Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

README.md

@@ -65,17 +65,9 @@ just deploy
 just deploy-nginx
 ```
 
-### Admin users (htpasswd)
-
-```bash
-just manage-admin-users
-# Then on server:
-ssh xamxam "sudo bash /tmp/manage-admin-users.sh"
-```
-
 ## Security notes
 
-- Admin panel protected by nginx `auth_basic` + PHP session (`AdminAuth`)
+- Admin panel protected by PHP session (`AdminAuth`) — password-only, no username
 - Uploads stored outside webroot, served via controlled `media.php`
 - Rate limiting on public search (`src/RateLimit.php`)
 - See `nginx/docs/SECURITY_HEADERS.md` for security headers reference