Improved import security, added browser tests

src/lib/db.js

@@ -121,7 +121,7 @@ export function closeDay(date, ts, stale = false) {
 }
 
 /** Confirmed same-day reopening; status and all resumed slots commit together. */
-export function reopenDay(date, now, mode = 'continue') {
+export function reopenDay(date, now, mode = 'continue', expected = null) {
   return db.transaction('rw', db.days, db.entries, async () => {
     const day = await getDay(date);
     if (!['continue', 'break'].includes(mode)) throw new Error('Choix de reprise invalide.');
@@ -129,6 +129,10 @@ export function reopenDay(date, now, mode = 'continue') {
     const entries = await getEntries(date);
     const last = entries.at(-1);
     if (!last) return false;
+    if (expected && (day.endedTs !== expected.endedTs ||
+      ['id', 'kind', 'task', 'client', 'startTs', 'endTs'].some(key => last[key] !== expected.last[key]))) {
+      throw new Error('La clôture ou le dernier poste a changé. Fermez puis ouvrez la confirmation de reprise.');
+    }
     const boundary = day.endedTs;
     if (!Number.isFinite(boundary) || now < boundary) return false;
     if (mode === 'continue' && ['work', 'travel'].includes(last.kind)) {