fix(phpstan): resolve 6 pre-existing type errors + 2 cs-fixer nits

- AdminAuth: drop dead password_hash() === false check (PHP 8 returns string)
- ExportController: remove redundant !== null after isset() on duration fields
- SystemController: $def['json'] is always present, drop ?? false
- TfeController: simplify always-true type guard when sorting TFE files
- validate-file-fragment: AV 5GB override condition was always true, apply unconditionally
- tests: single-quote string, sort use statements (php-cs-fixer)

app/src/AdminAuth.php

@@ -335,10 +335,9 @@ class AdminAuth
             return false;
         }
 
+        // password_hash() returns a non-empty string on success and throws
+        // ValueError on failure (PHP 8+), so no false-return check is needed.
         $hash = password_hash($newPassword, PASSWORD_BCRYPT, ['cost' => 12]);
-        if ($hash === false) {
-            return false;
-        }
 
         self::setPasswordHash($hash);
         self::logout(); // invalidate any existing admin session