fix(phpstan): resolve 6 pre-existing type errors + 2 cs-fixer nits

- AdminAuth: drop dead password_hash() === false check (PHP 8 returns string)
- ExportController: remove redundant !== null after isset() on duration fields
- SystemController: $def['json'] is always present, drop ?? false
- TfeController: simplify always-true type guard when sorting TFE files
- validate-file-fragment: AV 5GB override condition was always true, apply unconditionally
- tests: single-quote string, sort use statements (php-cs-fixer)

app/src/AdminAuth.php

@@ -335,10 +335,9 @@ class AdminAuth
             return false;
         }
 
+        // password_hash() returns a non-empty string on success and throws
+        // ValueError on failure (PHP 8+), so no false-return check is needed.
         $hash = password_hash($newPassword, PASSWORD_BCRYPT, ['cost' => 12]);
-        if ($hash === false) {
-            return false;
-        }
 
         self::setPasswordHash($hash);
         self::logout(); // invalidate any existing admin session

app/src/Controllers/ExportController.php

@@ -457,8 +457,8 @@ class ExportController
                 !empty($t['cc2r']) ? 'Oui' : 'Non',
                 !empty($t['exemplaire_baiu']) ? 'Oui' : 'Non',
                 !empty($t['exemplaire_erg']) ? 'Oui' : 'Non',
-                isset($t['duration_pages']) && $t['duration_pages'] !== null ? (string) $t['duration_pages'] : '',
-                isset($t['duration_minutes']) && $t['duration_minutes'] !== null ? (string) $t['duration_minutes'] : '',
+                isset($t['duration_pages']) ? (string) $t['duration_pages'] : '',
+                isset($t['duration_minutes']) ? (string) $t['duration_minutes'] : '',
                 !empty($t['has_annexes']) ? 'Oui' : 'Non',
                 $t['license_custom']     ?? '',
                 $t['contact_visible']    ?? '',

app/src/Controllers/SystemController.php

@@ -101,7 +101,7 @@ class SystemController
         $def = self::LOG_FILES[$tab];
         if (isset($def['cron'])) {
             $base = '/var/log/' . $def['cron'];
-        } elseif (($def['json'] ?? false) === true) {
+        } elseif ($def['json'] === true) {
             $dir = php_sapi_name() === 'cli-server'
                 ? APP_ROOT . '/storage/logs'
                 : '/var/log/xamxam';

app/src/Controllers/TfeController.php

@@ -314,8 +314,9 @@ class TfeController
                 return 1;
             }
 
-            // 2. TFE PDF (main)
-            if ($type === 'main' || ($ext === 'pdf' && $type !== 'annex' && $type !== 'note_intention')) {
+            // 2. TFE PDF (main) — reached only for non-annex, non-note_intention
+            //    types, so a PDF extension here is the main document.
+            if ($type === 'main' || $ext === 'pdf') {
                 return 2;
             }
 

app/src/Controllers/validate-file-fragment-shared.php

@@ -182,10 +182,10 @@ foreach ($allFiles as $idx => $f) {
         continue;
     }
 
-    // Per-type size override: video/audio up to 8 GB
+    // Per-type size override: video/audio up to 5 GB
     $isAv = preg_match('/^(video|audio)\//', $mimeType)
             || in_array($ext, ['mp4','webm','ogv','mov','mp3','ogg','oga','wav','flac','aac','m4a']);
-    if ($isAv && $effMaxSize < 5 * 1024 * 1024 * 1024) {
+    if ($isAv) {
         $effMaxSize = 5 * 1024 * 1024 * 1024;
         $effMaxDesc = '5 GB';
     }