] indisponible [\${DIALSTATUS}] -> Passage au Trunk / Route suivant)";
+                }
+
+                // 5. Si tous les Trunks de cette route sont indisponibles
+                $sub[] = " same => n,Set(CALLERID(all)=\${ORIG_CID})";
+                if ($contNext) {
+                    $sub[] = " same => n,NoOp(Fin de sequence pour [{$rName}] -> Passage a la route sortante suivante)";
+                    $sub[] = " same => n,Return()";
+                } else {
+                    $sub[] = " same => n," . $this->buildDestinationDialplan($congDest);
+                    $sub[] = " same => n,Hangup()";
+                }
+                $sub[] = " same => n(call_done),Hangup()";
+                $sub[] = "";
+
+                $subroutineBlocks[] = implode("\n", $sub);
+            }
+
+            // Génération du contexte [outbound-allroutes]
+            $lines[] = "[outbound-allroutes]";
+            foreach ($patternDispatches as $astExten => $dispatches) {
+                $lines[] = "; --- Masque sortant : {$astExten} ---";
+                $lines[] = "exten => {$astExten},1,NoOp(Appel Sortant vers \${EXTEN} depuis le poste \${CALLERID(num)})";
+                $lines[] = " same => n,Set(ORIG_CID=\${CALLERID(all)})";
+
+                $lastCongDest = 'terminate-congestion';
+                foreach ($dispatches as $d) {
+                    $rId       = $d['route_id'];
+                    $prepend   = $d['prepend'];
+                    $prefixLen = (int)$d['prefix_len'];
+                    $patCid    = $d['callerid'];
+                    $lastCongDest = $d['cong_dest'] ?: $lastCongDest;
+
+                    $numExpr = $prefixLen > 0 ? "{$prepend}\${EXTEN:{$prefixLen}}" : "{$prepend}\${EXTEN}";
+                    if ($patCid !== '') {
+                        $lines[] = " same => n,GosubIf(\$[\"\${CALLERID(num)}\" = \"{$patCid}\"]?sub-outroute-{$rId},s,1({$numExpr}))";
+                    } else {
+                        $lines[] = " same => n,Gosub(sub-outroute-{$rId},s,1({$numExpr}))";
+                    }
+                }
+                $lines[] = " same => n," . $this->buildDestinationDialplan($lastCongDest);
+                $lines[] = " same => n,Hangup()";
+                $lines[] = "";
+            }
+
+            foreach ($subroutineBlocks as $block) {
+                $lines[] = $block;
+            }
+        }
+
+        // 2. Contexte [app-terminate] (Actions Terminate Call style FreePBX : Occupation, Congestion, Zapateller, Hangup)
+        $lines[] = "[app-terminate]";
+        $lines[] = "exten => busy,1,NoOp(Terminate Call: Mettre definitivement l appelant sur occupation)";
+        $lines[] = " same => n,Playtones(busy)";
+        $lines[] = " same => n,Busy(20)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => congestion,1,NoOp(Terminate Call: Tonalite de congestion)";
+        $lines[] = " same => n,Playtones(congestion)";
+        $lines[] = " same => n,Congestion(20)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => zapateller,1,NoOp(Terminate Call: Tonalite SIT Anti-Robot)";
+        $lines[] = " same => n,Answer()";
+        $lines[] = " same => n,Zapateller()";
+        $lines[] = " same => n,Playback(ss-noservice)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => ringforever,1,NoOp(Terminate Call: Sonnerie dans le vide)";
+        $lines[] = " same => n,Ringing()";
+        $lines[] = " same => n,Wait(300)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => hangup,1,NoOp(Terminate Call: Raccrocher immediatement)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+
+        // 2a-bis. Contexte [app-scam-tarpit] (Pièges à Scammers : Musique d'attente en boucle & Fausse voix en boucle infinie)
+        $lines[] = "; --- Pièges à Scammers & Démarchage (Tarpit Anti-Spam) ---";
+        $lines[] = "[app-scam-tarpit]";
+        $lines[] = "exten => moh-default,1,NoOp(Tarpit Scammer - Musique par defaut en boucle)";
+        $lines[] = " same => n,Answer()";
+        $lines[] = " same => n,Wait(1)";
+        $lines[] = " same => n,MusicOnHold(default)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => _moh-.,1,NoOp(Tarpit Scammer - Musique dediee en boucle: \${EXTEN:4})";
+        $lines[] = " same => n,Answer()";
+        $lines[] = " same => n,Wait(1)";
+        $lines[] = " same => n,MusicOnHold(\${EXTEN:4})";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+        $lines[] = "exten => _loop-.,1,NoOp(Tarpit Scammer - Message/Voix en boucle infinie: \${EXTEN:5})";
+        $lines[] = " same => n,Answer()";
+        $lines[] = " same => n,Wait(1)";
+        $lines[] = " same => n(playloop),Playback(custom/\${EXTEN:5})";
+        $lines[] = " same => n,Wait(1)";
+        $lines[] = " same => n,Goto(playloop)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+
+        // 2b. Contexte [from-pstn-toheader] (Extrait le SDA depuis l'en-tête SIP To + Normalise le CallerID +33/0033 en 0X)
+        $lines[] = "[from-pstn-toheader]";
+        $lines[] = "exten => _X.,1,NoOp(Extraction SDA depuis SIP To Header - Appelant=\${CALLERID(num)})";
+        $lines[] = " same => n,ExecIf(\$[\"\${CALLERID(num):0:3}\" = \"+33\"]?Set(CALLERID(num)=0\${CALLERID(num):3}))";
+        $lines[] = " same => n,ExecIf(\$[\"\${CALLERID(num):0:4}\" = \"0033\"]?Set(CALLERID(num)=0\${CALLERID(num):4}))";
+        $lines[] = " same => n,GotoIf(\$[\"\${DB(blacklist/\${CALLERID(num)})}\" != \"\"]?app-blacklisted,s,1)";
+        $lines[] = " same => n,Set(DID_NUM=\${CUT(CUT(PJSIP_HEADER(read,To),@,1),:,2)})";
+        $lines[] = " same => n,GotoIf(\$[\"\${DID_NUM}\" != \"\"]?from-external,\${DID_NUM},1:from-external,\${EXTEN},1)";
+        $lines[] = "exten => s,1,NoOp(Extraction SDA depuis SIP To Header sur s - Appelant=\${CALLERID(num)})";
+        $lines[] = " same => n,ExecIf(\$[\"\${CALLERID(num):0:3}\" = \"+33\"]?Set(CALLERID(num)=0\${CALLERID(num):3}))";
+        $lines[] = " same => n,ExecIf(\$[\"\${CALLERID(num):0:4}\" = \"0033\"]?Set(CALLERID(num)=0\${CALLERID(num):4}))";
+        $lines[] = " same => n,GotoIf(\$[\"\${DB(blacklist/\${CALLERID(num)})}\" != \"\"]?app-blacklisted,s,1)";
+        $lines[] = " same => n,Set(DID_NUM=\${CUT(CUT(PJSIP_HEADER(read,To),@,1),:,2)})";
+        $lines[] = " same => n,GotoIf(\$[\"\${DID_NUM}\" != \"\"]?from-external,\${DID_NUM},1:from-external,s,1)";
+        $lines[] = "";
+
+        // Contexte pour appels rejetés par la liste noire
+        $lines[] = "[app-blacklisted]";
+        $lines[] = "exten => s,1,NoOp(Appelant \${CALLERID(num)} bloque par la liste noire)";
+        $lines[] = " same => n,Answer()";
+        $lines[] = " same => n,Wait(1)";
+        $lines[] = " same => n,Playtones(busy)";
+        $lines[] = " same => n,Busy(3)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+
+        // 2c. Contexte [from-external] (Routes Entrantes avec filtrage ID Appelant [CallerID] & SDA [DID])
+        $lines[] = "[from-external]";
+        $hasCatchAllRoute = false;
+
+        foreach ($trunks as $t) {
+            $mohSoundId = (int)($t['moh_sound_id'] ?? 0);
+            $trunkMohClass = ($mohSoundId > 0 && isset($mohSoundsMap[$mohSoundId]))
+                ? 'moh-sound-' . $mohSoundsMap[$mohSoundId]['slug']
+                : 'default';
+
+            $setMohLines = [];
+            if ($trunkMohClass !== 'default') {
+                $setMohLines[] = " same => n,Set(__MOHCLASS={$trunkMohClass})";
+                $setMohLines[] = " same => n,Set(CHANNEL(musicclass)={$trunkMohClass})";
+            }
+
+            $routes = self::normalizeInboundRoutes((string)($t['did_routes_json'] ?? '[]'));
+            $routeIdx = 0;
+            foreach ($routes as $rule) {
+                $routeIdx++;
+                $cidRaw  = trim((string)($rule['cid'] ?? 'Any'));
+                $didRaw  = trim((string)($rule['did'] ?? 'Any'));
+                $desc    = trim((string)($rule['description'] ?? 'Route entrante'));
+                $dest    = trim((string)($rule['destination'] ?? $t['inbound_dest'] ?? 'hangup'));
+
+                $isAnyDid = ($didRaw === '' || strcasecmp($didRaw, 'any') === 0 || $didRaw === '*' || $didRaw === '_X.');
+                $isAnyCid = ($cidRaw === '' || strcasecmp($cidRaw, 'any') === 0 || $cidRaw === '*');
+
+                $didPattern = $isAnyDid ? '_X.' : preg_replace('/[^0-9+XZN._\[\]\-]/', '', $didRaw);
+                if ($didPattern === '') {
+                    $didPattern = '_X.';
+                }
+
+                $timeInfo = !empty($rule['time_condition_enabled'])
+                    ? " [Horaires: {$rule['time_start']}-{$rule['time_finish']} {$rule['weekdays']}]"
+                    : "";
+
+                if ($isAnyCid) {
+                    if ($didPattern === '_X.') {
+                        if ($hasCatchAllRoute) {
+                            continue;
+                        }
+                        $hasCatchAllRoute = true;
+                    }
+                    $lines[] = "; Inbound Route [{$desc}] ({$t['name']}) : DID={$didPattern} / Appelant=Any{$timeInfo}";
+                    $lines[] = "exten => {$didPattern},1,NoOp(Inbound [{$desc}] Appelant=\${CALLERID(num)})";
+                    foreach ($this->buildInboundRouteLines($rule, $setMohLines, $desc, "{$t['id']}_{$routeIdx}_did") as $rl) {
+                        $lines[] = $rl;
+                    }
+                    if ($isAnyDid) {
+                        $lines[] = "exten => s,1,NoOp(Inbound [{$desc}] sur s Appelant=\${CALLERID(num)})";
+                        foreach ($this->buildInboundRouteLines($rule, $setMohLines, $desc, "{$t['id']}_{$routeIdx}_s") as $rl) {
+                            $lines[] = $rl;
+                        }
+                    }
+                } else {
+                    $cidClean = preg_replace('/[^0-9+XZN._\[\]\-]/', '', $cidRaw);
+                    if ($cidClean === '') {
+                        continue;
+                    }
+                    $cidVariants = [$cidClean];
+                    // Si le motif commence par _0 (ex: _0162XXXXXX), couvrir aussi 0033 et +33 automatiquement
+                    if (str_starts_with($cidClean, '_0') && strlen($cidClean) > 2 && $cidClean[2] !== '0') {
+                        $rest = substr($cidClean, 2);
+                        $cidVariants[] = '_0033' . $rest;
+                        $cidVariants[] = '_+33' . $rest;
+                    }
+
+                    $lines[] = "; Inbound Route Filtrage Appelant [{$desc}] ({$t['name']}) : DID={$didPattern} / CID={$cidClean}{$timeInfo}";
+                    $vIdx = 0;
+                    foreach ($cidVariants as $cidVar) {
+                        $vIdx++;
+                        $lines[] = "exten => {$didPattern}/{$cidVar},1,NoOp(Inbound Filter [{$desc}] CID=\${CALLERID(num)})";
+                        foreach ($this->buildInboundRouteLines($rule, $setMohLines, $desc, "{$t['id']}_{$routeIdx}_cid_{$vIdx}") as $rl) {
+                            $lines[] = $rl;
+                        }
+                        if ($isAnyDid) {
+                            $lines[] = "exten => s/{$cidVar},1,NoOp(Inbound Filter [{$desc}] sur s CID=\${CALLERID(num)})";
+                            foreach ($this->buildInboundRouteLines($rule, $setMohLines, $desc, "{$t['id']}_{$routeIdx}_scid_{$vIdx}") as $rl) {
+                                $lines[] = $rl;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        if (!$hasCatchAllRoute) {
+            $defaultDest = !empty($trunks) ? trim((string)$trunks[0]['inbound_dest']) : (!empty($ivrs) ? $ivrs[0]['name'] : 'hangup');
+            $lines[] = "; Route entrante par défaut (Fallback Any/Any)";
+            $lines[] = "exten => _X.,1,NoOp(Appel entrant externe par defaut vers \${EXTEN} [CID=\${CALLERID(num)}])";
+            $lines[] = " same => n," . $this->buildDestinationDialplan($defaultDest);
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "";
+            $lines[] = "exten => s,1,NoOp(Appel entrant externe sur s [CID=\${CALLERID(num)}])";
+            $lines[] = " same => n," . $this->buildDestinationDialplan($defaultDest);
+            $lines[] = " same => n,Hangup()";
+        }
+        $lines[] = "";
+
+        // 3. Contextes SVI / IVR
+        foreach ($ivrs as $ivr) {
+            $ivrSlug        = $this->slugify($ivr['name']);
+            $audio          = $this->resolveSoundFile($ivr['audio_file'] ?? '', 'demo-instruct');
+            $timeout        = max(2, min(60, (int)($ivr['timeout'] ?? 10)));
+            $directDial     = !empty($ivr['direct_dial']);
+            $invalidRetries = max(1, min(10, (int)($ivr['invalid_retries'] ?? 3)));
+            $invalidSound   = $this->resolveSoundFile($ivr['invalid_sound_id'] ?? 0, 'pbx-invalid');
+            $invalidDest    = trim((string)($ivr['invalid_dest'] ?? 'hangup')) ?: 'hangup';
+            $timeoutRetries = max(1, min(10, (int)($ivr['timeout_retries'] ?? 2)));
+            $timeoutSound   = $this->resolveSoundFile($ivr['timeout_sound_id'] ?? 0, '');
+            $timeoutDest    = trim((string)($ivr['timeout_dest'] ?? 'hangup')) ?: 'hangup';
+            $options        = json_decode((string)$ivr['options_json'], true) ?: [];
+
+            $lines[] = "; --- Serveur Vocal Interactif : {$ivr['name']} ---";
+            $lines[] = "[ivr-{$ivrSlug}]";
+            $lines[] = "exten => s,1,NoOp(SVI {$ivr['name']})";
+            $lines[] = " same => n,Answer()";
+            $lines[] = " same => n,Wait(1)";
+            $lines[] = " same => n,Set(IVR_INVALID_COUNT=0)";
+            $lines[] = " same => n,Set(IVR_TIMEOUT_COUNT=0)";
+            $lines[] = " same => n(loop),Background({$audio})";
+            $lines[] = " same => n,WaitExten({$timeout})";
+            $lines[] = "";
+
+            // Numérotation directe des postes internes si activée
+            if ($directDial && !empty($extensions)) {
+                $lines[] = "; Numérotation directe des postes autorisée";
+                foreach ($extensions as $ext) {
+                    $extNum = trim((string)$ext['extension']);
+                    if ($extNum !== '') {
+                        $lines[] = "exten => {$extNum},1,NoOp(SVI {$ivr['name']} - Numérotation directe poste {$extNum})";
+                        $lines[] = " same => n,Goto(from-internal,{$extNum},1)";
+                    }
+                }
+                $lines[] = "";
+            }
+
+            // Touches DTMF configurées
+            if (!empty($options)) {
+                $lines[] = "; Touches DTMF configurées";
+                foreach ($options as $digit => $dest) {
+                    $digit = preg_replace('/[^0-9*#]/', '', (string)$digit);
+                    if ($digit === '') {
+                        continue;
+                    }
+                    $lines[] = "exten => {$digit},1,NoOp(SVI {$ivr['name']} - Touche {$digit} -> {$dest})";
+                    $lines[] = " same => n," . $this->buildDestinationDialplan((string)$dest);
+                    $lines[] = " same => n,Hangup()";
+                }
+                $lines[] = "";
+            }
+
+            // Gestion de touche invalide (i)
+            $lines[] = "; Gestion touche invalide (max {$invalidRetries} tentative" . ($invalidRetries > 1 ? 's' : '') . ")";
+            $lines[] = "exten => i,1,NoOp(SVI {$ivr['name']} - Touche invalide pressee)";
+            $lines[] = " same => n,Set(IVR_INVALID_COUNT=$[ \${IVR_INVALID_COUNT} + 1 ])";
+            $lines[] = " same => n,GotoIf($[ \${IVR_INVALID_COUNT} >= {$invalidRetries} ]?invalid_fail)";
+            $lines[] = " same => n,Playback({$invalidSound})";
+            $lines[] = " same => n,Goto(s,loop)";
+            $lines[] = " same => n(invalid_fail),NoOp(SVI {$ivr['name']} - Echec invalide max atteint)";
+            $lines[] = " same => n,Playback({$invalidSound})";
+            $lines[] = " same => n," . $this->buildDestinationDialplan($invalidDest);
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "";
+
+            // Gestion timeout attente (t)
+            $lines[] = "; Gestion expiration attente (max {$timeoutRetries} tentative" . ($timeoutRetries > 1 ? 's' : '') . ")";
+            $lines[] = "exten => t,1,NoOp(SVI {$ivr['name']} - Timeout attente expire)";
+            $lines[] = " same => n,Set(IVR_TIMEOUT_COUNT=$[ \${IVR_TIMEOUT_COUNT} + 1 ])";
+            $lines[] = " same => n,GotoIf($[ \${IVR_TIMEOUT_COUNT} >= {$timeoutRetries} ]?timeout_fail)";
+            if ($timeoutSound !== '') {
+                $lines[] = " same => n,Playback({$timeoutSound})";
+            }
+            $lines[] = " same => n,Goto(s,loop)";
+            $lines[] = " same => n(timeout_fail),NoOp(SVI {$ivr['name']} - Echec timeout max atteint)";
+            if ($timeoutSound !== '') {
+                $lines[] = " same => n,Playback({$timeoutSound})";
+            }
+            $lines[] = " same => n," . $this->buildDestinationDialplan($timeoutDest);
+            $lines[] = " same => n,Hangup()";
+            $lines[] = "";
+        }
+
+        // 5. Contexte dédié Accès Sécurisé Boîte Vocale Directe (*97)
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; ACCÈS SÉCURISÉ BOÎTE VOCALE DIRECTE (*97)";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "[from-vm-direct]";
+        foreach ($extensions as $ext) {
+            $num = trim((string)$ext['extension']);
+            if (empty($ext['voicemail_enabled'])) {
+                continue;
+            }
+            $forcePin = !empty($ext['force_pin_change']);
+            $skipPin  = !empty($ext['voicemail_skip_pin']);
+
+            // Si premier appel (force_pin_change) OU accès direct sans PIN activé depuis son combiné :
+            // On appelle VoiceMailMain avec le flag ,s pour ne pas demander de mot de passe à la connexion.
