src/app/Views/admin/layout.php

@@ -79,6 +79,8 @@ $navClass = static function (string $code, string $current): string {
                     </div>
                 </button>
                 <div class="dropdown-menu" id="userMenu">
+                    <a href="/admin/profile/pin">Mon PIN d'action sensible</a>
+                    <div class="divider"></div>
                     <form method="post" action="/logout">
                         <input type="hidden" name="_csrf" value="<?= $csrf ?>">
                         <button class="danger" type="submit">Se deconnecter</button>

tests/Unit/Admin/DashboardControllerTest.php

@@ -157,6 +157,9 @@ final class DashboardControllerTest extends TestCase
         // Deconnexion = formulaire POST avec CSRF.
         self::assertStringContainsString('action="/logout"', $body);
         self::assertStringContainsString('name="_csrf"', $body);
+        // Le menu utilisateur rend la page self-service du PIN (decouvrable, pas
+        // seulement par URL directe).
+        self::assertStringContainsString('/admin/profile/pin', $body);
     }
 
     public function testForbiddenWhenPermissionDenied(): void