fix(phpstan): resolve 6 pre-existing type errors + 2 cs-fixer nits

- AdminAuth: drop dead password_hash() === false check (PHP 8 returns string)
- ExportController: remove redundant !== null after isset() on duration fields
- SystemController: $def['json'] is always present, drop ?? false
- TfeController: simplify always-true type guard when sorting TFE files
- validate-file-fragment: AV 5GB override condition was always true, apply unconditionally
- tests: single-quote string, sort use statements (php-cs-fixer)

TODO.md

@@ -71,6 +71,7 @@
 - [x] #squash-main-history-into [!high] Squash main..@ history into logical commits — Groups: (1) session-timeout+GC; (2) env/provision+docs; (3) coverage/accents; (4) cover-images; (5) admin-cleanup-page; (6) test-env+deploy; (7) admin-index-css; (8) toc; (9) misc features; (10) migrations/justfile/biome. Fold TODO-only commits. Keep postlaunch intact.
 - [x] #verify-final-tree-identical [!medium] Verify final tree identical to backup
 - [x] #decide-fate-of-stray [!low] Remove stray tracked commits.txt (6268-line git log dump) — Removed; no code references it
+- [x] #fix-6-pre-existing-phpstan [!medium] Fix 6 pre-existing phpstan errors (AdminAuth, ExportController x2, SystemController, TfeController, validate-file-fragment-shared)
 
 ## Deferred / Blocked
 - [ ] #just-setup-backs-a [!medium] just setup backs a stale setup-dev.sh (clones php-live-reload, legacy admin/data/ dirs) — needs rewrite or removal

app/src/AdminAuth.php

@@ -335,10 +335,9 @@ class AdminAuth
             return false;
         }
 
+        // password_hash() returns a non-empty string on success and throws
+        // ValueError on failure (PHP 8+), so no false-return check is needed.
         $hash = password_hash($newPassword, PASSWORD_BCRYPT, ['cost' => 12]);
-        if ($hash === false) {
-            return false;
-        }
 
         self::setPasswordHash($hash);
         self::logout(); // invalidate any existing admin session

app/src/Controllers/ExportController.php

@@ -457,8 +457,8 @@ class ExportController
                 !empty($t['cc2r']) ? 'Oui' : 'Non',
                 !empty($t['exemplaire_baiu']) ? 'Oui' : 'Non',
                 !empty($t['exemplaire_erg']) ? 'Oui' : 'Non',
-                isset($t['duration_pages']) && $t['duration_pages'] !== null ? (string) $t['duration_pages'] : '',
+                isset($t['duration_pages']) ? (string) $t['duration_pages'] : '',
-                isset($t['duration_minutes']) && $t['duration_minutes'] !== null ? (string) $t['duration_minutes'] : '',
+                isset($t['duration_minutes']) ? (string) $t['duration_minutes'] : '',
                 !empty($t['has_annexes']) ? 'Oui' : 'Non',
                 $t['license_custom']     ?? '',
                 $t['contact_visible']    ?? '',

app/src/Controllers/SystemController.php

@@ -101,7 +101,7 @@ class SystemController
         $def = self::LOG_FILES[$tab];
         if (isset($def['cron'])) {
             $base = '/var/log/' . $def['cron'];
-        } elseif (($def['json'] ?? false) === true) {
+        } elseif ($def['json'] === true) {
             $dir = php_sapi_name() === 'cli-server'
                 ? APP_ROOT . '/storage/logs'
                 : '/var/log/xamxam';

app/src/Controllers/TfeController.php

@@ -314,8 +314,9 @@ class TfeController
                 return 1;
             }
 
-            // 2. TFE PDF (main)
+            // 2. TFE PDF (main) — reached only for non-annex, non-note_intention
-            if ($type === 'main' || ($ext === 'pdf' && $type !== 'annex' && $type !== 'note_intention')) {
+            //    types, so a PDF extension here is the main document.
+            if ($type === 'main' || $ext === 'pdf') {
                 return 2;
             }
 

app/src/Controllers/validate-file-fragment-shared.php

@@ -182,10 +182,10 @@ foreach ($allFiles as $idx => $f) {
         continue;
     }
 
-    // Per-type size override: video/audio up to 8 GB
+    // Per-type size override: video/audio up to 5 GB
     $isAv = preg_match('/^(video|audio)\//', $mimeType)
             || in_array($ext, ['mp4','webm','ogv','mov','mp3','ogg','oga','wav','flac','aac','m4a']);
-    if ($isAv && $effMaxSize < 5 * 1024 * 1024 * 1024) {
+    if ($isAv) {
         $effMaxSize = 5 * 1024 * 1024 * 1024;
         $effMaxDesc = '5 GB';
     }

tests/phpunit/MarkdownHelperTest.php

@@ -1,8 +1,8 @@
 <?php
 
-use PHPUnit\Framework\TestCase;
 use League\CommonMark\CommonMarkConverter;
 use League\CommonMark\Extension\HeadingPermalink\HeadingPermalinkExtension;
+use PHPUnit\Framework\TestCase;
 
 /**
  * MarkdownHelperTest — TOC extraction from markdown headings.

tests/phpunit/ThesisCreateValidationTest.php

@@ -347,7 +347,7 @@ class ThesisCreateValidationTest extends TestCase
     public function testSynopsisSingleLineFieldTrimmed(): void
     {
         $post = $this->validPost();
-        $post['synopsis'] = "   texte qui flotte  ";
+        $post['synopsis'] = '   texte qui flotte  ';
 
         $data = $this->validate($post);
         $this->assertSame('texte qui flotte', $data['synopsis']);