+            // Asterisk détecte alors automatiquement qu'il s'agit d'un nouvel utilisateur (password == extension)
+            // et démarre directement l'assistant vocal pour choisir son code PIN et enregistrer ses annonces !
+            if ($forcePin || $skipPin) {
+                $lines[] = "exten => {$num},1,VoiceMailMain({$num}@default,s)";
+                $lines[] = " same => n,Hangup()";
+            } else {
+                // Demande le mot de passe PIN configuré
+                $lines[] = "exten => {$num},1,VoiceMailMain({$num}@default)";
+                $lines[] = " same => n,Hangup()";
+            }
+        }
+        $lines[] = "exten => _X.,1,Playback(vm-incorrect-mailbox)";
+        $lines[] = " same => n,Hangup()";
+        $lines[] = "";
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    /**
+     * Sauvegarde les anciens fichiers et écrit atomiquement pjsip.custom.conf et extensions.custom.conf
+     * avec les droits Debian asterisk:asterisk (0660).
+    /**
+     * Génère les classes Musique d'attente (MOH) personnalisées par site/catégorie
+     */
+    public function generateMusiconholdConf(): string
+    {
+        $rows = $this->db->query("SELECT * FROM sounds WHERE usage_type = 'moh' ORDER BY id ASC")->fetchAll();
+        $bySite = [];
+        foreach ($rows as $r) {
+            $site = trim((string)$r['site_category']) ?: 'Global';
+            $bySite[$site][] = $r;
+        }
+
+        // Synchronisation du fichier MOH par défaut dans /var/lib/asterisk/moh/default
+        $defId = (int)$this->db->query("SELECT default_moh_sound_id FROM settings WHERE id = 1")->fetchColumn();
+        if ($defId > 0) {
+            $stmtDef = $this->db->prepare("SELECT * FROM sounds WHERE id = :id");
+            $stmtDef->execute([':id' => $defId]);
+            $defSound = $stmtDef->fetch();
+            if ($defSound) {
+                $defDir = "/var/lib/asterisk/moh/default";
+                if (!is_dir($defDir)) {
+                    @mkdir($defDir, 0775, true);
+                }
+                @chown($defDir, 'www-data');
+                @chgrp($defDir, 'asterisk');
+                @chmod($defDir, 0775);
+
+                // Nettoyage des anciens fichiers pour ne garder QUE la musique par défaut active
+                foreach (glob("{$defDir}/*") ?: [] as $oldF) {
+                    if (is_file($oldF)) @unlink($oldF);
+                }
+
+                $srcWav  = "/var/lib/asterisk/sounds/custom/{$defSound['slug']}.wav";
+                $srcAlaw = "/var/lib/asterisk/sounds/custom/{$defSound['slug']}.alaw";
+                if (file_exists($srcWav)) {
+                    $dstW = "{$defDir}/{$defSound['slug']}.wav";
+                    @copy($srcWav, $dstW);
+                    @chmod($dstW, 0664);
+                    @chown($dstW, 'www-data');
+                    @chgrp($dstW, 'asterisk');
+                }
+                if (file_exists($srcAlaw)) {
+                    $dstA = "{$defDir}/{$defSound['slug']}.alaw";
+                    @copy($srcAlaw, $dstA);
+                    @chmod($dstA, 0664);
+                    @chown($dstA, 'www-data');
+                    @chgrp($dstA, 'asterisk');
+                }
+            }
+        }
+
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; CLASSES MUSIQUE D'ATTENTE (MOH) GÉNÉRÉES PAR NEXUSPBX (" . date('Y-m-d H:i:s') . ")";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "";
+
+        // Classe par défaut Asterisk
+        $lines[] = "[default]";
+        $lines[] = "mode=files";
+        $lines[] = "directory=/var/lib/asterisk/moh/default";
+        $lines[] = "sort=alpha";
+        $lines[] = "";
+
+        // Classes individuelles pour chaque musique d'attente (assignation spécifique Trunk / Route)
+        foreach ($rows as $r) {
+            $soundClass = "moh-sound-{$r['slug']}";
+            $soundDir = "/var/lib/asterisk/moh/sound_{$r['slug']}";
+            if (!is_dir($soundDir)) {
+                @mkdir($soundDir, 0775, true);
+            }
+            @chown($soundDir, 'www-data');
+            @chgrp($soundDir, 'asterisk');
+            @chmod($soundDir, 0775);
+
+            $srcWav  = "/var/lib/asterisk/sounds/custom/{$r['slug']}.wav";
+            $srcAlaw = "/var/lib/asterisk/sounds/custom/{$r['slug']}.alaw";
+            if (file_exists($srcWav)) {
+                $dstW = "{$soundDir}/{$r['slug']}.wav";
+                if (!file_exists($dstW) || filesize($dstW) !== filesize($srcWav)) {
+                    @copy($srcWav, $dstW);
+                    @chmod($dstW, 0664);
+                    @chown($dstW, 'www-data');
+                    @chgrp($dstW, 'asterisk');
+                }
+            }
+            if (file_exists($srcAlaw)) {
+                $dstA = "{$soundDir}/{$r['slug']}.alaw";
+                if (!file_exists($dstA) || filesize($dstA) !== filesize($srcAlaw)) {
+                    @copy($srcAlaw, $dstA);
+                    @chmod($dstA, 0664);
+                    @chown($dstA, 'www-data');
+                    @chgrp($dstA, 'asterisk');
+                }
+            }
+
+            $lines[] = "[{$soundClass}]";
+            $lines[] = "mode=files";
+            $lines[] = "directory={$soundDir}";
+            $lines[] = "sort=alpha";
+            $lines[] = "";
+        }
+
+        foreach ($bySite as $siteName => $sounds) {
+            $siteSlug = $this->slugify($siteName);
+            if ($siteSlug === 'global' || $siteSlug === 'default') {
+                continue;
+            }
+            $mohClass = "moh-{$siteSlug}";
+            $dir = "/var/lib/asterisk/moh/{$siteSlug}";
+            if (!is_dir($dir)) {
+                @mkdir($dir, 0775, true);
+                @chown($dir, 'www-data');
+                @chgrp($dir, 'asterisk');
+            }
+            $lines[] = "[{$mohClass}]";
+            $lines[] = "mode=files";
+            $lines[] = "directory={$dir}";
+            $lines[] = "sort=alpha";
+            $lines[] = "";
+        }
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    /**
+     * Génère le fichier de configuration des ports audio / NAT / RTP (/etc/asterisk/rtp.conf)
+     */
+    public function generateRtpConf(): string
+    {
+        $settings  = $this->db->query('SELECT * FROM settings WHERE id = 1')->fetch() ?: [];
+        $rtpStart  = max(1024, min(65530, (int)($settings['rtp_start'] ?? 10000)));
+        $rtpEnd    = max($rtpStart + 4, min(65535, (int)($settings['rtp_end'] ?? 20000)));
+        $checksums = !empty($settings['rtp_checksums']) ? 'yes' : 'no';
+        $strict    = !empty($settings['rtp_strict']) ? 'yes' : 'no';
+        $timeout   = max(5, (int)($settings['rtp_timeout'] ?? 30));
+        $keepalive = max(0, (int)($settings['rtp_keepalive'] ?? 15));
+        $date      = date('Y-m-d H:i:s');
+
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; CONFIGURATION DES PORTS FLUX VOIX AUDIO (RTP) - NexusPBX ($date)";
+        $lines[] = "; SOURCE UNIQUE DE VÉRITÉ : SQLITE (Paramètres SIP & NAT)";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "[general]";
+        $lines[] = "rtpstart = {$rtpStart}";
+        $lines[] = "rtpend = {$rtpEnd}";
+        $lines[] = "rtpchecksums = {$checksums}";
+        $lines[] = "strictrtp = {$strict}";
+        $lines[] = "rtptimeout = {$timeout}";
+        $lines[] = "rtpholdtimeout = 300";
+        if ($keepalive > 0) {
+            $lines[] = "rtpkeepalive = {$keepalive}";
+        }
+        $lines[] = "";
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    /**
+     * Génère le fichier de configuration des touches en cours d'appel (/etc/asterisk/features.conf)
+     */
+    public function generateFeaturesConf(): string
+    {
+        $date = date('Y-m-d H:i:s');
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; CONFIGURATION DES TOUCHES EN COURS D'APPEL (FEATURES) - NexusPBX ($date)";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "[general]";
+        $lines[] = "featuredigittimeout => 1500";
+        $lines[] = "atxfernoanswertimeout => 15";
+        $lines[] = "atxferdropcall => no";
+        $lines[] = "";
+        $lines[] = "[featuremap]";
+        $lines[] = "blindxfer => ##";
+        $lines[] = "atxfer => *2";
+        $lines[] = "disconnect => *0";
+        $lines[] = "automixmon => *1";
+        $lines[] = "";
+        $lines[] = "[applicationmap]";
+        $lines[] = "";
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    /**
+     * Génère le fichier de messagerie vocale (/etc/asterisk/voicemail.custom.conf)
+     */
+    public function generateVoicemailConf(): string
+    {
+        $settings   = $this->db->query('SELECT * FROM settings WHERE id = 1')->fetch() ?: [];
+        $extensions = $this->db->query('SELECT * FROM extensions WHERE enabled = 1 ORDER BY CAST(extension AS INTEGER) ASC, extension ASC')->fetchAll();
+        $date       = date('Y-m-d H:i:s');
+
+        $lines = [];
+        $lines[] = "; ===========================================================================";
+        $lines[] = "; FICHIER GÉNÉRÉ AUTOMATIQUEMENT PAR NEXUSPBX ({$date})";
+        $lines[] = "; MESSAGERIE VOCALE (VOICEMAIL) - CONTEXTE [default]";
+        $lines[] = "; ===========================================================================";
+        $lines[] = "";
+        $lines[] = "[default](+)";
+
+        foreach ($extensions as $ext) {
+            if (empty($ext['voicemail_enabled'])) {
+                continue;
+            }
+            $num       = trim((string)$ext['extension']);
+            $name      = str_replace([',', '|', '"'], ' ', trim((string)$ext['name']));
+            $email     = trim((string)($ext['voicemail_email'] ?? ''));
+            $pin       = trim((string)($ext['voicemail_pin'] ?? ''));
+            $forcePin  = !empty($ext['force_pin_change']);
+            $attach    = !empty($ext['voicemail_attach']) ? 'yes' : 'no';
+            $delete    = !empty($ext['voicemail_delete']) ? 'yes' : 'no';
+
+            // Si force_pin_change est actif ou PIN vide, mot de passe initial = numéro d'extension
+            // ce qui déclenche automatiquement le tutoriel de premier appel Asterisk
+            $spoolBoxDir = "/var/spool/asterisk/voicemail/default/{$num}";
+            if ($forcePin || $pin === '') {
+                $effectivePin = $num;
+                $options = "attach={$attach}|delete={$delete}|forcename=yes|forcegreetings=yes";
+                // Supprimer un éventuel secret.conf antérieur pour forcer Asterisk à réinitialiser la boîte au premier appel
+                if (file_exists("{$spoolBoxDir}/secret.conf")) {
+                    @unlink("{$spoolBoxDir}/secret.conf");
+                }
+            } else {
+                $effectivePin = $pin;
+                $options = "attach={$attach}|delete={$delete}";
+                // Mettre à jour secret.conf avec le PIN configuré
+                if (is_dir($spoolBoxDir)) {
+                    @file_put_contents("{$spoolBoxDir}/secret.conf", $pin . "\n");
+                    @chown("{$spoolBoxDir}/secret.conf", 'asterisk');
+                    @chgrp("{$spoolBoxDir}/secret.conf", 'asterisk');
+                }
+            }
+
+            $lines[] = "{$num} => {$effectivePin},{$name},{$email},,{$options}";
+        }
+        $lines[] = "";
+
+        return implode("\n", $lines) . "\n";
+    }
+
+    public function writeAllConfigs(): array
+    {
+        if (!is_dir(self::BACKUP_DIR)) {
+            @mkdir(self::BACKUP_DIR, 0770, true);
+        }
+
+        $pjsipContent      = $this->generatePjsipConf();
+        $extensionsContent = $this->generateExtensionsConf();
+        $mohContent        = $this->generateMusiconholdConf();
+        $rtpContent        = $this->generateRtpConf();
+        $featuresContent   = $this->generateFeaturesConf();
+        $voicemailContent  = $this->generateVoicemailConf();
+
+        $this->writeAtomicWithPermissions(self::PJSIP_CONF_PATH, $pjsipContent);
+        $this->writeAtomicWithPermissions(self::EXTENSIONS_CONF_PATH, $extensionsContent);
+        $this->writeAtomicWithPermissions(self::MOH_CONF_PATH, $mohContent);
+        $this->writeAtomicWithPermissions(self::RTP_CONF_PATH, $rtpContent);
+        $this->writeAtomicWithPermissions(self::FEATURES_CONF_PATH, $featuresContent);
+        $this->writeAtomicWithPermissions(self::VOICEMAIL_CONF_PATH, $voicemailContent);
+
+        // S'assurer que pjsip.conf et extensions.conf incluent bien les fichiers .custom.conf
+        SystemChecker::ensureAsteriskIncludes();
+
+        $this->db->exec("UPDATE settings SET last_applied_at = CURRENT_TIMESTAMP WHERE id = 1");
+
+        return [
+            'pjsip_path'      => self::PJSIP_CONF_PATH,
+            'extensions_path' => self::EXTENSIONS_CONF_PATH,
+            'moh_path'        => self::MOH_CONF_PATH,
+            'rtp_path'        => self::RTP_CONF_PATH,
+            'features_path'   => self::FEATURES_CONF_PATH,
+            'voicemail_path'  => self::VOICEMAIL_CONF_PATH,
+            'pjsip_bytes'     => strlen($pjsipContent),
+            'extensions_bytes'=> strlen($extensionsContent),
+            'moh_bytes'       => strlen($mohContent),
+            'rtp_bytes'       => strlen($rtpContent),
+            'features_bytes'  => strlen($featuresContent),
+            'voicemail_bytes' => strlen($voicemailContent),
+        ];
+    }
+
+    private function writeAtomicWithPermissions(string $targetPath, string $content): void
+    {
+        $dir = dirname($targetPath);
+        if (!is_dir($dir)) {
+            throw new RuntimeException("Le dossier {$dir} n'existe pas sur ce serveur Debian.");
+        }
+
+        // Sauvegarde horodatée si le fichier existe déjà
+        if (file_exists($targetPath)) {
+            $stamp = date('Ymd_His');
+            $base  = basename($targetPath);
+            @copy($targetPath, self::BACKUP_DIR . "/{$base}.{$stamp}.bak");
+        }
+
+        $tmpPath = $targetPath . '.tmp.' . getmypid();
+        if (@file_put_contents($tmpPath, $content, LOCK_EX) === false) {
+            throw new RuntimeException("Impossible d'écrire dans {$targetPath}. Vérifiez que www-data fait partie du groupe asterisk et que /etc/asterisk est accessible en écriture de groupe (chmod 2775).");
+        }
+
+        @chgrp($tmpPath, 'asterisk');
+        @chmod($tmpPath, 0660);
+
+        if (!@rename($tmpPath, $targetPath)) {
+            @unlink($tmpPath);
+            throw new RuntimeException("Échec du remplacement atomique de {$targetPath}.");
+        }
+    }
+
+    public static function normalizeInboundRoutes(string $json): array
+    {
+        $decoded = json_decode($json, true);
+        if (!is_array($decoded) || empty($decoded)) {
+            return [];
+        }
+
+        // Format liste structurée : [ ['cid' => '...', 'did' => '...', 'description' => '...', 'destination' => '...'], ... ]
+        if (array_is_list($decoded)) {
+            $out = [];
+            foreach ($decoded as $item) {
+                if (!is_array($item)) {
+                    continue;
+                }
+                $cid  = trim((string)($item['cid'] ?? 'Any')) ?: 'Any';
+                $did  = trim((string)($item['did'] ?? 'Any')) ?: 'Any';
+                $desc = trim((string)($item['description'] ?? ''));
+                $dest = trim((string)($item['destination'] ?? ''));
+                if ($dest === '') {
+                    continue;
+                }
+
+                $timeCondition = !empty($item['time_condition_enabled']);
+                $timeStart     = preg_match('/^\d{2}:\d{2}$/', (string)($item['time_start'] ?? '')) ? (string)$item['time_start'] : '08:30';
+                $timeFinish    = preg_match('/^\d{2}:\d{2}$/', (string)($item['time_finish'] ?? '')) ? (string)$item['time_finish'] : '18:00';
+                $weekdays      = trim((string)($item['weekdays'] ?? 'mon-fri')) ?: 'mon-fri';
+                $destClosed    = trim((string)($item['time_dest_closed'] ?? 'terminate-hangup')) ?: 'terminate-hangup';
+
+                $out[] = [
+                    'cid'                    => $cid,
+                    'did'                    => $did,
+                    'description'            => $desc ?: ($cid !== 'Any' ? "Filtre {$cid}" : "Route {$did}"),
+                    'destination'            => $dest,
+                    'time_condition_enabled' => (int)$timeCondition,
+                    'time_start'             => $timeStart,
+                    'time_finish'            => $timeFinish,
+                    'weekdays'               => $weekdays,
+                    'time_dest_closed'       => $destClosed,
+                ];
+            }
+            return $out;
+        }
+
+        // Rétrocompatibilité ancien format clé/valeur : { "0123456789": "ext-101" }
+        $out = [];
+        foreach ($decoded as $did => $dest) {
+            $d = trim((string)$did);
