fix(security): SSRF log injection and folder permissions

backend/gestion/services/geo_services.go

@@ -274,13 +274,25 @@ func CalculateETAWithTomTom(from, to Coordinates) (int, float64, error) {
 	}
 
 	// API TomTom Routing: Calculate Route avec trafic
-	apiURL := fmt.Sprintf(
-		"https://api.tomtom.com/routing/1/calculateRoute/%f,%f:%f,%f/json?key=%s&traffic=true&travelMode=car",
-		from.Latitude, from.Longitude, to.Latitude, to.Longitude, apiKey,
-	)
+	u := &url.URL{
+		Scheme: "https",
+		Host:   "api.tomtom.com",
+		Path:   fmt.Sprintf("/routing/1/calculateRoute/%f,%f:%f,%f/json", from.Latitude, from.Longitude, to.Latitude, to.Longitude),
+	}
+	q := url.Values{}
+	q.Set("key", apiKey)
+	q.Set("traffic", "true")
+	q.Set("travelMode", "car")
+	u.RawQuery = q.Encode()
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+	if err != nil {
+		distance := CalculateDistance(from, to)
+		return CalculateETA(distance), distance, nil
+	}
 
 	client := &http.Client{Timeout: 8 * time.Second}
-	resp, err := client.Get(apiURL)
+	resp, err := client.Do(req)
 	if err != nil {
 		// Fallback sur calcul local en cas d'erreur réseau
 		distance := CalculateDistance(from, to)