Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

app/public/admin/toast-fragment.php

@@ -9,7 +9,13 @@
 require_once __DIR__ . '/../../bootstrap.php';
 require_once __DIR__ . '/../../src/AdminAuth.php';
 
-AdminAuth::requireLogin();
+// Don't redirect unauthenticated requests — just return empty (defense-in-depth).
+// The toast-region poll fires on <hx-trigger="load">; if the user is on the
+// login page they are not authenticated yet.
+if (!AdminAuth::isAuthenticated()) {
+    http_response_code(204);
+    exit;
+}
 
 $flash = App::consumeFlash();