+            $v = trim((string)$dest);
+            if ($d !== '' && $v !== '') {
+                $out[] = [
+                    'cid'                    => 'Any',
+                    'did'                    => $d,
+                    'description'            => "SDA {$d}",
+                    'destination'            => $v,
+                    'time_condition_enabled' => 0,
+                    'time_start'             => '08:30',
+                    'time_finish'            => '18:00',
+                    'weekdays'               => 'mon-fri',
+                    'time_dest_closed'       => 'terminate-hangup',
+                ];
+            }
+        }
+        return $out;
+    }
+
+    private function buildInboundRouteLines(array $rule, array $setMohLines, string $desc, string $tagId): array
+    {
+        $dest        = trim((string)($rule['destination'] ?? 'hangup'));
+        $timeEnabled = !empty($rule['time_condition_enabled']);
+        $timeStart   = trim((string)($rule['time_start'] ?? '08:30'));
+        $timeFinish  = trim((string)($rule['time_finish'] ?? '18:00'));
+        $weekdays    = trim((string)($rule['weekdays'] ?? 'mon-fri'));
+        $destClosed  = trim((string)($rule['time_dest_closed'] ?? 'terminate-hangup'));
+        $timeRange   = "{$timeStart}-{$timeFinish}";
+
+        $out = [];
+        foreach ($setMohLines as $sml) {
+            $out[] = $sml;
+        }
+
+        if ($timeEnabled) {
+            $tag = "tc_{$tagId}";
+            $out[] = " same => n,GotoIfTime({$timeRange},{$weekdays},*,*?{$tag}_open)";
+            $out[] = " same => n,NoOp(Inbound [{$desc}] - Fermé / Hors horaires [{$timeRange}/{$weekdays}] -> {$destClosed})";
+            $out[] = " same => n," . $this->buildDestinationDialplan($destClosed);
+            $out[] = " same => n,Hangup()";
+            $out[] = " same => n({$tag}_open),NoOp(Inbound [{$desc}] - Ouvert [{$timeRange}/{$weekdays}] -> {$dest})";
+            $out[] = " same => n," . $this->buildDestinationDialplan($dest);
+            $out[] = " same => n,Hangup()";
+        } else {
+            $out[] = " same => n," . $this->buildDestinationDialplan($dest);
+            $out[] = " same => n,Hangup()";
+        }
+
+        return $out;
+    }
+
+    private function buildDestinationDialplan(string $dest): string
+    {
+        $dest = trim($dest);
+        if ($dest === '' || $dest === 'hangup' || $dest === 'terminate-hangup') {
+            return 'Goto(app-terminate,hangup,1)';
+        }
+        if ($dest === 'busy' || $dest === 'terminate-busy') {
+            return 'Goto(app-terminate,busy,1)';
+        }
+        if ($dest === 'congestion' || $dest === 'terminate-congestion') {
+            return 'Goto(app-terminate,congestion,1)';
+        }
+        if ($dest === 'zapateller' || $dest === 'terminate-zapateller') {
+            return 'Goto(app-terminate,zapateller,1)';
+        }
+        if ($dest === 'ringforever' || $dest === 'terminate-ringforever') {
+            return 'Goto(app-terminate,ringforever,1)';
+        }
+        if ($dest === 'moh-default') {
+            return 'Goto(app-scam-tarpit,moh-default,1)';
+        }
+        if (str_starts_with($dest, 'moh-')) {
+            $mohId = substr($dest, 4);
+            $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
+            $stmt->execute([':id' => (int)$mohId]);
+            $slug = $stmt->fetchColumn();
+            $mohClass = $slug ? "moh-sound-{$slug}" : 'default';
+            return "Goto(app-scam-tarpit,moh-{$mohClass},1)";
+        }
+        if (str_starts_with($dest, 'sound-loop-')) {
+            $sndId = substr($dest, 11);
+            $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
+            $stmt->execute([':id' => (int)$sndId]);
+            $slug = $stmt->fetchColumn();
+            if ($slug) {
+                return "Goto(app-scam-tarpit,loop-{$slug},1)";
+            }
+            return 'Goto(app-terminate,hangup,1)';
+        }
+        if (str_starts_with($dest, 'sound-')) {
+            $snd = $this->resolveSoundFile(substr($dest, 6));
+            if ($snd !== '') {
+                return "Playback({$snd})";
+            }
+            return 'Goto(app-terminate,hangup,1)';
+        }
+        if (str_starts_with($dest, 'custom-') || str_starts_with($dest, 'mobile-') || str_starts_with($dest, 'external-')) {
+            $num = preg_replace('/^(custom|mobile|external)-/', '', $dest);
+            return "Goto(from-internal,{$num},1)";
+        }
+        if (preg_match('/^\d+$/', $dest)) {
+            return "Goto(from-internal,{$dest},1)";
+        }
+        if (str_starts_with($dest, 'ext-')) {
+            $ext = substr($dest, 4);
+            return "Goto(from-internal,{$ext},1)";
+        }
+        if (str_starts_with($dest, 'grp-')) {
+            $grp = substr($dest, 4);
+            return "Goto(from-internal,{$grp},1)";
+        }
+        if (str_starts_with($dest, 'ivr-')) {
+            $slug = $this->slugify($dest);
+            return "Goto(ivr-{$slug},s,1)";
+        }
+        // Si c'est directement le nom d'un IVR
+        $slug = $this->slugify($dest);
+        return "Goto(ivr-{$slug},s,1)";
+    }
+
+    private function resolveSoundFile($soundRef, string $fallback = ''): string
+    {
+        if (empty($soundRef)) {
+            return $fallback;
+        }
+        if (is_numeric($soundRef)) {
+            $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
+            $stmt->execute([':id' => (int)$soundRef]);
+            $slug = $stmt->fetchColumn();
+            return $slug ? "custom/{$slug}" : $fallback;
+        }
+        $ref = trim((string)$soundRef);
+        if (str_starts_with($ref, 'sound-')) {
+            return $this->resolveSoundFile(substr($ref, 6), $fallback);
+        }
+        if (!str_contains($ref, '/') && !in_array($ref, ['demo-instruct', 'demo-echotest', 'pbx-invalid', 'hello-world', 'beep', 'silence/1', 'vm-goodbye'])) {
+            $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE slug = :slug OR name = :name');
+            $stmt->execute([':slug' => $ref, ':name' => $ref]);
+            $slug = $stmt->fetchColumn();
+            if ($slug) {
+                return "custom/{$slug}";
+            }
+        }
+        return $ref ?: $fallback;
+    }
+
+    private function slugify(string $text): string
+    {
+        $slug = strtolower(trim($text));
+        $slug = preg_replace('/^ivr-/', '', $slug);
+        $slug = preg_replace('/[^a-z0-9]+/', '-', $slug);
+        return trim($slug, '-') ?: 'default';
+    }
+}
+
diff --git a/src/Database.php b/src/Database.php
new file mode 100644
index 0000000..cc59a66
--- /dev/null
+++ b/src/Database.php
@@ -0,0 +1,871 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+
+class Database
+{
+    private static ?PDO $instance = null;
+    public const DB_PATH = __DIR__ . '/../storage/database.sqlite';
+
+    public static function getDatabasePath(): string
+    {
+        return self::DB_PATH;
+    }
+
+    public static function resetConnection(): void
+    {
+        self::$instance = null;
+    }
+
+    public static function getConnection(bool $forceReconnect = false): PDO
+    {
+        if (self::$instance === null || $forceReconnect) {
+            self::$instance = null;
+            $dir = dirname(self::DB_PATH);
+            if (!is_dir($dir)) {
+                mkdir($dir, 0770, true);
+            }
+
+            $isNew = !file_exists(self::DB_PATH);
+
+            self::$instance = new PDO('sqlite:' . self::DB_PATH, null, null, [
+                PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+                PDO::ATTR_EMULATE_PREPARES   => false,
+            ]);
+
+            self::$instance->exec('PRAGMA foreign_keys = ON;');
+            self::$instance->exec('PRAGMA journal_mode = WAL;');
+            self::$instance->exec('PRAGMA busy_timeout = 5000;');
+
+            self::initializeSchema();
+
+            if ($isNew) {
+                @chmod(self::DB_PATH, 0660);
+            }
+        }
+
+        return self::$instance;
+    }
+
+    public static function initializeSchema(): void
+    {
+        $db = self::$instance;
+        if (!$db) {
+            return;
+        }
+
+        $schema = <<<SQL
+        -- 1. Table settings : Paramètres globaux du serveur Asterisk & AMI
+        CREATE TABLE IF NOT EXISTS settings (
+            id INTEGER PRIMARY KEY CHECK (id = 1),
+            domain TEXT NOT NULL DEFAULT 'pbx.local',
+            external_ip TEXT NOT NULL DEFAULT '',
+            local_net TEXT NOT NULL DEFAULT '192.168.1.0/24',
+            udp_port INTEGER NOT NULL DEFAULT 5060,
+            tls_port INTEGER NOT NULL DEFAULT 5061,
+            letsencrypt_domain TEXT NOT NULL DEFAULT '',
+            ami_host TEXT NOT NULL DEFAULT '127.0.0.1',
+            ami_port INTEGER NOT NULL DEFAULT 5038,
+            ami_user TEXT NOT NULL DEFAULT 'pbxgui',
+            ami_secret TEXT NOT NULL DEFAULT 'AsteriskAmi2026!',
+            wizard_completed INTEGER NOT NULL DEFAULT 0,
+            tls_verify_client INTEGER NOT NULL DEFAULT 0,
+            external_udp_port INTEGER NOT NULL DEFAULT 0,
+            external_tls_port INTEGER NOT NULL DEFAULT 0,
+            local_networks_json TEXT NOT NULL DEFAULT '["10.10.0.0/16","192.168.1.0/24"]',
+            rtp_start INTEGER NOT NULL DEFAULT 10000,
+            rtp_end INTEGER NOT NULL DEFAULT 20000,
+            rtp_checksums INTEGER NOT NULL DEFAULT 1,
+            rtp_strict INTEGER NOT NULL DEFAULT 1,
+            rtp_timeout INTEGER NOT NULL DEFAULT 30,
+            rtp_keepalive INTEGER NOT NULL DEFAULT 15,
+            allow_anonymous_sip INTEGER NOT NULL DEFAULT 0,
+            last_applied_at DATETIME DEFAULT NULL,
+            updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        INSERT OR IGNORE INTO settings (id) VALUES (1);
+
+        -- 2. Table users : Authentification sur l'interface d'administration
+        CREATE TABLE IF NOT EXISTS users (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            username VARCHAR(64) NOT NULL UNIQUE,
+            password_hash TEXT NOT NULL,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 3. Table extensions : Postes téléphoniques PJSIP (UDP interne ou TLS+SRTP distant)
+        CREATE TABLE IF NOT EXISTS extensions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            extension VARCHAR(16) NOT NULL UNIQUE,
+            name VARCHAR(64) NOT NULL,
+            secret VARCHAR(128) NOT NULL,
+            transport VARCHAR(8) NOT NULL DEFAULT 'udp' CHECK (transport IN ('udp', 'tls')),
+            encryption INTEGER NOT NULL DEFAULT 0 CHECK (encryption IN (0, 1, 2)),
+            codecs VARCHAR(64) NOT NULL DEFAULT 'alaw,ulaw,opus',
+            max_contacts INTEGER NOT NULL DEFAULT 2,
+            enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 4. Table groups : Groupes d'appel (Ring Groups)
+        CREATE TABLE IF NOT EXISTS groups (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            extension VARCHAR(16) NOT NULL UNIQUE,
+            name VARCHAR(64) NOT NULL,
+            strategy VARCHAR(16) NOT NULL DEFAULT 'ringall' CHECK (strategy IN ('ringall', 'hunt', 'random')),
+            ring_time INTEGER NOT NULL DEFAULT 20,
+            members TEXT NOT NULL DEFAULT '[]',
+            failover_dest VARCHAR(64) NOT NULL DEFAULT 'hangup',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 5. Table trunks : Opérateurs SIP entrants / sortants (Configuration PJSIP complète)
+        CREATE TABLE IF NOT EXISTS trunks (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(64) NOT NULL UNIQUE,
+            host VARCHAR(128) NOT NULL,
+            port INTEGER NOT NULL DEFAULT 5060,
+            outbound_proxy VARCHAR(128) NOT NULL DEFAULT '',
+            transport VARCHAR(8) NOT NULL DEFAULT 'udp',
+            auth_mode VARCHAR(16) NOT NULL DEFAULT 'userpass',
+            username VARCHAR(64) NOT NULL DEFAULT '',
+            auth_username VARCHAR(64) NOT NULL DEFAULT '',
+            secret VARCHAR(128) NOT NULL DEFAULT '',
+            register INTEGER NOT NULL DEFAULT 1 CHECK (register IN (0, 1)),
+            server_uri VARCHAR(192) NOT NULL DEFAULT '',
+            client_uri VARCHAR(192) NOT NULL DEFAULT '',
+            contact_user VARCHAR(64) NOT NULL DEFAULT '',
+            expiration INTEGER NOT NULL DEFAULT 3600,
+            retry_interval INTEGER NOT NULL DEFAULT 60,
+            line_support INTEGER NOT NULL DEFAULT 1 CHECK (line_support IN (0, 1)),
+            from_user VARCHAR(64) NOT NULL DEFAULT '',
+            from_domain VARCHAR(128) NOT NULL DEFAULT '',
+            outbound_callerid VARCHAR(128) NOT NULL DEFAULT '',
+            send_pai INTEGER NOT NULL DEFAULT 1 CHECK (send_pai IN (0, 1)),
+            send_rpid INTEGER NOT NULL DEFAULT 0 CHECK (send_rpid IN (0, 1)),
+            trust_id_inbound INTEGER NOT NULL DEFAULT 1 CHECK (trust_id_inbound IN (0, 1)),
+            codecs VARCHAR(64) NOT NULL DEFAULT 'alaw,ulaw,g722',
+            dtmf_mode VARCHAR(16) NOT NULL DEFAULT 'rfc4733',
+            media_encryption VARCHAR(16) NOT NULL DEFAULT 'no',
+            nat_symmetric INTEGER NOT NULL DEFAULT 1 CHECK (nat_symmetric IN (0, 1)),
+            direct_media INTEGER NOT NULL DEFAULT 0 CHECK (direct_media IN (0, 1)),
+            qualify_frequency INTEGER NOT NULL DEFAULT 60,
+            max_channels INTEGER NOT NULL DEFAULT 0,
+            match_ips TEXT NOT NULL DEFAULT '',
+            context VARCHAR(64) NOT NULL DEFAULT 'from-external',
+            inbound_dest VARCHAR(64) NOT NULL DEFAULT 'ivr-accueil',
+            did_routes_json TEXT NOT NULL DEFAULT '{}',
+            outbound_prefix VARCHAR(32) NOT NULL DEFAULT '',
+            custom_endpoint_params TEXT NOT NULL DEFAULT '',
+            enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 6. Table ivrs : Serveurs vocaux interactifs (SVI / IVR)
+        CREATE TABLE IF NOT EXISTS ivrs (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(64) NOT NULL UNIQUE,
+            audio_file VARCHAR(128) NOT NULL DEFAULT 'hello-world',
+            timeout INTEGER NOT NULL DEFAULT 5,
+            options_json TEXT NOT NULL DEFAULT '{}',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 7. Table outbound_routes : Routes Sortantes (Priorité, Séquence Trunks, Dial Patterns, Droits Groupes & Postes)
+        CREATE TABLE IF NOT EXISTS outbound_routes (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            priority INTEGER NOT NULL DEFAULT 10,
+            name VARCHAR(64) NOT NULL,
+            outbound_callerid VARCHAR(128) NOT NULL DEFAULT '',
+            override_ext_cid INTEGER NOT NULL DEFAULT 0 CHECK (override_ext_cid IN (0, 1)),
+            route_password VARCHAR(64) NOT NULL DEFAULT '',
+            route_type VARCHAR(32) NOT NULL DEFAULT 'normal',
+            moh_class VARCHAR(64) NOT NULL DEFAULT 'default',
+            trunk_sequence_json TEXT NOT NULL DEFAULT '[]',
+            dial_patterns_json TEXT NOT NULL DEFAULT '[]',
+            permission_mode VARCHAR(16) NOT NULL DEFAULT 'all',
+            allowed_groups_json TEXT NOT NULL DEFAULT '[]',
+            allowed_extensions_json TEXT NOT NULL DEFAULT '[]',
+            continue_next_route INTEGER NOT NULL DEFAULT 1 CHECK (continue_next_route IN (0, 1)),
+            congestion_dest VARCHAR(64) NOT NULL DEFAULT 'terminate-congestion',
+            record_mode VARCHAR(16) NOT NULL DEFAULT 'dontcare',
+            enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 8. Table extension_groups : Groupes d'extensions (Sites, Services, Droits Routes Sortantes - ex: Nice, Paris)
+        CREATE TABLE IF NOT EXISTS extension_groups (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(64) NOT NULL UNIQUE,
+            description VARCHAR(128) NOT NULL DEFAULT '',
+            color VARCHAR(32) NOT NULL DEFAULT 'cyan',
+            members TEXT NOT NULL DEFAULT '[]',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 9. Table sounds : Médiathèque & Fichiers Sons (MoH, annonces, IVR, congestion classés par site et usage)
+        CREATE TABLE IF NOT EXISTS sounds (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(128) NOT NULL,
+            slug VARCHAR(128) NOT NULL UNIQUE,
+            site_category VARCHAR(64) NOT NULL DEFAULT 'Global',
+            usage_type VARCHAR(32) NOT NULL DEFAULT 'announcement',
+            description VARCHAR(255) NOT NULL DEFAULT '',
+            filename VARCHAR(255) NOT NULL,
+            original_filename VARCHAR(255) NOT NULL DEFAULT '',
+            duration_sec INTEGER NOT NULL DEFAULT 0,
+            file_size INTEGER NOT NULL DEFAULT 0,
+            format VARCHAR(16) NOT NULL DEFAULT 'wav',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 10. Table sound_sites : Catégories de sites pour les sons (Global, Site Nice, Site Paris...)
