Fix consent token not set before submission

- home.tsx: extract postConsent() helper; make onSubmit async and await it
  before doActualSubmit (returning users); await it in handleConsentConfirm
  before doActualSubmit (new users, was fire-and-forget)
- consultation.tsx: same fix on returning-user path in onSubmit

Without this, returning users (consent_v1 in localStorage) never called
/api/consent so the _ct cookie was never set, causing all submissions to
return 403 consent_required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

artifacts/voix-du-peuple/src/pages/consultation.tsx

@@ -181,6 +181,12 @@ export default function ConsultationPage() {
       setShowConsentDialog(true);
       return;
     }
+    try {
+      const visitorId = getVisitorId();
+      const h: Record<string, string> = { "Content-Type": "application/json" };
+      if (visitorId) h["X-Visitor-Id"] = visitorId;
+      await fetch(`${API_BASE}/api/consent`, { method: "POST", headers: h, body: JSON.stringify({ consent_version: "1.0" }) });
+    } catch { /* non-bloquant */ }
     await doActualSubmit(data);
   };
 

artifacts/voix-du-peuple/src/pages/home.tsx

@@ -165,22 +165,24 @@ export default function Home() {
     });
   };
 
-  // Confirme le consentement, l'enregistre en DB, puis exécute la soumission en attente
+  const postConsent = async () => {
-  const handleConsentConfirm = () => {
-    localStorage.setItem("consent_v1", new Date().toISOString());
-    setConsentGiven(true);
-    setShowConsentDialog(false);
     const visitorId = getVisitorId();
-    fetch(`${API_BASE}/api/consent`, {
+    await fetch(`${API_BASE}/api/consent`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         ...(visitorId ? { "X-Visitor-Id": visitorId } : {}),
       },
       body: JSON.stringify({ consent_version: "1.0" }),
-    }).catch(() => {
+    }).catch(() => {});
-      // Dégradation silencieuse — localStorage suffit comme preuve côté client
+  };
-    });
+
+  // Confirme le consentement, l'enregistre en DB, puis exécute la soumission en attente
+  const handleConsentConfirm = async () => {
+    localStorage.setItem("consent_v1", new Date().toISOString());
+    setConsentGiven(true);
+    setShowConsentDialog(false);
+    await postConsent();
     if (pendingSubmitData.current) {
       doActualSubmit(pendingSubmitData.current);
       pendingSubmitData.current = null;
@@ -250,7 +252,7 @@ export default function Home() {
     defaultValues: { content: "", author: "" },
   });
 
-  const onSubmit = (data: SubmitIdeaValues) => {
+  const onSubmit = async (data: SubmitIdeaValues) => {
     // Honeypot — si le champ leurre est rempli, c'est un bot
     if (honeypotRef.current?.value) {
       setSubmitResult({ success: true, message: "Votre contribution a été ajoutée à la synthèse." });
@@ -268,6 +270,7 @@ export default function Home() {
       setShowConsentDialog(true);
       return;
     }
+    await postConsent();
     doActualSubmit(data);
   };