fix(phpstan): resolve 6 pre-existing type errors + 2 cs-fixer nits

- AdminAuth: drop dead password_hash() === false check (PHP 8 returns string)
- ExportController: remove redundant !== null after isset() on duration fields
- SystemController: $def['json'] is always present, drop ?? false
- TfeController: simplify always-true type guard when sorting TFE files
- validate-file-fragment: AV 5GB override condition was always true, apply unconditionally
- tests: single-quote string, sort use statements (php-cs-fixer)

TODO.md

@@ -71,6 +71,7 @@
 - [x] #squash-main-history-into [!high] Squash main..@ history into logical commits — Groups: (1) session-timeout+GC; (2) env/provision+docs; (3) coverage/accents; (4) cover-images; (5) admin-cleanup-page; (6) test-env+deploy; (7) admin-index-css; (8) toc; (9) misc features; (10) migrations/justfile/biome. Fold TODO-only commits. Keep postlaunch intact.
 - [x] #verify-final-tree-identical [!medium] Verify final tree identical to backup
 - [x] #decide-fate-of-stray [!low] Remove stray tracked commits.txt (6268-line git log dump) — Removed; no code references it
+- [x] #fix-6-pre-existing-phpstan [!medium] Fix 6 pre-existing phpstan errors (AdminAuth, ExportController x2, SystemController, TfeController, validate-file-fragment-shared)
 
 ## Deferred / Blocked
 - [ ] #just-setup-backs-a [!medium] just setup backs a stale setup-dev.sh (clones php-live-reload, legacy admin/data/ dirs) — needs rewrite or removal