+        CREATE TABLE IF NOT EXISTS sound_sites (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(64) NOT NULL UNIQUE,
+            description VARCHAR(255) NOT NULL DEFAULT '',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 11. Table certificates : Gestionnaire de Certificats SSL / TLS (Let's Encrypt & Custom)
+        CREATE TABLE IF NOT EXISTS certificates (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            name VARCHAR(128) NOT NULL,
+            type VARCHAR(32) NOT NULL DEFAULT 'custom', -- letsencrypt, custom, selfsigned
+            primary_domain VARCHAR(255) NOT NULL,
+            alt_names TEXT NOT NULL DEFAULT '',
+            issuer VARCHAR(255) NOT NULL DEFAULT '',
+            valid_from DATETIME DEFAULT NULL,
+            valid_to DATETIME DEFAULT NULL,
+            days_remaining INTEGER NOT NULL DEFAULT 0,
+            cert_path TEXT NOT NULL,
+            key_path TEXT NOT NULL,
+            chain_path TEXT NOT NULL DEFAULT '',
+            fullchain_path TEXT NOT NULL DEFAULT '',
+            email VARCHAR(255) NOT NULL DEFAULT '',
+            auto_renew INTEGER NOT NULL DEFAULT 1,
+            is_default INTEGER NOT NULL DEFAULT 0,
+            status VARCHAR(32) NOT NULL DEFAULT 'valid', -- valid, expiring_soon, expired, error
+            last_error TEXT NOT NULL DEFAULT '',
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+
+        -- 12. Table feature_codes : Codes de Fonctions Téléphoniques & Services Asterisk
+        CREATE TABLE IF NOT EXISTS feature_codes (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            feature_key VARCHAR(64) UNIQUE NOT NULL,
+            code VARCHAR(16) NOT NULL,
+            default_code VARCHAR(16) NOT NULL,
+            name VARCHAR(128) NOT NULL,
+            category VARCHAR(64) NOT NULL,
+            description TEXT NOT NULL DEFAULT '',
+            enabled INTEGER NOT NULL DEFAULT 1,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+        SQL;
+
+        $db->exec($schema);
+        self::migrateSettingsTable($db);
+        self::migrateExtensionsTable($db);
+        self::migrateTrunksTable($db);
+        self::migrateOutboundRoutesTable($db);
+        self::migrateExtensionGroupsTable($db);
+        self::migrateSoundsTable($db);
+        self::migrateSoundSitesTable($db);
+        self::migrateIvrsTable($db);
+        self::migrateCertificatesTable($db);
+        self::migrateFeatureCodesTable($db);
+
+        // Création du compte admin par défaut (admin / admin123) s'il n'existe aucun utilisateur
+        $userCount = (int)$db->query('SELECT COUNT(*) FROM users')->fetchColumn();
+        if ($userCount === 0) {
+            $stmt = $db->prepare('INSERT INTO users (username, password_hash) VALUES (:u, :p)');
+            $stmt->execute([
+                ':u' => 'admin',
+                ':p' => password_hash('admin123', PASSWORD_DEFAULT),
+            ]);
+        }
+
+        // Données de démonstration initiales si la table extensions est vide
+        $extCount = (int)$db->query('SELECT COUNT(*) FROM extensions')->fetchColumn();
+        if ($extCount === 0) {
+            $stmtExt = $db->prepare('
+                INSERT INTO extensions (extension, name, secret, transport, encryption, codecs, max_contacts, enabled)
+                VALUES (:ext, :name, :secret, :transport, :encryption, :codecs, :max_contacts, 1)
+            ');
+            $stmtExt->execute([
+                ':ext'          => '101',
+                ':name'         => 'Accueil Bureau (LAN)',
+                ':secret'       => 'LanPass101!Sip',
+                ':transport'    => 'udp',
+                ':encryption'   => 0,
+                ':codecs'       => 'alaw,ulaw,g722',
+                ':max_contacts' => 2,
+            ]);
+            $stmtExt->execute([
+                ':ext'          => '102',
+                ':name'         => 'Direction Nomade (TLS/SRTP)',
+                ':secret'       => 'TlsSecure102!Sip',
+                ':transport'    => 'tls',
+                ':encryption'   => 1,
+                ':codecs'       => 'opus,g722,alaw',
+                ':max_contacts' => 3,
+            ]);
+
+            $stmtGrp = $db->prepare('
+                INSERT INTO groups (extension, name, strategy, ring_time, members, failover_dest)
+                VALUES (:ext, :name, :strategy, :ring_time, :members, :failover)
+            ');
+            $stmtGrp->execute([
+                ':ext'       => '600',
+                ':name'      => 'Support Général',
+                ':strategy'  => 'ringall',
+                ':ring_time' => 25,
+                ':members'   => json_encode(['101', '102']),
+                ':failover'  => 'hangup',
+            ]);
+
+            $stmtIvr = $db->prepare('
+                INSERT INTO ivrs (name, audio_file, timeout, options_json)
+                VALUES (:name, :audio, :timeout, :options)
+            ');
+            $stmtIvr->execute([
+                ':name'    => 'ivr-accueil',
+                ':audio'   => 'custom/bienvenue-entreprise',
+                ':timeout' => 5,
+                ':options' => json_encode([
+                    '1' => 'ext-101',
+                    '2' => 'grp-600',
+                    '0' => 'ext-102',
+                ]),
+            ]);
+        }
+    }
+
+    private static function migrateSettingsTable(PDO $db): void
+    {
+        $cols = $db->query('PRAGMA table_info(settings)')->fetchAll();
+        $existing = array_column($cols, 'name');
+
+        if (!in_array('company_name', $existing, true)) {
+            $db->exec("ALTER TABLE settings ADD COLUMN company_name VARCHAR(128) NOT NULL DEFAULT ''");
+        }
+        if (!in_array('company_logo', $existing, true)) {
+            $db->exec("ALTER TABLE settings ADD COLUMN company_logo TEXT NOT NULL DEFAULT ''");
+        }
+        if (!in_array('default_moh_sound_id', $existing, true)) {
+            $db->exec("ALTER TABLE settings ADD COLUMN default_moh_sound_id INTEGER DEFAULT 2");
+        }
+        if (!in_array('tls_verify_client', $existing, true)) {
+            $db->exec("ALTER TABLE settings ADD COLUMN tls_verify_client INTEGER NOT NULL DEFAULT 0");
+        }
+
+        $extraSettings = [
+            'external_udp_port'   => "INTEGER NOT NULL DEFAULT 0",
+            'external_tls_port'   => "INTEGER NOT NULL DEFAULT 0",
+            'local_networks_json' => "TEXT NOT NULL DEFAULT '[\"10.10.0.0/16\",\"192.168.1.0/24\"]'",
+            'rtp_start'           => "INTEGER NOT NULL DEFAULT 10000",
+            'rtp_end'             => "INTEGER NOT NULL DEFAULT 20000",
+            'rtp_checksums'       => "INTEGER NOT NULL DEFAULT 1",
+            'rtp_strict'          => "INTEGER NOT NULL DEFAULT 1",
+            'rtp_timeout'         => "INTEGER NOT NULL DEFAULT 30",
+            'rtp_keepalive'       => "INTEGER NOT NULL DEFAULT 15",
+            'allow_anonymous_sip' => "INTEGER NOT NULL DEFAULT 0",
+            'system_language'     => "VARCHAR(16) NOT NULL DEFAULT 'fr'",
+            'backup_auto_enabled' => "INTEGER NOT NULL DEFAULT 0",
+            'backup_frequency'    => "VARCHAR(32) NOT NULL DEFAULT 'daily'",
+            'backup_retention'    => "INTEGER NOT NULL DEFAULT 7",
+            'backup_storage_type' => "VARCHAR(16) NOT NULL DEFAULT 'local'",
+            'backup_ssh_host'     => "VARCHAR(128) NOT NULL DEFAULT ''",
+            'backup_ssh_port'     => "INTEGER NOT NULL DEFAULT 22",
+            'backup_ssh_user'     => "VARCHAR(64) NOT NULL DEFAULT ''",
+            'backup_ssh_auth_type'=> "VARCHAR(16) NOT NULL DEFAULT 'password'",
+            'backup_ssh_password' => "TEXT NOT NULL DEFAULT ''",
+            'backup_ssh_remote_path' => "VARCHAR(255) NOT NULL DEFAULT '/backups/nexus'",
+            'backup_last_run'     => "VARCHAR(32) DEFAULT NULL",
+            'backup_last_status'  => "TEXT NOT NULL DEFAULT ''",
+            'firewall_enabled'       => "INTEGER NOT NULL DEFAULT 1",
+            'admin_https_port'       => "INTEGER NOT NULL DEFAULT 8443",
+            'certbot_strict_port80'  => "INTEGER NOT NULL DEFAULT 0",
+            'fail2ban_sip_maxretry'  => "INTEGER NOT NULL DEFAULT 3",
+            'fail2ban_sip_findtime'  => "INTEGER NOT NULL DEFAULT 600",
+            'fail2ban_sip_bantime'   => "INTEGER NOT NULL DEFAULT 3600",
+            'fail2ban_web_maxretry'  => "INTEGER NOT NULL DEFAULT 3",
+            'fail2ban_web_bantime'   => "INTEGER NOT NULL DEFAULT 3600",
+            'fail2ban_whitelist_ips' => "TEXT NOT NULL DEFAULT '127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 82.122.84.60'",
+        ];
+        foreach ($extraSettings as $colName => $colDef) {
+            if (!in_array($colName, $existing, true)) {
+                $db->exec("ALTER TABLE settings ADD COLUMN {$colName} {$colDef}");
+            }
+        }
+    }
+
+    private static function migrateExtensionsTable(PDO $db): void
+    {
+        $sql = $db->query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'extensions'")->fetchColumn();
+        if ($sql && str_contains($sql, "CHECK (encryption IN (0, 1))")) {
+            $db->beginTransaction();
+            try {
+                $db->exec("CREATE TABLE extensions_new (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    extension VARCHAR(16) NOT NULL UNIQUE,
+                    name VARCHAR(64) NOT NULL,
+                    secret VARCHAR(128) NOT NULL,
+                    transport VARCHAR(8) NOT NULL DEFAULT 'udp' CHECK (transport IN ('udp', 'tls')),
+                    encryption INTEGER NOT NULL DEFAULT 0 CHECK (encryption IN (0, 1, 2)),
+                    codecs VARCHAR(64) NOT NULL DEFAULT 'alaw,ulaw,opus',
+                    max_contacts INTEGER NOT NULL DEFAULT 2,
+                    enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+                    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+                )");
+                $db->exec("INSERT INTO extensions_new SELECT * FROM extensions");
+                $db->exec("DROP TABLE extensions");
+                $db->exec("ALTER TABLE extensions_new RENAME TO extensions");
+                $db->commit();
+            } catch (\Throwable $e) {
+                $db->rollBack();
+                throw $e;
+            }
+        }
+
+        $cols = $db->query('PRAGMA table_info(extensions)')->fetchAll();
+        $existing = array_column($cols, 'name');
+
+        $extraExtensionCols = [
+            'voicemail_enabled'  => "INTEGER NOT NULL DEFAULT 0",
+            'voicemail_pin'      => "VARCHAR(32) NOT NULL DEFAULT ''",
+            'force_pin_change'   => "INTEGER NOT NULL DEFAULT 0",
+            'voicemail_skip_pin' => "INTEGER NOT NULL DEFAULT 0",
+            'voicemail_email'    => "VARCHAR(128) NOT NULL DEFAULT ''",
+            'voicemail_attach'   => "INTEGER NOT NULL DEFAULT 1",
+            'voicemail_delete'   => "INTEGER NOT NULL DEFAULT 0",
+            'ring_time'          => "INTEGER NOT NULL DEFAULT 20",
+        ];
+        foreach ($extraExtensionCols as $colName => $colDef) {
+            if (!in_array($colName, $existing, true)) {
+                $db->exec("ALTER TABLE extensions ADD COLUMN {$colName} {$colDef}");
+            }
+        }
+    }
+
+    private static function migrateTrunksTable(PDO $db): void
+    {
+        $cols = $db->query('PRAGMA table_info(trunks)')->fetchAll();
+        $existing = array_column($cols, 'name');
+
+        if (!in_array('outbound_proxy', $existing, true)) {
+            // Migration sans perte de la table trunks vers le schéma PJSIP complet (avec support UDP/TCP/TLS)
+            $db->beginTransaction();
+            try {
+                $db->exec('ALTER TABLE trunks RENAME TO trunks_old');
+                $db->exec("
+                    CREATE TABLE trunks (
+                        id INTEGER PRIMARY KEY AUTOINCREMENT,
+                        name VARCHAR(64) NOT NULL UNIQUE,
+                        host VARCHAR(128) NOT NULL,
+                        port INTEGER NOT NULL DEFAULT 5060,
+                        outbound_proxy VARCHAR(128) NOT NULL DEFAULT '',
+                        transport VARCHAR(8) NOT NULL DEFAULT 'udp',
+                        auth_mode VARCHAR(16) NOT NULL DEFAULT 'userpass',
+                        username VARCHAR(64) NOT NULL DEFAULT '',
+                        auth_username VARCHAR(64) NOT NULL DEFAULT '',
+                        secret VARCHAR(128) NOT NULL DEFAULT '',
+                        register INTEGER NOT NULL DEFAULT 1 CHECK (register IN (0, 1)),
+                        server_uri VARCHAR(192) NOT NULL DEFAULT '',
+                        client_uri VARCHAR(192) NOT NULL DEFAULT '',
+                        contact_user VARCHAR(64) NOT NULL DEFAULT '',
+                        expiration INTEGER NOT NULL DEFAULT 3600,
+                        retry_interval INTEGER NOT NULL DEFAULT 60,
+                        line_support INTEGER NOT NULL DEFAULT 1 CHECK (line_support IN (0, 1)),
+                        from_user VARCHAR(64) NOT NULL DEFAULT '',
+                        from_domain VARCHAR(128) NOT NULL DEFAULT '',
+                        outbound_callerid VARCHAR(128) NOT NULL DEFAULT '',
+                        send_pai INTEGER NOT NULL DEFAULT 1 CHECK (send_pai IN (0, 1)),
+                        send_rpid INTEGER NOT NULL DEFAULT 0 CHECK (send_rpid IN (0, 1)),
+                        trust_id_inbound INTEGER NOT NULL DEFAULT 1 CHECK (trust_id_inbound IN (0, 1)),
+                        codecs VARCHAR(64) NOT NULL DEFAULT 'alaw,ulaw,g722',
+                        dtmf_mode VARCHAR(16) NOT NULL DEFAULT 'rfc4733',
+                        media_encryption VARCHAR(16) NOT NULL DEFAULT 'no',
+                        nat_symmetric INTEGER NOT NULL DEFAULT 1 CHECK (nat_symmetric IN (0, 1)),
+                        direct_media INTEGER NOT NULL DEFAULT 0 CHECK (direct_media IN (0, 1)),
+                        qualify_frequency INTEGER NOT NULL DEFAULT 60,
+                        max_channels INTEGER NOT NULL DEFAULT 0,
+                        match_ips TEXT NOT NULL DEFAULT '',
+                        context VARCHAR(64) NOT NULL DEFAULT 'from-external',
+                        inbound_dest VARCHAR(64) NOT NULL DEFAULT 'ivr-accueil',
+                        did_routes_json TEXT NOT NULL DEFAULT '{}',
+                        outbound_prefix VARCHAR(32) NOT NULL DEFAULT '',
+                        custom_endpoint_params TEXT NOT NULL DEFAULT '',
+                        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+                        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+                    )
+                ");
+                $db->exec("
+                    INSERT INTO trunks (id, name, host, port, username, secret, transport, register, codecs, inbound_dest, enabled, created_at)
+                    SELECT id, name, host, port, username, secret, transport, register, codecs, inbound_dest, enabled, created_at
+                    FROM trunks_old
+                ");
+                $db->exec('DROP TABLE trunks_old');
+                $db->commit();
+            } catch (\Throwable $e) {
+                $db->rollBack();
+                throw $e;
+            }
+            $cols = $db->query('PRAGMA table_info(trunks)')->fetchAll();
+            $existing = array_column($cols, 'name');
+        }
+
+        // Colonnes universelles PJSIP supplémentaires (Session Timers, Fax T.38, Diversion, Retries, Langue, Keepalive)
+        $extraColumns = [
+            'max_retries'              => "INTEGER NOT NULL DEFAULT 10000",
+            'forbidden_retry_interval' => "INTEGER NOT NULL DEFAULT 600",
+            'fatal_retry_interval'     => "INTEGER NOT NULL DEFAULT 0",
+            'send_diversion'           => "INTEGER NOT NULL DEFAULT 1",
+            'timers'                   => "VARCHAR(16) NOT NULL DEFAULT 'yes'",
+            'language'                 => "VARCHAR(16) NOT NULL DEFAULT 'fr'",
+            'rtp_keepalive'            => "INTEGER NOT NULL DEFAULT 15",
+            't38_udptl'                => "VARCHAR(16) NOT NULL DEFAULT 'no'",
+            'fax_detect'               => "INTEGER NOT NULL DEFAULT 0",
+            'inband_progress'          => "INTEGER NOT NULL DEFAULT 0",
+            'custom_reg_params'        => "TEXT NOT NULL DEFAULT ''",
+            'custom_aor_params'        => "TEXT NOT NULL DEFAULT ''",
+            'moh_sound_id'             => "INTEGER NOT NULL DEFAULT 0",
+        ];
+
+        foreach ($extraColumns as $colName => $colDef) {
+            if (!in_array($colName, $existing, true)) {
+                $db->exec("ALTER TABLE trunks ADD COLUMN {$colName} {$colDef}");
+            }
+        }
+    }
+
+    private static function migrateOutboundRoutesTable(PDO $db): void
+    {
+        $count = (int)$db->query('SELECT COUNT(*) FROM outbound_routes')->fetchColumn();
+        if ($count === 0) {
+            // Vérifie quels trunks et postes existent déjà pour pré-initialiser la route sortante principale
+            $trunks = $db->query('SELECT name, outbound_callerid FROM trunks ORDER BY id ASC')->fetchAll();
+            $firstTrunkName = !empty($trunks) ? (string)$trunks[0]['name'] : 'ovh-telecom';
+            $firstTrunkCid  = !empty($trunks) && trim((string)$trunks[0]['outbound_callerid']) !== ''
+                ? trim((string)$trunks[0]['outbound_callerid'])
+                : 'Sytelis Consulting <0422560185>';
+
+            $exts = $db->query('SELECT extension FROM extensions ORDER BY CAST(extension AS INTEGER) ASC')->fetchAll(PDO::FETCH_COLUMN);
+            $grps = $db->query('SELECT extension FROM groups ORDER BY CAST(extension AS INTEGER) ASC')->fetchAll(PDO::FETCH_COLUMN);
+
+            $stmt = $db->prepare('
+                INSERT INTO outbound_routes (
+                    priority, name, outbound_callerid, override_ext_cid, route_password,
+                    route_type, moh_class, trunk_sequence_json, dial_patterns_json,
+                    permission_mode, allowed_groups_json, allowed_extensions_json,
+                    continue_next_route, congestion_dest, record_mode, enabled
+                ) VALUES (
+                    :priority, :name, :cid, :override_cid, :pwd,
+                    :rtype, :moh, :trunks, :patterns,
+                    :pmode, :agroups, :aexts,
