Secure /ma-commande URLs with accessToken to prevent brute force

- Add accessToken (32 hex chars) to BilletBuyer, generated at creation
- URLs now: /ma-commande/{orderNumber}/{token} and /ma-commande/{orderNumber}/{token}/billet/{ref}
- Both orderNumber AND token must match to access order page
- Token is random, unpredictable, unique per order
- Migration generates tokens for existing rows

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

migrations/Version20260321240000.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260321240000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add access_token to billet_buyer';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql("ALTER TABLE billet_buyer ADD COLUMN IF NOT EXISTS access_token VARCHAR(32) DEFAULT '' NOT NULL");
+        $this->addSql("UPDATE billet_buyer SET access_token = md5(random()::text) WHERE access_token = ''");
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE billet_buyer DROP COLUMN IF EXISTS access_token');
+    }
+}