Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

app/public/admin/recapitulatif.php

@@ -24,7 +24,10 @@ if (isset($_GET['id'])) {
     if ($thesisId !== false && $thesisId > 0) {
         try {
             $db = new Database();
-            $thesis = $db->getThesis($thesisId);
+            // Student-mode preview: only show published theses.
+            $thesis = $studentMode
+                ? $db->getThesisById($thesisId)
+                : $db->getThesis($thesisId);
 
             if (!$thesis) {
                 $error = "TFE non trouvé.";