+                    :cont, :cdest, :rec, 1
+                )
+            ');
+
+            // Route 1 : OVH (principale)
+            $stmt->execute([
+                ':priority'     => 1,
+                ':name'         => 'OVH',
+                ':cid'          => $firstTrunkCid,
+                ':override_cid' => 0,
+                ':pwd'          => '',
+                ':rtype'        => 'normal',
+                ':moh'          => 'default',
+                ':trunks'       => json_encode([$firstTrunkName]),
+                ':patterns'     => json_encode([
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '0[1-59]XXXXXXXX', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '0[67]XXXXXXXX', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '080[0-9]XXXXXX', 'callerid' => ''],
+                ]),
+                ':pmode'        => 'all',
+                ':agroups'      => json_encode($grps),
+                ':aexts'        => json_encode($exts),
+                ':cont'         => 1,
+                ':cdest'        => 'terminate-busy',
+                ':rec'          => 'dontcare',
+            ]);
+
+            // Route 2 : Emergency (Numéros d'urgence)
+            $stmt->execute([
+                ':priority'     => 2,
+                ':name'         => 'Emergency',
+                ':cid'          => $firstTrunkCid,
+                ':override_cid' => 1,
+                ':pwd'          => '',
+                ':rtype'        => 'emergency',
+                ':moh'          => 'default',
+                ':trunks'       => json_encode([$firstTrunkName]),
+                ':patterns'     => json_encode([
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '15', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '17', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '18', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '112', 'callerid' => ''],
+                    ['prepend' => '', 'prefix' => '', 'match_pattern' => '114', 'callerid' => ''],
+                ]),
+                ':pmode'        => 'all',
+                ':agroups'      => json_encode($grps),
+                ':aexts'        => json_encode($exts),
+                ':cont'         => 1,
+                ':cdest'        => 'terminate-congestion',
+                ':rec'          => 'dontcare',
+            ]);
+        }
+    }
+
+    private static function migrateExtensionGroupsTable(PDO $db): void
+    {
+        $count = (int)$db->query('SELECT COUNT(*) FROM extension_groups')->fetchColumn();
+        if ($count === 0) {
+            $stmt = $db->prepare('INSERT INTO extension_groups (name, description, color, members) VALUES (:n, :d, :c, :m)');
+            $stmt->execute([
+                ':n' => 'Groupe Nice',
+                ':d' => 'Extensions du site de Nice (Trunk local Livebox)',
+                ':c' => 'emerald',
+                ':m' => json_encode(['101', '102']),
+            ]);
+            $stmt->execute([
+                ':n' => 'Groupe Paris',
+                ':d' => 'Extensions du site de Paris (Trunk principal OVH)',
+                ':c' => 'indigo',
+                ':m' => json_encode(['103']),
+            ]);
+        }
+    }
+
+    private static function migrateSoundsTable(PDO $db): void
+    {
+        $count = (int)$db->query('SELECT COUNT(*) FROM sounds')->fetchColumn();
+        if ($count === 0) {
+            $stmt = $db->prepare('
+                INSERT INTO sounds (name, slug, site_category, usage_type, description, filename, original_filename, duration_sec, file_size, format)
+                VALUES (:name, :slug, :site, :usage, :desc, :file, :orig, :dur, :size, :fmt)
+            ');
+
+            $demoSounds = [
+                [
+                    ':name'  => 'Message d\'accueil SVI Standard',
+                    ':slug'  => 'bienvenue-entreprise',
+                    ':site'  => 'Global',
+                    ':usage' => 'ivr',
+                    ':desc'  => 'Jingle d\'accueil principal du serveur vocal interactif',
+                    ':file'  => 'bienvenue-entreprise.wav',
+                    ':orig'  => 'bienvenue-entreprise.wav',
+                    ':dur'   => 2,
+                    ':size'  => 31800,
+                    ':fmt'   => 'wav',
+                ],
+                [
+                    ':name'  => 'Musique d\'attente Standard',
+                    ':slug'  => 'attente-musicale-standard',
+                    ':site'  => 'Global',
+                    ':usage' => 'moh',
+                    ':desc'  => 'Mélodie douce d\'attente (MoH) par défaut pour les appels mis en garde',
+                    ':file'  => 'attente-musicale-standard.wav',
+                    ':orig'  => 'attente-musicale-standard.wav',
+                    ':dur'   => 4,
+                    ':size'  => 63600,
+                    ':fmt'   => 'wav',
+                ],
+                [
+                    ':name'  => 'Message Ligne Occupée & Congestion',
+                    ':slug'  => 'ligne-occupee-congestion',
+                    ':site'  => 'Global',
+                    ':usage' => 'congestion',
+                    ':desc'  => 'Tonalité cadencée d\'occupation si aucun trunk ou poste n\'est disponible',
+                    ':file'  => 'ligne-occupee-congestion.wav',
+                    ':orig'  => 'ligne-occupee-congestion.wav',
+                    ':dur'   => 1,
+                    ':size'  => 16000,
+                    ':fmt'   => 'wav',
+                ],
+                [
+                    ':name'  => 'Annonce Fermeture Nice',
+                    ':slug'  => 'annonce-fermeture-nice',
+                    ':site'  => 'Site Nice',
+                    ':usage' => 'announcement',
+                    ':desc'  => 'Message informant des horaires d\'ouverture du bureau de Nice',
+                    ':file'  => 'annonce-fermeture-nice.wav',
+                    ':orig'  => 'annonce-fermeture-nice.wav',
+                    ':dur'   => 2,
+                    ':size'  => 28800,
+                    ':fmt'   => 'wav',
+                ],
+            ];
+
+            foreach ($demoSounds as $ds) {
+                $stmt->execute($ds);
+            }
+        }
+    }
+
+    private static function migrateSoundSitesTable(PDO $db): void
+    {
+        $count = (int)$db->query('SELECT COUNT(*) FROM sound_sites')->fetchColumn();
+        if ($count === 0) {
+            $stmt = $db->prepare('INSERT INTO sound_sites (name, description) VALUES (:n, :d)');
+            $stmt->execute([':n' => 'Global', ':d' => 'Fichiers généraux partagés par tout le PBX']);
+            $stmt->execute([':n' => 'Site Nice', ':d' => 'Annonces et musiques spécifiques au site de Nice']);
+            $stmt->execute([':n' => 'Site Paris', ':d' => 'Annonces et musiques spécifiques au site de Paris']);
+        }
+    }
+
+    private static function migrateIvrsTable(PDO $db): void
+    {
+        $cols = $db->query("PRAGMA table_info(ivrs)")->fetchAll(PDO::FETCH_ASSOC);
+        $existing = array_column($cols, 'name');
+
+        $extraColumns = [
+            'description'       => "TEXT NOT NULL DEFAULT ''",
+            'direct_dial'       => "INTEGER NOT NULL DEFAULT 1",
+            'invalid_retries'   => "INTEGER NOT NULL DEFAULT 3",
+            'invalid_sound_id'  => "INTEGER NOT NULL DEFAULT 0",
+            'invalid_dest'      => "VARCHAR(64) NOT NULL DEFAULT 'hangup'",
+            'timeout_retries'   => "INTEGER NOT NULL DEFAULT 2",
+            'timeout_sound_id'  => "INTEGER NOT NULL DEFAULT 0",
+            'timeout_dest'      => "VARCHAR(64) NOT NULL DEFAULT 'hangup'",
+        ];
+
+        foreach ($extraColumns as $colName => $colDef) {
+            if (!in_array($colName, $existing, true)) {
+                $db->exec("ALTER TABLE ivrs ADD COLUMN {$colName} {$colDef}");
+            }
+        }
+    }
+
+    private static function migrateCertificatesTable(PDO $db): void
+    {
+        $count = (int)$db->query('SELECT COUNT(*) FROM certificates')->fetchColumn();
+        if ($count === 0) {
+            $defaultCert = '/etc/asterisk/keys/asterisk.crt';
+            $defaultKey  = '/etc/asterisk/keys/asterisk.key';
+
+            $domain = 'pbx.local';
+            $issuer = 'Asterisk PBX System';
+            $validFrom = date('Y-m-d H:i:s');
+            $validTo = date('Y-m-d H:i:s', time() + (3650 * 86400));
+            $daysRemaining = 3650;
+
+            if (file_exists($defaultCert)) {
+                $raw = @file_get_contents($defaultCert);
+                if ($raw) {
+                    $parsed = @openssl_x509_parse($raw);
+                    if ($parsed) {
+                        $domain = $parsed['subject']['CN'] ?? 'pbx.local';
+                        $issuer = $parsed['issuer']['O'] ?? ($parsed['issuer']['CN'] ?? 'Asterisk Self-Signed CA');
+                        if (!empty($parsed['validFrom_time_t'])) {
+                            $validFrom = date('Y-m-d H:i:s', $parsed['validFrom_time_t']);
+                        }
+                        if (!empty($parsed['validTo_time_t'])) {
+                            $validTo = date('Y-m-d H:i:s', $parsed['validTo_time_t']);
+                            $daysRemaining = (int)round(($parsed['validTo_time_t'] - time()) / 86400);
+                        }
+                    }
+                }
+            }
+
+            $stmt = $db->prepare('INSERT INTO certificates (
+                name, type, primary_domain, alt_names, issuer, valid_from, valid_to, days_remaining,
+                cert_path, key_path, chain_path, fullchain_path, is_default, status
+            ) VALUES (
+                :name, :type, :domain, :alt_names, :issuer, :valid_from, :valid_to, :days_rem,
+                :cert_path, :key_path, :chain_path, :fullchain_path, 1, :status
+            )');
+
+            $stmt->execute([
+                ':name'           => 'Certificat Auto-signé Système',
+                ':type'           => 'selfsigned',
+                ':domain'         => $domain,
+                ':alt_names'      => '',
+                ':issuer'         => $issuer,
+                ':valid_from'     => $validFrom,
+                ':valid_to'       => $validTo,
+                ':days_rem'       => $daysRemaining,
+                ':cert_path'      => $defaultCert,
+                ':key_path'       => $defaultKey,
+                ':chain_path'     => '',
+                ':fullchain_path' => $defaultCert,
+                ':status'         => ($daysRemaining > 0) ? 'valid' : 'expired',
+            ]);
+        }
+    }
+
+    private static function migrateFeatureCodesTable(PDO $db): void
+    {
+        $db->exec("CREATE TABLE IF NOT EXISTS feature_codes (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            feature_key VARCHAR(64) UNIQUE NOT NULL,
+            code VARCHAR(16) NOT NULL,
+            default_code VARCHAR(16) NOT NULL,
+            name VARCHAR(128) NOT NULL,
+            category VARCHAR(64) NOT NULL,
+            description TEXT NOT NULL DEFAULT '',
+            enabled INTEGER NOT NULL DEFAULT 1,
+            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+            updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        )");
+
+        $defaults = [
+            // Supervision & Interception BLF
+            ['pickup_blf', '**', '**', "Interception d'appel dirigée (BLF Yealink)", 'pickup', "Récupère l'appel du poste surveillé en appuyant sur sa touche BLF ou en composant ** suivi de son numéro."],
+            ['pickup_group', '*8', '*8', "Interception d'appel de groupe", 'pickup', "Récupère n'importe quel appel qui sonne dans votre groupe de postes (ou composez *8 suivi du numéro pour une capture dirigée)."],
+            
+            // Renvois d'appels
+            ['cf_activate', '*72', '*72', "Activer le renvoi d'appels inconditionnel", 'forward', "Renvoie immédiatement tous les appels vers un autre numéro (composez *72 ou *72 suivi du numéro de destination)."],
+            ['cf_deactivate', '*73', '*73', "Désactiver le renvoi d'appels inconditionnel", 'forward', "Annule le renvoi inconditionnel de vos appels."],
+            ['cfu_activate', '*52', '*52', "Activer le renvoi sur non-réponse / indisponibilité", 'forward', "Renvoie vos appels uniquement en cas de non-réponse ou d'indisponibilité."],
+            ['cfu_deactivate', '*53', '*53', "Désactiver le renvoi sur non-réponse / indisponibilité", 'forward', "Annule le renvoi sur non-réponse / indisponibilité."],
+            
+            // Ne pas déranger (DND)
+            ['dnd_activate', '*78', '*78', "Activer le mode Ne-pas-Déranger (DND)", 'dnd', "Rejette les appels entrants en envoyant le signal occupé ou renvoie vers la messagerie."],
+            ['dnd_deactivate', '*79', '*79', "Désactiver le mode Ne-pas-Déranger (DND)", 'dnd', "Rétablit la sonnerie normale de votre combiné téléphonique."],
+            ['dnd_toggle', '*76', '*76', "Inverser l'état Ne-pas-Déranger (Toggle)", 'dnd', "Bascule rapidement entre l'état Ne-pas-déranger Actif et Inactif."],
+
+            // Messagerie vocale
+            ['voicemail_direct', '*97', '*97', "Accès direct à votre boîte vocale", 'voicemail', "Consulte vos messages vocaux sans mot de passe depuis votre propre poste."],
+            ['voicemail_general', '*98', '*98', "Consulter la boîte vocale d'une autre extension", 'voicemail', "Accède à n'importe quelle boîte vocale en saisissant le numéro de poste et le code PIN."],
+
+            // Sécurité & Filtrage
+            ['blacklist_add', '*30', '*30', "Ajouter un numéro à la liste noire (Blacklist)", 'security', "Bloque définitivement les appels provenant d'un numéro indésirable."],
+            ['blacklist_remove', '*31', '*31', "Retirer un numéro de la liste noire", 'security', "Débloque un numéro précédemment blacklisté."],
+            ['blacklist_last', '*32', '*32', "Bloquer instantanément le dernier appelant", 'security', "Ajoute immédiatement le numéro du dernier appel reçu à la liste noire."],
+
+            // Outils & Diagnostics
+            ['speak_exten', '*65', '*65', "Identifier vocalement votre numéro de poste", 'tools', "Asterisk énonce à voix haute le numéro de l'extension actuelle (Speak your extension)."],
+            ['last_caller', '*69', '*69', "Identifier vocalement le dernier appelant reçu", 'tools', "Énonce le numéro du dernier appel reçu et propose de le rappeler."],
+            ['echo_test', '*43', '*43', "Test d'écho audio bidirectionnel", 'tools', "Permet de tester micro, écouteur et latence réseau en renvoyant votre voix en miroir."],
+            ['speaking_clock', '*60', '*60', "Horloge parlante / Test audio", 'tools', "Donne la date et l'heure exacte et valide le fonctionnement des codecs audio."],
+            ['moh_test', '*44', '*44', "Test d'écoute de la musique d'attente (MoH)", 'tools', "Diffuse la musique d'attente générale pour valider la qualité sonore."]
+        ];
+
+        $stmtCheck = $db->prepare('SELECT COUNT(*) FROM feature_codes WHERE feature_key = :k');
+        $stmtInsert = $db->prepare('INSERT INTO feature_codes (feature_key, code, default_code, name, category, description, enabled) VALUES (:k, :c, :def, :n, :cat, :d, 1)');
+
+        foreach ($defaults as $item) {
+            $stmtCheck->execute([':k' => $item[0]]);
+            if ((int)$stmtCheck->fetchColumn() === 0) {
+                $stmtInsert->execute([
+                    ':k'   => $item[0],
+                    ':c'   => $item[1],
+                    ':def' => $item[2],
+                    ':n'   => $item[3],
+                    ':cat' => $item[4],
+                    ':d'   => $item[5],
+                ]);
+            }
+        }
+    }
+}
+
diff --git a/src/FirewallManager.php b/src/FirewallManager.php
new file mode 100644
index 0000000..d0035a2
--- /dev/null
+++ b/src/FirewallManager.php
@@ -0,0 +1,553 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use Exception;
+use RuntimeException;
+use InvalidArgumentException;
+
+class FirewallManager
+{
+    public const JAIL_LOCAL_PATH = '/etc/fail2ban/jail.local';
+    public const NGINX_CONF_PATH = '/etc/nginx/sites-available/nexus-pbx';
+    public const WEB_FILTER_PATH = '/etc/fail2ban/filter.d/nexus-web.conf';
+
+    /**
+     * Récupère la configuration actuelle du pare-feu et de Fail2ban depuis SQLite.
+     */
+    public static function getSettings(): array
+    {
+        $db = Database::getConnection();
+        $stmt = $db->query("SELECT 
+            firewall_enabled, admin_https_port, certbot_strict_port80,
+            fail2ban_sip_maxretry, fail2ban_sip_findtime, fail2ban_sip_bantime,
+            fail2ban_web_maxretry, fail2ban_web_bantime, fail2ban_whitelist_ips
+            FROM settings WHERE id = 1");
+        $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+        if (!$row) {
+            return [
+                'firewall_enabled' => 1,
+                'admin_https_port' => 8443,
+                'certbot_strict_port80' => 0,
+                'fail2ban_sip_maxretry' => 3,
+                'fail2ban_sip_findtime' => 600,
+                'fail2ban_sip_bantime' => 3600,
+                'fail2ban_web_maxretry' => 3,
+                'fail2ban_web_bantime' => 3600,
+                'fail2ban_whitelist_ips' => '127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 82.122.84.60',
+            ];
+        }
+
+        return [
+            'firewall_enabled' => (int)($row['firewall_enabled'] ?? 1),
+            'admin_https_port' => (int)($row['admin_https_port'] ?? 8443),
+            'certbot_strict_port80' => (int)($row['certbot_strict_port80'] ?? 0),
+            'fail2ban_sip_maxretry' => (int)($row['fail2ban_sip_maxretry'] ?? 3),
+            'fail2ban_sip_findtime' => (int)($row['fail2ban_sip_findtime'] ?? 600),
+            'fail2ban_sip_bantime' => (int)($row['fail2ban_sip_bantime'] ?? 3600),
+            'fail2ban_web_maxretry' => (int)($row['fail2ban_web_maxretry'] ?? 3),
+            'fail2ban_web_bantime' => (int)($row['fail2ban_web_bantime'] ?? 3600),
+            'fail2ban_whitelist_ips' => (string)($row['fail2ban_whitelist_ips'] ?? '127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 82.122.84.60'),
+        ];
+    }
+
+    /**
+     * Retourne l'état complet en direct de Fail2ban et les IPs bannies.
+     * Utilise un cache rapide de 4 secondes pour soulager le tableau de bord temps réel.
