Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

app/templates/partials/form/text-field.php

@@ -74,4 +74,6 @@ $ariaInvalid = ($errorFieldName === $name) ? ' aria-invalid="true" aria-errormes
 </div>
 <?php
 // Reset consumed variables so includes in a loop don't bleed state.
-unset($type, $required, $placeholder, $hint, $id, $attrs, $attrStr, $k, $v, $hintId, $describedBy, $ariaDescribedBy, $ariaInvalid, $errorFieldName);
+unset($type, $required, $placeholder, $hint, $id, $attrs, $attrStr, $k, $v, $hintId, $describedBy, $ariaDescribedBy, $ariaInvalid);
+// NOTE: $errorFieldName is intentionally NOT unset — it is a shared variable
+// consumed by the parent partial (e.g. fieldset-tfe-info.php for the synopsis textarea).