+     */
+    public static function getStatus(bool $forceFresh = false): array
+    {
+        $cacheFile = '/tmp/nexus_fw_status_cache.json';
+        if (!$forceFresh && file_exists($cacheFile)) {
+            $mtime = @filemtime($cacheFile);
+            if ($mtime && (time() - $mtime) < 4) {
+                $cached = json_decode((string)file_get_contents($cacheFile), true);
+                if (is_array($cached)) {
+                    return $cached;
+                }
+            }
+        }
+
+        $settings = self::getSettings();
+
+        // 1. Détection service Fail2ban
+        exec('sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
+        $isRunning = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
+
+        $jails = [];
+        $bannedList = [];
+        $totalBannedCount = 0;
+
+        if ($isRunning) {
+            exec('sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
+            $statStr = implode("\n", $statOut);
+
+            // Extraction des prisons actives
+            if (preg_match('/Jail list:\s+(.+)$/m', $statStr, $m)) {
+                $jailNames = array_map('trim', explode(',', $m[1]));
+                foreach ($jailNames as $jName) {
+                    if ($jName === '') continue;
+                    $jStatus = self::getJailDetails($jName);
+                    $jails[$jName] = $jStatus;
+
+                    foreach ($jStatus['banned_ips'] as $bIp) {
+                        $bannedList[] = [
+                            'ip' => $bIp,
+                            'jail' => $jName,
+                            'jail_label' => self::formatJailName($jName),
+                        ];
+                        $totalBannedCount++;
+                    }
+                }
+            }
+        }
+
+        // IP actuelle du client
+        $currentIp = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
+        if (str_contains($currentIp, ',')) {
+            $currentIp = trim(explode(',', $currentIp)[0]);
+        }
+
+        $status = [
+            'is_running' => $isRunning,
+            'settings' => $settings,
+            'jails' => $jails,
+            'banned_ips' => $bannedList,
+            'total_banned' => $totalBannedCount,
+            'client_ip' => $currentIp,
+        ];
+
+        @file_put_contents($cacheFile, json_encode($status));
+        return $status;
+    }
+
+    /**
+     * Débannit une adresse IP d'une prison ou de toutes les prisons.
+     */
+    public static function unbanIp(string $ip, string $jail = ''): array
+    {
+        $ip = trim($ip);
+        if ($ip === '' || (!filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
+            throw new InvalidArgumentException("Adresse IP invalide : {$ip}");
+        }
+
+        $jail = trim($jail);
+        $unbannedFrom = [];
+
+        if ($jail !== '' && $jail !== 'all') {
+            $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
+            exec($cmd, $out, $code);
+            if ($code === 0) {
+                $unbannedFrom[] = $jail;
+            }
+        } else {
+            // Débannir de toutes les prisons connues
+            foreach (['asterisk', 'nexus-web', 'sshd'] as $j) {
+                $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
+                exec($cmd, $out, $code);
+                if ($code === 0) {
+                    $unbannedFrom[] = $j;
+                }
+            }
+        }
+
+        @unlink('/tmp/nexus_fw_status_cache.json');
+
+        return [
+            'success' => count($unbannedFrom) > 0,
+            'message' => count($unbannedFrom) > 0
+                ? "L'adresse IP {$ip} a été débannie avec succès (" . implode(', ', $unbannedFrom) . ")."
+                : "L'adresse IP {$ip} n'a pas été trouvée dans les listes de bannissement actives.",
+        ];
+    }
+
+    /**
+     * Bannit manuellement une adresse IP.
+     */
+    public static function banIp(string $ip, string $jail = 'asterisk'): array
+    {
+        $ip = trim($ip);
+        if ($ip === '' || (!filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
+            throw new InvalidArgumentException("Adresse IP invalide : {$ip}");
+        }
+
+        $jail = trim($jail) ?: 'asterisk';
+        $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
+        exec($cmd, $out, $code);
+        @unlink('/tmp/nexus_fw_status_cache.json');
+
+        return [
+            'success' => $code === 0,
+            'message' => $code === 0
+                ? "L'adresse IP {$ip} a été bannie sur la règle {$jail}."
+                : "Échec du bannissement : " . implode("\n", $out),
+        ];
+    }
+
+    /**
+     * Enregistre les paramètres du pare-feu, régénère jail.local et la configuration Nginx.
+     */
+    public static function saveSettings(array $data): array
+    {
+        $db = Database::getConnection();
+
+        $strictPort80 = !empty($data['certbot_strict_port80']) ? 1 : 0;
+        $firewallEnabled = (!empty($data['firewall_enabled']) || $strictPort80 === 1) ? 1 : 0;
+        $adminPort = max(1, min(65535, (int)($data['admin_https_port'] ?? 8443)));
+        $sipMaxRetry = max(1, min(20, (int)($data['fail2ban_sip_maxretry'] ?? 3)));
+        $sipFindTime = max(60, min(86400, (int)($data['fail2ban_sip_findtime'] ?? 600)));
+        $sipBanTime = max(60, min(31536000, (int)($data['fail2ban_sip_bantime'] ?? 3600)));
+        $webMaxRetry = max(1, min(20, (int)($data['fail2ban_web_maxretry'] ?? 3)));
+        $webBanTime = max(60, min(31536000, (int)($data['fail2ban_web_bantime'] ?? 3600)));
+
+        $whitelist = trim((string)($data['fail2ban_whitelist_ips'] ?? ''));
+        $cleanTokens = array_values(array_filter(preg_split('/\s+/', $whitelist)));
+        
+        // Toujours préserver l'adresse de bouclage locale pour les processus internes
+        if (!in_array('127.0.0.1/8', $cleanTokens, true)) {
+            array_unshift($cleanTokens, '127.0.0.1/8');
+        }
+        if (!in_array('::1', $cleanTokens, true)) {
+            $cleanTokens[] = '::1';
+        }
+
+        $finalWhitelist = implode(' ', array_unique($cleanTokens));
+
+        // 1. Sauvegarde dans la base SQLite
+        $stmt = $db->prepare("UPDATE settings SET
+            firewall_enabled = :fe,
+            admin_https_port = :ap,
+            certbot_strict_port80 = :sp80,
+            fail2ban_sip_maxretry = :smr,
+            fail2ban_sip_findtime = :sft,
+            fail2ban_sip_bantime = :sbt,
+            fail2ban_web_maxretry = :wmr,
+            fail2ban_web_bantime = :wbt,
+            fail2ban_whitelist_ips = :wl,
+            updated_at = CURRENT_TIMESTAMP
+            WHERE id = 1");
+
+        $stmt->execute([
+            ':fe' => $firewallEnabled,
+            ':ap' => $adminPort,
+            ':sp80' => $strictPort80,
+            ':smr' => $sipMaxRetry,
+            ':sft' => $sipFindTime,
+            ':sbt' => $sipBanTime,
+            ':wmr' => $webMaxRetry,
+            ':wbt' => $webBanTime,
+            ':wl' => $finalWhitelist,
+        ]);
+
+        // 2. Génération et application du fichier /etc/fail2ban/jail.local
+        self::generateJailLocal(
+            $finalWhitelist,
+            $sipMaxRetry,
+            $sipFindTime,
+            $sipBanTime,
+            $webMaxRetry,
+            $webBanTime,
+            $adminPort
+        );
+
+        // 3. Rechargement de Fail2ban
+        exec('sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
+
+        // 4. Mise à jour de la configuration Nginx
+        self::applyNginxConfig($adminPort, $strictPort80);
+
+        @unlink('/tmp/nexus_fw_status_cache.json');
+
+        return [
+            'success' => true,
+            'message' => 'Configuration Pare-feu & Fail2ban appliquée avec succès ! Nginx et Fail2ban rechargés.',
+            'settings' => self::getSettings(),
+        ];
+    }
+
+    /**
+     * Écrit le fichier /etc/fail2ban/jail.local
+     */
+    public static function generateJailLocal(
+        string $whitelist,
+        int $sipMaxRetry,
+        int $sipFindTime,
+        int $sipBanTime,
+        int $webMaxRetry,
+        int $webBanTime,
+        int $adminPort
+    ): void {
+        $portsWeb = "http,https,{$adminPort}";
+
+        $conf = <<<EOF
+# Fichier généré automatiquement par NexusPBX
+# Ne pas modifier manuellement - éditable depuis l'interface Web
+
+[DEFAULT]
+ignoreip = {$whitelist}
+findtime = {$sipFindTime}
+bantime = {$sipBanTime}
+maxretry = {$sipMaxRetry}
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+
+[sshd]
+enabled = true
+port = ssh
+mode = aggressive
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+maxretry = 3
+bantime = 3600
+
+[asterisk]
+enabled = true
+filter = asterisk
+logpath = /var/log/asterisk/security.log
+maxretry = {$sipMaxRetry}
+findtime = {$sipFindTime}
+bantime = {$sipBanTime}
+port = 5060,5061
+protocol = udp
+
+[nexus-web]
+enabled = true
+filter = nexus-web
+logpath = /var/log/nexus_security.log
+maxretry = {$webMaxRetry}
+findtime = 600
+bantime = {$webBanTime}
+port = {$portsWeb}
+protocol = tcp
+
+EOF;
+
+        file_put_contents(self::JAIL_LOCAL_PATH, $conf);
+    }
+
+    /**
+     * Met à jour Nginx pour séparer le port 80 (Certbot/ACME uniquement si strict) et écouter sur le port d'admin.
+     */
+    public static function applyNginxConfig(int $adminHttpsPort, int $strictPort80): void
+    {
+        $phpSock = '/run/php/php8.4-fpm.sock';
+        if (!file_exists($phpSock)) {
+            $found = glob('/run/php/php*-fpm.sock');
+            if (!empty($found)) {
+                $phpSock = $found[0];
+            }
+        }
+
+        // Configuration Port 80 (HTTP)
+        if ($strictPort80 === 1) {
+            // Mode Strict : Le port 80 sert UNIQUEMENT aux challenges ACME Certbot
+            $port80Block = <<<EOF
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    # Challenge ACME Let's Encrypt (Certbot) UNIQUEMENT
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/nexus-pbx/public;
+        try_files \$uri =404;
+    }
+
+    # Tout le reste est strictement bloqué sur le port 80
+    location / {
+        return 404;
+    }
+}
+EOF;
+        } else {
+            // Mode Normal : Port 80 sert l'application (et les challenges ACME)
+            $port80Block = <<<EOF
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    client_max_body_size 64M;
+
+    root /var/www/nexus-pbx/public;
+    index index.php;
+
+    access_log /var/log/nginx/nexus-pbx.access.log;
+    error_log  /var/log/nginx/nexus-pbx.error.log;
+
+    location / {
+        try_files \$uri \$uri/ /index.php?\$query_string;
+    }
+
+    location ~* \.(?:css|js)$ {
+        expires -1;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files \$uri =404;
+    }
+
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:{$phpSock};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF;
+        }
+
+        // Configuration HTTPS : écoute sur port 443 ET sur le port admin custom si différent de 443
+        $listenCustom = "";
+        if ($adminHttpsPort !== 443 && $adminHttpsPort > 0) {
+            $listenCustom = "\n    listen {$adminHttpsPort} ssl;\n    listen [::]:{$adminHttpsPort} ssl;";
+        }
+
+        $httpsBlock = <<<EOF
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;{$listenCustom}
+    server_name _;
+
+    ssl_certificate /etc/asterisk/keys/active_cert.crt;
+    ssl_certificate_key /etc/asterisk/keys/active_key.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    client_max_body_size 64M;
+
+    root /var/www/nexus-pbx/public;
+    index index.php;
+
+    access_log /var/log/nginx/nexus-pbx.ssl.access.log;
+    error_log  /var/log/nginx/nexus-pbx.ssl.error.log;
+
+    location / {
+        try_files \$uri \$uri/ /index.php?\$query_string;
+    }
+
+    location ~* \.(?:css|js)$ {
+        expires -1;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+        try_files \$uri =404;
+    }
+
+    location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:{$phpSock};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF;
+
+        // Configuration Port 8080 : Annuaire XML pour téléphones IP (Yealink, Fanvil, Grandstream, etc.)
+        $phonebookBlock = <<<EOF
+server {
+    listen 8080;
+    listen [::]:8080;
+    server_name _;
+    root /var/www/nexus-pbx/public;
+
+    # Annuaire XML pour postes IP (phonebook.php)
+    location = /phonebook.php {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:{$phpSock};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+    }
+
+    # Avatars / Photos de contacts pour téléphones IP
+    location ^~ /avatars/ {
+        try_files \$uri =404;
+    }
+
+    location / {
+        return 404;
+    }
+}
+EOF;
+
+        $fullNginxConfig = $port80Block . "\n\n" . $phonebookBlock . "\n\n" . $httpsBlock . "\n";
+        file_put_contents(self::NGINX_CONF_PATH, $fullNginxConfig);
+
+        // Test de syntaxe
+        exec('sudo /usr/sbin/nginx -t 2>&1', $tOut, $tCode);
+        if ($tCode !== 0) {
+            throw new RuntimeException("Erreur de syntaxe Nginx : " . implode("\n", $tOut));
+        }
+
+        // Rechargement Nginx sans coupure
+        exec('sudo /usr/bin/systemctl reload nginx 2>&1');
+    }
+
+    private static function getJailDetails(string $jail): array
+    {
+        exec('sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
+        $str = implode("\n", $out);
+
+        $currentlyFailed = 0;
+        $totalFailed = 0;
+        $currentlyBanned = 0;
+        $totalBanned = 0;
+        $bannedIps = [];
+
+        if (preg_match('/Currently failed:\s+(\d+)/', $str, $m)) {
+            $currentlyFailed = (int)$m[1];
+        }
+        if (preg_match('/Total failed:\s+(\d+)/', $str, $m)) {
+            $totalFailed = (int)$m[1];
+        }
+
+        // Intégrer également les événements consignés dans le journal physique
+        if ($jail === 'asterisk') {
+            $logIncidents = is_readable('/var/log/asterisk/security.log')
+                ? (int)shell_exec("grep -c -E 'ChallengeResponseFailed|InvalidAccountID|FailedAuth' /var/log/asterisk/security.log 2>/dev/null")
+                : 0;
+            $totalFailed = max($totalFailed, $logIncidents);
+        } elseif ($jail === 'nexus-web') {
+            $logIncidents = is_readable('/var/log/nexus_security.log')
+                ? (int)shell_exec("grep -c 'FailedLogin' /var/log/nexus_security.log 2>/dev/null")
+                : 0;
+            $totalFailed = max($totalFailed, $logIncidents);
+        }
+        if (preg_match('/Currently banned:\s+(\d+)/', $str, $m)) {
+            $currentlyBanned = (int)$m[1];
+        }
+        if (preg_match('/Total banned:\s+(\d+)/', $str, $m)) {
+            $totalBanned = (int)$m[1];
+        }
+        if (preg_match('/Banned IP list:\s*(.*)$/m', $str, $m)) {
+            $rawIps = trim($m[1]);
+            if ($rawIps !== '') {
+                $bannedIps = array_values(array_filter(preg_split('/\s+/', $rawIps)));
+            }
+        }
+
+        return [
+            'name' => $jail,
+            'currently_failed' => $currentlyFailed,
+            'total_failed' => $totalFailed,
+            'currently_banned' => $currentlyBanned,
+            'total_banned' => $totalBanned,
+            'banned_ips' => $bannedIps,
+        ];
+    }
+
+    private static function formatJailName(string $jail): string
+    {
+        return match ($jail) {
+            'asterisk' => 'Téléphonie SIP (PJSIP)',
+            'nexus-web' => 'Interface Web Admin',
+            'sshd' => 'Accès Console SSH',
+            default => ucfirst($jail),
+        };
+    }
+}
diff --git a/src/PhonebookManager.php b/src/PhonebookManager.php
new file mode 100644
index 0000000..6f466e3
--- /dev/null
+++ b/src/PhonebookManager.php
@@ -0,0 +1,303 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use Exception;
+use RuntimeException;
+use InvalidArgumentException;
+
+class PhonebookManager
+{
+    public const AVATARS_DIR = '/var/www/nexus-pbx/public/avatars';
+
+    /**
+     * Initialise le dossier des avatars.
+     */
+    public static function initDirectory(): void
+    {
+        if (!is_dir(self::AVATARS_DIR)) {
+            @mkdir(self::AVATARS_DIR, 0775, true);
+        }
+        @chown(self::AVATARS_DIR, 'www-data');
+        @chgrp(self::AVATARS_DIR, 'www-data');
+    }
+
+    /**
+     * Synchronise automatiquement les postes d'extensions vers l'annuaire d'entreprise.
+     */
+    public static function syncExtensions(PDO $db): void
+    {
+        // 1. Récupère la cartographie des groupes d'extensions
+        $egRows = $db->query("SELECT id, name, members FROM extension_groups")->fetchAll();
+        $extToGroup = [];
+        foreach ($egRows as $eg) {
+            $members = json_decode((string)$eg['members'], true) ?: [];
+            foreach ($members as $extNum) {
+                if (!isset($extToGroup[(string)$extNum])) {
+                    $extToGroup[(string)$extNum] = trim((string)$eg['name']);
+                }
+            }
+        }
+
+        // 2. Récupère tous les postes
+        $exts = $db->query("SELECT id, extension, name, voicemail_email FROM extensions")->fetchAll();
+        $activeExtIds = [];
+
+        $findStmt = $db->prepare("SELECT id, display_name, internal_number, email, group_name FROM phonebook_contacts WHERE extension_id = :ext_id OR (extension_id IS NULL AND is_internal = 1 AND internal_number = :num)");
+        $insertStmt = $db->prepare("
+            INSERT INTO phonebook_contacts (extension_id, display_name, internal_number, email, group_name, is_internal)
+            VALUES (:ext_id, :name, :num, :email, :grp, 1)
+        ");
+        $updateStmt = $db->prepare("
+            UPDATE phonebook_contacts
+            SET extension_id = :ext_id, display_name = :name, internal_number = :num, email = :email, group_name = :grp, updated_at = CURRENT_TIMESTAMP
+            WHERE id = :id
+        ");
+
+        foreach ($exts as $ext) {
+            $extId = (int)$ext['id'];
+            $extNum = trim((string)$ext['extension']);
+            $extName = trim((string)$ext['name']);
+            $email = trim((string)($ext['voicemail_email'] ?? ''));
+            $group = $extToGroup[$extNum] ?? 'Général';
+            $activeExtIds[] = $extId;
+
+            $findStmt->execute([':ext_id' => $extId, ':num' => $extNum]);
+            $existing = $findStmt->fetch(PDO::FETCH_ASSOC);
+
+            if ($existing) {
+                $updateStmt->execute([
+                    ':id'     => (int)$existing['id'],
+                    ':ext_id' => $extId,
+                    ':name'   => $extName,
+                    ':num'    => $extNum,
+                    ':email'  => $email,
+                    ':grp'    => $group,
+                ]);
+            } else {
+                $insertStmt->execute([
+                    ':ext_id' => $extId,
+                    ':name'   => $extName,
+                    ':num'    => $extNum,
+                    ':email'  => $email,
+                    ':grp'    => $group,
+                ]);
+            }
+        }
+
+        // 3. Supprime les contacts internes orphelins (si extension supprimée)
+        if (!empty($activeExtIds)) {
+            $inClause = implode(',', $activeExtIds);
+            $db->exec("DELETE FROM phonebook_contacts WHERE is_internal = 1 AND extension_id IS NOT NULL AND extension_id NOT IN ({$inClause})");
+        }
+    }
+
+    /**
+     * Récupère la liste des contacts filtrée ou non par groupe.
+     */
+    public static function getContacts(PDO $db, ?string $group = null): array
+    {
+        self::syncExtensions($db);
+
+        $params = [];
+        $sql = "SELECT * FROM phonebook_contacts";
+
+        if ($group !== null && trim($group) !== '' && strtolower(trim($group)) !== 'all' && strtolower(trim($group)) !== 'tous') {
+            $cleanGroup = trim($group);
+            $sql .= " WHERE LOWER(group_name) = LOWER(:grp) OR LOWER(group_name) LIKE LOWER(:grp_like) OR LOWER(group_name) IN ('tous', 'all')";
+            $params[':grp'] = $cleanGroup;
+            $params[':grp_like'] = "%{$cleanGroup}%";
+        }
+
+        $sql .= " ORDER BY display_name COLLATE NOCASE ASC";
+        $stmt = $db->prepare($sql);
+        $stmt->execute($params);
+        return $stmt->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    /**
+     * Récupère la liste de tous les groupes d'annuaire disponibles.
+     */
+    public static function getGroups(PDO $db): array
+    {
+        $groups = [];
+        $egRows = $db->query("SELECT name FROM extension_groups ORDER BY name ASC")->fetchAll(PDO::FETCH_COLUMN);
+        foreach ($egRows as $g) {
+            $g = trim((string)$g);
+            if ($g !== '') $groups[$g] = true;
+        }
+        $pbRows = $db->query("SELECT DISTINCT group_name FROM phonebook_contacts WHERE group_name != ''")->fetchAll(PDO::FETCH_COLUMN);
+        foreach ($pbRows as $g) {
+            $g = trim((string)$g);
+            if ($g !== '') $groups[$g] = true;
+        }
+
+        // Ajoute Issy-Les-Moulineaux si pas encore présent
+        if (!isset($groups['Issy-Les-Moulineaux'])) {
+            $groups['Issy-Les-Moulineaux'] = true;
+        }
+
+        $result = array_keys($groups);
+        sort($result, SORT_NATURAL | SORT_FLAG_CASE);
+        return $result;
+    }
+
+    /**
+     * Enregistre un contact (création ou mise à jour).
+     */
+    public static function saveContact(PDO $db, array $data): int
+    {
+        $id = isset($data['id']) && $data['id'] !== '' ? (int)$data['id'] : null;
+        $name = trim((string)($data['display_name'] ?? ''));
+        $internal = trim((string)($data['internal_number'] ?? ''));
+        $mobile = trim((string)($data['mobile_number'] ?? ''));
+        $other = trim((string)($data['other_number'] ?? ''));
+        $email = trim((string)($data['email'] ?? ''));
+        $photo = trim((string)($data['photo_url'] ?? ''));
+        $group = trim((string)($data['group_name'] ?? 'Général')) ?: 'Général';
+        $isInternal = !empty($data['is_internal']) ? 1 : 0;
+        $extensionId = !empty($data['extension_id']) ? (int)$data['extension_id'] : null;
+
+        if ($name === '') {
+            throw new InvalidArgumentException("Le nom du contact est obligatoire.");
+        }
+        if ($internal === '' && $mobile === '' && $other === '') {
+            throw new InvalidArgumentException("Veuillez renseigner au moins un numéro de téléphone (Poste, Mobile ou Autre).");
+        }
+
+        if ($id) {
+            $stmt = $db->prepare("
+                UPDATE phonebook_contacts
+                SET display_name = :name, internal_number = :internal, mobile_number = :mobile,
+                    other_number = :other, email = :email, photo_url = :photo, group_name = :grp,
+                    is_internal = :is_int, extension_id = :ext_id, updated_at = CURRENT_TIMESTAMP
+                WHERE id = :id
+            ");
+            $stmt->execute([
+                ':id'       => $id,
+                ':name'     => $name,
+                ':internal' => $internal,
+                ':mobile'   => $mobile,
+                ':other'    => $other,
+                ':email'    => $email,
+                ':photo'    => $photo,
+                ':grp'      => $group,
+                ':is_int'   => $isInternal,
+                ':ext_id'   => $extensionId,
+            ]);
+            return $id;
+        } else {
+            $stmt = $db->prepare("
+                INSERT INTO phonebook_contacts (display_name, internal_number, mobile_number, other_number, email, photo_url, group_name, is_internal, extension_id)
+                VALUES (:name, :internal, :mobile, :other, :email, :photo, :grp, :is_int, :ext_id)
+            ");
+            $stmt->execute([
+                ':name'     => $name,
+                ':internal' => $internal,
+                ':mobile'   => $mobile,
+                ':other'    => $other,
+                ':email'    => $email,
+                ':photo'    => $photo,
+                ':grp'      => $group,
+                ':is_int'   => $isInternal,
+                ':ext_id'   => $extensionId,
+            ]);
+            return (int)$db->lastInsertId();
+        }
+    }
+
+    /**
+     * Supprime un contact d'annuaire.
+     */
+    public static function deleteContact(PDO $db, int $id): bool
+    {
+        $stmt = $db->prepare("DELETE FROM phonebook_contacts WHERE id = :id");
+        return $stmt->execute([':id' => $id]);
+    }
+
+    /**
+     * Détermine l'URL de base pour l'accès aux photos et avatars depuis les postes IP.
+     */
+    public static function getBaseUrl(?PDO $db = null): string
+    {
+        if (!empty($_SERVER['HTTP_HOST'])) {
+            $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
+            return "{$scheme}://" . $_SERVER['HTTP_HOST'];
+        }
+
+        if ($db) {
+            try {
+                $st = $db->query("SELECT domain, external_ip FROM settings WHERE id = 1")->fetch(PDO::FETCH_ASSOC);
+                if (!empty($st['external_ip'])) {
+                    return "http://" . $st['external_ip'] . ":8080";
+                }
+                if (!empty($st['domain']) && $st['domain'] !== 'pbx.local') {
+                    return "http://" . $st['domain'] . ":8080";
+                }
+            } catch (\Throwable $e) {}
+        }
+
+        $serverIp = !empty($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : '127.0.0.1';
+        return "http://{$serverIp}:8080";
+    }
+
+    /**
+     * Génère le flux XML officiel Yealink IP Phone Remote Address Book.
+     */
+    public static function renderYealinkXml(PDO $db, ?string $group = null): string
+    {
+        $contacts = self::getContacts($db, $group);
+        $baseUrl = self::getBaseUrl($db);
+        $groupTitle = ($group !== null && trim($group) !== '' && strtolower(trim($group)) !== 'all')
+            ? trim($group)
+            : 'NexusPBX';
+
+        $xml = new \SimpleXMLElement('<?xml version="1.0" encoding="UTF-8"?><YealinkIPPhoneDirectory/>');
+        $xml->addChild('Title', "Annuaire " . htmlspecialchars($groupTitle, ENT_XML1, 'UTF-8'));
+
+        foreach ($contacts as $c) {
+            $name = trim((string)$c['display_name']);
+            $phone1 = trim((string)$c['internal_number']);
+            $phone2 = trim((string)$c['mobile_number']);
+            $phone3 = trim((string)$c['other_number']);
+            $email = trim((string)($c['email'] ?? ''));
+            $photo = trim((string)($c['photo_url'] ?? ''));
+
+            if ($phone1 === '' && $phone2 !== '') {
+                $phone1 = $phone2;
+                $phone2 = '';
+            }
+
+            if ($phone1 === '' && $phone2 === '' && $phone3 === '') {
+                continue;
+            }
+
+            $entry = $xml->addChild('DirectoryEntry');
+            $entry->addChild('Name', htmlspecialchars($name, ENT_XML1, 'UTF-8'));
+            $entry->addChild('Telephone', htmlspecialchars($phone1, ENT_XML1, 'UTF-8'));
+            if ($phone2 !== '') {
+                $entry->addChild('Mobile', htmlspecialchars($phone2, ENT_XML1, 'UTF-8'));
+            }
+            if ($phone3 !== '') {
+                $entry->addChild('OtherTelephone', htmlspecialchars($phone3, ENT_XML1, 'UTF-8'));
+            }
+            if ($email !== '') {
+                $entry->addChild('Email', htmlspecialchars($email, ENT_XML1, 'UTF-8'));
+            }
+            if ($photo !== '') {
+                $fullPhotoUrl = (strpos($photo, '://') === false)
+                    ? rtrim($baseUrl, '/') . '/' . ltrim($photo, '/')
+                    : $photo;
+                $entry->addChild('Photo', htmlspecialchars($fullPhotoUrl, ENT_XML1, 'UTF-8'));
+                $entry->addChild('Picture', htmlspecialchars($fullPhotoUrl, ENT_XML1, 'UTF-8'));
+            }
+        }
+
+        $dom = dom_import_simplexml($xml)->ownerDocument;
+        $dom->formatOutput = true;
+        return $dom->saveXML();
+    }
+}
+
diff --git a/src/SystemChecker.php b/src/SystemChecker.php
new file mode 100644
index 0000000..2835e3f
--- /dev/null
+++ b/src/SystemChecker.php
@@ -0,0 +1,209 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use Throwable;
+
+class SystemChecker
+{
+    public static function runDiagnostics(PDO $db): array
+    {
+        $settings = $db->query('SELECT * FROM settings WHERE id = 1')->fetch() ?: [];
+        $leDomain = trim((string)($settings['letsencrypt_domain'] ?? ''));
+
+        $checks = [];
+
+        // 1. OS Debian & PHP SQLite3
+        $osPretty = 'Linux Debian';
+        if (is_readable('/etc/os-release')) {
+            $osContent = (string)file_get_contents('/etc/os-release');
+            if (preg_match('/PRETTY_NAME="([^"]+)"/', $osContent, $m)) {
+                $osPretty = $m[1];
+            }
+        }
+        $checks[] = [
+            'id'      => 'debian_os',
+            'label'   => 'Système Debian & PHP ' . PHP_VERSION,
+            'ok'      => extension_loaded('pdo_sqlite'),
+            'detail'  => $osPretty . ' (PDO SQLite actif)',
+        ];
+
+        // 2. Base SQLite accessible en écriture
+        $dbWritable = is_writable(Database::DB_PATH) && is_writable(dirname(Database::DB_PATH));
+        $checks[] = [
+            'id'      => 'sqlite_db',
+            'label'   => 'Base de données SQLite3 (Source unique)',
+            'ok'      => $dbWritable,
+            'detail'  => $dbWritable
+                ? 'Lecture/Écriture OK (' . realpath(Database::DB_PATH) . ')'
+                : 'Permissions insuffisantes sur storage/database.sqlite',
+        ];
+
+        // 3. Utilisateur et Groupe Debian asterisk:asterisk
+        $astUser  = function_exists('posix_getpwnam') ? posix_getpwnam('asterisk') : true;
+        $astGroup = function_exists('posix_getgrnam') ? posix_getgrnam('asterisk') : true;
+        $checks[] = [
+            'id'      => 'asterisk_user',
+            'label'   => 'Utilisateur & Groupe Debian (asterisk:asterisk)',
+            'ok'      => (bool)($astUser && $astGroup),
+            'detail'  => ($astUser && $astGroup)
+                ? 'Utilisateur système asterisk:asterisk présent'
+                : 'Utilisateur ou groupe asterisk introuvable sur Debian',
+        ];
+
+        // 4. Droits d'écriture sur /etc/asterisk et *.custom.conf
+        $etcWritable = is_dir('/etc/asterisk') && is_writable('/etc/asterisk');
+        $pjsipOk     = !file_exists(ConfigGenerator::PJSIP_CONF_PATH) ? $etcWritable : is_writable(ConfigGenerator::PJSIP_CONF_PATH);
+        $extOk       = !file_exists(ConfigGenerator::EXTENSIONS_CONF_PATH) ? $etcWritable : is_writable(ConfigGenerator::EXTENSIONS_CONF_PATH);
+        $permOk      = $etcWritable && $pjsipOk && $extOk;
+        $checks[] = [
+            'id'      => 'asterisk_perms',
+            'label'   => 'Droits d\'écriture sur /etc/asterisk/*.custom.conf',
+            'ok'      => $permOk,
+            'detail'  => $permOk
+                ? '/etc/asterisk accessible en écriture par le worker PHP (groupe asterisk)'
+                : 'Accès refusé en écriture dans /etc/asterisk pour PHP-FPM',
+        ];
+
+        // 5. Directives #tryinclude dans pjsip.conf et extensions.conf
+        $pjsipMain = @file_get_contents('/etc/asterisk/pjsip.conf') ?: '';
+        $extMain   = @file_get_contents('/etc/asterisk/extensions.conf') ?: '';
+        $incOk     = str_contains($pjsipMain, 'pjsip.custom.conf') && str_contains($extMain, 'extensions.custom.conf');
+        $checks[] = [
+            'id'      => 'asterisk_includes',
+            'label'   => 'Inclusions natives (#tryinclude *.custom.conf)',
+            'ok'      => $incOk,
+            'detail'  => $incOk
+                ? 'pjsip.conf et extensions.conf incluent bien les fichiers .custom.conf'
+                : 'Directive #tryinclude manquante dans pjsip.conf ou extensions.conf',
+        ];
+
+        // 6. Certificats TLS (Let's Encrypt ou Certificat local Debian)
+        if ($leDomain !== '') {
+            $leCert = "/etc/letsencrypt/live/{$leDomain}/fullchain.pem";
+            $leKey  = "/etc/letsencrypt/live/{$leDomain}/privkey.pem";
+            $leOk   = is_readable($leCert) && is_readable($leKey);
+            $checks[] = [
+                'id'      => 'tls_certs',
+                'label'   => "Certificat TLS Let's Encrypt ({$leDomain})",
+                'ok'      => $leOk,
+                'detail'  => $leOk
+                    ? "Certificat Let's Encrypt lisible ({$leCert})"
+                    : "Certificat introuvable ou non lisible dans /etc/letsencrypt/live/{$leDomain}/",
+            ];
+        } else {
+            $fallbackOk = is_readable('/etc/asterisk/keys/asterisk.crt') && is_readable('/etc/asterisk/keys/asterisk.key');
+            $checks[] = [
+                'id'      => 'tls_certs',
+                'label'   => 'Certificats TLS SIP (Port 5061)',
+                'ok'      => $fallbackOk,
+                'detail'  => $fallbackOk
+                    ? 'Certificat TLS local actif (/etc/asterisk/keys/asterisk.crt) — prêt pour Let\'s Encrypt'
+                    : 'Aucun domaine Let\'s Encrypt configuré',
+            ];
+        }
+
+        // 7. Connexion Asterisk Manager Interface (AMI)
+        $amiOk     = false;
+        $amiDetail = '';
+        try {
+            $ami  = AmiClient::fromDatabase($db);
+            $info = $ami->testConnection();
+            $amiOk     = true;
+            $amiDetail = ($info['version'] ?: $info['banner']) . ' (Socket AMI 127.0.0.1:' . ($settings['ami_port'] ?? 5038) . ')';
+        } catch (Throwable $e) {
+            $amiDetail = $e->getMessage();
+        }
+
+        $checks[] = [
+            'id'      => 'ami_connection',
+            'label'   => 'Liaison Asterisk Manager Interface (AMI)',
+            'ok'      => $amiOk,
+            'detail'  => $amiDetail,
+        ];
+
+        $allCriticalOk = true;
+        foreach ($checks as $c) {
+            if (!$c['ok'] && $c['id'] !== 'tls_certs') {
+                $allCriticalOk = false;
+            }
+        }
+
+        return [
+            'healthy' => $allCriticalOk,
+            'checks'  => $checks,
+        ];
+    }
+
+    public static function ensureAsteriskIncludes(): void
+    {
+        $pjsipConf = '/etc/asterisk/pjsip.conf';
+        if (is_file($pjsipConf) && is_writable($pjsipConf)) {
+            $content = (string)file_get_contents($pjsipConf);
+            if (!str_contains($content, 'pjsip.custom.conf')) {
+                file_put_contents($pjsipConf, rtrim($content) . "\n\n#tryinclude \"pjsip.custom.conf\"\n");
+            }
+        }
+
+        $extConf = '/etc/asterisk/extensions.conf';
+        if (is_file($extConf) && is_writable($extConf)) {
+            $content = (string)file_get_contents($extConf);
+            if (!str_contains($content, 'extensions.custom.conf')) {
+                file_put_contents($extConf, rtrim($content) . "\n\n#tryinclude \"extensions.custom.conf\"\n");
+            }
+        }
+
+        $mohConf = '/etc/asterisk/musiconhold.conf';
+        if (is_file($mohConf) && is_writable($mohConf)) {
+            $content = (string)file_get_contents($mohConf);
+            // Désactive la classe [default] native d'Asterisk pour laisser la priorité à musiconhold.custom.conf
+            $cleaned = preg_replace('/^\[default\]/m', ';[default]', $content);
+            $cleaned = preg_replace('/^mode=files/m', ';mode=files', $cleaned);
+            $cleaned = preg_replace('/^directory=moh/m', ';directory=moh', $cleaned);
+            if (!str_contains($cleaned, 'musiconhold.custom.conf')) {
+                $cleaned = rtrim($cleaned) . "\n\n#tryinclude \"/etc/asterisk/musiconhold.custom.conf\"\n";
+            }
+            if ($cleaned !== $content) {
+                file_put_contents($mohConf, $cleaned);
+            }
+        }
+
+        $vmConf = '/etc/asterisk/voicemail.conf';
+        if (is_file($vmConf) && is_writable($vmConf)) {
+            $content = (string)file_get_contents($vmConf);
+            $cleaned = preg_replace('/^1234 => 4242.*/m', ';1234 => 4242,Example Mailbox,root@localhost', $content);
+            $cleaned = preg_replace('/^;\s*passwordlocation\s*=\s*spooldir/m', 'passwordlocation=spooldir', $cleaned);
+            $cleaned = preg_replace('/^;\s*externpassnotify\s*=.*/m', 'externpassnotify=/usr/bin/php /var/www/nexus-pbx/scripts/voicemail_pass_sync.php', $cleaned);
+            if (!str_contains($cleaned, 'voicemail.custom.conf')) {
+                $cleaned = rtrim($cleaned) . "\n\n#tryinclude \"voicemail.custom.conf\"\n";
+            }
+            if ($cleaned !== $content) {
+                file_put_contents($vmConf, $cleaned);
+            }
+        }
+
+        $astConf = '/etc/asterisk/asterisk.conf';
+        if (is_file($astConf) && is_writable($astConf)) {
+            $content = (string)file_get_contents($astConf);
+            $lang = 'fr';
+            try {
+                $db = Database::getConnection();
+                $s = $db->query('SELECT system_language FROM settings WHERE id = 1')->fetch();
+                if (!empty($s['system_language'])) {
+                    $lang = trim((string)$s['system_language']);
+                }
+            } catch (\Throwable $e) {}
+            if (preg_match('/^;?\s*defaultlanguage\s*=/m', $content)) {
+                $cleaned = preg_replace('/^;?\s*defaultlanguage\s*=.*$/m', "defaultlanguage = {$lang}", $content);
+            } else {
+                $cleaned = preg_replace('/\[options\]/i', "[options]\ndefaultlanguage = {$lang}", $content);
+            }
+            if ($cleaned !== $content) {
+                file_put_contents($astConf, $cleaned);
+            }
+        }
+    }
+}
+
diff --git a/src/SystemMetrics.php b/src/SystemMetrics.php
new file mode 100644
index 0000000..7b58c47
--- /dev/null
+++ b/src/SystemMetrics.php
@@ -0,0 +1,403 @@
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+use PDO;
+use Throwable;
+
+require_once __DIR__ . '/FirewallManager.php';
+require_once __DIR__ . '/AmiClient.php';
+
+class SystemMetrics
+{
+    private const CACHE_FILE = __DIR__ . '/../storage/metrics_prev.json';
+
+    public static function collect(PDO $db): array
+    {
+        $now = microtime(true);
+        $prev = self::loadPrevSample();
+
+        // 1. CPU (/proc/stat + /proc/loadavg + /proc/cpuinfo)
+        $cpuStat = self::readCpuStat();
+        $cpuPercent = 0.0;
+        if (isset($prev['cpu'])) {
+            $dTotal = $cpuStat['total'] - $prev['cpu']['total'];
+            $dIdle  = $cpuStat['idle'] - $prev['cpu']['idle'];
+            if ($dTotal > 0) {
+                $cpuPercent = round(max(0.0, min(100.0, (1.0 - ($dIdle / $dTotal)) * 100.0)), 1);
+            }
+        }
+
+        $loadAvg = sys_getloadavg() ?: [0.0, 0.0, 0.0];
+        $cpuCores = 1;
+        $cpuModel = 'Processeur Debian';
+        if (is_readable('/proc/cpuinfo')) {
+            $cpuinfo = (string)file_get_contents('/proc/cpuinfo');
+            $cpuCores = max(1, substr_count($cpuinfo, 'processor'));
+            if (preg_match('/model name\s*:\s*(.+)/i', $cpuinfo, $m)) {
+                $cpuModel = trim($m[1]);
+            }
+        }
+
+        // 2. Mémoire RAM & Swap (/proc/meminfo)
+        $mem = self::readMemInfo();
+
+        // 3. Disque HDD/SSD (/)
+        $diskTotal = (float)(@disk_total_space('/') ?: 1);
+        $diskFree  = (float)(@disk_free_space('/') ?: 0);
+        $diskUsed  = max(0.0, $diskTotal - $diskFree);
+        $diskPct   = round(($diskUsed / $diskTotal) * 100.0, 1);
+
+        // 4. Réseau (/proc/net/dev)
+        $net = self::readNetDev();
+        $rxRateKbps = 0.0;
+        $txRateKbps = 0.0;
+        if (isset($prev['net'], $prev['timestamp']) && ($now - $prev['timestamp']) > 0.2) {
+            $dt = $now - $prev['timestamp'];
+            $dRx = max(0, $net['rx_bytes'] - $prev['net']['rx_bytes']);
+            $dTx = max(0, $net['tx_bytes'] - $prev['net']['tx_bytes']);
+            // En Ko/s (KB/s)
+            $rxRateKbps = round(($dRx / $dt) / 1024, 2);
+            $txRateKbps = round(($dTx / $dt) / 1024, 2);
+        }
+
+        // Sauvegarde de l'échantillon pour le calcul différentiel CPU & Réseau
+        self::savePrevSample([
+            'timestamp' => $now,
+            'cpu'       => $cpuStat,
+            'net'       => $net,
+        ]);
+
+        // 5. Uptime Debian (/proc/uptime)
+        $uptimeSeconds = 0;
+        if (is_readable('/proc/uptime')) {
+            $parts = explode(' ', trim((string)file_get_contents('/proc/uptime')));
+            $uptimeSeconds = (int)floor((float)($parts[0] ?? 0));
+        }
+
+        // 6. Version Debian & État temps réel Asterisk via AMI (Postes enregistrés, latence RTT, appels actifs)
+        $debianVer = is_readable('/etc/debian_version') ? trim((string)file_get_contents('/etc/debian_version')) : '13';
+        $asteriskInfo = self::readAsteriskLiveStatus($db);
+
+        // 7. Statut des Services Debian & Fail2ban / Pare-feu
+        $fwStatus = FirewallManager::getStatus();
+        $services = self::readServicesStatus($asteriskInfo, $fwStatus);
+
+        return [
+            'timestamp'  => date('H:i:s'),
+            'hostname'   => gethostname() ?: 'debian-pbx',
+            'os_version' => "Debian {$debianVer}",
+            'uptime'     => self::formatDuration($uptimeSeconds),
+            'cpu'       => [
+                'percent' => $cpuPercent,
+                'cores'   => $cpuCores,
+                'model'   => $cpuModel,
+                'load_1'  => round((float)$loadAvg[0], 2),
+                'load_5'  => round((float)$loadAvg[1], 2),
+                'load_15' => round((float)$loadAvg[2], 2),
+            ],
+            'memory'    => $mem,
+            'disk'      => [
+                'total_gb' => round($diskTotal / 1073741824, 2),
+                'used_gb'  => round($diskUsed / 1073741824, 2),
+                'free_gb'  => round($diskFree / 1073741824, 2),
+                'percent'  => $diskPct,
+            ],
+            'network'   => [
+                'interface' => $net['interface'],
+                'ip'        => $net['ip'],
+                'rx_kbps'   => $rxRateKbps,
+                'tx_kbps'   => $txRateKbps,
+                'rx_total_mb' => round($net['rx_bytes'] / 1048576, 1),
+                'tx_total_mb' => round($net['tx_bytes'] / 1048576, 1),
+            ],
+            'asterisk'  => $asteriskInfo,
+            'services'  => $services,
+            'security'  => [
+                'firewall_enabled' => (bool)($fwStatus['settings']['firewall_enabled'] ?? false),
+                'fail2ban_running' => (bool)($fwStatus['is_running'] ?? false),
+                'admin_port'       => (int)($fwStatus['settings']['admin_https_port'] ?? 8443),
+                'strict_port80'    => (bool)($fwStatus['settings']['certbot_strict_port80'] ?? false),
+                'total_banned'     => (int)($fwStatus['total_banned'] ?? 0),
+                'banned_ips'       => $fwStatus['banned_ips'] ?? [],
+                'jails'            => $fwStatus['jails'] ?? [],
+            ],
+        ];
+    }
+
+    private static function readServicesStatus(array $astInfo, array $fwStatus): array
+    {
+        $out = trim((string)@shell_exec('systemctl is-active asterisk nginx php8.4-fpm fail2ban 2>/dev/null'));
+        $lines = preg_split('/\r?\n/', $out) ?: [];
+
+        $astActive   = ($lines[0] ?? '') === 'active' || ($astInfo['uptime'] ?? '') !== 'Hors-ligne';
+        $nginxActive = ($lines[1] ?? '') === 'active';
+        $phpActive   = ($lines[2] ?? '') === 'active';
+        $f2bActive   = ($lines[3] ?? '') === 'active' || !empty($fwStatus['is_running']);
+        $isF2bRunning = !empty($fwStatus['is_running']) && (($lines[3] ?? '') === 'active');
+        $fwEnabled   = !empty($fwStatus['settings']['firewall_enabled']) && $isF2bRunning;
+
+        $adminPort = $fwStatus['settings']['admin_https_port'] ?? 8443;
+
+        return [
+            [
+                'id'          => 'asterisk',
+                'name'        => 'Asterisk 22 PBX',
+                'desc'        => 'Moteur SIP PJSIP & Dialplan',
+                'port'        => '5060 / 5061',
+                'active'      => $astActive,
+                'status_text' => $astActive ? 'Opérationnel' : 'Arrêté',
+                'uptime'      => $astInfo['uptime'] ?? 'Actif',
+            ],
+            [
+                'id'          => 'nginx',
+                'name'        => 'Serveur Web Nginx',
+                'desc'        => 'Portail GUI & Reverse Proxy',
+                'port'        => "80 / 443 / {$adminPort}",
+                'active'      => $nginxActive,
+                'status_text' => $nginxActive ? 'Opérationnel' : 'Arrêté',
+                'uptime'      => 'En ligne',
+            ],
+            [
+                'id'          => 'php',
+                'name'        => 'PHP 8.4 FPM',
+                'desc'        => 'API FastCGI & SQLite',
+                'port'        => 'Unix Socket',
+                'active'      => $phpActive,
+                'status_text' => $phpActive ? 'Opérationnel' : 'Arrêté',
+                'uptime'      => 'En ligne',
+            ],
+            [
+                'id'          => 'fail2ban',
+                'name'        => 'Fail2ban IDS / IPS',
+                'desc'        => 'Jails [asterisk, web, ssh]',
+                'port'        => 'Surveillance logs',
+                'active'      => $f2bActive,
+                'status_text' => $f2bActive ? 'En surveillance' : 'Arrêté',
+                'uptime'      => $f2bActive ? 'Actif' : 'Arrêté',
+            ],
+            [
+                'id'          => 'firewall',
+                'name'        => 'Pare-feu & Filtrage',
+                'desc'        => $fwEnabled ? 'Règles actives & Isolation 80' : 'Inactif (Tout autoriser)',
+                'port'        => 'Filtrage IP & Nginx',
+                'active'      => $fwEnabled,
+                'status_text' => $fwEnabled ? 'Filtrage Actif' : 'Inactif',
+                'uptime'      => $fwEnabled ? 'Actif' : 'Inactif',
+            ],
+        ];
+    }
+
+    private static function readCpuStat(): array
+    {
+        if (!is_readable('/proc/stat')) {
+            return ['total' => 0, 'idle' => 0];
+        }
+        $firstLine = fgets(fopen('/proc/stat', 'r')) ?: '';
+        $parts = preg_split('/\s+/', trim($firstLine)) ?: [];
+        array_shift($parts); // retire "cpu"
+        $vals = array_map('intval', $parts);
+        $idle = ($vals[3] ?? 0) + ($vals[4] ?? 0); // idle + iowait
+        $total = array_sum($vals);
+        return ['total' => $total, 'idle' => $idle];
+    }
+
+    private static function readMemInfo(): array
+    {
+        $data = [];
+        if (is_readable('/proc/meminfo')) {
+            foreach (file('/proc/meminfo') ?: [] as $line) {
+                if (preg_match('/^(\w+):\s+(\d+)/', $line, $m)) {
+                    $data[$m[1]] = (int)$m[2]; // en kB
+                }
+            }
+        }
+        $totalKb = max(1, $data['MemTotal'] ?? 1);
+        $availKb = $data['MemAvailable'] ?? (($data['MemFree'] ?? 0) + ($data['Buffers'] ?? 0) + ($data['Cached'] ?? 0));
+        $usedKb  = max(0, $totalKb - $availKb);
+        $swapTotalKb = $data['SwapTotal'] ?? 0;
+        $swapFreeKb  = $data['SwapFree'] ?? 0;
+        $swapUsedKb  = max(0, $swapTotalKb - $swapFreeKb);
+
+        return [
+            'total_mb' => (int)round($totalKb / 1024),
+            'used_mb'  => (int)round($usedKb / 1024),
+            'free_mb'  => (int)round($availKb / 1024),
+            'percent'  => round(($usedKb / $totalKb) * 100.0, 1),
+            'swap_total_mb' => (int)round($swapTotalKb / 1024),
+            'swap_used_mb'  => (int)round($swapUsedKb / 1024),
+        ];
+    }
+
+    private static function readNetDev(): array
+    {
+        $iface = 'eth0';
+        $rxBytes = 0;
+        $txBytes = 0;
+
+        if (is_readable('/proc/net/dev')) {
+            $lines = file('/proc/net/dev') ?: [];
+            foreach ($lines as $line) {
+                if (!str_contains($line, ':')) {
+                    continue;
+                }
+                [$name, $rest] = explode(':', $line, 2);
+                $name = trim($name);
+                if ($name === 'lo') {
+                    continue;
+                }
+                $cols = preg_split('/\s+/', trim($rest)) ?: [];
+                $iface = $name;
+                $rxBytes = (int)($cols[0] ?? 0);
+                $txBytes = (int)($cols[8] ?? 0);
+                break;
+            }
+        }
+
+        $ip = $_SERVER['SERVER_ADDR'] ?? '';
+        if ($ip === '' || $ip === '127.0.0.1') {
+            $out = @shell_exec("ip -4 -o addr show dev " . escapeshellarg($iface) . " 2>/dev/null");
+            if (is_string($out) && preg_match('/inet\s+([0-9.]+)/', $out, $m)) {
+                $ip = $m[1];
+            }
+        }
+
+        return [
+            'interface' => $iface,
+            'ip'        => $ip ?: '127.0.0.1',
+            'rx_bytes'  => $rxBytes,
+            'tx_bytes'  => $txBytes,
+        ];
+    }
+
+    private static function readAsteriskLiveStatus(PDO $db): array
+    {
+        $contacts = [];
+        $activeCalls = 0;
+        $astUptime = 'Actif';
+        $astVersion = 'Asterisk 22 • PJSIP';
+        $onlineCount = 0;
+
+        try {
+            $ami = AmiClient::fromDatabase($db);
+            $rawVer = $ami->runCommand('core show version');
+            if (preg_match('/Asterisk\s+([0-9]+\.[0-9]+(?:\.[0-9]+)?)/i', $rawVer, $vm)) {
+                $astVersion = "Asterisk {$vm[1]} • PJSIP";
+            }
+            $rawContacts = $ami->runCommand('pjsip show contacts');
+            $astDbRaw = $ami->runCommand('database show registrar/contact');
+            $contactMeta = [];
+            foreach (preg_split('/\r?\n/', $astDbRaw) ?: [] as $dbLine) {
+                if (preg_match('/^\/registrar\/contact\/([^;]+);@[a-f0-9]+:\s*(\{.*\})/i', $dbLine, $dbM)) {
+                    $extKey = $dbM[1];
+                    $parsedJson = json_decode($dbM[2], true);
+                    if ($parsedJson) {
+                        $contactMeta[$extKey] = $parsedJson;
+                    }
+                }
+            }
+
+            foreach (preg_split('/\r?\n/', $rawContacts) ?: [] as $line) {
+                // Contact:  101/sip:101@10.10.167.162:5060                 5dd9a21be8 Avail         9.234
+                // or with -nan: Contact:  102/sip:102@10.10.168.228:5060;x-ast-txp=trans bb0686ce80 Unavail        -nan
+                if (preg_match('/Contact:\s+([^\s\/]+)\/sip:([^\s]+)\s+([a-f0-9]+)\s+(\S+)\s+(-?[0-9.]+|nan|-nan)/i', $line, $m)) {
+                    $extNum = $m[1];
+                    $uri = $m[2];
+                    $status = $m[4];
+                    $isAvail = (stripos($status, 'Avail') !== false && stripos($status, 'Unavail') === false) || stripos($status, 'NonQual') !== false;
+                    if ($isAvail) {
+                        $onlineCount++;
+                    }
+
+                    $meta = $contactMeta[$extNum] ?? [];
+                    $fullUri = $meta['uri'] ?? ("sip:" . $uri);
+                    $userAgent = $meta['user_agent'] ?? '';
+
+                    // Détection précise du transport utilisé en direct
+                    $activeTransport = 'udp';
+                    if (preg_match('/transport=(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (preg_match('/x-ast-txp=transport-(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (str_starts_with($fullUri, 'sips:')) {
+                        $activeTransport = 'tls';
+                    }
+
+                    $contacts[] = [
+                        'extension'        => $extNum,
+                        'uri'              => $fullUri,
+                        'user_agent'       => $userAgent,
+                        'active_transport' => $activeTransport,
+                        'status'           => $status,
+                        'rtt_ms'           => is_numeric($m[5]) ? round((float)$m[5], 1) : null,
+                    ];
+                }
+            }
+
+            $rawChannels = $ami->runCommand('core show channels count');
+            if (preg_match('/(\d+)\s+active\s+call/i', $rawChannels, $cm)) {
+                $activeCalls = (int)$cm[1];
+            }
+
+            $rawUptime = $ami->runCommand('core show uptime');
+            if (preg_match('/System uptime:\s*(.+)/i', $rawUptime, $um)) {
+                $astUptime = trim($um[1]);
+            }
+
+            $registrations = [];
+            $rawRegs = $ami->runCommand('pjsip show registrations');
+            foreach (preg_split('/\r?\n/', $rawRegs) ?: [] as $line) {
+                // trunk-ovh-reg/sip:siptrunk.ovh.net:5060                 trunk-ovh-auth    Registered
+                if (preg_match('/^\s*(trunk-[^\s\/]+)-reg\/(\S+)\s+(\S+)\s+(\S+)/i', $line, $rm)) {
+                    $registrations[$rm[1]] = [
+                        'server_uri' => $rm[2],
+                        'auth'       => $rm[3],
+                        'status'     => $rm[4],
+                    ];
+                }
+            }
+        } catch (Throwable) {
+            $astUptime = 'Hors-ligne';
+            $registrations = [];
+        }
+
+        return [
+            'version'         => $astVersion,
+            'online_contacts' => $onlineCount,
+            'active_calls'    => $activeCalls,
+            'uptime'          => $astUptime,
+            'contacts'        => $contacts,
+            'registrations'   => $registrations ?? [],
+        ];
+    }
+
+    private static function loadPrevSample(): array
+    {
+        if (!is_readable(self::CACHE_FILE)) {
+            return [];
+        }
+        $raw = @file_get_contents(self::CACHE_FILE);
+        return $raw ? (json_decode($raw, true) ?: []) : [];
+    }
+
+    private static function savePrevSample(array $sample): void
+    {
+        @file_put_contents(self::CACHE_FILE, json_encode($sample));
+    }
+
+    private static function formatDuration(int $seconds): string
+    {
+        $days = intdiv($seconds, 86400);
+        $hours = intdiv($seconds % 86400, 3600);
+        $mins = intdiv($seconds % 3600, 60);
+        if ($days > 0) {
+            return "{$days}j {$hours}h {$mins}m";
+        }
+        if ($hours > 0) {
+            return "{$hours}h {$mins}m";
+        }
+        return "{$mins} min";
+    }
+}
+
diff --git a/storage/backups/.gitkeep b/storage/backups/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/storage/sounds/.gitkeep b/storage/sounds/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/storage/system_backups/.gitkeep b/storage/system_backups/.gitkeep
new file mode 100644
index 0000000..e69de29